joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100030da
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push ebp
push esi
push 8
pop ebp
lea esi, [edi + 4]
cmp dword [edi + 0x18], ebp
jb 0x100030ec
mov eax, dword [esi]
jmp 0x100030ee
mov eax, esi
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.Program_Files
push eax
call ebx
test eax, eax
jne 0x100031a8
cmp dword [edi + 0x18], ebp
jb 0x1000310d
mov eax, dword [esi]
jmp 0x1000310f
mov eax, esi
push str.Windows_
push eax
call ebx
test eax, eax
jne 0x100031a8
cmp dword [edi + 0x18], ebp
jb 0x10003128
mov eax, dword [esi]
jmp 0x1000312a
mov eax, esi
push str.AppData_
push eax
call ebx
test eax, eax
jne 0x100031a8
cmp dword [edi + 0x18], ebp
jb 0x1000313f
mov eax, dword [esi]
jmp 0x10003141
mov eax, esi
push str.ProgramData_
push eax
call ebx
test eax, eax
jne 0x100031a8
cmp dword [edi + 0x18], ebp
jb 0x10003156
mov eax, dword [esi]
jmp 0x10003158
mov eax, esi
push str._temp_
push eax
call ebx
test eax, eax
jne 0x100031a8
cmp dword [edi + 0x18], ebp
jb 0x1000316d
mov eax, dword [esi]
jmp 0x1000316f
mov eax, esi
push str.RECYCLE
push eax
call ebx
test eax, eax
jne 0x100031a8
cmp dword [edi + 0x18], ebp
jb 0x10003184
mov eax, dword [esi]
jmp 0x10003186
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x100031ae
cmp dword [edi + 0x18], ebp
jb 0x1000319b
mov esi, dword [esi]
push esi
push str.invalid_path:_ls
call fcn.100210eb
pop ecx
pop ecx
mov al, 1
pop esi
pop ebp
pop ebx
ret
push 0x10045fa4
push edi
call fcn.10004ca2
cmp eax, 0xffffffff
je 0x100031cd
cmp dword [edi + 0x18], ebp
jb 0x100031c5
mov esi, dword [esi]
push esi
push str.specific_path:_ls
jmp 0x100031a1
cmp dword [edi + 0x18], ebp
jb 0x100031d6
mov eax, dword [esi]
jmp 0x100031d8
mov eax, esi
push eax
call ebx
test eax, 0x400
je 0x100031f1
cmp dword [edi + 0x18], ebp
jb 0x100031e9
mov esi, dword [esi]
push esi
push str.jmp_symbolic_link:_ls__
jmp 0x100031a1
xor al, al
jmp 0x100031aa
Function at 0x100031f5
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x384]
sub esp, 0x404
mov eax, dword [0x10050060]
xor eax, ebp
mov dword [ebp + 0x380], eax
push ebx
push esi
push edi
xor eax, eax
push str.RunAsServ
mov word [ebp - 0x80], ax
call fcn.100210eb
pop ecx
xor esi, esi
push esi
push 0x19
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x80]
push eax
push str.common_desktop_dir:_ls
call fcn.100210eb
pop ecx
pop ecx
cmp word [ebp - 0x80], si
je 0x10003271
call fcn.10001e69
add eax, 0x48
cmp dword [eax + 0x18], 8
jb 0x1000325d
mov eax, dword [eax + 4]
jmp 0x10003260
add eax, 4
lea esi, [ebp - 0x80]
mov ebx, str.common_desktop
mov edi, eax
call fcn.1000b3d0
xor esi, esi
xor eax, eax
push esi
mov word [ebp - 0x80], ax
push 0x10
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x80]
push eax
push str.desktop_dir:_ls
call fcn.100210eb
pop ecx
pop ecx
cmp word [ebp - 0x80], si
je 0x100032c2
call fcn.10001e69
add eax, 0x48
cmp dword [eax + 0x18], 8
jb 0x100032ae
mov eax, dword [eax + 4]
jmp 0x100032b1
add eax, 4
lea esi, [ebp - 0x80]
mov ebx, str.desktop
mov edi, eax
call fcn.1000b3d0
xor esi, esi
xor eax, eax
push esi
mov word [ebp - 0x80], ax
push 5
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x80]
push eax
push str.documents_dir:_ls
call fcn.100210eb
pop ecx
pop ecx
cmp word [ebp - 0x80], si
je 0x10003311
call fcn.10001e69
add eax, 0x48
cmp dword [eax + 0x18], 8
jb 0x100032ff
mov eax, dword [eax + 4]
jmp 0x10003302
add eax, 4
lea esi, [ebp - 0x80]
mov ebx, str.documents
mov edi, eax
call fcn.1000b3d0
