joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b140
Capabilities:
Get graphical window text
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x490c9a
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x4bc760]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push esi
push edi
mov eax, dword [0x4bc760]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
mov dword [esp + 0x1c], ecx
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
test edi, edi
je 0x43b1a4
imul eax, eax, 0x64
xor edx, edx
div edi
mov ebx, eax
jmp 0x43b1a7
push 0x64
pop ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push ebx
push 0x402
push dword [ecx + 0x34]
call esi
mov edx, ebx
lea ecx, [esp + 0x50]
call fcn.00405f77
and dword [esp + 0x178], 0
lea ecx, [esp + 0x68]
push 0x4a6cd8
mov edx, eax
call fcn.0040ed8c
pop ecx
mov ebx, dword [esp + 0x1c]
mov edx, eax
mov byte [esp + 0x178], 1
lea ecx, [ebx + 0x18]
push ecx
lea ecx, [esp + 0x3c]
call fcn.0040ed64
pop ecx
push 0
push 1
lea ecx, [esp + 0x70]
call fcn.00405141
push 0
push 1
lea ecx, [esp + 0x58]
mov byte [esp + 0x180], 4
call fcn.00405141
cmp dword [esp + 0x4c], 8
lea eax, [esp + 0x38]
cmovae eax, dword [esp + 0x38]
push eax
push 0
push 0xc
push dword [ebx + 0x30]
call esi
push ecx
push str.Downloaded
lea ecx, [esp + 0xd4]
call fcn.004113ca
push dword [esp + 0x14]
lea edx, [esp + 0xd0]
mov byte [esp + 0x17c], 5
lea ecx, [esp + 0x104]
call fcn.004227df
pop ecx
add eax, 0x18
mov byte [esp + 0x178], 6
push eax
lea ecx, [esp + 0x24]
call fcn.00404e93
lea ecx, [esp + 0x100]
call fcn.0041155a
lea ecx, [esp + 0xcc]
mov byte [esp + 0x178], 9
call fcn.0041155a
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push 0
push dword [esp + 0x1c]
call fcn.0042473b
pop ecx
pop ecx
push 0xffffffffffffffff
mov byte [esp + 0x17c], 0xa
push 0
push eax
lea ecx, [esp + 0x2c]
call fcn.00405284
push 0
push 1
lea ecx, [esp + 0x58]
mov byte [esp + 0x180], 9
call fcn.00405141
push ecx
push str._from
lea ecx, [esp + 0xa0]
call fcn.004113ca
push dword [esp + 0x14]
lea edx, [esp + 0x9c]
mov byte [esp + 0x17c], 0xb
lea ecx, [esp + 0x138]
call fcn.004227df
pop ecx
push 0xffffffffffffffff
push 0
add eax, 0x18
mov byte [esp + 0x180], 0xc
push eax
lea ecx, [esp + 0x2c]
call fcn.00405284
lea ecx, [esp + 0x134]
call fcn.0041155a
lea ecx, [esp + 0x98]
mov byte [esp + 0x178], 9
call fcn.0041155a
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x80]
push 0
push edi
call fcn.0042473b
pop ecx
pop ecx
push 0xffffffffffffffff
xor edi, edi
mov byte [esp + 0x17c], 0xd
push edi
push eax
lea ecx, [esp + 0x2c]
call fcn.00405284
push edi
push 1
lea ecx, [esp + 0x88]
call fcn.00405141
cmp dword [esp + 0x34], 8
lea eax, [esp + 0x20]
cmovae eax, dword [esp + 0x20]
push eax
push edi
push 0xc
push dword [ebx + 0x38]
call esi
push edi
push 1
lea ecx, [esp + 0x28]
call fcn.00405141
push edi
push 1
lea ecx, [esp + 0x40]
call fcn.00405141
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x158]
xor ecx, esp
call fcn.0046a4a7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43c8b3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x4bc760]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1f4
lea eax, [ebp - 0x314]
mov esi, ecx
push 0
push eax
call fcn.0046cb40
mov edi, 0x114
mov dword [ebp - 0x318], 0x1f8
push edi
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0046cb40
add esp, 0x18
mov dword [ebp - 0x120], edi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jae 0x43c921
sub dword [ebp - 0x318], 4
push 0
lea eax, [ebp - 0x318]
push eax
push 0x1f8
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea eax, [ebp - 0x180]
neg esi
push eax
mov dword [ebp - 0x180], esi
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046a4a7
mov esp, ebp
pop ebp
ret
Function at 0x441567
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4415ac
call fcn.0045196d
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4415ac
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4415c8
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0043d05b
mov ebx, eax
test edi, edi
je 0x4415c6
test esi, esi
je 0x4415c6
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4460cd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0045196d
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x446104
