joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484a75
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x49a134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x424373
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42438e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4243ac
xor al, al
jmp 0x424393
shr eax, 0xa
and al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042e063
mov esp, ebp
pop ebp
ret
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00426cf0
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push str.GetFileAttributes___failed:
push eax
call fcn.00422b40
add esp, 0x14
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.00416550
push 0x496540
lea eax, [ebp - 0x4c]
push eax
call fcn.00430e8b
int3
Function at 0x42b800
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x1505
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x42b83c
mov eax, dword [ebp - 4]
shl eax, 5
add eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x42b813
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x472611
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00472209

Function at 0x47261c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00472393

Function at 0x473838
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047370c

Function at 0x4768d8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004762cc
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x404a42
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x404a51
pop dword [ebp - 0x28]
mov eax, 0x404a51
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x219205b3
add dword [ebp - 0x38], 0x2cc03f98
mov dword [ebp - 0x34], 0x2c76d28f
sub dword [ebp - 0x34], 0xfa43864a
mov dword [ebp - 0x30], 0x8b0e2989
add dword [ebp - 0x30], 0xc13e1aa5
mov dword [ebp - 0x2c], 0x3824a223
add dword [ebp - 0x2c], 0xc7db5ddd
lea eax, [ebp - 0x38]
push eax
mov eax, 0x5ca366ca
add eax, 0xa39d6982
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x74fb9bfc
sub dword [ebp - 0x38], 0x8932a6
mov dword [ebp - 0x34], 0x8cb0d48d
add dword [ebp - 0x34], 0xb4bb8ce8
mov dword [ebp - 0x30], 0x5615eebb
add dword [ebp - 0x30], 0xd597db1
mov dword [ebp - 0x2c], 0x5b68ed1a
add dword [ebp - 0x2c], 0xa49712e6
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xf6b4fcac
add eax, 0x98bd39c
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a0a2
push 0
call eax
mov ecx, 0xcd2ed48a
add ecx, 0x32d175bd
xor edx, edx
add edx, eax
mov ebx, 0xf307ce3f
sub ebx, 0xf2c61e3f
add ebx, dword [ebp - 0x28]
mov esi, 0x28dd9294
add esi, 0xeda6b95a
xor dword [ebp - 0x20], esi
mov edi, dword [ebx]
xor dword [ebp - 8], edi
add edi, esi
sub dword [ebp - 8], 0x132fad50
mov dword [edx], edi
sub dword [ebp - 0x18], edx
add edx, 4
add ebx, 0x4d57507f
sub ebx, 0x4d57507b
loop 0x404b70
add eax, 0x51f2f150
add eax, 0xae0e2a9f
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x403086
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x41904c
call fcn.00413724
sub esp, 0xc
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
lea edi, [esi + 0x68]
lea ecx, [edi + 0xc]
call fcn.00401daf
push 0
push 0x1f4
mov ecx, edi
call fcn.004060e5
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.00412fe0
push 0x45
lea ecx, [ebp - 0x18]
pop edx
call fcn.00405ed1
mov edx, dword [eax]
mov ecx, dword [esi + 0x6c]
and dword [ebp - 4], 0
call fcn.00405eeb
push dword [ebp - 0x18]
call fcn.00403a63
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x404965
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x423168], 0
push esi
mov esi, edx
jne 0x40499a
mov edx, ecx
lea ecx, [ebp - 0xc]
call fcn.00403b85
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov esi, eax
push dword [ebp - 0xc]
call fcn.00403a63
pop ecx
test esi, esi
jmp 0x4049a4
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
je 0x4049aa
mov al, 1
jmp 0x4049ac
xor al, al
pop esi
leave
ret

Function at 0x4049af
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x423168], 0
jne 0x4049e1
mov edx, ecx
push esi
lea ecx, [ebp - 0xc]
call fcn.00403b85
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
mov esi, eax
push dword [ebp - 0xc]
call fcn.00403a63
pop ecx
test esi, esi
pop esi
jmp 0x4049ea
push ecx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
je 0x4049f0
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x4049f4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x423168], 0
jne 0x404a29
mov edx, ecx
push esi
lea ecx, [ebp - 0xc]
call fcn.00403b85
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov esi, eax
push dword [ebp - 0xc]
call fcn.00403a63
pop ecx
test esi, esi
pop esi
jmp 0x404a34
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x404a3a
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x404f2c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x423168], 0
jne 0x404f61
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.00403b85
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
push dword [ebp - 0xc]
setne bl
call fcn.00403a63
pop ecx
mov al, bl
pop ebx
leave
ret
push ecx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
leave
ret
Function at 0x404f70
Capabilities:
Get common file path

