joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012b50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10073240
push 0x10031af0
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x10079214]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x5c], esi
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x4c], ebx
xor edi, edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 4], edi
push 0x1005d524
call fcn.10004bd0
add esp, 4
test ebx, ebx
je 0x10012d4f
push 1
push esi
push dword [ebp + 0x10]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
test eax, eax
je 0x10012bdb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x1005d540
call fcn.10004bd0
add esp, 8
jmp 0x10012d4f
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], esi
mov edi, 0x1ffe
mov dword [ebp - 0x58], edi
xor esi, esi
mov dword [ebp - 0x60], esi
cmp esi, 2
jb 0x10012c18
mov word [ebx + esi], 0
cmp edi, 0x1ffe
jne 0x10012c1e
movzx edi, word [ebx]
mov dword [ebp - 0x58], edi
push edi
push 0x1005d578
call fcn.10004bd0
add esp, 8
cmp edi, 0x1ffe
jbe 0x10012c32
push 0x1005d594
call fcn.10004bd0
add esp, 4
jmp 0x10012d1b
cmp esi, edi
jl 0x10012c48
push str.____n
call fcn.10004bd0
add esp, 4
jmp 0x10012d1b
push 0
push dword [ebp + 0x18]
push 0
lea eax, [ebp - 0x68]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
mov ebx, eax
cmp ebx, 2
jae 0x10012d03
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp + ebx*4 - 0x68]
jne 0x10012c81
push 0x1005d604
call fcn.10004bd0
add esp, 4
jmp 0x10012d18
push 0x2c
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.10031950
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x5c]
push dword [ebp + 0x10]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
test dword [ebp - 0x48], 1
jne 0x10012cb9
push str.___._n
call fcn.10004bd0
add esp, 4
jmp 0x10012d18
push 0
mov eax, edi
sub eax, esi
push eax
mov ebx, dword [ebp - 0x4c]
lea eax, [ebx + esi]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x10012cea
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.___:_:_u_n
call fcn.10004bd0
add esp, 8
jmp 0x10012d1b
add esi, eax
mov dword [ebp - 0x60], esi
push esi
push eax
push str.___:_u_u._n
call fcn.10004bd0
add esp, 0xc
jmp 0x10012bf1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ebx
push 0x1005d5d0
call fcn.10004bd0
add esp, 0xc
mov ebx, dword [ebp - 0x4c]
cmp esi, 2
jb 0x10012d32
movzx ecx, word [ebx]
mov edx, ecx
cmp esi, ecx
jne 0x10012d35
mov edi, 1
mov eax, ecx
jmp 0x10012d3a
movzx edx, word [ebx]
xor edi, edi
movzx eax, dx
mov dword [ebp - 0x54], edi
push esi
movzx eax, ax
push eax
push str._____u_u._n
call fcn.10004bd0
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
call fcn.10012d7e
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1002deb9
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10014530
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10073220
push 0x10031af0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x10079214]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x58], esi
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x4c], ebx
xor edi, edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 4], edi
push 0x1005d3cc
call fcn.10004bd0
add esp, 4
test ebx, ebx
je 0x100146da
push 2
push esi
push dword [ebp + 0x10]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
test eax, eax
je 0x100145bb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x1005d3e8
call fcn.10004bd0
add esp, 8
jmp 0x100146da
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], esi
movzx edi, word [ebx]
xor esi, esi
mov dword [ebp - 0x5c], esi
nop dword [eax]
push 0
push dword [ebp + 0x18]
push 0
lea eax, [ebp - 0x64]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
mov ebx, eax
cmp ebx, 2
jae 0x1001468e
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp + ebx*4 - 0x64]
jne 0x10014609
push 0x1005d458
call fcn.10004bd0
add esp, 4
jmp 0x100146a3
push 0x2c
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.10031950
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x58]
mov ebx, dword [ebp + 0x10]
push ebx
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
test dword [ebp - 0x48], 2
jne 0x10014642
push 0x1005d46c
call fcn.10004bd0
add esp, 4
jmp 0x100146a3
cmp esi, edi
jge 0x100146a3
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x4c]
add eax, esi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x10014665
add esi, eax
mov dword [ebp - 0x5c], esi
jmp 0x10014642
cmp esi, edi
jge 0x100146a3
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2733
je 0x100145d0
call ebx
push eax
push 0x1005d488
call fcn.10004bd0
add esp, 8
jmp 0x100146a3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ebx
push 0x1005d424
call fcn.10004bd0
add esp, 0xc
mov eax, dword [ebp - 0x4c]
cmp esi, 2
jb 0x100146bd
movzx ecx, word [eax]
mov edx, ecx
cmp esi, ecx
jne 0x100146c0
mov edi, 1
mov eax, ecx
jmp 0x100146c5
movzx edx, word [eax]
xor edi, edi
movzx eax, dx
mov dword [ebp - 0x54], edi
push esi
movzx eax, ax
push eax
push 0x1005d4b0
call fcn.10004bd0
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
call fcn.10014709
