joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440df8
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x45de00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00435e2e
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00435e2e
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x440e6f
cmp word [ecx], dx
je 0x440e6f
mov eax, dword [0x44e1e4]
push edi
dec eax
push eax
push 0x44e0d0
call fcn.00440d97
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x440ee2
cmp word [eax], dx
je 0x440ee2
mov eax, dword [edi]
test eax, eax
je 0x440e93
cmp word [eax], dx
je 0x440e93
lea eax, [ebp - 0x10]
push eax
call fcn.0044077a
jmp 0x440e9c
lea eax, [ebp - 0x10]
push eax
call fcn.00440815
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x440f0c
mov eax, dword [0x44e0cc]
push dword [ebp - 0x14]
dec eax
push eax
push 0x44ddc0
call fcn.00440d97
add esp, 0xc
test al, al
je 0x440f0c
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x440ed7
cmp word [eax], di
je 0x440ed7
lea eax, [ebp - 0x10]
push eax
call fcn.0044077a
pop ecx
jmp 0x440f0e
lea eax, [ebp - 0x10]
push eax
call fcn.00440815
jmp 0x440ed4
mov eax, dword [edi]
test eax, eax
je 0x440ef9
cmp word [eax], dx
je 0x440ef9
lea eax, [ebp - 0x10]
push eax
call fcn.0044072f
pop ecx
jmp 0x440f0c
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x440fd7
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00440c1c
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x440fd7
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x440fd7
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x440fd7
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x440f64
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004352fa
test ebx, ebx
je 0x440fd2
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004352fa
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x440fd7
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x440fd7
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00446640
add esp, 0x10
xor eax, eax
inc eax
jmp 0x440fd9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f113
leave
ret
Function at 0x441af9
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00441a75
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x441c68
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x441c68
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x441c1d
jg 0x441b55
test eax, eax
je 0x441c13
push 1
push 0x1000
call fcn.00434beb
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x441b78
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x441c0a
push 0x8000
push ebx
call fcn.0042e808
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x441ba1
jg 0x441b9c
cmp ecx, 0x1000
jb 0x441ba1
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00432f52
add esp, 0x10
cmp eax, 0xffffffff
je 0x441be6
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x441b9c
jl 0x441bcd
test ecx, ecx
jne 0x441b8e
push dword [ebp - 0xc]
push ebx
call fcn.0042e808
push esi
call fcn.00434c48
add esp, 0xc
xor ebx, ebx
jmp 0x441c76
cmp byte [edi + 0x24], 0
je 0x441bfd
cmp dword [edi + 0x20], 5
jne 0x441bfd
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x441c08
mov ebx, dword [edi + 0x18]
jmp 0x441c0a
xor ebx, ebx
push esi
call fcn.00434c48
pop ecx
jmp 0x441c76
test ecx, ecx
jg 0x441bdf
jl 0x441c1d
test eax, eax
jae 0x441bdf
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004311ff
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x441c3d
cmp byte [edi + 0x1c], 0
je 0x441bdf
jmp 0x441c6e
push ebx
call fcn.0043bd5a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x441bdf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x441c76
cmp byte [edi + 0x1c], 0
je 0x441c73
mov ebx, dword [edi + 0x18]
jmp 0x441c76
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004311ff
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4479d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4479fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4479fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x24de4998
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x7f4023a2
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10009cd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005c25f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1007b06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0
mov dword [ebx], 0x100721b0
mov dword [ebx + 0x50], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [ebx]
mov dword [ebp - 0x14], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov esi, dword [eax + 4]
add esi, ebx
mov ecx, esi
call fcn.100089c0
mov eax, dword [esi + 0x30]
lea edi, [ebx + 4]
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 2
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 3
push eax
call fcn.10005630
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov byte [ebp - 0xd], al
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10009da7
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x10009da7
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov al, byte [ebp - 0xd]
mov byte [ebp - 4], 1
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x10009dc7
mov eax, dword [esi + 0xc]
mov ecx, esi
or eax, 4
push 0
push eax
call fcn.10001d60
mov dword [ebp - 4], 5
mov eax, dword [ebx]
push 8
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], edi
lea eax, [ecx - 0x50]
mov dword [ecx + ebx - 4], eax
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100184a8
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 6
call fcn.1001507c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, ebx
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10011790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005c130
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1007b06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.100184a8
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1001507c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011890
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005c9f7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1007b06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x10], 0
je 0x100118e5
mov dword [edi], 0x100721b0
mov dword [edi + 0x50], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.100089c0
