joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100eb8a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push edi
xor edi, edi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0x100ebf1
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebx
jne 0x100ebc4
mov eax, dword [ebp - 8]
jmp 0x100ebf4
mov eax, dword [0x1029018]
cmp eax, ebx
je 0x100ebfc
test byte [eax + 0x1c], 0x20
je 0x100ebfc
cmp byte [eax + 0x19], 1
jb 0x100ebfc
push edi
push dword [ebp + 0xc]
push 0x10023e4
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010091b7
jmp 0x100ebf7
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [0x1029018]
cmp edi, ebx
jne 0x100ec43
push esi
push dword [ebp + 0x1c]
lea eax, [ebp + 8]
push ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
cmp edi, ebx
jne 0x100ec3d
push dword [ebp + 8]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
cmp esi, ebx
pop ecx
jne 0x100ec84
push 8
pop edi
cmp esi, ebx
je 0x100ec3d
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, dword [0x1029018]
pop esi
cmp dword [ebp - 8], ebx
je 0x100ec56
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1029018]
cmp eax, ebx
je 0x100ec7c
test byte [eax + 0x1c], 0x20
je 0x100ec7c
cmp byte [eax + 0x19], 3
jb 0x100ec7c
push edi
push dword [ebp + 0xc]
push 0x10023e4
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010091b7
mov eax, edi
pop edi
pop ebx
leave
ret 0x18
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, ebx
jne 0x100ec32
cmp dword [ebp - 0xc], 3
je 0x100eca9
push 0xd
pop edi
cmp edi, ebx
jne 0x100ec32
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
jmp 0x100ec3d

Function at 0x100ecc1
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x100ed09
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 3
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1029018]
test eax, eax
je 0x100ed34
test byte [eax + 0x1c], 0x20
je 0x100ed34
cmp byte [eax + 0x19], 3
jb 0x100ed34
push edi
push dword [ebp + 0xc]
push 0x10023e4
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010091b7
mov eax, edi
pop edi
leave
ret 0x14
Function at 0x100ee89
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp + 0x1c]
push eax
push esi
push 0x2001f
push esi
push 0x1001a10
push esi
push dword [ebx + 4]
mov dword [ebp - 4], ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x100ef0f
push dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
push dword [ebp + 0xc]
push dword [0x1028220]
push esi
push dword [ebp + 0x1c]
call fcn.0100ecc1
mov edi, eax
cmp edi, esi
jne 0x100eef6
push dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
push dword [ebp + 0x14]
push dword [0x1028228]
push esi
push dword [ebp + 0x1c]
call fcn.0100ecc1
mov edi, eax
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x100ef0f
push dword [ebx + 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x1012fdf
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, 0x102905c
push 0xfa0
push 0x1029044
xor edi, edi
xor ebx, ebx
mov dword [0x1029060], eax
mov dword [0x102905c], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
cmp eax, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1029064], eax
jne 0x1013026
call esi
mov ebx, eax
cmp ebx, edi
jne 0x10130d4
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [0x102903c], eax
jne 0x1013046
call esi
mov ebx, eax
cmp ebx, edi
jne 0x10130d4
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
cmp eax, edi
mov dword [0x1029038], eax
jne 0x1013060
call esi
mov ebx, eax
cmp ebx, edi
jne 0x10130d4
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x1012e50
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x10130a8
mov dword [0x1029040], eax
mov eax, dword [0x1029018]
cmp eax, edi
je 0x10130d4
test byte [eax + 0x1c], 0x20
je 0x10130d4
cmp byte [eax + 0x19], 1
jb 0x10130d4
push dword [ebp - 4]
push 0x1002434
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010174e5
jmp 0x10130d4
call esi
mov ebx, eax
mov eax, dword [0x1029018]
cmp eax, edi
je 0x10130d4
test byte [eax + 0x1c], 0x20
je 0x10130d4
cmp byte [eax + 0x19], 1
jb 0x10130d4
push ebx
push 0x1002434
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010174e5
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1013c4a
