joyce8/EMBER2024-capa huggingface dataset:
Function at 0x594e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x594f7
add esp, 0xfffffff0
call fcn.00013384
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0002aa40
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x21a3c]
call fcn.00013014
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x21a3c]
call fcn.00013014
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x2c8e8]
call fcn.00033a00
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x5966c
mov eax, dword [0x149a58]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00033dd0
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5b014
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x149a58]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0001edd4
test eax, eax
je 0x595ea
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0001b434
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0001edfc
test eax, eax
je 0x595fe
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00014014
mov eax, dword [0x1498a8]
cmp byte [eax], 0
jne 0x5962f
mov eax, ebx
call fcn.00059758
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x59661
call fcn.000133dc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x599c8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x14a7d0]
cmp dword [eax + 0x24], 0
je 0x59a6b
cmp dword [ebx + 0x84], 0
jne 0x59a65
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x59958
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x59a65
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x59a2e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x59a65
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.00023670
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x59a3d
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x5a478
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x5a4ad
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00013ecc
jmp 0x5a4b7
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00013e38
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x5b388
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x5b3c0
mov eax, esi
call fcn.00043168
test al, al
je 0x5b3c0
mov eax, dword [ebx + 0x74]
call fcn.00042e6c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5b3c0
push 0
mov eax, dword [ebx + 0x74]
call fcn.00042e6c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x5f220
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x205c0]
call fcn.00014858
xor eax, eax
push ebp
push 0x5f367
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x147b48], 0
jne 0x5f273
mov ecx, dword [0x1498d0]
mov dl, 1
mov eax, dword [0x1989c]
call fcn.0001e234
call fcn.000137dc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00012cd0
mov eax, ebx
call fcn.0001462c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x5f378
lea edi, [ebp - 0x30]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00017604
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.0001463c
test eax, eax
jle 0x5f30e
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x5f307
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0001402c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00014014
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0001a65c
test eax, eax
jne 0x5f307
mov ebx, 0x15
jmp 0x5f313
mov ebx, 0x10
jmp 0x5f313
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x147b48]
call fcn.0005f11c
mov eax, dword [ebp - 8]
call fcn.0005f11c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.0001761c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f36e
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00013e08
lea eax, [ebp - 0x10]
mov edx, dword [0x205c0]
call fcn.00014924
ret

Function at 0x5ff74
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00014228
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x5ff8d
test al, 0x10
jne 0x5ff91
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x5ffd0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x5fff1
cmp ecx, 0x100
jle 0x60007
mov ecx, 0x60094
mov dl, 1
mov eax, dword [0x1989c]
call fcn.0001e178
call fcn.000137dc
xor ebx, ebx
mov esi, dword [ebp - 4]
lea edi, [ebp - 0x109]
mov byte [esi], bl
mov eax, ebx
cdq
idiv ecx
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [edi], al
inc ebx
inc edi
inc esi
cmp ebx, 0x100
jne 0x60012
xor esi, esi
mov ebx, pe_nt_image_headers32
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x109]
xor ecx, ecx
mov cl, byte [eax]
add esi, ecx
xor ecx, ecx
mov cl, byte [edx]
add esi, ecx
and esi, 0xff
mov cl, byte [eax]
mov byte [ebp - 9], cl
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + esi]
mov byte [eax], cl
mov ecx, dword [ebp - 4]
lea edi, [ecx + esi]
mov cl, byte [ebp - 9]
mov byte [edi], cl
inc edx
inc eax
dec ebx
