joyce8/EMBER2024-capa huggingface dataset:
Function at 0x108f61e
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
xor ebx, ebx
push 0x38
lea eax, [ebp - 0x44]
push ebx
push eax
mov dword [ebp - 8], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
add esp, 0xc
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x48], 0x3c
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x108f661
mov esi, dword [sym.imp.WININET.dll_InternetCrackUrlW]
sub eax, ecx
lea ecx, [ebp - 0x48]
push ecx
push ebx
sar eax, 1
push eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x108f696
call fcn.0108edc3
mov edi, eax
push edi
push 0x49b01ca
jmp 0x108f7ba
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0108f57d
mov edi, eax
cmp edi, ebx
je 0x108f6b8
push edi
push 0x4a401ca
jmp 0x108f7ba
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0108f57d
mov edi, eax
cmp edi, ebx
je 0x108f6da
push edi
push 0x4a701ca
jmp 0x108f7ba
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0108f57d
mov edi, eax
cmp edi, ebx
je 0x108f6fc
push edi
push 0x4aa01ca
jmp 0x108f7ba
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0108f57d
mov edi, eax
cmp edi, ebx
je 0x108f71e
push edi
push 0x4ad01ca
jmp 0x108f7ba
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x108f724
lea ecx, [ebp - 0x48]
push ecx
sub eax, edx
push 0x80000000
sar eax, 1
push eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x108f754
call fcn.0108edc3
mov edi, eax
push edi
push 0x4b401ca
jmp 0x108f7ba
mov dword [ebp - 0xc], ebx
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.WININET.dll_InternetCreateUrlW]
test eax, eax
jne 0x108f781
call fcn.0108edc3
mov edi, eax
cmp edi, 0x8007007a
jne 0x108f79b
cmp esi, ebx
jne 0x108f79b
cmp esi, ebx
jne 0x108f7a3
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x108f7af
shr dword [ebp - 0xc], 1
jmp 0x108f757
push edi
push 0x4cf01ca
jmp 0x108f7ba
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [ebp - 4], ebx
xor edi, edi
jmp 0x108f7bf
mov edi, 0x8007000e
push edi
push 0x4dc01ca
call fcn.010893e6
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x40], ebx
je 0x108f7cf
push dword [ebp - 0x44]
call esi
cmp dword [ebp - 0x34], ebx
je 0x108f7d9
push dword [ebp - 0x38]
call esi
cmp dword [ebp - 0x18], ebx
je 0x108f7e3
push dword [ebp - 0x1c]
call esi
cmp dword [ebp - 0x10], ebx
je 0x108f7ed
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 4], ebx
je 0x108f7f7
push dword [ebp - 4]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10901cb
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 0x14]
xor ecx, ecx
push eax
mov dword [edi], ecx
push ecx
mov dword [ebx], ecx
mov dword [ebp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1090207
mov eax, 0x8007000e
push eax
push 0x73f01a3
mov edi, eax
call fcn.010893e6
jmp 0x1090258
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp + 0x14]
push eax
push esi
push 0
push 1
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x1090242
call fcn.0108edc3
mov edi, eax
push edi
push 0x74c01a3
call fcn.010893e6
jmp 0x109024d
mov eax, dword [ebp + 0x14]
mov dword [edi], esi
xor esi, esi
mov dword [ebx], eax
xor edi, edi
test esi, esi
je 0x1090258
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x1090a65
Capabilities:
Hash data using sha1
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000000
push 1
xor edi, edi
push 0x1012720
push edi
mov dword [esi], edi
push esi
mov dword [ebx], edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1090aa2
mov dword [esi], edi
call fcn.0108edc3
mov ebx, eax
push ebx
push 0xd2d01a3
jmp 0x1090ac5
push ebx
push edi
push edi
push 0x8004
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1090acc
mov dword [ebx], edi
call fcn.0108edc3
mov ebx, eax
push ebx