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 1
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.0100e297
mov esi, eax
cmp esi, ebx
jne 0x1013d5e
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x2001f
push ebx
push 0x1001a10
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x1013d55
push ebx
push dword [ebp - 4]
push dword [0x10280a8]
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
mov esi, eax
cmp esi, ebx
jne 0x1013d4c
cmp byte [ebp + 0x18], bl
je 0x1013cda
push dword [0x10280a8]
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, eax
cmp esi, ebx
jne 0x1013d4c
lea eax, [ebp - 8]
push eax
push 0xffff
push dword [ebp + 0x14]
call fcn.010239c1
mov esi, eax
cmp esi, ebx
jne 0x1013d4c
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add eax, eax
push eax
push dword [ebp + 0x14]
push 1
push ebx
push dword [0x10280cc]
push dword [ebp - 4]
call edi
mov esi, eax
cmp esi, ebx
jne 0x1013d4b
lea eax, [ebp - 0xc]
push eax
push 0xffff
push dword [ebp + 0x14]
call fcn.010239c1
mov esi, eax
cmp esi, ebx
jne 0x1013d4b
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add eax, eax
push eax
push dword [ebp + 0x10]
push 1
push ebx
push dword [0x10280d4]
push dword [ebp - 4]
call edi
mov esi, eax
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0x1013d6b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
jne 0x1013d93
mov eax, 0x10024f0
push eax
push 0x10024b8
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push esi
push 1
push dword [0x10280a0]
push dword [ebp + 8]
call fcn.0100e195
mov edi, eax
cmp edi, esi
jne 0x1013ef3
push esi
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
jne 0x1013ecc
add dword [ebp - 0xc], 2
mov eax, dword [ebp - 0xc]
push eax
mov dword [ebp - 0x18], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 8], eax
je 0x1013ecc
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x10280cc]
push dword [ebp - 4]
call edi
cmp eax, esi
jne 0x1013ecc
cmp dword [ebp - 0x10], 1
jne 0x1013ecc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x10280d0]
mov dword [ebp - 0x1c], 4
push dword [ebp - 4]
call edi
cmp eax, 2
jne 0x1013ecc
mov eax, dword [ebp - 0xc]
push eax
mov dword [ebp - 0x20], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0x14], eax
jne 0x1013e67
push 8
pop edi
jmp 0x1013ece
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x10280d8]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1013e93
push dword [ebp - 8]
push dword [ebp - 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.01013be7
jmp 0x1013ea5
push esi
push dword [ebp - 8]
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.01013c4a
mov edi, eax
cmp edi, esi
jne 0x1013ece
push 4
lea eax, [ebp + 8]
push eax
push 4
push esi
push dword [0x10280d0]
mov dword [ebp + 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1013ece
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], esi
je 0x1013ee5
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0x14], esi
je 0x1013ef3
push dword [ebp - 0x14]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x101523e
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push 0xc
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push esi
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
xor edi, edi
inc edi
mov byte [ebp - 1], bl
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
jne 0x101528c
cmp dword [esi], ebx
mov eax, esi
je 0x1015288
inc edi
cmp edi, 3
ja 0x1015283
add eax, dword [eax]
cmp dword [eax], ebx
jne 0x1015277
cmp edi, 2
ja 0x101528c
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x101529b
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryInformationFile]
push edi
mov edi, dword [ebp + 0xc]
push 4
push 0x28
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov byte [edi], 0
mov byte [ebx], 0
call esi
test eax, eax
jne 0x10152f7
test byte [ebp - 0x17], 4
je 0x10152f7
push 0x23
push 8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov byte [edi], 1
call esi
test eax, eax
jne 0x10152f7
cmp dword [ebp - 0xc], 0x8000000a
jne 0x10152f7
mov byte [ebx], 1
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1015480
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
push 1
push 0x21
push 0x10