lea ebx, [edi + 4]
mov dword [esi + 0x3c], 0
push 0x20
mov ecx, esi
mov dword [esi + 0x38], ebx
call fcn.10011560
cmp dword [esi + 0x38], 0
mov word [esi + 0x40], ax
jne 0x1001193b
mov eax, dword [esi + 0xc]
mov ecx, esi
or eax, 4
push 0
push eax
call fcn.10001d60
mov dword [ebp - 4], 2
mov eax, dword [edi]
push 8
mov dword [ebp + 0xc], ebx
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + edi - 4], eax
mov dword [ebx], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.100184a8
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 3
call fcn.1001507c
mov dword [esi + 4], eax
lea ecx, [ebx + 8]
lea eax, [ebx + 4]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
add esp, 8
lea eax, [ebx + 0x14]
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x18]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x28]
mov dword [ebx + 0x30], eax
mov dword [ecx], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov ecx, eax
not ecx
mov dword [ebx], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
and ecx, 1
mov dword [ebx + 0x38], 0
shl ecx, 2
mov edx, ecx
or edx, 8
and al, 8
cmove edx, ecx
mov ecx, dword [ebp + 8]
mov eax, edx
or eax, 0x10
and cl, 4
cmove eax, edx
mov dword [ebx + 0x3c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001a4ac
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1007b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001a4db
push 2
pop eax
jmp 0x1001a56d
push str.DGYg80dlVh2FoNE0
push str.YkNeF8pGJvCom4Qj
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.1001a1fd
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.10037150
add esp, 0x1c
mov dword [ebp - 0x58], edi
test ebx, ebx
mov dword [ebp - 0x48], esi
mov ecx, str.open
mov dword [ebp - 0x54], 0x40
mov eax, str.runas
mov dword [ebp - 0x3c], 5
cmove eax, ecx
cmp dword [ebp - 8], 8
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
and dword [ebp - 0x40], 0
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20], 0
mov esi, eax
je 0x1001a563
cmp dword [ebp + 0x10], 0
je 0x1001a563
push dword [ebp + 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x1c]
call fcn.1000eac0
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018297
leave
ret

Function at 0x1001a5ac
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x3c
mov eax, 0x1005d380
call fcn.10019013
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x1001a5cf
xor al, al
jmp 0x1001a68f
lea edi, [ecx + 4]
cmp dword [edi + 0x10], 0
ja 0x1001a5f2
lea eax, [ebp - 0x40]
push eax
call fcn.1001e14c
pop ecx
push eax
mov ecx, edi
call fcn.1000e580
lea ecx, [ebp - 0x40]
call fcn.1000eac0
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
and dword [ebp - 0x14], 0
push edi
call fcn.1000e380
xor edi, edi
lea ecx, [ebp - 0x28]
push str.Software_
mov dword [ebp - 4], edi
call fcn.1000e7b0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
call fcn.1000e7b0
test ebx, ebx
je 0x1001a63a
push 0x100721d8
lea ecx, [ebp - 0x28]
call fcn.1000e7b0
push ebx
lea ecx, [ebp - 0x28]
call fcn.1000e7b0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x44]
push ecx
push 0xf003f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x44], edi
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001a685
test esi, esi
je 0x1001a672
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1001a67c
push edi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.1000eac0
mov al, 1
call fcn.10018fbd
ret 0xc
Function at 0x1001a96b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1007b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
cmp dword [esi + 0x14], ebx
ja 0x1001a9c3
lea eax, [ebp - 0x1c]
push eax
call fcn.1001e14c
pop ecx
lea ecx, [esi + 4]
push eax
call fcn.1000e580
lea ecx, [ebp - 0x1c]
call fcn.1000eac0
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x1001a9ce
mov eax, dword [eax]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x20]
push ecx
push 0xf013f
push ebx
push eax
push 0x80000003
call esi
test eax, eax
je 0x1001a9f1
xor al, al
jmp 0x1001aaaa
lea eax, [ebp - 0x24]
push eax
push 0xf013f
push ebx
push str.SoftWare
push dword [ebp - 0x20]
call esi
test eax, eax
je 0x1001aa14
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001a9ea
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2c]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x1001aa46
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x20]
call esi
jmp 0x1001a9ea
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1001aa99
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1001aa6b
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call esi
mov bl, 1
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018297
leave
ret 0x10
Function at 0x1001c478
Capabilities:
Check if file exists

Disassembly:
push 0x23c
mov eax, 0x1005d7ff
call fcn.10019013
mov edi, ecx
lea eax, [ebp - 0x230]
push eax
call fcn.1001c196
and dword [ebp - 4], 0
lea esi, [edi + 4]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1001c4aa
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x100628b0
call fcn.1000e7b0
push 0x100628b4
mov ecx, esi
call fcn.1000e7b0
push 0x100721d8
mov ecx, esi
call fcn.1000e7b0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.1000e740
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1001c4ff
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001c597
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10037150
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1001c06a
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1001c556
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.1000e7b0
push 0x100721d8
mov ecx, esi
call fcn.1000e7b0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.1000e740
cmp dword [esi + 0x14], 8
jb 0x1001c59f
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea esi, [edi + 0x1c]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1001c5b7
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x100628b0
call fcn.1000e7b0
push 0x100628b4
mov ecx, esi
call fcn.1000e7b0
push 0x100721d8
mov ecx, esi
call fcn.1000e7b0
lea eax, [ebp - 0x248]
mov ecx, edi
push eax
call fcn.1001c1f5
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.1000cf40
lea ecx, [ebp - 0x248]
call fcn.1000eac0
lea ecx, [ebp - 0x230]
call fcn.1000eac0
call fcn.10018fbd
ret