joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406808
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406912
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40685b
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403258
jmp 0x4068f9
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.004067bc
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.004067dc
mov ebx, eax
test esi, esi
je 0x406883
dec esi
test esi, esi
jl 0x406883
cmp edi, ebx
jne 0x406862
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.00403328
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403578
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403384
cmp eax, 2
jl 0x4068f9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x4068f9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403384
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x4068f9
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403384
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403578
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406919
lea eax, [ebp - 0x110]
call fcn.00403174
ret

Function at 0x406954
Capabilities:
Get file attributes

Disassembly:
call fcn.004057f0
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x406968
dec eax
and al, 0x10
sete al
ret

Function at 0x406ba4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406c3c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x406bf1
mov eax, dword [ebx + 0x19]
call fcn.00403538
push eax
push esi
mov eax, edi
call fcn.00403538
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403538
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x406c26
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.00403538
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00406654
mov eax, dword [ebp - 8]
call fcn.00403538
push eax
mov eax, edi
call fcn.00403538
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403538
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c43
lea eax, [ebp - 8]
call fcn.00403174
ret
Function at 0x4083f4
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x408403
mov edx, dword [edx + 0x36]
jmp fcn.00403328
mov ecx, dword [edx + 0x18]
jecxz 0x4083fb
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.00403648
pop edx
mov ecx, dword [ebx]
jecxz 0x40842b
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret
Function at 0x40da24
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe48
cmp dword [0x41656c], 0
ja 0x40daab
lea eax, [esp + 0x28]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esp
mov edx, 0x28
call fcn.0040557c
mov dword [esp + 4], 0x40d8a8
mov eax, 0x40dab4
mov dword [esp + 0x24], eax
mov eax, dword [0x41550c]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
push esp
call sub.user32.dll_RegisterClassA
push 0
mov eax, dword [0x41550c]
mov eax, dword [eax]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x80000000
push 0
mov eax, dword [esp + 0x4c]
push eax
push 0x80
call sub.user32.dll_CreateWindowExA
mov dword [0x41656c], eax
call fcn.00405a40
mov dword [0x416570], eax
add esp, 0x1b8
ret

Function at 0x40dcc0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [ebx + 0xc], 0
jne 0x40dd62
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0xc], eax
mov word [esp], 2
push edi
call sub.wsock32.dll_htons
mov word [esp + 2], ax
test esi, esi
jne 0x40dd01
xor eax, eax
mov dword [esp + 4], eax
jmp 0x40dd12
mov eax, esi
call fcn.00403538
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.wsock32.dll_bind
inc eax
jne 0x40dd35
mov eax, dword [ebx + 0xc]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
mov dword [ebx + 0xc], eax
jmp 0x40dd62
call fcn.00405a40
mov dword [ebx + 8], eax
push 0x28
push 0x400
mov eax, dword [0x41656c]
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.wsock32.dll_WSAAsyncSelect
cmp word [ebx + 0x26], 0
je 0x40dd62
mov edx, ebx
mov eax, dword [ebx + 0x28]
call dword [ebx + 0x24]
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x40ddf0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
jmp 0x40de22
push 0
push esi
push edi
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x40de1c
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x40de2d
mov byte [ebx + 0x10], 1
jmp 0x40de22
sub esi, eax
add eax, edi
mov edi, eax
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40de2d
test esi, esi
ja 0x40ddfb
pop edi
pop esi
pop ebx
ret
Function at 0x48168c
Capabilities:
Encode data using xor

