joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100103a0
Capabilities:
Delete service
Stop service

Disassembly:
mov eax, 0x1020
call fcn.10019dc0
mov eax, dword [0x1003efe0]
xor eax, esp
mov dword [esp + 0x101c], eax
push ebx
push ebp
push esi
push edi
push 0xf003f
xor ebp, ebp
push ebp
push ebp
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x100103fb
push 1
lea ebx, [edi + 0x40]
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x100103f0
push eax
mov ebp, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebp, ebp
jne 0x10010405
mov eax, 1
jmp 0x10010596
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1001045f
push 0x400
lea eax, [esp + 0x30]
push eax
push 0xd80a
call fcn.10010070
add esp, 0xc
test eax, eax
jne 0x10010452
push str.Could_not_open_Service_Manager
lea ecx, [esp + 0x30]
push 0x400
push ecx
call fcn.1001baee
push eax
call fcn.10001d50
add esp, 0x10
push 0
push ebx
lea edx, [esp + 0x34]
push edx
jmp 0x1001058c
push 0x10020
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x100104bd
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x400
lea eax, [esp + 0x30]
push eax
push 0xd80c
call fcn.10010070
add esp, 0xc
test eax, eax
jne 0x10010452
push str.Could_not_open_service
lea ecx, [esp + 0x30]
push 0x400
push ecx
call fcn.1001baee
push eax
call fcn.10001d50
add esp, 0x10
push esi
push ebx
lea edx, [esp + 0x34]
push edx
jmp 0x1001058c
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1001052c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x1001052c
cmp eax, 0x425
jne 0x100104ea
cmp dword [esp + 0x14], 3
je 0x1001052c
push 0x400
lea ecx, [esp + 0x30]
push ecx
push 0xd80e
call fcn.10010070
add esp, 0xc
test eax, eax
jne 0x1001051c
push str.Could_not_stop_service
lea edx, [esp + 0x30]
push 0x400
push edx
call fcn.10010030
add esp, 0xc
push 0
push ebx
lea eax, [esp + 0x34]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, eax
call esi
push edi
call esi
test ebp, ebp
jne 0x100103fb
push 0x400
lea ecx, [esp + 0x830]
push ecx
push 0xd80d
call fcn.10010070
add esp, 0xc
test eax, eax
jne 0x10010581
push str.Could_not_delete_service
lea edx, [esp + 0x830]
push 0x400
push edx
call fcn.10010030
add esp, 0xc
push 0
push ebx
lea eax, [esp + 0x834]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10019da6
add esp, 0x1020
ret
Function at 0x100105b0
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x208
mov eax, dword [0x1003efe0]
xor eax, esp
mov dword [esp + 0x204], eax
mov ecx, dword [esp + 0x210]
push esi
mov esi, dword [esp + 0x210]
lea eax, [esp + 0x218]
push eax
push ecx
push 0xff
lea edx, [esp + 0x14]
push 0x100
push edx
call fcn.1001b67a
add esp, 0x14
cmp dword [esi + 0x260], 0
lea eax, [esp + 8]
mov word [esp + 0x206], 0
mov dword [esp + 4], eax
jne 0x10010619
mov ecx, eax
push ecx
call fcn.1001bcb1
add esp, 4
add esi, 0x40
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x1001064c
push 0
lea edx, [esp + 8]
push edx
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [esp + 0x208]
pop esi
xor ecx, esp
call fcn.10019da6
add esp, 0x208
ret

Function at 0x10010930
Capabilities:
Create service

Disassembly:
mov eax, 0x1004
call fcn.10019dc0
mov eax, dword [0x1003efe0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
push esi
push edi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x1001098d
push 1
lea eax, [edi + 0x40]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x10010982
push eax
mov ebx, 1
call ebp
push esi
call ebp
test ebx, ebx
jne 0x10010a89
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
push 0x400
lea ecx, [esp + 0x14]
push ecx
jne 0x100109e7
push 0xd80a
call fcn.10010070
add esp, 0xc
test eax, eax
jne 0x100109cd
push str.Could_not_open_Service_Manager
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
add edi, 0x40
push edi
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x10010a8e
push 0x66
call fcn.10010070
add esp, 0xc
test eax, eax
jne 0x10010a05
push str.BitDefender_Threat_Scanner
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0
push str.RPCSS
push 0
push 0
lea ebx, [edi + 0x40]
add edi, 0x268
push edi
push 1
push 3
push 0x20
push 0xf01ff
lea eax, [esp + 0x38]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x10010a83
push esi
call ebp
push 0x400
lea ecx, [esp + 0x814]
push ecx
push 0xd80b
call fcn.10010070
add esp, 0xc
test eax, eax
jne 0x10010a6c
push str.Could_not_start_service
lea edx, [esp + 0x814]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push ebx
lea eax, [esp + 0x818]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x10010a8e
push eax
call ebp
push esi
call ebp
mov eax, 1
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10019da6