Disassembly:
mov eax, 0x419438
call fcn.00413724
sub esp, 0x32c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi]
mov dword [esi + 4], ebx
mov word [eax], bx
cmp byte [0x423168], bl
jne 0x404fee
lea eax, [ebp - 0x12c]
mov byte [ebp - 0x12c], bl
push eax
push 0x105
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00403bdf
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.00403bca
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00401daf
push dword [ebp - 0x24]
call fcn.00403a63
push dword [ebp - 0x18]
call fcn.00403a63
pop ecx
pop ecx
jmp 0x405017
lea eax, [ebp - 0x338]
mov word [ebp - 0x338], bx
push eax
push 0x105
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov edi, eax
lea eax, [ebp - 0x338]
push eax
mov ecx, esi
call fcn.00401d50
cmp edi, ebx
jbe 0x405028
cmp edi, 0x104
ja 0x405028
push 1
pop eax
jmp 0x40502a
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4050ee
Capabilities:
Get common file path

Disassembly:
mov eax, 0x419470
call fcn.00413724
sub esp, 0x32c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi]
mov dword [esi + 4], ebx
mov word [eax], bx
cmp byte [0x423168], bl
jne 0x40516c
lea eax, [ebp - 0x12c]
mov byte [ebp - 0x12c], bl
push eax
push 0x105
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00403bdf
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.00403bca
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00401daf
push dword [ebp - 0x24]
call fcn.00403a63
push dword [ebp - 0x18]
call fcn.00403a63
pop ecx
pop ecx
jmp 0x405195
lea eax, [ebp - 0x338]
mov word [ebp - 0x338], bx
push eax
push 0x105
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov edi, eax
lea eax, [ebp - 0x338]
push eax
mov ecx, esi
call fcn.00401d50
cmp edi, ebx
jbe 0x4051a6
cmp edi, 0x104
ja 0x4051a6
push 1
pop eax
jmp 0x4051a8
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405925
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40594b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x40594b
xor al, al
jmp 0x40596b
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00414260
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x40cbc7
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41a2f8
call fcn.00413724
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x41b69c
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x41b754
push 4
mov ebx, 0x41b68c
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00403291
mov dword [esi + 0x3c], 0x41b804
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.00403291
mov dword [edi], 0x41b80c
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0040c1be
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040c1be
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040c1be
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0040c1be
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040c1be
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x412ff0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.0041468e
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x413018
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x413027
mov eax, 1
ret 4
Function at 0x1000e100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 1
mov eax, dword [ebp + 0x10]
shl eax, 1
push eax
call fcn.10005521
add esp, 8
mov dword [ebp - 4], eax
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x62
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x66
mov dword [ebp - 0x18], 0
jmp 0x1000e16b
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp + 0x10]
jae 0x1000e1ab
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x18]
movzx ecx, byte [eax]
sar ecx, 4
and ecx, 0xf
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov cl, byte [ebp + ecx - 0x14]
mov byte [eax + edx*2], cl
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x18]
movzx eax, byte [edx]
and eax, 0xf
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, byte [ebp + eax - 0x14]
mov byte [edx + ecx*2 + 1], al
jmp 0x1000e162
mov ecx, dword [ebp - 4]
mov dword [ebp + 8], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10011be
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x1002018]
push 0x104
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x174], ecx
push 1
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ecx
push eax
call fcn.01001149
cmp eax, 1
jl 0x100129e
push ebx
xor ebx, ebx
cmp byte [ebp - 0x160], bl
push esi
lea esi, [ebp - 0x160]
je 0x1001238
cmp byte [esi], 0x3a
je 0x100121b
inc esi
cmp byte [esi], bl
jne 0x100120f
jmp 0x100121e
mov byte [esi], bl
inc esi
cmp byte [esi], bl
je 0x1001238
push 0x10010ac
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100123e
lea esi, [ebp - 0x160]
push 0x29
lea eax, [ebp - 0x58]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x100129c
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jl 0x100129c
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x100129c
push ebx
lea eax, [ebp - 0x170]
push eax
call sub.ole32.dll_CoRegisterSurrogateEx
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.01001324
leave
ret 0x10
Function at 0x10030b8
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1049174], 0
je 0x1012766
ret
push esi
push edi
call sym.spoolsv.exe_PrvRevertToPrinterSelf
push 0x1011ee4
push 0
push 2
mov edi, eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x101bfa8
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x10127a8
push edi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
je 0x101bff1
push 0xffffffffffffffff
push dword [0x1049280]
call fcn.010127c1
pop edi
pop esi
jmp 0x10030c5
mov eax, dword [0x1049104]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x1049104
je 0x101bfda
test byte [eax + 0x1c], 1
je 0x101bfda
call esi
push eax
mov eax, dword [0x1049104]
push 0x1013298
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
push 0
call esi
push eax
push 0x101c008
call fcn.01031f8b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x69
call fcn.01032208
jmp 0x10127a8