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
cmp eax, esi
jge 0x10154c2
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
cmp edi, 0x12
jne 0x10154bc
xor edi, edi
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov eax, edi
pop edi
pop esi
leave
ret 0xc

Function at 0x10154cf
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
or dword [esi], 0xffffffff
push edi
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
test edi, edi
pop ecx
jne 0x10154f2
push 8
pop eax
jmp 0x1015534
mov eax, dword [ebp + 8]
push 0x104
push edi
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x1015523
push 0
push 0x2020000
push 3
push 0
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
pop edi
pop esi
pop ebp
ret 8
Function at 0x10155b6
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, dword [ebp + 0x14]
push edi
push 0xa
pop ecx
xor eax, eax
push 4
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
push 0x28
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
mov byte [esi], 0
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
test edi, edi
jne 0x1015614
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 0xffffffff
jne 0x1015614
mov byte [esi], 1
mov eax, edi
pop edi
pop esi
leave
ret 0x10

Function at 0x1015700
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
xor ebx, ebx
push 0x1000
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
jne 0x101573d
mov dword [ebp + 8], 0xc000009a
jmp 0x10157cd
push esi
mov esi, dword [sym.imp.ntdll.dll_NtClose]
push edi
mov edi, dword [ebp + 0xc]
cmp word [ebp - 0x10], bx
je 0x10157c2
push ebx
lea eax, [ebp - 4]
push eax
push edi
push 1
push 7
lea eax, [ebp - 0x10]
push eax
call fcn.01015171
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x10157c2
push 0x1000
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0101523e
test al, al
push dword [ebp - 4]
je 0x10157c0
call esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x18
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0x40
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ntdll.dll_NtDeleteFile]
cmp byte [ebp + 0x10], bl
mov dword [ebp + 8], eax
je 0x10157c2
lea eax, [ebp - 0x10]
push eax
call fcn.0102339e
cmp dword [ebp + 8], ebx
je 0x1015748
jmp 0x10157c2
call esi
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
mov eax, dword [ebp + 8]
pop ebx
leave
ret 0xc
Function at 0x1015a14
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
or dword [ebp - 8], 0xffffffff
push esi
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
mov byte [ebp - 1], 0
push dword [ebp + 0x10]
xor esi, esi
push dword [ebp + 8]
mov dword [ebp - 0xc], 0x208
call fcn.0101553f
mov edi, eax
test edi, edi
jne 0x1015b17
lea eax, [ebp - 1]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 8]
call fcn.010155b6
mov edi, eax
test edi, edi
jne 0x1015b03
cmp byte [ebp - 1], al
je 0x1015b03
push ebx
mov ebx, dword [ebp - 0xc]
add ebx, 8
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
test esi, esi
pop ecx
je 0x1015aca
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
push 9
mov ecx, edx
push ebx
and ecx, 3
rep stosb byte es:[edi], al
push esi
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, 0x80000005
jne 0x1015ad6
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0xc]
xor esi, esi
cmp eax, 0x7fffffff
pop ecx
jae 0x1015ad1
add eax, eax
mov dword [ebp - 0xc], eax
jmp 0x1015a71
mov eax, 0xc000009a
jmp 0x1015ad6
mov eax, 0xc000000d
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
test edi, edi
pop ebx
jne 0x1015b03
test esi, esi
je 0x1015b03
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi]
lea eax, [esi + 4]
push eax
push dword [ebp + 0xc]
call fcn.0101593d
mov edi, eax
jmp 0x1015b0c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1015b17
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret 0x18

Function at 0x10168e6
Capabilities:
Create thread
Get domain information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
xor esi, esi
push 1
push esi
mov dword [ebp - 4], esi
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
mov edi, eax
cmp edi, esi
jne 0x101696b
mov eax, dword [ebp - 4]
cmp dword [eax], 2
sete cl
mov byte [0x1028b00], cl
