joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003bf5a
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x1003bf6e
xor eax, eax
jmp 0x1003c0ac
mov eax, ebx
shl eax, 3
push 6
pop ecx
cdq
idiv ecx
mov edx, ebx
imul ecx, eax, 6
shl edx, 3
push 3
sub edx, ecx
dec edx
pop ecx
sub edx, 1
je 0x1003bf97
dec edx
sub edx, 1
jne 0x1003bf99
add eax, 2
jmp 0x1003bf99
add eax, ecx
push esi
mov esi, dword [ebp + 0x14]
inc eax
cmp dword [esi], eax
jge 0x1003bfac
push 0xfffffffffffffff0
mov dword [esi], eax
pop eax
jmp 0x1003c0ab
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x1003c042
dec eax
mov ebx, dword [ebp + 8]
xor edx, edx
push 3
pop ecx
div ecx
inc eax
imul ecx, eax, 3
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x10179368]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
mov al, byte [eax + 0x10179368]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
mov al, byte [eax + 0x10179368]
mov byte [edi + 2], al
mov al, byte [esi + 0x10179368]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x1003bfd7
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x1003c045
mov eax, dword [ebp + 8]
cmp ecx, ebx
jge 0x1003c09e
movzx edx, byte [eax]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
jge 0x1003c05a
movzx ecx, byte [eax + 1]
jmp 0x1003c05c
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
mov al, byte [eax + 0x10179368]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
mov al, byte [eax + 0x10179368]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], ebx
jge 0x1003c093
and ecx, 0xf
mov al, byte [ecx*4 + 0x10179368]
mov byte [edi + 2], al
jmp 0x1003c097
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi], eax
xor eax, eax
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c2a5
Capabilities:
Get mac address on windows

Disassembly:
push 0x58
mov eax, 0x10174320
call fcn.1006e789
mov esi, dword [ebp + 8]
and dword [ebp - 0x64], 0
push 0x288
mov dword [ebp - 0x54], 4
call fcn.10059328
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1003c2e1
push 0x1017653d
mov ecx, esi
call fcn.1002b7f0
jmp 0x1003c449
lea eax, [ebp - 0x54]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x1003c306
push ebx
call fcn.10058ca1
push dword [ebp - 0x54]
call fcn.10059328
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x1003c2d0
xor eax, eax
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x38], al
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x1003c41e
mov byte [ebp - 0x20], al
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
xor ecx, ecx
mov dword [ebp - 0x60], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 1
mov edi, ebx
test ebx, ebx
je 0x1003c3f7
movzx eax, byte [edi + 0x199]
push eax
movzx eax, byte [edi + 0x198]
push eax
movzx eax, byte [edi + 0x197]
push eax
movzx eax, byte [edi + 0x196]
push eax
movzx eax, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push eax
lea eax, [ebp - 0x20]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.1002de70
lea eax, [edi + 0x10c]
push eax
call fcn.1016cb95
push 0x10179444
push eax
call fcn.1004f080
add esp, 0x2c
test eax, eax
jne 0x1003c453
cmp dword [edi + 0x1a0], 0x47
je 0x1003c453
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x50]
call fcn.1002b7f0
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x60]
call fcn.100388e9
push 0
push 1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.10038763
mov edi, dword [edi]
test edi, edi
jne 0x1003c34e
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x60]
sub eax, ecx
push 0x18
cdq
pop edi
idiv edi
test eax, eax
je 0x1003c416
lea eax, [ebp - 0x38]
cmp eax, ecx
je 0x1003c416
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.1002b3f0
lea ecx, [ebp - 0x60]
call fcn.10038834
push ebx
call fcn.10058ca1
pop ecx
xor ebx, ebx
mov dword [esi + 0x14], 0xf
lea eax, [ebp - 0x38]
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.1002de00
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.10038763
mov eax, esi
call fcn.1006e744
ret 4
cmp byte [ebp - 0x20], 0
jne 0x1003c45d
xor eax, eax
jmp 0x1003c467
lea eax, [ebp - 0x20]
push eax
call fcn.1005b7e0
pop ecx
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
call fcn.1002b520
jmp 0x1003c416
Function at 0x1003c493
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x101d5024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
and dword [ebp - 0x6a4], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x284]
mov edi, 0x208
push edi
push 0
push eax
call fcn.1004cec0
add esp, 0xc
lea eax, [ebp - 0x284]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x101ce0a0
call fcn.1005b6b8
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100590ef
push edi
lea eax, [ebp - 0x694]
push 0
push eax
call fcn.1004cec0
push edi
xor edi, edi
lea eax, [ebp - 0x48c]
push edi
push eax
call fcn.1004cec0
push 0x64
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x698], edi
push edi
push eax
mov dword [ebp - 0x6a0], edi
mov dword [ebp - 0x69c], edi
call fcn.1004cec0
add esp, 0x34
lea eax, [ebp - 0x48c]
push ebx
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x698]
push eax
push ebx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1003c591
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.1002de70
add esp, 0xc
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.1002b7f0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003357f
mov esp, ebp
pop ebp
ret 4
Function at 0x10043b78
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x10174ff0
call fcn.1006e755
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.1004b0e7
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.1004b11b
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x10043bb8
mov edi, 0xf003f
push edi
push esi
push 0x1017a840
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10043c18
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10043bf3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10043c18
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.1004b0fa
call fcn.1006e72f
ret 0xc
Function at 0x100440af
Capabilities:
Get common file path

