joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441eac
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x442057
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x442038
mov dl, 1
mov eax, dword [0x40c134]
call fcn.00402ccc
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403984
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x442027
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004308dc
test al, al
je 0x44201a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x442068
lea eax, [ebp - 0x254]
call fcn.00408628
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44201a
xor eax, eax
push ebp
push 0x442013
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4420a0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x441ffc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00403bb4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x441ffc
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00403bb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44201a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x441f1d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0040edb8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44205e
lea eax, [ebp - 0x260]
call fcn.00403984
ret

Function at 0x4428a4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4607c8]
cmp byte [eax + 0x95], 0
jne 0x442915
cmp dword [0x4607e4], 0
jne 0x4428d6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x442860
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4607e4], eax
cmp dword [0x4607e0], 0
jne 0x4428f1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4607e0], eax
cmp dword [0x4607e8], 0
jne 0x442915
push esp
push 0
push 0
push 0x442804
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4607e8], eax
pop edx
ret
Function at 0x442a0c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x442a23
add esp, 0xfffffff0
call fcn.00402ffc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00411d24
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40be34]
call fcn.00402ccc
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40be34]
call fcn.00402ccc
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x413b7c]
call fcn.0041b04c
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x442b98
mov eax, dword [0x45f494]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041b41c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x444518
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45f494]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00409a10
test eax, eax
je 0x442b16
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00407fdc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00409a38
test eax, eax
je 0x442b2a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00403bb4
mov eax, dword [0x45f39c]
cmp byte [eax], 0
jne 0x442b5b
mov eax, ebx
call fcn.00442c84
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x442b8d
call fcn.00403054
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x442ef4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4607c8]
cmp dword [eax + 0x24], 0
je 0x442f97
cmp dword [ebx + 0x84], 0
jne 0x442f91
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x442e84
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x442f91
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x442f5a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x442f91
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0040d4f8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x442f69
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x4439a4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x4439d9
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403a6c
jmp 0x4439e3
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.004039d8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44488c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x4448c4
mov eax, esi
call fcn.0042c694
test al, al
je 0x4448c4
mov eax, dword [ebx + 0x74]
call fcn.0042c398
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4448c4
push 0
mov eax, dword [ebx + 0x74]
call fcn.0042c398
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x44a708
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x44a736
mov eax, ebx
call fcn.0044b1ac
cmp dword [ebx + 0x3c], 0
je 0x44a72f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x44a7a7
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x44a799
cmp dword [ebx + 8], 0
je 0x44a758
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x44a76a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x44a799