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1002deb9
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10014bc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push 0
push 0
push 1
xorps xmm0, xmm0
mov dword [ebp - 4], 0
push 0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x10014490
push 0
push 0
call fcn.10038ef7
add esp, 0x18
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test edi, edi
pop edi
setne al
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10016150
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005770a
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10079214]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
lea eax, [edi + 0x50]
mov dword [edi], 0x1005ee34
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edi
mov dword [eax], vtable.std::ios_base.0
mov dword [ebp - 4], 0
mov dword [eax], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 1
lea esi, [edi + 4]
push 0
push 0
push esi
mov dword [ebp - 0x10], 1
call fcn.10015be0
mov dword [ebp - 4], 2
mov eax, dword [edi]
push 8
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], esi
lea eax, [ecx - 0x50]
mov dword [ecx + edi - 4], eax
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.1002db0a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10016208
push 1
call fcn.100204b8
add esp, 4
mov dword [ebx + 4], eax
jmp 0x1001620a
xor ebx, ebx
lea eax, [esi + 4]
mov dword [esi + 0x34], ebx
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov byte [ebp - 4], 3
mov dword [esi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 4
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ce00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058809
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10079214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2c], 0
cmp byte [esi + 8], 0
je 0x1001ce46
call fcn.1001cad0
mov byte [esi + 8], 0
cmp dword [esi + 4], 0x40000000
jle 0x1001ce82
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
je 0x1001ce67
push eax
call fcn.10039dea
add esp, 4
mov dword [esi + 0x24], 0xffffffff
cmp dword [esi + 0x20], 8
lea eax, [esi + 0xc]
jb 0x1001ce72
mov eax, dword [eax]
push eax
call fcn.100393a2
add esp, 4
mov ecx, esi
call fcn.1001cad0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
mov eax, dword [edi + 0x10]
push 0
add eax, eax
push eax
call fcn.10019e10
mov edx, dword [ebp - 0x18]
mov ebx, eax
mov dword [ebp - 0x2c], 1
test edx, edx
je 0x1001cee0
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, edi
cmovae ecx, dword [ebp - 0x28]
cmp dword [edi + 0x14], 8
jb 0x1001cebe
mov eax, dword [edi]
push 0
push 0
push edx
push ecx
push dword [edi + 0x10]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.1001cba0
cmp dword [ebx + 0x14], 0x10
mov ecx, dword [ebx + 0x10]
jb 0x1001ceeb
mov ebx, dword [ebx]
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
je 0x1001cf02
push ecx
push ebx
push eax
call fcn.1003a6ff
add esp, 0xc
mov ebx, eax
jmp 0x1001cf05
or ebx, 0xffffffff
mov eax, 1
mov dword [ebp - 0x2c], eax
and eax, 0xfffffffe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10003ca0
test ebx, ebx
jle 0x1001cf2b
add dword [esi + 4], ebx
jmp 0x1001cf3a
cmp dword [edi + 0x14], 8
jb 0x1001cf33
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002deb9
mov esp, ebp
pop ebp
ret 4
Function at 0x1001e1d0
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058bcb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x10079214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x220]
push 0x210
push 0
push eax
call fcn.10031950
add esp, 0xc
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x224]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x224], 0
call esi
test eax, eax
jne 0x1001e288
mov esi, dword [ebp - 0x224]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], 0x200
jmp 0x1001e2d0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x1001e3a2
mov esi, dword [ebp - 0x224]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], 0x100
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x210
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push str.Path
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001e323
mov eax, dword [ebp - 0x234]
cmp eax, 1
je 0x1001e311
cmp eax, 2
jne 0x1001e323
cmp dword [ebp - 0x224], 0
jne 0x1001e323
xor eax, eax
mov word [ebp - 0x220], ax
push str.SoftMgr_somextrainfo.ini
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001e364
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x1001e3a9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x230], 0
jmp 0x1001e3a9
lea eax, [ebp - 0x220]
push eax
push 0
push str.ItemType
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ebx, ebx
cmp eax, 2
setne bl
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x1001e39e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x230], 0
mov eax, ebx
jmp 0x1001e3ae
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov dword [ebp - 0x22c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002deb9
mov esp, ebp
pop ebp
ret
Function at 0x1001e930
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058c90