add esp, 0x1004
ret
Function at 0x100112f0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
push 0
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [esi + 0x30], eax
jne 0x1001130c
pop esi
pop ecx
ret
push edi
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x10010b70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x10011334
mov ecx, dword [esi + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x100116f0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x1c
push edi
mov edi, ecx
call fcn.100103a0
test eax, eax
jne 0x1001170b
mov eax, 0x80004005
pop edi
add esp, 0x1c
ret 4
mov ecx, dword [0x100403ac]
push ebx
lea eax, [esp + 0x14]
push eax
push 1
push 0x65
xor ebx, ebx
push ecx
mov dword [esp + 0x24], str.APPID
mov dword [esp + 0x28], str.EF436DD1_6449_4F19_83C2_CF546175C7BF
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.1000a170
cmp eax, ebx
jl 0x10011843
push esi
push 0x20006
push str.AppID
push SysReAllocStringLen
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
call fcn.10002120
cmp eax, ebx
je 0x10011789
push eax
call fcn.10002010
mov esi, eax
mov eax, dword [esp + 0x10]
add esp, 4
cmp eax, ebx
je 0x1001177e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
pop edi
add esp, 0x1c
ret 4
mov esi, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.EF436DD1_6449_4F19_83C2_CF546175C7BF
push esi
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x1001180d
mov eax, dword [esp + 0x10]
push str.LocalService
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [esp + 0x2c], bl
je 0x1001182e
push 1
lea ecx, [edi + 0x40]
push ecx
push str.LocalService
lea ecx, [esp + 0x1c]
call fcn.10002210
mov ecx, edi
call fcn.10010930
test eax, eax
jne 0x1001182e
lea ecx, [esp + 0x10]
call fcn.10003310
lea ecx, [esp + 0xc]
call fcn.10003310
pop esi
pop ebx
mov eax, 0x80004005
pop edi
add esp, 0x1c
ret 4
push eax
call fcn.10002010
add esp, 4
cmp esi, ebx
mov edi, eax
je 0x10011823
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov eax, edi
pop edi
add esp, 0x1c
ret 4
lea ecx, [esp + 0x10]
call fcn.10003310
lea ecx, [esp + 0xc]
call fcn.10003310
xor eax, eax
pop esi
pop ebx
pop edi
add esp, 0x1c
ret 4
Function at 0x10011850
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
call fcn.100103a0
test eax, eax
jne 0x10011865
mov eax, 0x80004005
add esp, 8
ret
push ebx
lea eax, [esp + 8]
push eax
push 0x20006
xor ebx, ebx
push ebx
push str.AppID
push SysReAllocStringLen
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x100118dd
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0x20006
push str.EF436DD1_6449_4F19_83C2_CF546175C7BF
push eax
lea ecx, [esp + 0x1c]
mov ebp, eax
mov dword [esp + 0x1c], ebx
call fcn.10002120
cmp eax, ebx
je 0x100118eb
push eax
call fcn.10002010
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, ebx
je 0x100118cc
push eax
call edi
cmp ebp, ebx
je 0x100118d3
push ebp
call edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push eax
call fcn.10002010
add esp, 4
pop ebx
add esp, 8
ret
mov esi, dword [esp + 0x10]
push str.LocalService
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push ebx
call fcn.100116b0
test esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
je 0x10011910
push esi
call edi
test ebp, ebp
je 0x10011917
push ebp
call edi
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x10012020
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1002e19b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1003efe0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [esi], edi
call fcn.1000d2c0
lea ecx, [esi + 0xc]
mov dword [esp + 0x18], edi
call fcn.10013600
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x10012850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1002e296
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003efe0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esi + 0x30]
mov dword [esp + 0x14], 1
call eax
mov ecx, dword [esi + 0x18]
push ecx
call fcn.1000e3e0
add esp, 4
lea ecx, [esi + 0xc]
mov byte [esp + 0x14], 0
call fcn.10013620
lea ecx, [esi + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.1000d310
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x10013fd0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1003efe0]
xor eax, esp
mov dword [esp + 0x208], eax
mov ecx, dword [0x10040694]
push esi
push edi
mov edi, dword [esp + 0x218]
push 0x104
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x100140b3
lea edx, [esp + 8]
push 0x5c
push edx
call fcn.1001ba44
add esp, 8
test eax, eax
je 0x100140b3
mov ecx, str.excludemd5.dll
lea edx, [eax + 2]
sub edx, ecx
lea ecx, [ecx]