Disassembly:
push 0x240
mov eax, 0x1017508b
call fcn.1006e789
mov ebx, ecx
mov dword [ebp - 0x24c], ebx
mov esi, dword [ebp + 8]
push esi
push str.CRunCheckSoftInstallInfo::IsExistDestopShortName_lpszDestopShortName:_s
call fcn.1003af01
push 0x208
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.1004cec0
add esp, 0x14
lea eax, [ebp - 0x218]
push edi
push 0x19
push eax
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call edi
test eax, eax
je 0x100441c6
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x10044136
lea eax, [ebp - 0x218]
push eax
call fcn.1005b6b8
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10025730
and dword [ebp - 4], 0
push 0x101ce09c
call fcn.1005b6b8
pop ecx
push eax
push 0x101ce09c
lea ecx, [ebp - 0x230]
call fcn.10027360
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push esi
cmovae eax, dword [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.10043d03
mov ebx, eax
lea eax, [ebp - 0x218]
push esi
push eax
push str.CRunCheckSoftInstallInfo::IsExistDestopShortName_szDestop_1:_s__s
call fcn.1003af01
add esp, 0xc
lea ecx, [ebp - 0x230]
push 0
push 1
test ebx, ebx
je 0x100441b7
call fcn.10025670
mov eax, ebx
jmp 0x1004428d
or dword [ebp - 4], 0xffffffff
call fcn.10025670
mov ebx, dword [ebp - 0x24c]
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call edi
test eax, eax
je 0x1004428b
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
je 0x1004420d
lea eax, [ebp - 0x218]
push eax
call fcn.1005b6b8
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.10025730
mov edi, 0x101ce09c
mov dword [ebp - 4], 1
push edi
call fcn.1005b6b8
pop ecx
push eax
push edi
lea ecx, [ebp - 0x248]
call fcn.10027360
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push esi
cmovae eax, dword [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.10043d03
mov edi, eax
lea eax, [ebp - 0x218]
push esi
push eax
push str.CRunCheckSoftInstallInfo::IsExistDestopShortName_szDestop_2:_s__s
call fcn.1003af01
add esp, 0xc
lea ecx, [ebp - 0x248]
push 0
push 1
call fcn.10025670
test edi, edi
je 0x1004428b
mov eax, edi
jmp 0x1004428d
xor eax, eax
call fcn.1006e744
ret 4
Function at 0x10044295
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x101d5024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
test edi, edi
jne 0x100442bd
xor eax, eax
jmp 0x100443f3
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], ebx
push eax
push 9
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100442b6
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1004cec0
add esp, 0xc
mov dword [ebp - 0x420], ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100443e1
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100443bb
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x424], 0x104
push eax
call fcn.1004cec0
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x428]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100443af
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.1004ed4b
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call ebx
test esi, esi
jne 0x100443e9
mov eax, dword [ebp - 0x420]
lea ecx, [ebp - 0x20c]
push 0x104
inc eax
push ecx
push eax
push dword [ebp - 0x418]
mov dword [ebp - 0x420], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x10044326
push dword [ebp - 0x418]
call ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003357f
mov esp, ebp
pop ebp
ret 4
Function at 0x10044dbf
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101d5024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
jne 0x10044de4
xor eax, eax
jmp 0x10044e77
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
push esi
push eax
call fcn.1004cec0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x109
push esi
push str.SYSTEMCurrentControlSetServices_
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10044e75
push ebx
push 0x104
lea eax, [ebp - 0x20c]
mov ebx, esi
push eax
push esi
jmp 0x10044e53
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.1005bf19
pop ecx
pop ecx
test eax, eax
je 0x10044e65
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x10044e32
jmp 0x10044e68
xor esi, esi
inc esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1003357f
mov esp, ebp
pop ebp
ret 4
Function at 0x100452d8
Capabilities:
Check if file exists
Get common file path
Get startup folder