Disassembly:
jo 0x4820d4
mov edi, dword [esp + 4]
pushal
push edx
bswap si
mov esi, dword [esp + 0x2c]
pushfd
jmp 0x484a74
push 0x787f0c52
pushfd
pushfd
mov byte [esp], cl
lea esp, [esp + 0xc]
je 0x483d07
jmp 0x482d48
add eax, edi
clc
cmp eax, edx
push 0x366bef36
call fcn.0048201a
push 0xe9afa5c0
mov esp, ebp
bswap bp
call fcn.00487264
scasb al, byte es:[edi]
sbb dword [esi - 0x376d753d], 0x52
fild word [ebx]
push cs
add ecx, dword [esi]
adc cl, byte [ecx + 0x1ac9dc93]
or eax, 0x4c878f5e
and al, 0xcf
sub byte [ebp + 0x1e], cl
or eax, dword [ebx]
dec esp
movsb byte es:[edi], byte [esi]
inc edi
add ecx, dword [esp + 0x47]
ror esp, 0x4b
push ebx
add byte [0xea8db416], dl
and byte [ecx], 0xcb
xor eax, 0xe240d058
xchg esi, eax
inc dword [ecx]
fimul word [ecx - 0x23]
ja 0x483183
imul dword [0x92b2a5b5]
lodsd eax, dword [esi]
xor eax, 0x5f43854a
dec eax
add dword [ebx + 0x1f], ebp
xchg ebx, eax
add ebp, dword [ebp + edi*4 + 0x6f]
jno 0x48323b
xchg ebx, eax
cmp eax, 0xa9b1c971
cmp byte [eax - 0x2d554e91], 0xbd
loopne 0x4831d2
arpl word es:[ecx + 0x3064f4e0], si
jecxz 0x483196
add dword [edi], ecx
mov bh, 0xc
dec edi
lea esp, [esp + 4]
stc
or di, bp
rol edi, 2
rol di, cl
mov edi, dword [edx + 0x1c]
cmc
cmc
test dl, 0xb6
clc
add edi, eax
stc
mov edi, dword [edi + ecx*4]
cmc
test edi, edi
jmp 0x48118c
jmp 0x48316b
Function at 0x40df14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40df23
pop dword [ebp - 0x10]
mov eax, 0x5b979812
add eax, 0xa4a94711
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3f460
push 0
mov eax, 0xe17cef5a
sub eax, 0xe13a9d42
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x42ceed8b
sub ecx, 0x42ce9fa1
xor edx, edx
add edx, eax
mov esi, 0xe9f0e651
sub esi, 0xe9ad9251
add esi, dword [ebp - 0x10]
mov ebx, 0x55fb3902
sub ebx, 0xfbe2b2ac
xor dword [ebp - 0xc], 0xb402f9c1
mov edi, dword [esi]
xor dword [ebp - 0xc], edi
xor edi, ebx
mov dword [ebp - 4], 0x4a2ea774
mov dword [edx], edi
xor dword [ebp - 8], 0x657c46a4
add edx, 0xf94f5fad
add edx, 0x6b0a057
add esi, 0xbb0b5c76
add esi, 0x44f4a38e
loop 0x40df84
add eax, 0x4414499d
add eax, 0xbbece0de
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5d9f49a4
add ecx, 0xa2a0b65c
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1006bd9
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x12c18
push 0x64
xor ebx, ebx
push ebx
push 1
push ebx
mov dword [ebp - 4], ebx
call sub.NETAPI32.dll_NetQueryDisplayInformation
cmp eax, ebx
je 0x1006c0c
cmp eax, 0xea
jne 0x1006cdb
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, ebx
jl 0x1006cdb
push esi
lea esi, [eax + eax*2]
shl esi, 3
inc eax
push edi
mov dword [ebp - 0x18], eax
jmp 0x1006c28
xor ebx, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
push dword [esi + eax]
push ebx
call edi
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x1006ccd
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push ebx
mov dword [ebp - 0xc], 0x10
push dword [esi + eax]
push 0
call edi
test eax, eax
je 0x1006cc6
cmp dword [ebp - 0x14], 1
jne 0x1006cc6
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov al, byte [eax]
and dword [ebp - 8], 0
movzx edi, al
test edi, edi
jle 0x1006cc6
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
cmp dword [eax], 0x1f5
jne 0x1006cbe
mov eax, dword [ebp - 4]
push dword [esi + eax]
push str.Guest
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1006c9b
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esi, 0x18
dec dword [ebp - 0x18]
jne 0x1006c26
pop edi
pop esi
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
pop ebx
leave
ret