mov ecx, dword [ebp + 0x380]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002874e
add ebp, 0x384
leave
ret 0x10
Function at 0x1000332b
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push 0x458
mov eax, 0x1004013b
call fcn.100296da
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x43c], esi
call fcn.1000b7a1
xor edi, edi
mov dword [ebp - 4], esi
inc edi
cmp dword [ebx + 0x60], 8
mov dword [ebp - 0x43c], edi
jb 0x1000336b
mov eax, dword [ebx + 0x4c]
jmp 0x1000336e
lea eax, [ebx + 0x4c]
push esi
push eax
push 0x80000002
call fcn.1000b6e8
add esp, 0xc
test al, al
jne 0x1000344b
xor eax, eax
mov word [ebp - 0x210], ax
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov word [ebp - 0x410], ax
push esi
lea eax, [ebp - 0x410]
push eax
push dword [0x100539f8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x210]
push eax
push str._ls_rundll32.exe__ls_RunAsUser
lea ecx, [ebp - 0x42c]
call fcn.1000b2a5
add esp, 0xc
mov dword [ebp - 4], edi
cmp dword [ebp - 0x414], 8
mov eax, dword [ebp - 0x428]
jae 0x100033f7
lea eax, [ebp - 0x428]
push eax
push str.rundll32:_ls
call fcn.100210eb
cmp dword [ebp - 0x414], 8
mov eax, dword [ebp - 0x428]
pop ecx
pop ecx
jae 0x10003419
lea eax, [ebp - 0x428]
push eax
call fcn.1000adc9
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x430], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x430]
call fcn.100011e4
push 0
push edi
lea esi, [ebp - 0x42c]
mov byte [ebp - 4], 0
call fcn.10005985
cmp dword [ebx + 0x60], 8
jb 0x10003456
mov ecx, dword [ebx + 0x4c]
jmp 0x10003459
lea ecx, [ebx + 0x4c]
lea eax, [ebp - 0x464]
push eax
call fcn.10001287
pop ecx
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x44c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x464]
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x464]
lea edi, [ebp - 0x444]
lea esi, [ebp - 0x434]
mov dword [ebp - 0x444], eax
call fcn.1000688c
test al, al
jne 0x10003563
call fcn.1000c89b
push 8
pop esi
cmp dword [eax + 0x18], esi
jb 0x100034ca
mov eax, dword [eax + 4]
jmp 0x100034cd
add eax, 4
cmp dword [ebx + 0x60], esi
jb 0x100034d7
mov ecx, dword [ebx + 0x4c]
jmp 0x100034da
lea ecx, [ebx + 0x4c]
lea edx, [ebp - 0x42c]
push edx
mov edx, eax
call fcn.1000b410
pop ecx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x414], esi
jae 0x10003501
lea eax, [ebp - 0x428]
push eax
push 0x10046128
call fcn.100210eb
mov eax, dword [ebp - 0x428]
pop ecx
pop ecx
cmp dword [ebp - 0x414], esi
jae 0x10003522
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10003540
lea eax, [ebp - 0x42c]
push eax
mov eax, dword [ebp - 0x438]
call fcn.10004faa
push 0
push 1
lea esi, [ebp - 0x42c]
mov byte [ebp - 4], 2
call fcn.10005985
lea esi, [ebp - 0x434]
call fcn.100060de
jmp 0x10003487
lea eax, [ebp - 0x464]
push eax
mov byte [ebp - 4], 0
call fcn.100050b4
mov eax, dword [ebp - 0x438]
call fcn.1002975d
ret 4
Function at 0x100037e5
Capabilities:
Get disk information

Disassembly:
push 0x24
mov eax, 0x1003f48b
call fcn.100296da
xor ebx, ebx
mov dword [ebp - 4], ebx
push 4
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], ebx
call fcn.10028efc
pop ecx
cmp eax, ebx
je 0x1000380c
mov dword [eax], edi
jmp 0x1000380e
xor eax, eax
mov dword [edi], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x100461cc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x100461d0]
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x2c], ebx
je 0x10003886
xor eax, eax
inc eax
shl eax, cl
test eax, eax
je 0x10003886
lea eax, [ebp - 0x1c]
add ecx, 0x61
push eax
mov word [ebp - 0x1c], cx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x10003886