push 0xd3401a3
call fcn.010893e6
jmp 0x1090ace
xor ebx, ebx
cmp ebx, edi
je 0x1090af6
mov eax, dword [esi]
cmp eax, edi
je 0x1090af6
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
jne 0x1090af4
call fcn.0108edc3
push ebx
push 0xd3f01a3
call fcn.010893e6
mov dword [esi], edi
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
Function at 0x10923b0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push ebx
call fcn.0103794c
mov dword [ebp - 4], eax
test eax, eax
je 0x10923e3
push eax
push 0x6f101a3
call fcn.010893e6
jmp 0x1092494
push esi
push edi
mov edi, dword [ebp - 8]
jmp 0x1092446
push ebx
push dword [ebp + 0xc]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
lea eax, [ebp + 0x10]
push eax
push esi
push 0
push 1
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1092475
call fcn.0108edc3
cmp dword [ebp - 0xc], 0
mov dword [ebp - 4], eax
jne 0x1092468
cmp eax, 0x800700ea
jne 0x1092468
mov eax, esi
test edi, edi
je 0x1092432
mov byte [eax], 0
inc eax
dec edi
jne 0x109242b
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 1
push edi
push 0
mov dword [ebp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x10923ea
mov eax, 0x8007000e
push eax
mov dword [ebp - 4], eax
push 0x6fa01a3
jmp 0x109246e
push eax
push 0x71601a3
call fcn.010893e6
jmp 0x1092487
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
xor esi, esi
mov dword [eax], ecx
mov dword [ebp - 4], esi
test esi, esi
je 0x1092492
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0x14
Function at 0x109ae94
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10cd598]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
or dword [esi], 0xffffffff
push edi
mov edi, dword [ebp + 0x10]
and dword [edi], 0
push esi
call fcn.0109982f
test ebx, ebx
jne 0x109af07
mov ebx, 0xf6
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x101ad90
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x109aeec
cmp eax, ebx
jae 0x109aeec
push 0x101dfb0
jmp 0x109af5e
mov eax, 0x80070002
push eax
push 0x4f70191
mov dword [ebp - 0x210], eax
call fcn.010893e6
jmp 0x109b050
push 0x5c
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x109af75
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x109af1b
sub eax, edx
sar eax, 1
lea ecx, [eax + 2]
mov eax, 0x104
cmp ecx, eax
jb 0x109af4b
mov eax, 0x800700ce
push eax
mov dword [ebp - 0x210], eax
push 0x5030191
jmp 0x109b04a
push 0x101dfa8
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0102d982
push ebx
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0102d9bc
lea ebx, [ebp - 0x20c]
push ebx
push esi
call fcn.0109a157
mov dword [ebp - 0x210], eax
test eax, eax
je 0x109af91
push eax
push 0x50b0191
jmp 0x109b04a
push 2
pop eax
jmp 0x109afb4
call fcn.0108edc3
mov dword [ebp - 0x210], eax
cmp eax, 0xe0000100
jne 0x109b01c
cmp dword [ebp - 0x218], 2
jne 0x109b01c
xor eax, eax
inc eax
and dword [ebp - 0x214], 0
lea ecx, [ebp - 0x214]
push ecx
push eax
push 0
push ebx
mov dword [ebp - 0x218], eax
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
mov dword [esi], eax
mov eax, dword [ebp - 0x214]
mov dword [edi], eax
cmp dword [esi], 0xffffffff
je 0x109af96
xor edi, edi
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push edi
push edi
push edi
push 0x101df98
push esi
call fcn.0109a656
push edi
push edi
push ebx
push 1
push 0x3b2
push edi
push 0x536
push 0x191
call fcn.010a687f
mov dword [ebp - 0x210], edi
jmp 0x109b050
mov ecx, dword [edi]
neg ecx
sbb ecx, ecx
and ecx, edi
push ecx
push 0
push ebx
push 1
push 0x3b3
push eax
push 0x526
push 0x191
call fcn.010a687f
push dword [ebp - 0x210]
push 0x5270191
push ebx
call fcn.01089421
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01074bd5
leave
ret 0xc