jne 0x6003b
mov edx, dword [ebp - 4]
add edx, 0x100
mov eax, dword [ebp - 4]
mov ecx, pe_nt_image_headers32
call fcn.00012948
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x600ac
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor eax, eax
xor ecx, ecx
mov ebx, dword [ebp + 8]
dec ebx
test ebx, ebx
jl 0x60139
inc ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0
inc eax
and al, 0xff
xor ebx, ebx
mov bl, al
add cl, byte [edx + ebx]
and cl, 0xff
xor ebx, ebx
mov bl, al
mov bl, byte [edx + ebx]
mov byte [ebp - 5], bl
mov esi, ecx
and esi, 0xff
xor ebx, ebx
mov bl, al
lea edi, [edx + ebx]
mov bl, byte [edx + esi]
mov byte [edi], bl
mov bl, byte [ebp - 5]
mov byte [edx + esi], bl
xor ebx, ebx
mov bl, al
mov bl, byte [edx + ebx]
mov esi, ecx
and esi, 0xff
add bl, byte [edx + esi]
and bl, 0xff
mov byte [ebp - 5], bl
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov bl, byte [ebx + esi]
movzx esi, byte [ebp - 5]
xor bl, byte [edx + esi]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0xc]
mov byte [esi + edi], bl
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x600cf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x61518
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x61542
cmp dword [ebx + 0x64], 0
jne 0x61542
cmp dword [ebx + 0x6c], 0
jne 0x61542
mov edi, esi
jmp 0x615c9
cmp edi, 0xffffffff
jne 0x6154a
dec edi
jmp 0x615c9
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x615c9
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.000605dc
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x61597
mov cx, word [esp]
sub cx, si
jmp 0x61599
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x61580
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x615bf
mov cx, word [esp]
sub cx, si
jmp 0x615c1
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x615a8
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x61626
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.000612b4
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x61611
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x61626
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x61522
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x64c7c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x94], ebx
mov esi, dword [ebp + 0x14]
lea edi, [ebp - 0x90]
push ecx
mov ecx, 0x1a
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00014218
lea eax, [ebp - 0x90]
mov edx, dword [0x63db8]
call fcn.00014a44
mov eax, dword [ebp + 8]
call fcn.00014218
xor eax, eax
push ebp
push 0x64e31
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x64dea
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x64e44
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
push 0x64e50
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
push 0x64e60
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x14], eax
push 0x64e74
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x18], eax
push 0x64e88
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x1c], eax
push 0x64ea0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x20], eax
push 0x64ebc
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x24], eax
push 0x64ecc
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0xc]
jg 0x64de0
mov eax, dword [ebp - 4]
mov edx, 0x64ee4
call fcn.00014174
je 0x64dd0
cmp dword [ebp - 4], 0
je 0x64dd0
call esi
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
push ebx
call dword [ebp - 0x14]
mov eax, dword [ebp - 8]
push eax
push ebx
call dword [ebp - 0x18]
push 0x64ef4
push ebx
call dword [ebp - 0x1c]
push 0x64f04
push ebx
call dword [ebp - 0x20]
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x94]
push eax
mov ecx, 0x64f04
lea edx, [ebp - 0x90]
mov eax, edi
call fcn.00064370
mov eax, dword [ebp - 0x94]
push eax
push ebx
call dword [ebp - 0x28]
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [ebp - 0x24]
cmp dword [ebp - 0xc], 0
je 0x64ddc
mov byte [ebp - 0xd], 0
jmp 0x64de0
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64df4
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64e38
lea eax, [ebp - 0x94]
call fcn.00013de4
lea eax, [ebp - 0x90]
mov edx, dword [0x63db8]
call fcn.00014924
lea eax, [ebp - 4]
call fcn.00013de4
lea eax, [ebp + 8]
call fcn.00013de4
ret
Function at 0x66e38
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00012cd0
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x149e14]
cmp byte [edx + 8], 0
je 0x66e9c
mov edx, dword [0x149e0c]
cmp dword [edx], 2
jne 0x66e9c
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret

Function at 0x66ea0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x66f58
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00066e38
test al, al
je 0x66f3a
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00013ecc