Function at 0x1006ddd
Capabilities:
Check for peb beingdebugged flag
Check systemkerneldebuggerinformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 2
lea eax, [ebp - 4]
push eax
push 0x23
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp byte [ebp - 4], 0
jne 0x1006e06
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp byte [eax + 2], 0
je 0x1006e11
push 0x1006dd7
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
leave
ret
Function at 0x10070e0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x10070f5
dec eax
test eax, eax
mov dword [ecx + 4], eax
jne 0x10070f5
jmp 0x100ce3e
ret
push ebx
push esi
push edi
push dword [0x1026bb8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax + 8]
movsx eax, word [esi + 2]
sub eax, 4
je 0x100ceff
dec eax
je 0x100ce93
sub eax, 5
je 0x100cef0
dec eax
je 0x100ceb1
dec eax
je 0x100cea2
dec eax
je 0x100ce93
dec eax
jne 0x100cf0c
xor eax, eax
mov ax, word [esi + 8]
test ax, ax
je 0x100cf0c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
jmp 0x100cf0c
mov eax, dword [esi + 8]
test eax, eax
je 0x100cf0c
push eax
call fcn.01007e4e
jmp 0x100cf0c
mov eax, dword [esi + 8]
test eax, eax
je 0x100cf0c
push eax
call fcn.01014ab6
jmp 0x100cf0c
xor eax, eax
mov al, byte [esi + 0x14]
and eax, 3
sub eax, 0
je 0x100cee8
dec eax
je 0x100cecc
dec eax
jne 0x100cf0c
mov edi, dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
jmp 0x100ced2
mov edi, dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [esi + 8]
test eax, eax
je 0x100cedc
push eax
call edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x100cf0c
push eax
call edi
jmp 0x100cf0c
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x100ced2
mov eax, dword [esi + 8]
test eax, eax
je 0x100cf0c
push eax
call fcn.0100c8dc
jmp 0x100cf0c
mov eax, dword [esi + 8]
test eax, eax
je 0x100cf0c
push eax
call fcn.01014ab6
push esi
mov ecx, ebx
call fcn.010183dc
pop edi
pop esi
pop ebx
ret
Function at 0x1007aa7
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x44
or dword [esp], 0xffffffff
push ebx
push esi
mov esi, dword [esp + 0x58]
mov eax, esi
shl eax, 2
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1007ad1
or eax, 0xffffffff
jmp 0x1007bb2
push ebp
push ebx
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor ebp, ebp
test esi, esi
jbe 0x1007ba6
push edi
mov edi, dword [esp + 0x58]
add edi, 4
lea esi, [ebx + ebp*4]
mov eax, dword [esi]
mov dword [edi - 4], eax
mov eax, dword [esi]
cmp eax, dword [esp + 0x5c]
jne 0x1007b00
mov dword [esp + 0x10], ebp
shr eax, 0x10
and ax, 0xf000
cmp ax, 0xe000
jne 0x1007b8a
cmp dword [0x102ba04], 0
jne 0x1007b3f
push str.imm32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1007b36
push 0x1001f4c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x102ba04], eax
cmp dword [0x102ba04], 0
je 0x1007b8a
push 0x40
lea eax, [esp + 0x18]
push eax
push dword [esi]
call dword [0x102ba04]
test eax, eax
je 0x1007b8a
push 0x1001f34
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1007b97
push 0x1001f24
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007b81
push 1
push edi
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1007b97
xor eax, eax
mov ax, word [esi]
push eax
call fcn.010078b6
mov dword [edi], eax
inc ebp
add edi, 8
cmp ebp, dword [esp + 0x60]
jb 0x1007aec
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0xc]
pop ebp
pop esi
pop ebx
add esp, 0x44
ret 0xc

Function at 0x1007bfa
Capabilities:
Get keyboard layout

Disassembly:
push edi
push 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov edi, eax
cmp edi, 2
jae 0x1007c10
xor eax, eax
jmp 0x1007c67
mov eax, dword [esp + 8]
push esi
lea esi, [eax + eax*2]
shl esi, 2
mov eax, dword [esi + 0x102b9f4]
test eax, eax
jne 0x1007c47
mov eax, edi
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
jne 0x1007c3b
xor eax, eax
jmp 0x1007c66
mov dword [esi + 0x102b9f0], edi
mov dword [esi + 0x102b9f4], eax
push edi
mov edi, dword [esp + 0x14]
push edi
push eax
call fcn.01007bba
test eax, eax
je 0x1007c37
push eax
call fcn.01008380
xor eax, eax
mov dword [esi + 0x102b9ec], edi
inc eax
pop esi
pop edi
ret 8

Function at 0x1007d05
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x1001f60
call dword [sym.imp.USER32.dll_FindWindowW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x1009020
Capabilities:
Hide graphical window