cmp dword [ebx + 8], 0
je 0x44a74b
cmp eax, 3
je 0x44a77d
dec eax
jne 0x44a74b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x44a74b
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x44a74b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x44a7c5
cmp dword [ebx + 0x10], 0xcc
je 0x44a7c5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0044a7d0
pop ebx
ret

Function at 0x45b368
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov ebx, dword [esp + 0x10]
mov eax, ebx
sub eax, 1
jb 0x45b38e
je 0x45b39f
dec eax
je 0x45b3b0
jmp 0x45b3bf
mov eax, 0x460850
mov edx, 0x45b4ac
call fcn.004039d8
jmp 0x45b3bf
mov eax, 0x460850
mov edx, 0x45b4c0
call fcn.004039d8
jmp 0x45b3bf
mov eax, 0x460850
mov edx, 0x45b4d4
call fcn.004039d8
cmp ebx, 2
jne 0x45b437
cmp dword [esp + 4], 5
jne 0x45b3e3
cmp dword [esp + 8], 2
jne 0x45b3e3
mov eax, 0x460854
mov edx, 0x45b4e8
call fcn.004039d8
jmp 0x45b437
cmp dword [esp + 4], 5
jne 0x45b402
cmp dword [esp + 8], 1
jne 0x45b402
mov eax, 0x460854
mov edx, 0x45b504
call fcn.004039d8
jmp 0x45b437
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x45b423
cmp dword [esp + 8], 0
jne 0x45b423
mov eax, 0x460854
mov edx, 0x45b518
call fcn.004039d8
jmp 0x45b437
cmp eax, 4
ja 0x45b437
mov eax, 0x460854
mov edx, 0x45b4d4
call fcn.004039d8
cmp dword [esp + 0x10], 1
jne 0x45b499
cmp dword [esp + 4], 4
jne 0x45b45d
cmp dword [esp + 8], 0x5a
jne 0x45b45d
mov eax, 0x460854
mov edx, 0x45b530
call fcn.004039d8
jmp 0x45b499
cmp dword [esp + 4], 4
jne 0x45b47c
cmp dword [esp + 8], 0xa
jne 0x45b47c
mov eax, 0x460854
mov edx, 0x45b544
call fcn.004039d8
jmp 0x45b499
cmp dword [esp + 4], 4
jne 0x45b499
cmp dword [esp + 8], 0
jne 0x45b499
mov eax, 0x460854
mov edx, 0x45b4c0
call fcn.004039d8
add esp, 0x94
pop ebx
ret
Function at 0x4062ca
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4062ee
xor eax, eax
test eax, eax
je 0x406300
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406300
xor ecx, ecx
jmp 0x406303
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4063ef
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42ce04], 0
push esi
jne 0x406426
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406400
mov dword [ecx*4 + 0x42ce00], eax
inc ecx
cmp ecx, 0x100
jl 0x4063fb
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406457
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42ce00]
xor eax, esi
inc ecx
dec edx
jne 0x406439
pop edi
not eax
pop esi
ret 0xc

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..00cfg
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5fa7349b
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x4b7b1b8a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10001ae0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
call fcn.100056f0
mov dword [esi], vtable.CAPWinInet.0
call fcn.1000c3bc
mov ecx, eax
test ecx, ecx
je 0x10001b34
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x44], eax
call fcn.1000c3bc
mov ecx, eax
test ecx, ecx
je 0x10001b3e
mov eax, dword [ecx]
call dword [eax + 0xc]
push 0
push 0
push 0
push 0
add eax, 0x10
push str.Mozilla_4.0__compatible__MSIE_6.0_Windows_NT_5.1_
mov dword [esi + 0x48], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 0x40], eax
mov eax, esi
pop esi
ret
push 0x80004005
call fcn.100032c0
push 0x80004005
call fcn.100032c0
int3
Function at 0x10002b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10002b75
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10002bb4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10002bb0
lea ebx, [ebx]
cmp esi, edx
jae 0x10002bb4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10002ba0
cmp esi, edx
jb 0x10002bb9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x10004e60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
push esi
push edi
mov esi, ecx
lea edi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004e70
sub eax, edi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10004ea9
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x10004ec0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov eax, ecx
mov dword [ebp - 8], 1
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
xor esi, esi
mov dword [ebp - 4], 0
push esi
lea ecx, [ebp - 8]
push ecx
push esi
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004f80
push ebx
mov ebx, dword [ebp - 4]
test ebx, ebx
jne 0x10004f13
mov ecx, dword [ebp + 0xc]
call fcn.100030c0
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
push edi
push ebx
call fcn.101220d9
push ebx