Function at 0x109d5c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
xor edi, edi
mov dword [eax], edi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push edi
push ebx
push dword [ebp + 8]
call esi
cmp eax, edi
je 0x109d60c
push eax
call fcn.0108ed8e
mov esi, eax
push esi
push 0x5ab0197
push ebx
call fcn.01089421
jmp 0x109d68c
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp + 0xc], eax
cmp eax, edi
jne 0x109d62a
mov esi, 0x8007000e
push esi
push 0x5b20197
jmp 0x109d66f
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push edi
push ebx
push dword [ebp + 8]
call esi
cmp eax, edi
je 0x109d654
push eax
call fcn.0108ed8e
mov esi, eax
push esi
push 0x5b90197
push ebx
call fcn.01089421
jmp 0x109d67e
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.0108b162
mov esi, eax
cmp esi, edi
je 0x109d676
push esi
push 0x5bd0197
call fcn.010893e6
jmp 0x109d67e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
cmp dword [ebp + 0xc], edi
je 0x109d68c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x109d9dd
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 2
push 0x1002030
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.010aa8d0
mov esi, eax
cmp esi, edi
je 0x109da1d
push esi
push 0x7dc0197
push dword [ebp + 8]
call fcn.01089421
jmp 0x109da3c
push 0x101e4f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
cmp esi, edi
je 0x109da3c
push esi
push 0x7df0197
call fcn.010893e6
cmp dword [ebp - 4], edi
je 0x109da4a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], edi
je 0x109da58
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
leave
ret 4

Function at 0x109dfb7
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10cd598]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push 0xf0000000
xor eax, eax
push 1
push eax
push eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x109e004
call fcn.0108edc3
mov esi, eax
push esi
push 0xc3f0197
call fcn.010893e6
jmp 0x109e0db
mov esi, dword [ebp + 8]
cmp esi, 1
je 0x109e011
cmp esi, 0x10
jbe 0x109e014
push 0x10
pop esi
mov eax, dword [ebp + 0x10]
dec eax
cmp esi, eax
jbe 0x109e01e
mov esi, eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x28]
call edi
test eax, eax
jne 0x109e042
call fcn.0108edc3
mov esi, eax
push esi
push 0xc4d0197
jmp 0x109e05d
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 0x28]
call edi
test eax, eax
jne 0x109e064
call fcn.0108edc3
mov esi, eax
push esi
push 0xc520197
call fcn.010893e6
jmp 0x109e0da
lea eax, [esi + esi + 2]
push eax
push 0
mov edi, esi
push ebx
mov dword [ebp - 0x2c], 0x59
shr edi, 3
call sub.msvcrt.dll_memset
add esp, 0xc
xor ecx, ecx
test esi, esi
jbe 0x109e0d8
movzx eax, byte [ebp + ecx - 0x14]
xor edx, edx
div dword [ebp - 0x2c]
movzx eax, byte [ebp + ecx - 0x24]
mov dword [ebp - 0x30], edx
xor edx, edx
div esi
mov eax, dword [ebp - 0x34]
jmp 0x109e0a8
inc edx
cmp edx, esi
jne 0x109e0a8
xor edx, edx
xor ebx, ebx
cmp bx, word [eax + edx*2]
jne 0x109e0a1
mov ebx, dword [ebp - 0x30]
mov bx, word [ebx*2 + 0x101e3f8]
push 0x3e
mov word [eax + edx*2], bx
pop eax
cmp dword [ebp - 0x30], eax
jb 0x109e0d3
test edi, edi
jbe 0x109e0ce
dec edi
test edi, edi
jne 0x109e0d3
mov dword [ebp - 0x2c], eax
inc ecx
cmp ecx, esi
jb 0x109e086
xor esi, esi
pop edi
push 0x10
pop ecx
lea eax, [ebp - 0x14]
mov byte [eax], 0
inc eax
dec ecx
jne 0x109e0e1
cmp dword [ebp - 0x28], ecx
je 0x109e0f7
push ecx
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01074bd5
leave
ret 0xc
Function at 0x109e4b9
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x10cd598]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor edx, edx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x258], edx
mov dword [edi], edx
cmp esi, edx
je 0x109e4f3
mov dword [esi], edx
lea ebx, [ebp - 0x258]
