joyce8/EMBER2024-capa huggingface dataset:
Function at 0x108c896
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push 6
pop ecx
xor esi, esi
push 4
push esi
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x108c8ea
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x108c8d5
call esi
mov esi, eax
jmp 0x108c982
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x108c982
push ebx
push 0x35
push 0x1010e74
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x108c933
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x108c911
call esi
mov esi, eax
jmp 0x108c921
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070424
je 0x108c96c
cmp esi, 0x8007007b
jne 0x108c96f
jmp 0x108c96c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x108c966
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x108c954
call esi
mov esi, eax
jmp 0x108c96f
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x108c96f
cmp dword [ebp - 0x1c], 4
je 0x108c96f
xor esi, esi
inc esi
test ebx, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x108c97c
push ebx
call edi
push dword [ebp - 4]
call edi
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x108cab9
Capabilities:
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10f4670]
push ebx
mov ebx, dword [0x10f4674]
push esi
xor esi, esi
cmp eax, esi
je 0x108cb3b
cmp ebx, esi
je 0x108cb3b
cmp eax, esi
mov dword [ebp - 4], esi
jbe 0x108cb3b
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
sub eax, dword [ebp - 4]
lea eax, [eax + eax*8]
lea eax, [ebx + eax*4]
mov ecx, dword [eax - 0x18]
cmp ecx, 3
je 0x108cb26
cmp ecx, 1
je 0x108cb26
push 0x35
push dword [eax - 0x24]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x108cb26
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 4
push esi
call fcn.0108c772
push esi
call edi
xor esi, esi
inc dword [ebp - 4]
mov eax, dword [0x10f4670]
cmp dword [ebp - 4], eax
jb 0x108cae4
test esi, esi
je 0x108cb3a
push esi
call edi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
Function at 0x108cb48
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 6
pop ecx
xor ebx, ebx
push 4
push ebx
xor eax, eax
mov dword [ebp - 0x28], ebx
lea edi, [ebp - 0x24]
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x108cb9d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x108cb88
call esi
mov esi, eax
jmp 0x108cd17
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x108cd17
push 0x35
push 0x1010e74
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
jne 0x108cbf1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x108cbc6
call esi
mov esi, eax
jmp 0x108cbd6
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070424
je 0x108cbea
cmp esi, 0x8007007b
jne 0x108cd01
xor esi, esi
jmp 0x108cd01
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x108cc28
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x108cc10
call esi
mov esi, eax
jmp 0x108cc20
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070420
jmp 0x108cbe4
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x108cc61
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x108cc4c
call esi
mov esi, eax
jmp 0x108cd01
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x108cd01
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp dword [ebp - 0x24], 2
mov edi, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jne 0x108ccd4
mov ebx, 0x3e8
mov eax, dword [ebp - 0x10]
push 0xa
xor edx, edx
pop ecx
div ecx
cmp eax, ebx
jae 0x108cc8c
mov eax, ebx
jmp 0x108cc97
mov ecx, 0x2710
cmp eax, ecx
jbe 0x108cc97
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x108cc37
cmp dword [ebp - 0x24], 4
je 0x108ccd4
cmp dword [ebp - 0x14], edi
jbe 0x108ccc4
call esi
mov edi, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jmp 0x108ccce
call esi
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
ja 0x108cd1e
cmp dword [ebp - 0x24], 2
je 0x108cc7a
push dword [ebp - 0xc]
call fcn.0108cab9
mov esi, eax
test esi, esi
jl 0x108cd01
mov eax, dword [0x10f4674]
test eax, eax
je 0x108cd01
push eax
call dword [sym.imp.msvcrt.dll_free]
and dword [0x10f4674], 0
and dword [0x10f4670], 0
pop ecx
cmp dword [ebp - 4], 0
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x108cd12
push dword [ebp - 4]
call edi
push dword [ebp - 0xc]
call edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
mov esi, 0x8007041d
jmp 0x108cd01
Function at 0x108cd2a
Capabilities:
Enumerate services
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
je 0x108ce44
cmp dword [ebp + 0xc], edi
je 0x108ce44
mov esi, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push 1
push dword [ebp + 0xc]
call esi
cmp eax, edi
jne 0x108cdcc
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xea
jne 0x108cdb2
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 8], eax
jne 0x108cd9b