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x10014030
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x10040450], eax
je 0x100140b3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitMd5Check
push eax
call esi
test eax, eax
mov dword [0x10040454], eax
je 0x100140b3
mov ecx, dword [0x10040450]
push str.UnInitMd5Check
push ecx
call esi
test eax, eax
mov dword [0x10040458], eax
jne 0x1001408e
push str._ThreatScanner__Warning:_UninitMD5Check___not_found__3____n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x100140b3
mov edx, dword [0x10040450]
push str.SkipFile
push edx
call esi
test eax, eax
mov dword [0x1004045c], eax
je 0x100140b3
push edi
call dword [0x10040454]
add esp, 4
test eax, eax
jne 0x100140ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x10040450]
test eax, eax
je 0x100140d5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10040450], 0
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.10019da6
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10019da6
add esp, 0x20c
ret

Function at 0x10014340
Capabilities:
Read file via mapping

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xdc], 0
je 0x10014355
mov eax, 0xc0001009
pop esi
ret 8
mov eax, dword [esp + 8]
push eax
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test eax, eax
mov dword [esi + 0xc8], eax
je 0x10014394
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xdc], eax
jne 0x1001439d
mov ecx, dword [esi + 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xc0001005
pop esi
ret 8
mov edx, dword [esp + 0xc]
mov dword [esi + 0xe0], edx
xor eax, eax
pop esi
ret 8
Function at 0x100148b0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x1002e46b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1003efe0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov eax, dword [0x1003efe0]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x10]
push eax
push 1
push edi
push str.SoftwareBitDefenderBitDefender_DesktopMaintenanceInstall
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x240], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x10014978
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push str.InstallDir
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0x104
call fcn.10002170
test eax, eax
jne 0x10014978
lea eax, [esp + 0x18]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10014950
sub eax, edx
sar eax, 1
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + 0x1c]
push str.quarcore.dll
push edx
call fcn.1001b698
jmp 0x100149d5
mov ecx, dword [0x10040694]
push 0x104
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10014a5e
lea edx, [esp + 0x18]
push 0x5c
push edx
call fcn.1001ba44
lea ecx, [esp + 0x20]
add esp, 8
lea esi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x100149b0
sub ecx, esi
sar ecx, 1
mov edx, 0x104
sub edx, ecx
push edx
add eax, 2
push str.quarcore.dll
push eax
call fcn.1001a714
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov word [esp + 0x222], di
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
mov dword [0x10040674], eax
je 0x10014a5e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.QuarcoreInit
push eax
call esi
cmp eax, edi
mov dword [0x10040678], eax
je 0x10014a5e
mov ecx, dword [0x10040674]
push str.QuarcoreCopyAndCrypt
push ecx
call esi
cmp eax, edi
mov dword [0x1004067c], eax
je 0x10014a5e
mov edx, dword [0x10040674]
push str.QuarcoreCopyAndCrypt2
push edx
call esi
mov dword [0x10040680], eax
mov eax, dword [0x10040674]
push str.QuarcoreCopyAndCrypt3
push eax
call esi
mov ecx, dword [0x10040674]
push str.QuarcoreUninit
push ecx
mov dword [0x10040684], eax
call esi
cmp eax, edi
mov dword [0x10040688], eax
jne 0x10014a85
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x10040674]
cmp eax, edi
je 0x10014a76
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, edi
je 0x10014a81
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10014ab2
push edi
call dword [0x10040678]
add esp, 4
test eax, eax
je 0x10014aa5
cmp ebx, edi
je 0x10014a9e
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x65b
jmp 0x10014ab2
cmp ebx, edi
je 0x10014ab0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.10019da6
add esp, 0x220
ret
Function at 0x10014ae0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
mov ebx, ecx
cmp byte [ebx + 0xc], 0
push esi
push edi
je 0x10014b02
mov eax, dword [ebx + 0x50]
cmp eax, 0xffffffff
je 0x10014afb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x50], 0xffffffff
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x10014b17
lea ecx, [ebx + 0x90]
call fcn.100137a0
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call ebp