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00446125
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47c7f2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bc760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004715de
mov dword [ebp - 0x14], eax
cmp dword [0x4c352c], esi
jne 0x47c8e5
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x47c872
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x47c9c5
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x47c9c5
push 0x49c170
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47c9c5
push eax
call ebx
push 0x49c17c
push edi
mov dword [0x4c352c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x49c18c
push edi
mov dword [0x4c3530], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4c3534], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c353c], eax
test eax, eax
je 0x47c8e2
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c3538], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x47c90a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47c8fd
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x47c91f
push 4
pop eax
jmp 0x47c9c7
cmp dword [ebp - 0x14], esi
je 0x47c91f
push dword [0x4c352c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x47c904
mov eax, dword [0x4c3538]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x47c97d
cmp dword [0x4c353c], edi
je 0x47c97d
push eax
call ebx
push dword [0x4c353c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x47c97d
test eax, eax
je 0x47c97d
call ecx
test eax, eax
je 0x47c972
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x47c972
test byte [ebp - 8], 1
jne 0x47c97d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x47c9ad
mov eax, dword [0x4c3530]
cmp eax, edi
je 0x47c9aa
push eax
call ebx
test eax, eax
je 0x47c9aa
call eax
mov esi, eax
test esi, esi
je 0x47c9aa
mov eax, dword [0x4c3534]
cmp eax, edi
je 0x47c9aa
push eax
call ebx
test eax, eax
je 0x47c9aa
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4c352c]
call ebx
test eax, eax
je 0x47c9c5
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x47c9c7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046a4a7
mov esp, ebp
pop ebp
ret
Function at 0x102bf50
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp eax, edi
jne 0x102bf83
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x102c07e
mov ecx, dword [0x103d09c]
push ebx
push esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov esi, 0x102
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push edi
push eax
push 2
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_WaitForMultipleObjectsEx]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, esi
jne 0x102bfba
call dword [sym.imp.API_MS_Win_Core_Debug_L1_1_0.dll_IsDebuggerPresent]
test eax, eax
jne 0x102bf96
cmp ebx, edi
je 0x102bf96
cmp ebx, esi
mov ebx, dword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle]
jne 0x102c051
cmp dword [0x103d0b0], edi
je 0x102c048
push 0x1007ea8
xor esi, esi
push edi
inc esi
push 2
mov dword [0x103d0b4], esi
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_OpenEventW]
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x102bffd
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x102c077
push eax
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
push dword [ebp - 8]
call ebx
mov dword [0x103d0ac], esi
mov dword [0x103d0b0], edi
call dword [sym.imp.SETUPAPI.dll_SetupGetThreadLogToken]
mov ecx, eax
or ecx, edx
je 0x102c038
push 0x1007e48
push 2
push 0x1000000
push edx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
add esp, 0x14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0102bf50
jmp 0x102bff8
mov dword [ebp - 4], 0x5b4
jmp 0x102c077
cmp dword [ebp - 8], 1
jne 0x102c06a
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetExitCodeThread]
test eax, eax
jne 0x102c077
jmp 0x102bff2
cmp dword [ebp - 8], 0xffffffff
je 0x102bff2
mov dword [ebp - 4], 0xd
push dword [ebp - 0xc]
call ebx
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc
Function at 0x10318e8
Capabilities:
Check systemkerneldebuggerinformation
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor eax, eax
push eax
lea edi, [ebp - 4]
stosw word es:[edi], ax
push 2
lea eax, [ebp - 4]
push eax
push 0x23
xor esi, esi