mov dword [ebp - 4], 0x8007000e
jmp 0x108ce4b
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x14]
push eax
push 1
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x108cdcc
call edi
test eax, eax
jg 0x108cdc0
mov dword [ebp - 4], eax
jmp 0x108ce4b
and eax, 0xffff
or eax, 0x80070000
jmp 0x108cdb8
mov eax, dword [ebp - 0x10]
and dword [ebp + 0xc], 0
test eax, eax
jbe 0x108ce35
mov esi, dword [ebp - 8]
add esi, 0xc
mov eax, dword [esi]
cmp eax, 3
je 0x108ce27
cmp eax, 1
je 0x108ce27
push 0x35
push dword [esi - 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
mov dword [ebp - 0xc], edi
je 0x108ce27
lea eax, [ebp - 0x30]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 1
push edi
call fcn.0108c772
test eax, eax
mov dword [ebp - 4], eax
jl 0x108ce4b
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
and dword [ebp - 0xc], 0
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
add esi, 0x24
cmp dword [ebp + 0xc], eax
jb 0x108cddd
mov dword [0x10f4670], eax
mov eax, dword [ebp - 8]
mov dword [0x10f4674], eax
jmp 0x108ce5b
mov dword [ebp - 4], 0x80070057
cmp dword [ebp - 8], 0
je 0x108ce5b
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 0xc], 0
pop edi
pop esi
je 0x108ce6c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x108ce78
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 6
pop ecx
xor ebx, ebx
push 4
push ebx
xor eax, eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x108cecd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x108ceb8
call esi
mov esi, eax
jmp 0x108cfde
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x108cfde
push 0x3d
push 0x1010e74
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x108cf1f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x108cef4
call esi
mov esi, eax
jmp 0x108cf04
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070424
je 0x108cf18
cmp esi, 0x8007007b
jne 0x108cfc8
xor esi, esi
jmp 0x108cfc8
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [ebp - 0x24]
push ecx
push eax
call edi
test eax, eax
je 0x108cfa5
cmp dword [ebp - 0x20], 1
je 0x108cf18
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, eax
jmp 0x108cf7b
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x108cfc8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call edi
test eax, eax
je 0x108cfa5
cmp dword [ebp - 0x20], 1
je 0x108cf18
call esi
sub eax, ebx
cmp eax, 0xea60
ja 0x108cfb5
cmp dword [ebp - 0x20], 3
je 0x108cf54
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0108cd2a
mov esi, eax
test esi, esi
jl 0x108cfc8
lea eax, [ebp - 0x24]
push eax
push 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x108cfbc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x108cf42
call esi
jmp 0x108cfc6
mov esi, 0x8007041d
jmp 0x108cfc8
push 1
push dword [ebp - 4]
call fcn.0108c772
mov esi, eax
cmp dword [ebp - 4], 0
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x108cfd9
push dword [ebp - 4]
call edi
push dword [ebp - 8]
call edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x108cfea
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov eax, 0x10d859c
call fcn.0107a498
sub esp, 0x30
push ebx
push esi
xor ebx, ebx
push edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call sub.MFC42u.dll_CString::CString_2
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call sub.MFC42u.dll_CString::CString_2
mov word [ebp - 0x3c], bx
xor eax, eax
lea edi, [ebp - 0x3a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x1010f68
mov byte [ebp - 4], 1
stosw word es:[edi], ax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.msvcrt.dll_wcslen]
inc eax
cmp dword [ebp + 8], ebx
pop ecx
mov dword [ebp - 0x2c], eax
jne 0x108d051
mov dword [ebp - 0x10], 0x80070057
jmp 0x108d149
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1010f18
mov esi, 0x80000002
push esi
call edi
cmp eax, ebx
jne 0x108d13a
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1010eb8
push esi
call edi
cmp eax, ebx
jne 0x108d13a
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0x30]
push eax
movzx eax, word [ebp - 0x32]
push eax
movzx eax, word [ebp - 0x34]
push eax
movzx eax, word [ebp - 0x36]
push eax
movzx eax, word [ebp - 0x3a]
push eax
movzx eax, word [ebp - 0x3c]
push eax
lea eax, [ebp - 0x28]
push 0x1010e80
push eax
call sub.MFC42u.dll_CString::Format
add esp, 0x20
push 0x1010eb8
lea ecx, [ebp - 0x20]
call sub.MFC42u.dll_CString::operator
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x20]
call sub.MFC42u.dll_CString::operator_2
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [ebp - 0x20]
push esi
call edi
cmp eax, ebx
jne 0x108d13a
mov eax, dword [ebp - 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add eax, eax
push eax
push 0x1010f68
push 1
push ebx
push ebx
push dword [ebp - 0x14]
call esi
cmp eax, ebx
jne 0x108d13a
