joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006afc
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x1006b1a
push 0x2818
call fcn.01006518
pop ecx
push 1
call dword [sym.imp.msvcrt.dll_exit]
push ebx
push edi
push 0x1003d14
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcsstr]
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x1006b42
push dword [ebp + 8]
push 0x2819
call fcn.01006518
pop ecx
jmp 0x1006b11
push 0x2c
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x1006b58
xor eax, eax
mov word [ebx], ax
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1006b5d
sub eax, ecx
sar eax, 1
push esi
lea esi, [eax + 1]
lea eax, [esi + esi]
push eax
call fcn.01006572
add edi, 0x12
push edi
push esi
push eax
mov dword [0x1009514], eax
call fcn.01004da2
mov esi, eax
test esi, esi
jge 0x1006ba8
push esi
call fcn.010065ad
push eax
push esi
push 0x278b
call fcn.01006518
add esp, 0xc
jmp 0x1006b12
pop esi
test ebx, ebx
je 0x1006bb3
push 0x2c
pop eax
mov word [ebx], ax
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1006bbe
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push esi
push edi
push 0x1003cfc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x10067c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.010065ad
push eax
push esi
push 0x278f
call fcn.01006518
add esp, 0xc
push 1
call dword [sym.imp.msvcrt.dll_exit]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1003ce0
push edi
call esi
mov dword [0x1009550], eax
test eax, eax
jne 0x10067f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.010065ad
push eax
push esi
push 0x2790
jmp 0x10067b4
push 0x1003cd0
push edi
call esi
mov dword [0x100954c], eax
test eax, eax
je 0x10067db
push 0x1003cc4
push edi
call esi
mov dword [0x1009548], eax
test eax, eax
je 0x10067db
push 0x1003cac
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x100679f
push 0x1003c94
push eax
call esi
mov dword [0x1009544], eax
test eax, eax
je 0x10067db
pop edi
pop esi
ret
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x1009568], eax
test eax, eax
jne 0x1006bff
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
call fcn.010065ad
push eax
call esi
push eax
push 0x1003d28
call dword [sym.imp.msvcrt.dll_printf]
add esp, 0xc
push 1
call dword [sym.imp.msvcrt.dll_exit]
jmp 0x100678a
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x45686a4a
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x722e6160
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6a
sub eax, 0x403d10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x1003965
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x100d618
call fcn.01003b64
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100f3ac
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100377a
cmp eax, esi
jne 0x100376d
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x100377d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003754
xor esi, esi
inc esi
mov eax, dword [0x100f3a8]
cmp eax, esi
jne 0x1003790
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10037cb
mov eax, dword [0x100f3a8]
test eax, eax
jne 0x10037c5
mov dword [0x100f3a8], esi
push 0x1001218
push 0x100120c
call fcn.010036d1
pop ecx
pop ecx
test eax, eax
je 0x10037cb
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1003895
mov dword [0x100f068], esi
mov eax, dword [0x100f3a8]
cmp eax, esi
jne 0x10037ef
push 0x1001208
push 0x1001200
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100f3a8], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10037fc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100f3b0], ebx
je 0x100381d
push 0x100f3b0
call fcn.01003ad9
pop ecx
test eax, eax
je 0x100381d
push ebx
push 2
push ebx
call dword [0x100f3b0]
push dword [0x100f050]
push dword [0x100f054]
push dword [0x100f04c]
call fcn.010021e7
add esp, 0xc
mov dword [0x100f064], eax
cmp dword [0x100f058], ebx
jne 0x100387b
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x100f068], ebx
jne 0x1003889
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100f064]