Function at 0x100370b
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1003764
push edi
mov edi, 0x1049318
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call fcn.0100376e
lea eax, [esi + 0xc]
cmp dword [eax], 0
jne 0x101cb2e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x1c]
pop edi
cmp eax, 0xffffffff
jne 0x101cb39
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x101cb45
push dword [esi + 0x24]
call sym.spoolsv.exe_PrvDllFreeSplStr
push esi
call sym.spoolsv.exe_PrvDllFreeSplMem
pop esi
pop ebp
ret 4
push eax
call fcn.01019ea1
jmp 0x1003737
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100374b
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x101cb5c
push 4
push eax
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [esi + 0x20]
call sym.spoolsv.exe_PrvDllFreeSplMem
and dword [esi + 0x20], 0
jmp 0x1003756
Function at 0x1003930
Capabilities:
Get thread local storage value
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x1049138]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x101c3c7
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.RPCRT4.dll_I_RpcBindingInqTransportType]
cmp eax, ebx
jne 0x100c193
cmp dword [ebp - 0x18], 4
jne 0x101c3e3
lea eax, [ebp - 0x14]
push eax
push 1
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x101c3f7
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 2
push 1
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x101c3eb
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x100c1a5
xor eax, eax
cmp dword [ebp - 0x1c], ebx
setne al
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jl 0x101c40f
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100327d
leave
ret
cmp eax, 0x6bd
jne 0x101c3ce
xor esi, esi
jmp 0x1003a09
call fcn.0100ce32
jmp 0x10039f5
xor eax, eax
jmp 0x1003964
cmp eax, ebx
jle 0x101c3dc
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x1003a09
xor esi, esi
inc esi
jmp 0x1003a09
call fcn.0100ce32
mov esi, eax
jmp 0x1003a00
call fcn.0100ce32
mov esi, eax
sub esi, 0x800703f0
neg esi
sbb esi, esi
and esi, eax
jmp 0x1003a09
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x1003a18
test byte [eax + 0x1c], 1
je 0x1003a18
push esi
push 0x1021f90
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
jmp 0x1003a18
Function at 0x1005bd9
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebx], esi
cmp dword [ebp + 0xc], esi
je 0x100c579
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010180dc
test eax, eax
je 0x101ec34
push esi
push esi
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyW]
mov edi, eax
cmp edi, esi
jne 0x1005c3b
cmp dword [ebp + 0xc], 0x48
jae 0x101ec41
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp edi, esi
jne 0x101ecbb
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1005c50
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1005c44
push dword [ebp + 0xc]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov dword [ebx], eax
cmp eax, esi
jne 0x101ec5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1005c3b
lea ecx, [ebp + 0xc]
push ecx
push eax
push esi
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov edi, eax
cmp edi, esi
jne 0x101eca2
push dword [ebp + 0xc]
push dword [ebx]
call fcn.01018b66
push eax
call fcn.01018db6
mov edi, eax
cmp edi, esi
je 0x101ecab
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
test eax, eax
jne 0x101ec9e
push 2
pop edi
cmp edi, esi
je 0x101ecab
push dword [ebx]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov dword [ebx], esi
cmp edi, 2
jne 0x1005c3b
xor edi, edi
jmp 0x1005c3b
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101ecf2
test byte [eax + 0x1c], 1
je 0x101ecf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1049104]
push 0x1023b88
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
xor eax, eax
jmp 0x1005c4f
Function at 0x100d81f
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c0
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
and dword [ebx], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x80070057
test esi, esi
je 0x100d8bb
cmp word [esi], 0
je 0x100d8bb
push 2
push 2
lea ecx, [ebp - 0x19c]
call fcn.0100d30c
mov edi, dword [ebp - 8]
test edi, edi
jl 0x100d8b0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1bc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x1c0]
push eax
xor edi, edi
push edi
push esi
mov dword [ebp - 0x1c0], 4
mov dword [ebp - 0x1bc], edi
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
cmp eax, edi
je 0x101fc89
cmp eax, 0x2af9
jne 0x101fcec
xor edi, edi
inc edi
lea ecx, [ebp - 0x19c]
call fcn.0100d8d3
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100327d
leave
ret 8
push esi
call fcn.010410a6
test eax, eax
jl 0x101fcdb
push 0x804
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
pop ecx
js 0x101fcdb
mov eax, dword [ebp - 0x1a0]
push 2
push edi
push edi
push 0x401
push esi
push dword [eax + 0x10]
push dword [eax + 0x18]
call dword [sym.imp.WS2_32.dll_GetNameInfoW]
test eax, eax
jne 0x101fcd4
mov dword [ebx], esi
jmp 0x101fcdb
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x1a0]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
jmp 0x100d8b0
call fcn.0104108c
mov edi, eax
jmp 0x100d8b0