Disassembly:
mov dword [ecx + 0xc0], 4
mov ecx, dword [ecx + 0xc4]
test ecx, ecx
je 0x100903f
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x100aec1
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10026f0
call fcn.0100b134
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x100aefe
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100aefe
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100af16
cmp eax, 0x20b
je 0x100af03
mov dword [ebp - 0x1c], ebx
jmp 0x100af2a
cmp dword [ecx + 0x84], 0xe
jbe 0x100aefe
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x100af24
cmp dword [ecx + 0x74], 0xe
jbe 0x100aefe
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x103c300], 0xffffffff
or dword [0x103c304], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x102bf70]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x102bf6c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x103c2fc], eax
call fcn.01010de8
cmp dword [0x1026980], ebx
jne 0x100af85
push fcn.01010de8
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100b122
push 0x100162c
push 0x1001628
call sub.msvcrt.dll__initterm
mov eax, dword [0x102bf68]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x102bf64]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001624
push 0x10014e0
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x100b01b
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x100afef
cmp al, 0x22
jne 0x100afe1
cmp byte [esi], 0x22
jne 0x100aff8
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x100b002
cmp al, 0x20
jbe 0x100aff4
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x100b026
movzx eax, word [ebp - 0x48]
jmp 0x100b029
cmp byte [esi], 0x20
jbe 0x100aff8
inc esi
mov dword [ebp - 0x34], esi
jmp 0x100b01b
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x100b046
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100b07b
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100b16d
ret
Function at 0x100b3bb
Capabilities:
Get domain controller name
Get hostname
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
xor ebx, ebx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x100b3e6
mov word [ebp - 0x3c], bx
cmp dword [ebp + 0xc], ebx
je 0x100b41b
push dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100b41b
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x100b41b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
jmp 0x100b421
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
call edi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
call esi
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x100b4a5
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
call esi
mov esi, eax
cmp esi, ebx
je 0x100b497
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x100b490
cmp dword [ebp - 0x14], 1
jne 0x100b490
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp + 0xc], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp + 0xc], ebx
je 0x100b4a5
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x100b4b5
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 0x18]
leave
ret 8
Function at 0x100b4bc
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
test eax, eax
jne 0x100b5a8
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x208
push edi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x100b5a6
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
push 1
push ebx
push 0x1002ba8
push 0x80000002
mov word [edi], bx
call esi
test eax, eax
jne 0x100b5a6
lea eax, [ebp + 0xc]
push eax
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
jne 0x100b59d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x1002b80
push dword [ebp + 0xc]
mov esi, 0x104
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100b594
cmp dword [ebp + 8], 2
jne 0x100b57c
push esi
push edi
lea eax, [ebp - 0x214]
push eax
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x100b57c
mov dword [ebp + 8], 1
cmp dword [ebp + 8], 1
jne 0x100b594
lea eax, [ebp - 0x214]
push eax
push edi
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret 8
Function at 0x100b951
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
xor ebx, ebx
cmp dword [0x102bf8c], ebx
mov dword [ebp - 8], ebx
jne 0x100ba6f
push esi
push 7
xor esi, esi
call fcn.0100bcdc
test eax, eax
je 0x100b9ca
call fcn.0100b880
cmp ax, bx
mov word [0x102bf88], ax
je 0x100ba5a
push 0x10
lea ecx, [ebp - 0x38]
push ecx
movzx eax, ax
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100ba5a
test byte [ebp - 0x29], 8
je 0x100ba5a
xor eax, eax
mov ax, word [0x102bf88]
push eax
call fcn.0100b8f2
test eax, eax
je 0x100ba5a
jmp 0x100ba57
push 5
call fcn.0100bcdc
test eax, eax
je 0x100ba5a
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x100ba5a
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x1002c30
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ba5a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 0x1002c2c
push dword [ebp - 4]
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov byte [ebp - 0xd], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0100b7a1
test eax, eax
je 0x100ba5a
mov eax, dword [ebp - 8]
and eax, 0x3ff
cmp eax, 1
je 0x100ba51
cmp eax, 0xd
jne 0x100ba5a
mov word [0x102bf88], ax
xor esi, esi
inc esi
xor eax, eax
cmp esi, ebx
sete al
inc eax
push eax
push 0x102bf8c
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop esi
cmp dword [0x102bf8c], 1
jne 0x100ba89
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x100ba89
mov cx, word [0x102bf88]
mov word [eax], cx
xor eax, eax
cmp dword [0x102bf8c], 1
pop ebx
sete al
leave
ret 4

Function at 0x100baa2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp + 0xc]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x100bb01
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x100baf8
cmp dword [ebp - 0xc], 4
je 0x100baf8
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xc]
push eax
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x100bb44
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x100bb3b
cmp dword [ebp - 0xc], esi
je 0x100bb3b
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10