call fcn.01003ba9
ret
call fcn.01003cb1
jmp 0x1003732

Function at 0x10045f2
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01007e8c
Function at 0x1004fb2
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ecx, 0x100d0d6
xor esi, esi
mov eax, ecx
push edi
mov dword [ebp - 8], esi
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
cmp di, si
jne 0x1004fcc
mov edi, dword [ebp + 8]
sub eax, edx
sar eax, 1
mov ebx, eax
push ebx
push ecx
push edi
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x1005158
lea eax, [edi + ebx*2]
push 0x5c
push eax
call sub.msvcrt.dll_wcschr
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1005158
mov ecx, dword fs:[0x18]
mov ebx, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
sub eax, edi
sar eax, 1
lea edi, [eax + eax]
lea eax, [edi + 2]
push eax
mov eax, dword [ecx + 0x30]
push 0
push dword [eax + 0x18]
call ebx
mov dword [ebp - 4], eax
test eax, eax
jne 0x100503f
mov dword [ebp - 8], 0xc000009a
jmp 0x1005114
push edi
push dword [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
xor ecx, ecx
mov word [edi + eax], cx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1005058
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 0x16]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1005070
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 0x2e]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
add ecx, edi
push ecx
push 0
push dword [eax + 0x18]
mov dword [ebp + 8], ecx
call ebx
mov esi, eax
test esi, esi
je 0x1005033
push dword [ebp + 8]
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xc]
add esp, 0xc
lea ebx, [edi + esi]
mov dword [esi], 3
mov dword [esi + 0x14], edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10050be
push dword [ebp - 0xc]
sub eax, ecx
sar eax, 1
inc eax
push eax
lea eax, [esi + 0x18]
push eax
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [ebp - 4]
add esp, 0xc
push 2
pop edx
mov dword [ebx], edx
lea ecx, [eax + 2]
mov di, word [eax]
add eax, edx
test di, di
jne 0x10050e8
push dword [ebp - 4]
sub eax, ecx
sar eax, 1
inc eax
push eax
add ebx, 0x14
push ebx
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [eax], ecx
cmp dword [ebp - 4], 0
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
je 0x1005133
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call edi
cmp dword [ebp - 8], 0
jge 0x100514e
test esi, esi
je 0x100514e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call edi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dword [ebp - 8], 0xc000000d
jmp 0x100514e
Function at 0x100712e
Capabilities:
Access peb ldr_data
Query or enumerate registry key

Disassembly:
push 0x14
push 0x100d6b8
call fcn.01003b64
xor ebx, ebx
mov dword [ebp - 0x24], ebx
xor esi, esi
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov edi, dword [sym.imp.ntdll.dll_NtQueryKey]
call edi
mov dword [ebp - 0x1c], eax
cmp eax, 0xc0000023
je 0x1007171
cmp eax, ebx
jl 0x10071ea
mov dword [ebp - 0x1c], 0xc000000d
jmp 0x10071ea
mov eax, dword fs:[0x18]
push dword [ebp - 0x20]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
jne 0x1007196
mov dword [ebp - 0x1c], 0xc000009a
jmp 0x10071ea
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push esi
push ebx
push dword [ebp + 8]
call edi
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jl 0x10071ea
mov eax, dword fs:[0x18]
mov ecx, dword [esi + 0xc]
inc ecx
inc ecx
push ecx
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
cmp edi, ebx
je 0x100718d
push dword [esi + 0xc]
lea eax, [esi + 0x10]
push eax
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 0xc]
shr eax, 1
xor ecx, ecx
mov word [edi + eax*2], cx
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
cmp esi, ebx
je 0x1007202
mov eax, dword fs:[0x18]
push esi
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x1c], 0xc000017d
jne 0x100723d
mov dword [ebp - 4], ebx
int3
mov eax, dword [ebp - 0x1c]
call fcn.01003ba9
ret 8
Function at 0x10079c0
Capabilities:
Get process heap flags
Query or enumerate registry value