mov byte [ebp - 0x1d], bl
mov bl, byte [ebp - 0x1c]
lea esi, [ebp - 0x1d]
call fcn.100211e4
cmp byte [ebp - 0x1d], 0
jne 0x10003884
lea eax, [ebp - 0x24]
push eax
mov eax, edi
call fcn.10005454
xor ebx, ebx
mov ecx, dword [ebp - 0x24]
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x1a
jb 0x10003841
mov eax, edi
call fcn.1002975d
ret
Function at 0x1000a096
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x10050060]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xa88], ecx
mov ecx, dword [ebp + 0x18]
push edi
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xa8c], edx
test esi, esi
je 0x1000a2bb
test eax, eax
jne 0x1000a0e7
test ecx, ecx
je 0x1000a2bb
movzx eax, word [esi + 2]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp ax, 0x3a
je 0x1000a13d
cmp ax, 0x5c
je 0x1000a13d
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push eax
call fcn.1002c7e0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea eax, [ebp - 0x828]
push eax
call edi
lea esi, [ebp - 0x828]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000a2bb
test al, 0x10
je 0x1000a2bb
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x418]
push eax
call ebx
push 0x10046578
lea eax, [ebp - 0x418]
push eax
call edi
lea eax, [ebp - 0xa78]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xa90], eax
cmp eax, 0xffffffff
je 0x1000a2bb
mov dword [ebp - 0xa7c], 1
push 0x1004657c
lea eax, [ebp - 0xa4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1000a280
push 0x10046580
lea eax, [ebp - 0xa4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1000a280
cmp dword [ebp - 0xa78], 0xffffffff
je 0x1000a280
push esi
lea eax, [ebp - 0x210]
push eax
call ebx
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0x210]
push eax
call edi
test byte [ebp - 0xa78], 0x10
je 0x1000a260
cmp dword [ebp - 0xa80], 0
je 0x1000a224
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x210]
push eax
call dword [ebp - 0xa80]
test eax, eax
je 0x1000a29d
cmp dword [ebp + 0xc], 0
je 0x1000a280
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x210]
push dword [ebp - 0xa80]
push dword [ebp - 0xa88]
push dword [ebp - 0xa84]
push dword [ebp + 0xc]
push eax
call fcn.1000a096
push 2
pop ecx
cmp eax, ecx
jne 0x1000a280
mov dword [ebp - 0xa7c], ecx
jmp 0x1000a2a7
cmp dword [ebp - 0xa84], 0
je 0x1000a280
push dword [ebp - 0xa88]
lea eax, [ebp - 0x210]
push eax
call dword [ebp - 0xa84]
test eax, eax
je 0x1000a29d
lea eax, [ebp - 0xa78]
push eax
push dword [ebp - 0xa90]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000a1a0
jmp 0x1000a2a7
mov dword [ebp - 0xa7c], 2
push dword [ebp - 0xa90]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0xa7c]
jmp 0x1000a2bd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002874e
leave
ret 0x18
Function at 0x1000a34b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x10050060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
cmp edi, ebx
je 0x1000a445
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x1000a445
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.1002c7e0
add esp, 0xc
lea esi, [ebp - 0x210]
mov ecx, edi
call fcn.1000aa59
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000a3c2
shr eax, 4
not eax
and eax, 1
jmp 0x1000a447
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea esi, [ebp - 0x418]
call fcn.1000a455
test eax, eax
je 0x1000a445
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x10000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x1000a427
mov dword [ebp - 0x41c], 1
cmp eax, 0xffffffff
jne 0x1000a42d