mov edi, eax
push 0
push edi
call fcn.10123d80
add esp, 0x10
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0xc]
test eax, eax
jne 0x10004f67
push edi
call fcn.10003410
push edi
mov esi, 1
call fcn.101225e7
add esp, 4
mov eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.100030c0
push edi
call fcn.101225e7
add esp, 4
mov eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
call fcn.100030c0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10006da0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013ae68
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x1019b120]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
push 0x200
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x28], 0x100
call fcn.101220d9
add esp, 4
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x10006e29
push 0x1017cc58
mov ecx, esi
call fcn.10002dd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x20
call fcn.101220d9
mov edi, eax
add esp, 4
test edi, edi
je 0x10006e0a
xorps xmm0, xmm0
movdqu xmmword [edi], xmm0
push 0x40
movdqu xmmword [edi + 0x10], xmm0
call fcn.101220d9
add esp, 4
test eax, eax
je 0x10006e0a
push 0x40
mov esi, eax
push 0
push esi
call fcn.10123d80
mov eax, 0x20
add esp, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp - 0x24]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x10006ea3
push edi
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x10006f1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10006f1a
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10], eax
jbe 0x10006ede
push edi
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x10]
call fcn.1000b60d
add esp, 4
mov edi, eax
push dword [ebp - 0x10]
push 0
push edi
call fcn.10123d80
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], ecx
jbe 0x10006e72
push esi
call fcn.101225e7
mov eax, dword [ebp - 0x14]
add esp, 4
lea esi, [eax + eax]
push esi
call fcn.101220d9
add esp, 4
mov dword [ebp - 0x18], eax
push esi
mov esi, eax
push 0
push esi
call fcn.10123d80
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
jmp 0x10006e6f
push dword [ebp - 0x10]
mov edx, edi
lea ecx, [ebp - 0x20]
call fcn.10006ad0
add esp, 4
push esi
mov dword [ebp - 4], 0
call fcn.101225e7
add esp, 4
push edi
call fcn.101225e7
add esp, 4
push dword [ebp - 0x24]
call fcn.101225e7
mov edi, dword [ebp - 0x20]
add esp, 4
add edi, 0xfffffff0
push edi
call fcn.10003050
mov esi, dword [ebp - 0x2c]
add eax, 0x10
add esp, 4
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov dword [esi], eax
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10006f83
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100097b0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013b3b5
mov eax, dword fs:[0]
push eax
sub esp, 0x624
mov eax, dword [0x1019b120]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x62c]
mov ebx, 0x101a62f0
call fcn.1000be9e
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
cmp byte [0x101a6301], 0
je 0x1000992e
test edi, edi
je 0x1000992e
mov ecx, edi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009820
sub ecx, edx
je 0x1000992e
mov eax, dword [ebp + 8]
mov esi, edi
mov dword [ebp - 0x520], eax
lea ecx, [esi + 1]
lea ecx, [ecx]
mov al, byte [esi]
inc esi
test al, al
jne 0x10009840
sub esi, ecx
mov eax, 0x100
cmp esi, eax
cmovg esi, eax
lea eax, [ebp - 0x620]
push esi
push edi
push eax
call fcn.10127780
add esp, 0xc
mov byte [ebp + esi - 0x620], 0
lea eax, [ebp - 0x51c]
push 0x504
push 0
push eax
call fcn.10123d80
mov eax, dword [0x101a6804]
add esp, 0xc
test eax, eax
jle 0x100098cf
xor esi, esi
lea ecx, [ecx]
cmp esi, eax
jge 0x100098bc
lea ecx, [esi + esi*4]
shl ecx, 6
lea edx, [ebx + 0x14]
add edx, ecx
lea eax, [ecx + 0x101a6344]
push eax
lea ecx, [ebp - 0x51c]
call fcn.100090a0
mov eax, dword [0x101a6804]
add esp, 4
inc esi
jmp 0x10009890
push 0x504
lea eax, [ebx + 0x14]
push 0
push eax
call fcn.10123d80
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
call fcn.10009980
mov al, byte [ebx + 0x584]
test al, al
je 0x10009958
cmp dword [ebx + 0x55c], 0
jne 0x1000992e
test al, al
je 0x10009958
push dword [ebx + 0x564]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push 4
push 0
push 0
push fcn.10009410
call fcn.1000e0ef
mov dword [ebx + 0x55c], eax
mov dword [eax + 0x28], 0
mov eax, dword [ebx + 0x55c]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 4], 0xffffffff
call fcn.1000bf4d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10121948
mov esp, ebp
pop ebp
ret 8
push 0
call fcn.10009410
add esp, 4
jmp 0x1000992e