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x66f3a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00014228
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00014228
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00013f9c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x66ef3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66f5f
lea eax, [ebp - 0x2c]
call fcn.00013de4
lea eax, [ebp - 0xc]
call fcn.00013de4
ret
Function at 0x66f68
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x67020
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00066e38
test al, al
je 0x67002
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00013ecc
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x67002
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00014228
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00014228
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00013f9c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x66fbb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67027
lea eax, [ebp - 0x2c]
call fcn.00013de4
lea eax, [ebp - 0xc]
call fcn.00013de4
ret

Function at 0x67204
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00066a94
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00014228
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x67262
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x149b8c]
mov dl, 1
mov eax, dword [0x6698c]
call fcn.0001e270
call fcn.000137dc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x6726c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00014228
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x672c4
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x149e20]
mov dl, 1
mov eax, dword [0x6698c]
call fcn.0001e270
call fcn.000137dc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00066ac4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x70aec
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x70c16
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
mov eax, ebx
call fcn.00070a24
test al, al
je 0x70bf0
lea edx, [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x20
call fcn.00012cd0
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x124]
xor edx, edx
call fcn.0001b490
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x228]
mov ecx, 0x70c30
mov edx, dword [ebp - 4]
call fcn.000140b0
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x224]
call fcn.0001b490
mov dword [ebp - 0x10], eax
push 0
mov esi, dword [ebx + 0x34]
mov eax, dword [esi + 4]
call fcn.00014228
push eax
mov eax, dword [esi + 8]
call fcn.00014228
push eax
lea eax, [ebp - 0x24]
push eax
call sub.mpr.dll_WNetAddConnection2A
cmp eax, 0x4c3
jne 0x70bee
push 0
push 0
lea eax, [ebp - 0x22c]
mov ecx, 0x70c30
mov edx, dword [ebp - 4]
call fcn.000140b0
mov eax, dword [ebp - 0x22c]
call fcn.00014228
push eax
call sub.mpr.dll_WNetCancelConnection2A
push 0
mov esi, dword [ebx + 0x34]
mov eax, dword [esi + 4]
call fcn.00014228
push eax
mov eax, dword [esi + 8]
call fcn.00014228
push eax
lea eax, [ebp - 0x24]
push eax
call sub.mpr.dll_WNetAddConnection2A
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70c1d
lea eax, [ebp - 0x22c]
mov edx, 2
call fcn.00013e08
lea eax, [ebp - 4]
call fcn.00013de4
ret

Function at 0x70dc4
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
jne 0x70de8
call fcn.0006a3f8
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00014014
add esp, 0x104
pop ebx
ret
Function at 0x714a8
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014218
xor eax, eax
push ebp
push 0x715d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
call sub.kernel32.dll_GetCurrentProcess
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
call fcn.0006a6ec
push eax
push 0
call fcn.00072a54
test eax, eax
je 0x715c3
lea eax, [ebp - 0xc]
push eax
push 0x20008
push ebx
call sub.advapi32.dll_OpenProcessToken_1
test eax, eax
jne 0x71509
call fcn.0006a3f8
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x10]
call fcn.000127e0
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x715bc
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x71563
call fcn.0001387c
jmp 0x715c3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
test eax, eax
jbe 0x715a6
mov esi, eax
dec esi
test esi, esi
jb 0x715a6
inc esi
xor ebx, ebx
lea edi, [ebx + ebx*2]
mov eax, dword [ebp - 0x14]
lea edx, [eax + edi*4 + 4]
lea eax, [ebp - 0x20]
mov ecx, 8
call fcn.0001b4f8
test eax, eax
jne 0x715a2
mov eax, dword [ebp - 0x14]
test dword [eax + edi*4 + 0xc], 2
seta byte [ebp - 5]
jmp 0x715a6
inc ebx
dec esi
jne 0x71576
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x715c3
mov eax, dword [ebp - 0x14]
call fcn.000127f8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x715e0
lea eax, [ebp - 4]
call fcn.00013de4
ret