mov dword [ebp - 0x41c], ebx
lea eax, [ebp - 0x420]
call fcn.100011e4
xor eax, eax
cmp byte [ebp - 0x41c], bl
setne al
jmp 0x1000a447
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1002874e
leave
ret
Function at 0x1000a75e
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000a775
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
ret
test al, 1
je 0x1000a784
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
ret

Function at 0x1000a9df
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x10050060]
xor eax, ebp
mov dword [ebp + 0x84], eax
push 0x103
lea eax, [ebp - 0x7f]
push 0
push eax
mov byte [ebp - 0x80], 0
call fcn.1002c7e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
call fcn.1000a948
mov eax, 0x179b06cc
xor ecx, ecx
push esi
movzx edx, byte [ebp + ecx - 0x80]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x10051ea0]
inc ecx
cmp ecx, 0x24
jl 0x1000aa27
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
not eax
pop esi
call fcn.1002874e
add ebp, 0x88
leave
ret

Function at 0x1000aabc
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10050060]
xor eax, ebp
mov dword [ebp - 8], eax
movsx eax, byte [ebp + 8]
push ebx
push esi
push edi
push eax
push str.__c:
lea esi, [ebp - 0x60]
call fcn.1000b303
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x1000aaee
mov eax, dword [eax + 4]
jmp 0x1000aaf1
add eax, 4
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov ebx, eax
push 1
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x40], ebx
call fcn.100057e3
cmp ebx, esi
je 0x1000ab1f
cmp ebx, 0xffffffff
jne 0x1000ab39
lea eax, [ebp - 0x40]
call fcn.100011e4
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002874e
leave
ret
push 0x28
pop edx
push 9
pop ecx
xor eax, eax
push esi
mov dword [ebp - 0x3c], edx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
push edx
lea eax, [ebp - 0x3c]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2d1400
push ebx
mov dword [ebp - 0x44], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1000ab85
or esi, 0xffffffff
lea eax, [ebp - 0x40]
call fcn.100011e4
mov eax, esi
jmp 0x1000ab2a
mov esi, dword [ebp - 0x20]
jmp 0x1000ab79
Function at 0x1000abb0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x10050060]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, fcn.1000af2a
push esi
test eax, eax
je 0x1000ac3d
push 0x424
lea eax, [esp + 0x10]
push 0
push eax
call fcn.1002c7e0
add esp, 0xc
push dword [ebp + 8]
mov dword [esp + 0xc], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x1000ac34
cmp esi, 0xffffffff
je 0x1000ac34
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
jmp 0x1000ac30
push edi
lea eax, [esp + 0xc]
push eax
call fcn.1000af2a
test eax, eax
je 0x1000ac34
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1000ac16
lea eax, [esp + 4]
call fcn.100011e4
mov ecx, dword [esp + 0x434]
pop esi
xor ecx, esp
call fcn.1002874e
mov esp, ebp
pop ebp
ret 4

Function at 0x1000ac52
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x10050060]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
mov eax, fcn.1000aed8
test eax, eax
je 0x1000acd9
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x80], esi
test esi, esi
je 0x1000acd0
cmp esi, 0xffffffff
je 0x1000acd0
push 0x228
lea eax, [ebp - 0x78]
push 0
push eax
mov dword [ebp - 0x7c], 0x22c
call fcn.1002c7e0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1000accc
push edi
lea eax, [ebp - 0x7c]
push eax
call fcn.1000aed8
test eax, eax
je 0x1000acd0
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1000acb4
lea eax, [ebp - 0x80]