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x103191d
cmp byte [ebp - 4], 0
je 0x103191b
cmp byte [ebp - 3], 0
jne 0x103191b
inc esi
jmp 0x103191d
xor esi, esi
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x1031dde
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
push esi
xor esi, esi
cmp eax, esi
je 0x1031eb7
push ebx
push edi
mov edi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x1023d70
mov ebx, 0x80000002
push ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call edi
test eax, eax
jne 0x1031e62
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1023d4c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1031e51
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ebp - 0x10], 1
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x10], esi
jne 0x1031eb5
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x1023cd8
push ebx
call edi
test eax, eax
jne 0x1031eac
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1023d4c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1031ea3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x1031eb5
mov dword [eax], esi
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x1031ec1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x103d004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x210], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 1
push esi
push 0x1023df8
push 0x80000002
xor ebx, ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1031f91
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push 0x1023dd8
push dword [ebp - 0x210]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1031f7d
cmp dword [ebp - 0x214], 1
jne 0x1031f7d
cmp dword [ebp - 0x218], 0x208
ja 0x1031f7d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp dword [ebp - 0x210], esi
je 0x1031f91
push dword [ebp - 0x210]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01034b90
leave
ret

Function at 0x1032662
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp + 8]
push eax
push 8
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_GetTokenInformation]
test eax, eax
je 0x10326c1
cmp dword [ebp + 8], 2
je 0x10326ac
lea eax, [ebp - 4]
push eax
push 2
push 2
push esi
push esi
push edi
call dword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_DuplicateTokenEx]
test eax, eax
je 0x10326cf
mov edi, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push edi
call dword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_CheckTokenMembership]
test eax, eax
jne 0x10326c1
mov dword [ebp - 8], esi
cmp dword [ebp - 4], esi
je 0x10326cf
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 8
Function at 0x10327bf
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc70
mov eax, dword [0x103d004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xc48], 0
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 4
pop ecx
mov edi, 0x1015314
lea esi, [ebx + 4]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
mov dword [ebp - 0xc4c], eax
jne 0x10328d9
push ebx
push eax
call fcn.01031c91
test eax, eax
je 0x10328d9
mov esi, 0x61c
push esi
xor edi, edi
lea eax, [ebp - 0x620]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
push ebx
push dword [ebp - 0xc4c]
mov dword [ebp - 0x620], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetSelectedDriverW]
test eax, eax
jne 0x1032857
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0xe0000203
jne 0x10328d9
jmp 0x10328cf
mov esi, 0x622
push esi
lea eax, [ebp - 0xc44]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
push esi
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0x620]
push eax
push ebx
push dword [ebp - 0xc4c]
mov dword [ebp - 0xc44], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDriverInfoDetailW]
test eax, eax
jne 0x103289f
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x10328d9
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0xc70]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc70]
push eax
call dword [sym.imp.API_MS_Win_Core_SysInfo_L1_1_0.dll_GetSystemInfo]
push dword [ebp - 0xc70]
lea eax, [ebp - 0xa2c]
push eax
call fcn.01032566
test eax, eax
je 0x10328d9
mov dword [ebp - 0xc48], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc48]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01034b90
leave
ret 8