cmp eax, 0xffffffff
je 0x10014b34
test al, 1
je 0x10014b34
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
jne 0x10014b8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10014b8f
mov eax, dword [ebx + 0x3c]
test eax, eax
jle 0x10014b8f
push eax
call fcn.100142d0
add esp, 4
test al, al
je 0x10014b8f
push esi
call ebp
cmp eax, 0xffffffff
je 0x10014b77
test al, 1
je 0x10014b77
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x10018360
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x1003efe0]
xor eax, esp
mov dword [esp + 0x214], eax
lea eax, [esp]
push eax
push 1
push 0
push str.SoftwareBitDefenderBitDefender_SubmissionBitDefender_Submission_Tool
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100183c7
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push str.AppPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100183de
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.10019da6
add esp, 0x218
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.1001ba44
add esp, 8
test eax, eax
je 0x10018403
mov word [eax + 2], 0
jmp 0x1001840a
mov word [esp + 0xc], 0
push 0x104
lea edx, [esp + 0x10]
push edx
push esi
call fcn.1001a714
mov ecx, dword [esp + 0x220]
add esp, 0xc
xor ecx, esp
mov eax, 1
call fcn.10019da6
add esp, 0x218
ret
Function at 0x1001939c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1003efe0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.100192db
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.100197a0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x100193eb
cmp dword [ebp - 0x1c], 5
jb 0x10019403
jmp 0x100193ff
cmp dword [ebp - 0x10], 1
jne 0x10019403
cmp dword [ebp - 0x1c], 4
ja 0x100193ff
jne 0x10019403
cmp dword [ebp - 0x18], 0
jbe 0x10019403
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x100339e8
call fcn.10001e40
test eax, eax
jge 0x10019424
mov byte [0x100403a0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10019da6
add ebp, 0x78
leave
ret

Function at 0x10019da6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003efe0]
jne 0x10019db0
repz ret
jmp fcn.1001e37b
Function at 0x1001dee0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x1003f2c8]
je 0x1001defb
inc edi
cmp edi, 0x17
jb 0x1001deec
cmp edi, 0x17
jae 0x1001e07b
push ebp
push 3
call fcn.1002613e
cmp eax, 1
pop ecx
je 0x1001e047
push 3
call fcn.1002613e
test eax, eax
pop ecx
jne 0x1001df2f
cmp dword [0x10040c70], 1
je 0x1001e047
cmp ebx, 0xfc
je 0x1001e07a
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10040e28
push ebp
call fcn.1001fb8f
add esp, 0xc
test eax, eax
je 0x1001df65
push esi
push esi
push esi
push esi
push esi
call fcn.1001b2ab
add esp, 0x14
push 0x104
mov esi, 0x10040e41
push esi
push 0
mov byte [0x10040f45], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001dfa9
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1001fb8f
add esp, 0xc
test eax, eax
je 0x1001dfa9
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1001b2ab
add esp, 0x14
push esi
call fcn.1001ca10
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1001dfee
push esi
call fcn.1001ca10
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1004113c
push 0x1003407c
sub ecx, eax
push ecx
push eax
call fcn.1002608b
add esp, 0x14
test eax, eax
je 0x1001dfee
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1001b2ab
add esp, 0x14
jmp 0x1001dff0
xor esi, esi
push 0x10034078
push ebx
push ebp
call fcn.1002601a
add esp, 0xc
test eax, eax
je 0x1001e010
push esi
push esi
push esi
push esi
push esi
call fcn.1001b2ab
add esp, 0x14
push dword [edi*8 + 0x1003f2cc]
push ebx
push ebp
call fcn.1002601a
add esp, 0xc
test eax, eax
je 0x1001e032
push esi
push esi
push esi
push esi
push esi
call fcn.1001b2ab
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10025e5d
add esp, 0xc
jmp 0x1001e07a
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1001e07a
cmp ebp, 0xffffffff
je 0x1001e07a
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1003f2cc]
push dword [esi]
call fcn.1001ca10
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x10020dd2
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10020e0d
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10020df4
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10020e05
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10020e0f
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10020dea
xor eax, eax
pop edi
pop esi
Function at 0x10021019
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10020d92
mov ch, 0xb
and eax, 0x50a8458d
call fcn.10020da2
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10020d57
add esp, 0x10
invalid
invalid