call fcn.100011e4
pop esi
mov ecx, dword [ebp + 0x1b0]
xor ecx, ebp
call fcn.1002874e
add ebp, 0x1b4
leave
ret
Function at 0x1000adc9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
jne 0x1000ade2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
call fcn.1000acee
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.1000ac52
cmp dword [ebp - 0x14], esi
je 0x1000add9
push dword [ebp - 0x18]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x1000ae18
cmp eax, 0xffffffff
jne 0x1000ae24
lea eax, [ebp - 0x10]
call fcn.100011e4
mov eax, esi
jmp 0x1000addb
lea ecx, [ebp - 8]
push ecx
push 0xf01ff
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000ae18
push esi
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000aece
mov edi, dword [ebp + 8]
call fcn.1000a05c
push 0x40
mov dword [ebp + 8], eax
lea eax, [ebp - 0x68]
push esi
push eax
mov dword [ebp - 0x6c], 0x44
call fcn.1002c7e0
add esp, 0xc
push 5
pop eax
mov word [ebp - 0x3c], ax
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0xc]
mov dword [ebp - 0x40], 1
push 0x420
push esi
push esi
push esi
push dword [ebp + 8]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1000aebd
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
call ebx
push dword [ebp + 8]
call fcn.1000a089
push dword [ebp - 0xc]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 8]
call ebx
jmp 0x1000ae18
Function at 0x1000b540
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f946
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.10034220
mov eax, dword [0x10050060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x2028], eax
mov esi, ecx
mov dword [ebp - 0x202c], edi
call fcn.1000b7a1
xor ebx, ebx
push esi
inc ebx
lea esi, [ebp - 0x2024]
mov dword [ebp - 0x202c], ebx
call fcn.10009df3
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x2020], edi
je 0x1000b655
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2012]
push edi
push eax
mov dword [ebp - 0x2018], edi
call fcn.1002c7e0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x201c]
push eax
lea eax, [ebp - 0x2014]
push eax
push edi
jmp 0x1000b63f
inc dword [ebp - 0x2018]
lea eax, [ebp - 0x2014]
push eax
lea esi, [ebp - 0x2048]
call fcn.10004b6d
mov eax, esi
mov byte [ebp - 4], 2
push eax
mov eax, dword [ebp - 0x2028]
call fcn.10004faa
push edi
push 1
mov byte [ebp - 4], 1
call fcn.10005985
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x201c]
push eax
lea eax, [ebp - 0x2014]
push eax
push dword [ebp - 0x2018]
push dword [ebp - 0x2020]
mov dword [ebp - 0x201c], 0x1000
call ebx
test eax, eax
je 0x1000b5f1
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
cmp dword [ebp - 0x2020], edi
je 0x1000b673
push dword [ebp - 0x2020]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2028]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002874e
leave
ret

Function at 0x1000b693
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push 1
push esi
push esi
push str.Softwareprojonepodlp_volatiledteProcessing_
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1000b6e2
push 8
push dword [ebp + 0xc]
push 0xb
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x1000e296
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x1000e2a7
mov eax, dword [eax + 4]
jmp 0x1000e2aa
add eax, 4
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push str.Softwareprojonepodlpkeyrule_secClass_
push 0x80000002
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1000e2e0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
call fcn.1000b3be
leave
ret
xor eax, eax
leave
ret