push ebx
push ebx
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 0x14]
call esi
cmp eax, ebx
je 0x108d149
jle 0x108d146
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x18], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x108d15c
push dword [ebp - 0x18]
call esi
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x1c], ebx
je 0x108d169
push dword [ebp - 0x1c]
call esi
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x14], ebx
je 0x108d176
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call sub.MFC42u.dll_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call sub.MFC42u.dll_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x108d7fa
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
xor esi, esi
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jne 0x108d823
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x108d881
lea eax, [ebp - 4]
push eax
push 1
push ebx
push 0x10110d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x108d864
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x10110a0
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x108d867
push eax
jmp 0x108d81b
cmp dword [ebp - 0x14], 4
jne 0x108d819
cmp dword [ebp - 0xc], ebx
jbe 0x108d875
xor esi, esi
inc esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov dword [ebp - 0x10], 1
cmp dword [ebp - 4], ebx
pop esi
pop ebx
je 0x108d891
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x108d89d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x10e607c]
push esi
mov esi, edx
test esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x408], ecx
jne 0x108d8c7
xor eax, eax
jmp 0x108d9fc
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcscpy]
push edi
mov edi, dword [eax + 0x5c]
lea eax, [ebp - 0x404]
push esi
push eax
call ebx
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0xc
cmp word [esi + eax*2 - 2], 0x5c
je 0x108d902
lea eax, [ebp - 0x404]
push 0x1003824
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
push 0x100
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x108d931
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
call ebx
pop ecx
pop ecx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x108d9f8
cmp eax, 2
je 0x108d9f8
mov esi, dword [edi + 0x54]
jmp 0x108d976
lea eax, [ebp - 0x204]
push eax
lea eax, [esi + 4]
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x108d9f8
mov esi, dword [esi + 0x404]
test esi, esi
jne 0x108d955
push 1
push 0x408
call dword [sym.imp.msvcrt.dll_calloc]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x108d9f8
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x108d9a1
mov dword [eax + 0x404], esi
jmp 0x108d9a4
mov dword [edi + 0x54], esi
lea eax, [ebp - 0x204]
push eax
lea edi, [esi + 4]
push edi
call ebx
pop ecx
pop ecx
push 0
push 0x2000000
push 3
push 0
push 3
push 0x20080
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x108d9f4
lea eax, [ebp - 0x43c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x108d9ed
mov eax, dword [ebp - 0x420]
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x108d9fa
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.01078836
leave
ret 4
Function at 0x108da0e
Capabilities:
Enumerate disk volumes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10e607c]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20c], eax
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebx + 4]
push eax
lea eax, [ebp - 0x204]
push eax
call edi
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0x204]
push eax
call esi
mov ecx, 0x100
sub ecx, eax
add esp, 0xc
push ecx
lea eax, [ebp - 0x204]
push eax
call esi
pop ecx
lea eax, [ebp + eax*2 - 0x204]
push eax
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
test eax, eax
mov dword [ebp - 0x208], eax
je 0x108dafc
cmp eax, 0xffffffff
je 0x108dafc
push dword [ebp - 0x20c]
mov ecx, ebx
lea edx, [ebp - 0x204]
call fcn.0108d89d
test eax, eax
je 0x108daab
push dword [ebp - 0x20c]
push eax
call fcn.0108da0e
lea eax, [ebx + 4]
push eax
lea eax, [ebp - 0x204]
push eax
call edi
lea eax, [ebp - 0x204]
push eax
call esi
mov ecx, 0xff
sub ecx, eax
add esp, 0xc
shl ecx, 1
push ecx
lea eax, [ebp - 0x204]
push eax
call esi
pop ecx
lea eax, [ebp + eax*2 - 0x204]
push eax
push dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
test eax, eax
jne 0x108da88
push dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01078836
leave
ret 8
Function at 0x1090973
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10e607c]
push esi
push edi
xor edi, edi
cmp dword [0x10f5608], edi
mov dword [ebp - 4], eax
jne 0x10909f8
lea eax, [ebp - 0x38]
push eax
push 1
push edi
push 0x100ba58
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10909f8
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x3c]
push eax
push edi
push 0x10111ec