Function at 0x1032a33
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebx
push edi
push 0x101c928
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_CreateMutexW]
mov edi, eax
cmp edi, ebx
jne 0x1032a57
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x1032a85
push esi
mov esi, dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x1032a84
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_WaitForSingleObjectEx]
cmp eax, 0xffffffff
jne 0x1032a7d
call esi
mov ebx, eax
jmp 0x1032a84
test eax, eax
je 0x1032a84
push 0xd
pop ebx
pop esi
push ebx
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
mov eax, edi
pop edi
pop ebx
ret
Function at 0x1032b7a
Capabilities:
Shutdown system

Disassembly:
push 0x18
push 0x103a290
call fcn.01034b08
call dword [sym.imp.SETUPAPI.dll_SetupGetThreadLogToken]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push 1
push 0
push 0x102a91c
mov ebx, 0x102a7e4
push ebx
mov edi, 0x102a780
push edi
mov esi, 0x80000002
push esi
call fcn.01036d01
xor ecx, ecx
cmp eax, 1
sete cl
mov eax, ecx
test eax, eax
je 0x1032c8a
push 0x78
push 0x78
push 0x102a904
push ebx
push edi
push esi
call fcn.01036d01
mov edi, eax
xor esi, esi
cmp dword [0x103d08c], esi
je 0x1032c3a
mov al, byte [0x103d090]
cmp al, 4
jae 0x1032bee
test al, al
jne 0x1032c19
mov ecx, dword [0x103d07c]
mov edx, 0x80000000
and ecx, edx
xor eax, eax
or eax, ecx
je 0x1032c19
mov ecx, dword [0x103d084]
mov eax, ecx
and eax, edx
xor edx, edx
cmp edx, dword [0x103d080]
jne 0x1032c19
cmp eax, ecx
je 0x1032c1d
xor al, al
jmp 0x1032c1f
mov al, 1
test al, al
je 0x1032c3a
push edi
push 0x1007d18
push dword [0x103d064]
push dword [0x103d060]
call fcn.0103225a
mov dword [ebp - 0x1c], 0x13
push 1
lea eax, [ebp - 0x1c]
push eax
call fcn.0103594d
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], esi
push edi
push 0x102a8a0
push 2
push 0x800000
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call dword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
add esp, 0x18
push 0x20013
push 7
push edi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov dword [ebp - 4], 0xfffffffe
call fcn.01032c90
call fcn.01034b4d
ret
Function at 0x1035d7f
Capabilities:
Compare security identifiers

Disassembly:
push 0x28
push 0x103a350
call fcn.0103a164
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], 5
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], ebx
push ebx
mov edi, dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
call edi
lea eax, [ebp - 0x2c]
push eax
push 1
mov esi, 0x2000000
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_OpenThreadToken]
test eax, eax
je 0x1035dd6
xor eax, eax
jmp 0x1035ddb
call fcn.01035938
mov dword [ebp - 0x28], eax
cmp eax, 0x3f0
jne 0x1035e0a
push ebx
call edi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_OpenProcessToken]
test eax, eax
je 0x1035e02
xor eax, eax
jmp 0x1035e07
call fcn.01035938
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x1035e13
mov dword [ebp - 0x2c], ebx
jmp 0x1035e92
push ebx
call edi
push dword [ebp - 0x2c]
call fcn.01035c14
mov dword [ebp - 0x34], eax
cmp eax, ebx
je 0x1035e29
xor eax, eax
jmp 0x1035e2e
call fcn.01035938
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x1035e92
push ebx
call edi
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1035e59
xor eax, eax
jmp 0x1035e5e
call fcn.01035938
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x1035e92
push dword [ebp - 0x30]
call dword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_IsValidSid]
test eax, eax
jne 0x1035e7b
mov dword [ebp - 0x28], 0xd
jmp 0x1035e92
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call dword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_EqualSid]
test eax, eax
jne 0x1035e92
mov dword [ebp - 0x28], 0x65b
mov dword [ebp - 4], 0xfffffffe
jmp 0x1035ecc
cmp dword [ebp - 0x30], ebx
je 0x1035eda
push dword [ebp - 0x30]
call dword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_FreeSid]
cmp dword [ebp - 0x34], ebx
je 0x1035ee7
push dword [ebp - 0x34]
call fcn.010369af
cmp dword [ebp - 0x2c], ebx
je 0x1035ef5
push dword [ebp - 0x2c]
call dword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle]
push dword [ebp - 0x28]
call edi
xor eax, eax
cmp dword [ebp - 0x28], ebx
sete al
call fcn.0103a1ac
ret