Disassembly:
push 0x83c
mov eax, 0x10175211
call fcn.1006e789
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor ebx, ebx
push ebx
push eax
call fcn.1004cec0
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x834], 7
mov dword [ebp - 0x838], ebx
mov word [ebp - 0x848], ax
cmp word [ebp - 0x218], ax
je 0x10045343
lea eax, [ebp - 0x218]
push eax
call fcn.1005b6b8
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x848]
call fcn.10025730
mov dword [ebp - 4], ebx
mov ebx, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
push ebx
call fcn.1005b6b8
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x848]
call fcn.10027360
xor ebx, ebx
cmp word [esi], bx
jne 0x1004537d
mov eax, ebx
jmp 0x10045384
push esi
call fcn.1005b6b8
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.10027360
mov esi, str..lnk
push esi
call fcn.1005b6b8
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.10027360
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x848]
push eax
call esi
test eax, eax
je 0x10045492
push 0x208
lea eax, [ebp - 0x830]
push ebx
push eax
call fcn.1004cec0
push 0x208
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.1004cec0
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
cmovae eax, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.1005b8ab
add esp, 0x20
lea eax, [ebp - 0x628]
mov ecx, edi
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.10043a5e
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.1004cec0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x420]
push eax
call fcn.1005b6b8
pop ecx
test eax, eax
jne 0x10045480
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.1005b8ab
pop ecx
pop ecx
lea eax, [ebp - 0x420]
push eax
call esi
test eax, eax
je 0x10045492
xor esi, esi
inc esi
jmp 0x10045494
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x848]
call fcn.10025670
mov eax, esi
call fcn.1006e744
ret 4
Function at 0x100454ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101d5024]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x101e0b28]
test al, al
jne 0x10045545
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1004cec0
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1004553c
lea eax, [ebp - 0x20c]
push eax
call fcn.1005ba76
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.1004ed4b
pop ecx
pop ecx
test eax, eax
jne 0x10045534
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.1004ed4b
pop ecx
pop ecx
test eax, eax
je 0x1004553c
mov byte [0x101e0b28], bl
jmp 0x10045542
mov bl, byte [0x101e0b28]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003357f
mov esp, ebp
pop ebp
ret
Function at 0x10046051
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101d5024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.1004cec0
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x17
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100460bc
lea eax, [ebp - 0x20c]
push 0x101ce09c
push eax
call fcn.1005bec3
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.10045553
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003357f
mov esp, ebp
pop ebp
ret 4
Function at 0x1004647d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov edi, 0xf01ff
mov dword [ebp - 8], ebx
push edi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100465cc
lea eax, [ebp - 0x10]
push eax
push 1
push 1
push ebx
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x100465cc
push str.Kernel32.dll
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10046517
push str.WTSGetActiveConsoleSessionId
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10046510
call eax
push 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0xc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x100465cc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Wtsapi32.dll
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x100465f3
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10046563
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push ecx
push dword [ebp - 0x14]
call eax
push ebx
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
push dword [ebp - 0xc]
test eax, eax
jne 0x10046561
call esi
jmp 0x100465cc
call esi
push 0x44
pop edi
push edi
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.1004cec0
push 0x10
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.1004cec0
add esp, 0x18
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x60], str.WinSta0Default
mov dword [ebp - 0x3c], 1
push 5
pop eax
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push dword [ebp - 4]
push 0x430
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x100465cc
cmp dword [ebp - 4], ebx
je 0x100465ca
push dword [ebp - 4]
call sub.USERENV.dll_DestroyEnvironmentBlock
mov bl, 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100465db
cmp eax, 0xffffffff
je 0x100465db
push eax
call esi
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x100465ea
cmp ecx, 0xffffffff
je 0x100465ea
push ecx
call esi
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x10046563
push dword [ebp - 8]
jmp 0x1004655d
Function at 0x10046610
Capabilities:
Enumerate processes

Disassembly:
push 0x260
mov eax, 0x101753b9
call fcn.1006e789
mov eax, dword [ebp + 8]
test eax, eax
je 0x1004670c
push eax
lea ecx, [ebp - 0x40]
call fcn.100255d0
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1003a553
mov edi, 0x22c
lea eax, [ebp - 0x26c]
push edi
push ebx
push eax
call fcn.1004cec0
add esp, 0x10
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x100466fd
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x100466f2
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
jne 0x1004669c
mov eax, ebx
jmp 0x100466a9
lea eax, [ebp - 0x248]
push eax
call fcn.1005b6b8
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.10025730
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.1003a553
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.100390ac
test eax, eax
je 0x10046712
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.10025670
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1004667f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10025670
mov eax, esi
call fcn.1006e744
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.10025670
jmp 0x100466ff

Function at 0x10046b3b
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x100473cd
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [eax + 0x210]
mov esi, dword [edi]
mov dword [ebp - 8], edi
cmp esi, dword [eax + 0x214]
je 0x1004749a
lea edi, [esi + 0x28]
lea ecx, [ebx + 0xa8]
mov dword [ebp + 8], edi
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10177764
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10177764
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10177764
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10177764
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.1005c710
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x10047476
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.1005c710
pop ecx
pop ecx
test eax, eax
je 0x100474b7
mov eax, 0x1b0
lea ecx, [ebx + 0xa8]
add edi, eax
add esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
jne 0x10047400
mov edi, dword [ebp - 8]
lea eax, [ebx + 0xa8]
push eax
call fcn.1005b7e0
pop ecx
test eax, eax
je 0x100474b7
push ebx
mov ecx, edi
call fcn.10047df9
mov al, 1
jmp 0x100474b9
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4