push dword [ebp - 0x38]
mov dword [ebp - 0x34], 0x28
mov word [ebp - 8], di
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10909e0
mov dword [0x10f5608], 1
jmp 0x10909ef
lea eax, [ebp - 0x30]
push eax
call fcn.01085613
pop ecx
mov dword [0x10f5608], eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10f5608]
mov esi, 0x200
cmp eax, esi
jae 0x1090a43
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push 1
push dword [0x10e6270]
mov dword [ebp - 0x34], 0x20
call fcn.0108bcb1
test eax, eax
jne 0x1090a38
mov eax, dword [ebp - 0x24]
mov dword [0x10f5608], eax
mov eax, dword [0x10f5608]
cmp eax, esi
jb 0x1090a56
xor edi, edi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push edi
push dword [0x10e6270]
call fcn.0108b30b
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01078836
leave
ret

Function at 0x10911ca
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push 0x1090a67
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret

Function at 0x10911ec
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 0x10f4c04
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push eax
push 0x10903ec
push eax
push eax
mov word [0x10f4aa4], ax
mov word [0x10f4aa0], 1
mov word [0x10f4b4c], ax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret
Function at 0x1091991
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x10e607c]
push esi
push edi
push dword [0x10f0da0]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x404]
push 0x1011230
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
lea eax, [ebp - 0x404]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x10919de
lea esi, [ebp - 0x404]
jmp 0x10919e0
inc esi
inc esi
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1091a31
lea eax, [ebp - 0x628]
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x654]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10919fb
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01078836
leave
ret

Function at 0x10924f1
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x10e607c]
push esi
push 0x101124c
push dword [0x10f0da0]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x404]
push 0x1010148
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1092567
push 0
lea eax, [ebp - 0x628]
push eax
call fcn.010920d3
lea eax, [ebp - 0x654]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1092540
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop esi
call fcn.01078836
leave
ret
Function at 0x109884f
Capabilities:
Enumerate network shares

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
and dword [ebp - 8], 0
test edi, edi
jne 0x1098863
xor ecx, ecx
jmp 0x1098898
mov eax, dword [edi + 0x5c]
mov edx, dword [eax]
mov dword [ebp - 0x3c], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x38], edx
mov edx, dword [eax + 8]
mov dword [ebp - 0x34], edx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x30], edx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x2c], edx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x28], edx
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x24], edx
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push ecx
push 0
push 1
push 2
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x10989a4
push esi
push 0x4000
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
test esi, esi
pop ecx
mov dword [ebp - 0x1c], esi
jne 0x10988cf
or dword [ebp - 8], 0xffffffff
jmp 0x1098999
or dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x4000
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x1098983
and dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], eax
jbe 0x10988cf
add esi, 0x18
and dword [ebp - 4], 0
cmp dword [esi - 0x10], 3
lea eax, [ebp - 4]
push eax
jne 0x109892b
push dword [esi]
push dword [esi + 4]
push 4
push dword [esi - 4]
push dword [ebp + 8]
call fcn.010a4911
mov eax, dword [ebp - 4]
test eax, eax
je 0x109896d
mov byte [eax + 0x31], 1
jmp 0x1098938
lea eax, [esi - 0x18]
push eax
push edi
push dword [ebp + 8]
call fcn.010986fd
mov eax, dword [ebp - 4]
test eax, eax
je 0x109896d
test edi, edi
jne 0x109894e
push eax
push dword [ebp + 8]
call fcn.010a4349
jmp 0x109895f
push 0
mov dword [eax + 0x18], edi
push dword [ebp - 4]
lea eax, [edi + 0x1c]
push eax
call fcn.010948b9
test byte [esi - 0xc], 1
je 0x109896d
mov eax, dword [ebp - 4]
call fcn.01098381
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add esi, 0x20
cmp eax, dword [ebp - 0x10]
jb 0x10988fe
mov esi, dword [ebp - 0x1c]
jmp 0x10988cf
cmp eax, 0x103
je 0x1098991
mov dword [ebp - 8], 1
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x14]
call sub.MPR.dll_WNetCloseEnum
pop esi
jmp 0x10989bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x4c6
neg eax
sbb eax, eax
and eax, 0xfffffe28
mov dword [ebp - 8], eax
mov ax, word [ebp - 8]
leave
ret 4