push ebx
push edx
push eax
push ecx
call fcn.0108ae0f
mov ebx, eax
test ebx, ebx
je 0x109e518
push ebx
push 0x8c0197
call fcn.010893e6
jmp 0x109e5c8
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x260], eax
cmp eax, 0xffffffff
jne 0x109e53d
xor ebx, ebx
jmp 0x109e5c8
test byte [ebp - 0x254], 0x10
jne 0x109e58c
mov dword [edi], 1
test esi, esi
je 0x109e58c
lea eax, [ebp - 0x25c]
push eax
push 0
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x264]
call fcn.0108ae0f
mov ebx, eax
test ebx, ebx
jne 0x109e5a5
push dword [ebp - 0x25c]
call fcn.0109d580
test eax, eax
jne 0x109e5b2
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x109e53d
jmp 0x109e5ba
push ebx
push 0xa30197
call fcn.010893e6
jmp 0x109e5bc
mov eax, dword [ebp - 0x25c]
mov dword [esi], eax
xor ebx, ebx
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x258], 0
je 0x109e5dd
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01074bd5
leave
ret 0x10
Function at 0x109efc6
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x66c
mov eax, dword [0x10cd598]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x668], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
and dword [edi], 0
mov eax, ebx
mov dword [ebp - 0x66c], ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x109eff9
sub eax, ecx
sar eax, 1
add eax, 6
mov esi, 0x104
cmp eax, esi
jb 0x109f024
mov eax, 0x8007006f
push eax
push 0xf010197
push ebx
jmp 0x109f0c8
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102d982
push 0x101e55c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102d9bc
push 0x1001ee4
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102d9bc
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x109f0f8
test byte [ebp - 0x664], 0x10
je 0x109f092
lea eax, [ebp - 0x664]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x109f075
jmp 0x109f0e8
lea eax, [ebp - 0x638]
mov dword [ebp - 0x668], 1
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x109f0a5
sub eax, edx
sar eax, 1
cmp eax, esi
jb 0x109f0d4
mov eax, 0x8007006f
push eax
push 0xf130197
push dword [ebp - 0x66c]
mov esi, eax
call fcn.01089421
jmp 0x109f19e
lea eax, [ebp - 0x638]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0102d982
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x668], 0
jne 0x109f105
mov esi, 0x80070002
push esi
push 0xf1f0197
jmp 0x109f16c
cmp dword [ebp - 0x668], 1
jbe 0x109f11b
mov esi, 0x8007010b
push esi
push 0xf240197
jmp 0x109f16c
mov eax, dword [ebp - 0x66c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x109f124
sub eax, edx
sar eax, 1
mov ecx, eax
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x109f13d
sub eax, edx
sar eax, 1
lea esi, [eax + ecx + 2]
lea eax, [esi + esi]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
test eax, eax
jne 0x109f173
mov esi, 0x8007000e
push esi
push 0xf2c0197
call fcn.010893e6
jmp 0x109f19e
push dword [ebp - 0x66c]
push esi
push eax
call fcn.0102d982
push 0x1008aa0
push esi
push dword [edi]
call fcn.0102d9bc
lea eax, [ebp - 0x414]
push eax
push esi
push dword [edi]
call fcn.0102d9bc
xor esi, esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01074bd5
leave
ret 8
Function at 0x109f62c
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x10cd598]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov eax, edx
inc edi
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x109f64e
sub eax, esi
sar eax, 1
add eax, 4
mov esi, 0x104
cmp eax, esi
jb 0x109f67a
push 0x8007006f
push 0x35b0197
push edx
call fcn.01089421
jmp 0x109f6db
push edx
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102d982
push 0x101e564
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102d9bc
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x109f6db
test byte [ebp - 0x45c], 0x10