Disassembly:
push 0x20
push 0x100d718
call fcn.01003b64
xor esi, esi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x24], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
cmp dword [ebp + 0x10], esi
je 0x1007a12
lea eax, [ebp - 0x24]
push eax
push 0x20019
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0100781a
mov dword [ebp - 0x1c], eax
cmp eax, esi
jl 0x1007acd
jmp 0x1007a18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push 2
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov dword [ebp - 0x1c], eax
cmp eax, 0xc0000023
jne 0x1007acd
mov eax, dword fs:[0x18]
push dword [ebp - 0x20]
push esi
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
cmp edi, esi
jne 0x1007a60
mov dword [ebp - 0x1c], 0xc000009a
jmp 0x1007acd
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
push edi
push 2
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov dword [ebp - 0x1c], eax
cmp eax, esi
jl 0x1007acd
mov eax, dword [edi + 4]
cmp eax, dword [ebp + 0x14]
je 0x1007a8f
mov dword [ebp - 0x1c], 0xc0000024
jmp 0x1007acd
sub dword [ebp - 0x20], 0xc
mov eax, dword fs:[0x18]
push dword [ebp - 0x20]
push esi
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp eax, esi
je 0x1007a57
push dword [ebp - 0x20]
lea ecx, [edi + 0xc]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp + 8]
je 0x1007ae0
cmp eax, esi
je 0x1007ae0
push eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp edi, esi
je 0x1007af8
mov eax, dword fs:[0x18]
push edi
push esi
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x1c], 0xc000017d
jne 0x1007b2c
mov dword [ebp - 4], esi
int3
mov eax, dword [ebp - 0x1c]
call fcn.01003ba9
ret 0x18
Function at 0x100bb18
Capabilities:
Get process heap flags
Get storage device properties

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x100f004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x44], esi
call fcn.0100ca36
test al, al
jne 0x100bb43
xor eax, eax
jmp 0x100bc8e
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push 1
push 0x100d1e6
push 0x100d4c0
push esi
call fcn.0100c24e
mov ebx, dword [sym.imp.ntdll.dll_RtlFreeHeap]
test eax, eax
jl 0x100bc73
cmp dword [ebp - 0x40], 4
jb 0x100bc73
push dword [ebp - 0x3c]
shr dword [ebp - 0x40], 1
call sub.msvcrt.dll__wcslwr
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x100d48a
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
call sub.msvcrt.dll__snwscanf_s
add esp, 0x1c
cmp eax, 3
jne 0x100bc73
cmp dword [ebp - 0x54], esi
jne 0x100bc73
cmp dword [ebp - 0x4c], esi
jne 0x100bc73
cmp dword [ebp - 0x48], esi
jne 0x100bc73
lea eax, [ebp - 0x50]
push eax
push 0x100d448
call fcn.0100c39a
test eax, eax
jl 0x100bc73
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [ebp - 0x3c]
push esi
push dword [eax + 0x18]
call ebx
mov edx, dword [ebp - 0x50]
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa
stosd dword es:[edi], eax
pop ecx
xor eax, eax
push 0x28
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.0100c942
cmp eax, esi
pop edi
jge 0x100bc2e
cmp eax, 0xc000003a
jmp 0x100bc32
cmp dword [ebp - 0x1c], 7
jne 0x100bc73
push 0x100d406
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x6c]
push eax
push 0x20001
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x6c], 0x18
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
call dword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
cmp dword [ebp - 0x3c], esi
je 0x100bc8a
push dword [ebp - 0x3c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call ebx
mov eax, dword [ebp - 0x44]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100398b
leave
ret
Function at 0x100bccc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push edi
push 0x100d448
lea eax, [ebp - 0x14]
xor edi, edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push 0x20001
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
mov ebx, eax
cmp ebx, edi
jge 0x100bd48
cmp ebx, 0xc0000017
je 0x100bddc
cmp ebx, 0xc000009a
je 0x100bddc
mov ebx, 0xc0000452
jmp 0x100bddc
push dword [ebp - 4]
call fcn.0100bca0