mov eax, dword [eax]
cmp eax, 4
je 0x1016921
cmp eax, 5
jne 0x101694d
mov eax, dword [ebp + 8]
mov byte [eax], 1
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x10166df
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
jne 0x1016948
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x101694d
mov dword [0x1028f98], eax
mov eax, dword [ebp - 4]
push dword [eax + 8]
call fcn.01006c24
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call fcn.01006c52
push dword [ebp - 4]
call sub.NETAPI32.dll_DsRoleFreeMemory
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x1017e32
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryInformationFile]
push edi
mov edi, dword [ebp + 0xc]
push 4
push 0x28
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov byte [edi], 0
call esi
test eax, eax
jne 0x1017e84
test byte [ebp - 0x17], 4
je 0x1017e84
push 0x23
push 8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1017e84
cmp dword [ebp - 0xc], 0xa0000003
jne 0x1017e84
mov byte [edi], 1
pop edi
pop esi
leave
ret 8
Function at 0x1019825
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x410
push esi
mov dword [ebp - 4], ecx
mov byte [edi], 0
mov word [ebp - 0x14], 2
mov word [ebp - 0x12], 2
mov dword [ebp - 0x10], 0x100148c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
xor eax, eax
cmp ebx, eax
pop ecx
je 0x101991a
push 1
push dword [ebp + 0x10]
lea ecx, [ebp - 0x1c]
push 1
push 0xc
push esi
push ebx
push ecx
push eax
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov esi, eax
test esi, esi
jne 0x1019911
lea eax, [ebx + 0xc]
mov dword [ebp - 8], eax
mov ax, word [ebx + 8]
mov word [ebp - 0xa], ax
mov word [ebp - 0xc], ax
mov eax, dword [0x1029018]
test eax, eax
je 0x10198cd
test dword [eax + 0x1c], 0x80000020
je 0x10198cd
cmp byte [eax + 0x19], 3
jb 0x10198cd
push esi
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0x10]
push 0x10026a0
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010140ce
push 1
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
test eax, eax
mov ecx, dword [ebp - 4]
push dword [ebp + 0x14]
je 0x10198ef
lea eax, [ebp - 0xc]
mov byte [edi], 1
push eax
jmp 0x10198f5
push dword [ebp + 0x10]
mov byte [edi], 0
call fcn.01017f1c
mov esi, eax
test esi, esi
jne 0x1019911
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
call fcn.01017f1c
mov esi, eax
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x101991f
mov esi, 0xc000009a
mov eax, dword [0x1029018]
test eax, eax
je 0x101995b
mov ecx, esi
neg ecx
sbb ecx, ecx
and ecx, 0xc
xor edx, edx
dec ecx
inc edx
and ecx, 0x1f
shl edx, cl
or edx, 0x20
test dword [eax + 0x1c], edx
je 0x101995b
cmp byte [eax + 0x19], 3
jb 0x101995b
push esi
push 0x10026a0
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010174e5
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x101b7b1
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x1028084]
push ebx
push edi
mov edi, dword [ebp + 8]
push 2
xor ebx, ebx
push ebx
push ebx
push 0x401
lea ecx, [ebp - 0x808]
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0x80
push eax
mov dword [ebp - 0x80c], ebx
mov dword [ebp - 0x818], 0x1001a10
mov dword [ebp - 0x810], ebx
mov word [ebp - 0x808], bx
mov dword [ebp - 0x814], edi
call dword [sym.imp.WS2_32.dll_GetNameInfoW]
test eax, eax
je 0x101b818
mov word [ebp - 0x808], bx
cmp word [ebp - 0x808], bx
push esi
je 0x101b880
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push edi
call esi
mov ebx, eax
lea eax, [ebp - 0x808]
push eax
call esi
lea esi, [ebx + eax + 9]
lea eax, [esi + esi]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x101b880
push edi
push esi
push ebx
call fcn.0100a7d1
push 0x1002760
push esi
push ebx
call fcn.0100a82c
lea eax, [ebp - 0x808]
push eax
push esi
push ebx
call fcn.0100a82c
push 0x100275c
push esi
push ebx
call fcn.0100a82c
mov dword [ebp - 0x814], ebx
call fcn.01015c7b
mov esi, eax
test esi, esi
je 0x101b8b5
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x818]
push eax
push 4
push 2
push 0
push 0x400037ee
push 1
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call fcn.01015ca0
test ebx, ebx
pop esi
je 0x101b8c1
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01005634
leave
ret 8