je 0x109f6d2
lea eax, [ebp - 0x45c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x109f6b5
jmp 0x109f6d4
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01074bd5
leave
ret 4
Function at 0x109f6f2
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x10cd598]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
push esi
mov eax, edx
push edi
mov dword [ebp - 0x464], edx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x109f718
sub eax, esi
sar eax, 1
mov edi, eax
lea eax, [edi + 4]
mov esi, 0x104
cmp eax, esi
jb 0x109f74b
mov ebx, 0x8007006f
push ebx
push 0x3830197
mov dword [ebp - 0x460], ebx
push edx
jmp 0x109f863
push edx
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102d982
push 0x101e564
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102d9bc
inc edi
mov eax, esi
sub eax, edi
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x468], eax
cmp eax, 0xffffffff
jne 0x109f7b4
call fcn.0108edc3
mov dword [ebp - 0x460], eax
test eax, eax
je 0x109f7b4
push eax
push 0x38f0197
call fcn.010893e6
jmp 0x109f868
and dword [ebp - 0x460], 0
mov ebx, 0x8007006f
test byte [ebp - 0x45c], 0x10
jne 0x109f826
lea eax, [ebp - 0x430]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x109f7d2
sub eax, edx
sar eax, 1
add eax, edi
cmp eax, esi
jb 0x109f7ff
push ebx
push 0x39a0197
push dword [ebp - 0x464]
mov dword [ebp - 0x460], ebx
call fcn.01089421
jmp 0x109f826
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x46c]
lea eax, [ebp + edi*2 - 0x20c]
push eax
call fcn.0102d982
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x109f7c0
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x460], 0
je 0x109f868
push dword [ebp - 0x460]
push 0x3a20197
push dword [ebp - 0x464]
call fcn.01089421
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x460]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01074bd5
leave
ret 4
Function at 0x10a7625
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
lea eax, [ebp - 8]
xor edi, edi
push eax
push 2
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x18], edi
call fcn.0108a8a7
mov dword [ebp - 4], eax
cmp eax, edi
je 0x10a7662
push eax
push 0x21b0199
call fcn.010893e6
jmp 0x10a7723
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp - 8]
push edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x10a7698
call fcn.0108edc3
push eax
push 0x2280199
jmp 0x10a771a
mov eax, dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push edi
call esi
mov dword [ebp - 0x10], eax
cmp eax, edi
jne 0x10a76bb
mov eax, 0x8007000e
push eax
push 0x2310199
jmp 0x10a771a
push dword [ebp - 0x14]
push edi
call esi
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, edi
jne 0x10a76d7
mov eax, 0x8007000e
push eax
push 0x23a0199
jmp 0x10a771a
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 8]
push edi
call ebx
test eax, eax
jne 0x10a76fe
call fcn.0108edc3
push eax
push 0x2470199
jmp 0x10a771a
mov eax, dword [ebp - 0x20]
add eax, 0x44
push eax
push esi
call fcn.010a9f99
test eax, eax
jne 0x10a7722
call fcn.0108edc3
push eax
push 0x24f0199
mov dword [ebp - 4], eax
call fcn.010893e6
pop ebx
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x10a8d63
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x10a8d95
call fcn.0108edc3
mov edi, eax
test esi, esi
jne 0x10a8dd1
cmp edi, 0x800700ea
jne 0x10a8dd1
test esi, esi
jne 0x10a8dd9
mov eax, dword [ebp - 4]
add eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x10a8d71
mov eax, 0x8007000e
push eax
mov edi, eax
push 0x9d101c9
call fcn.010893e6
test esi, esi
je 0x10a8dc9
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
leave
ret 8
push edi
push 0x9c601c9
jmp 0x10a8db9
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor edi, edi
jmp 0x10a8dc9