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xc], edi
call esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySymbolicLinkObject]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov ebx, eax
cmp ebx, 0xc0000023
je 0x100bd85
cmp ebx, edi
jl 0x100bddc
mov ebx, 0xc0000001
jmp 0x100bddc
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
add ecx, 2
push ecx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x100bdad
mov ebx, 0xc000009a
jmp 0x100bddc
mov dword [ebp - 0x10], eax
mov ax, word [ebp - 0xc]
mov word [ebp - 0x12], ax
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov ebx, eax
cmp ebx, edi
jl 0x100bddc
movzx ecx, word [ebp - 0x14]
mov eax, dword [ebp - 8]
shr ecx, 1
xor edx, edx
mov word [eax + ecx*2], dx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [ebp - 4], edi
je 0x100bdea
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
cmp ebx, edi
jge 0x100be09
cmp dword [ebp - 8], edi
je 0x100be09
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x100bfde
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword fs:[0x18]
push ebx
push esi
xor ebx, ebx
push 0x6a
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
mov byte [ebp - 1], bl
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jne 0x100c01f
mov esi, 0xc0000017
jmp 0x100c148
test byte [ebp + 0xc], 1
push edi
je 0x100c03d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0100bf50
mov esi, eax
cmp esi, ebx
jge 0x100c18f
push ebx
push 0x18
lea eax, [ebp - 0x34]
push eax
push 7
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp esi, ebx
jl 0x100c131
mov dword [ebp + 0xc], ebx
cmp dword [ebp - 0x34], ebx
jbe 0x100c12c
push ebx
push dword [ebp + 0xc]
push 0x100d104
push 0x35
push dword [ebp - 0x14]
call sub.msvcrt.dll_swprintf_s
add esp, 0x14
cmp dword [ebp - 8], ebx
je 0x100c096
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 8], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
call fcn.0100c61a
test eax, eax
jl 0x100c118
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jne 0x100c118
mov dword [ebp - 0x1c], ebx
cmp dword [eax + 4], ebx
jbe 0x100c118
add eax, 0x48
push 4
pop ecx
mov edi, 0x10018ac
lea esi, [eax + 8]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x100c0de
cmp byte [ebp - 1], bl
jne 0x100c0f3
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax]
mov byte [ebp - 1], 1
mov dword [ebp - 0xc], ecx
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add eax, 0x90
cmp edx, dword [ecx + 4]
jb 0x100c0b9
jmp 0x100c118
lea eax, [ebp - 0x18]
push eax
call fcn.0100ca96
test eax, eax
jl 0x100c186
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call fcn.0100c502
test eax, eax
jl 0x100c186
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x34]
jb 0x100c062
cmp byte [ebp - 1], bl
jne 0x100c18d
mov esi, 0xc0000452
push dword [ebp - 0x14]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
cmp dword [ebp - 8], ebx
je 0x100c163
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x18], ebx
je 0x100c17e
push dword [ebp - 0x18]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
mov esi, 0xc0000451
jmp 0x100c131
xor esi, esi
cmp dword [ebp + 8], ebx
jne 0x100c197
mov dword [ebp - 0xc], ebx
push dword [ebp - 0xc]
mov edi, dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0x100d104
push 0x35
push edi
call sub.msvcrt.dll_swprintf_s
mov eax, dword [ebp + 0x10]
add esp, 0x14
mov dword [eax], edi
jmp 0x100c147
Function at 0x100cbc1
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x100cc16
jle 0x100cbf8
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100cc67
test byte [eax + 0x1c], 1
je 0x100cc67
push esi
push 0x100190c
push 0xd
jmp 0x100cc58
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
je 0x100cc65
jle 0x100cc3c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100cc67
test byte [eax + 0x1c], 1
je 0x100cc67
push esi
push 0x100190c
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001a58
jmp 0x100cc67
xor esi, esi
cmp dword [ebp - 4], edi
je 0x100cc75
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret 0x18