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10079214]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1001e9e3
push dword [ebp - 0x18]
call fcn.10037227
mov esi, eax
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x14]
add ecx, ecx
push ecx
call fcn.10037227
add esp, 8
mov edi, eax
mov dword [ebp - 0x20], edi
test esi, esi
je 0x1001ea40
test edi, edi
je 0x1001ea40
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x1001ea40
mov ebx, 1
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x1001ea02
test edi, edi
je 0x1001ea0f
push edi
call fcn.10037222
add esp, 4
test ebx, ebx
jne 0x1001ea22
test esi, esi
je 0x1001ea27
push esi
call fcn.10037222
add esp, 4
jmp 0x1001ea27
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor eax, eax
test ebx, ebx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
call fcn.10030a33
int3
Function at 0x1001f410
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10075168
push 0x10031af0
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x10079214]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x254], eax
xor ebx, ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x250], 0xffffffff
mov dword [ebp - 4], ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x250], edi
cmp edi, 0xffffffff
je 0x1001f4e1
push 0x22c
push ebx
lea eax, [ebp - 0x248]
push eax
call fcn.10031950
add esp, 0xc
mov dword [ebp - 0x248], 0x22c
lea eax, [ebp - 0x248]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1001f4e1
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop
push dword [ebp - 0x254]
lea eax, [ebp - 0x224]
push eax
call esi
test eax, eax
je 0x1001f4d6
lea eax, [ebp - 0x248]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1001f4b0
jmp 0x1001f4e1
mov ebx, 1
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.1001f517
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1002deb9
mov esp, ebp
pop ebp
ret

Function at 0x1001f530
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058dbb
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x10079214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10031950
add esp, 0xc
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x228]
push 0x20119
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallHuorongSysdiag
push reloc.WS2_32.dll_bind
call fcn.1000d170
mov edi, dword [ebp - 0x228]
test eax, eax
jne 0x1001f618
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0
push str.UninstallString
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001f618
mov eax, dword [ebp - 0x22c]
cmp eax, 1
je 0x1001f5fd
cmp eax, 2
jne 0x1001f618
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x1001f65d
test al, 1
jne 0x1001f618
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x1001f666
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x1001f636
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x228], 0
mov eax, esi
mov dword [ebp - 0x224], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002deb9
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
jmp 0x1001f61a
Function at 0x1001f7f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058e83
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x10079214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], 0
call fcn.10005540
mov ecx, eax
test ecx, ecx
je 0x1001f96c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 1
cmp edi, reloc.WS2_32.dll_accept
jne 0x1001f8cd
push dword [ebp - 0x21c]
lea eax, [ebp - 0x21c]
push ebx
push edi
push eax
call fcn.1001ea50
add esp, 0x10
mov dword [ebp - 4], 2
mov ecx, esi
push eax
call fcn.1000b140
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001f94e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1001f94e
cmp edi, reloc.WS2_32.dll_bind
jne 0x1001f94e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10031950
add esp, 0xc
mov dword [ebp - 0x224], 0x104
lea eax, [ebp - 0x224]
mov dword [ebp - 0x228], 1
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x21c]
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f930
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000a650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002deb9
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10004830
int3
Function at 0x1001f980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058ec8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x10079214]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
jne 0x1001f9c1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
push 0
push 0
push 0x80
push 2
push 1
push 0x40000000
push dword [ebp + 8]
call fcn.1001e890
test eax, eax
js 0x1001fa4d
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x1001fa09
mov esi, dword [esi]
push 0
lea ecx, [ebp + 0xc]
push ecx
push eax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1001fa29
call fcn.1001d010
mov esi, eax
test esi, esi
js 0x1001fa46
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x1001fa44
call fcn.1001d010
mov esi, eax
not esi
shr esi, 0x1f
jmp 0x1001fa4f
xor esi, esi
not esi
shr esi, 0x1f
jmp 0x1001fa4f
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001fa6b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret