joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454070
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x45410f
cmp dword [ebx + 0x94], 0
jne 0x454109
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x453ff8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x454109
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4540cf
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x454109
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414368
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4540de
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454328
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x461c90]
cmp dword [eax + 0x30], 0
je 0x454485
test bl, bl
jne 0x4543d6
cmp dword [esi + 0x9c], 0
jne 0x4543cb
mov eax, esi
call fcn.00456b24
push eax
push 0x454254
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x45439c
mov eax, dword [0x461c90]
call fcn.00457204
test al, al
je 0x45439c
mov eax, dword [0x461cb4]
call fcn.0040570c
mov edi, eax
cmp edi, 0
jl 0x45439c
push 0
mov eax, dword [0x461cb4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x454386
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4543cb
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414368
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4543ab
inc dword [esi + 0x9c]
jmp 0x454485
cmp dword [esi + 0x9c], 0
jle 0x454485
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x454485
cmp dword [esi + 0x44], 0
je 0x454431
mov eax, dword [0x461c90]
call fcn.00457204
test al, al
je 0x454431
mov eax, dword [0x461cb4]
call fcn.0040570c
mov edi, eax
cmp edi, 0
jl 0x454431
push 5
mov eax, dword [0x461cb4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45441b
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x454460
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414368
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x454440
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x461cb4
mov ecx, 1
mov edx, dword [0x454234]
call fcn.004058c0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x454f18
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x454f82
mov eax, ebx
call fcn.00457204
test al, al
jne 0x454f82
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404940
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x454f6f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x454f8f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004048a4
jmp 0x454f8f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004048a4
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x456328
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x456396
mov eax, esi
call fcn.0044005c
test al, al
je 0x456396
mov eax, dword [ebx + 0x84]
call fcn.0043fcac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x456396
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45638a
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043fcac
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00437c74
jmp 0x456396
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00456164
pop esi
pop ebx
ret

Function at 0x457ca8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x457d31
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x461cc4
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x457d1b
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040b5b0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x457d48
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x45ca3c]
mov dl, 1
mov eax, dword [0x4574ac]
call fcn.0040bee0
call fcn.00404298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457d38
lea eax, [ebp - 0x1c]
call fcn.00404850
ret

Function at 0x458300
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
xor esi, esi
xor edi, edi
movzx eax, byte [0x45835c]
cmp al, byte [ebx + 0x28]
je 0x458324
mov esi, 0x401
mov eax, ebx
call fcn.0045844c
mov edi, eax
movzx eax, byte [ebx + 0x28]
push eax
push esi
push edi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
movzx eax, byte [0x45835c]
cmp al, byte [ebx + 0x28]
jne 0x458354
xor eax, eax
mov dword [esp], eax
push esp
push 0x8004667e
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_ioctlsocket
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4583e0
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.00458300
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403c38
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x458444
call fcn.00457bf0
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x458436
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403c38
pop esi
pop ebx
ret

Function at 0x458468
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00404ce0
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00403378
test ebx, ebx
je 0x4584b7
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
movzx ecx, byte [edx]
mov byte [esp + 4], cl
movzx ecx, byte [edx + 1]
mov byte [esp + 5], cl
movzx ecx, byte [edx + 2]
mov byte [esp + 6], cl
movzx eax, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x458594
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4585c5
mov ecx, dword [0x45c984]
mov dl, 1
mov eax, dword [0x4574ac]
call fcn.0040bea4
call fcn.00404298
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x4585f2
mov ecx, dword [0x45c930]
mov dl, 1
mov eax, dword [0x4574ac]
call fcn.0040bea4
call fcn.00404298
xor eax, eax
push ebp
push 0x45866e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403c38
cmp byte [ebp + 8], 0
je 0x45864a
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004584fc
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.004583e0
jmp 0x458664
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00457ee0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45868b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x458864
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0045819c
xor eax, eax
push ebp
push 0x4589d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4589c1
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4588b0
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4588ba
call fcn.00404344
jmp 0x4589de
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004161e4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4589b6
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x458969
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x458956
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403c38
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0045881c
pop ecx
mov eax, dword [ebp - 4]
movzx edx, byte [0x4589ec]
cmp dl, byte [eax + 0x28]
je 0x4589bd
call fcn.0040bdc8
jmp 0x4589bd
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00416204
jmp 0x4589bd
cmp edi, ebx
jge 0x458985
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00416204
jmp 0x4588ba
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004161e4
cmp edx, dword [esp + 4]
jne 0x4589a5
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4588ba
push ebp
call fcn.0045881c
pop ecx
jmp 0x4589bd
push ebp
call fcn.0045881c
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4589de
mov eax, dword [ebp - 4]
call fcn.004581a8
ret
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4589f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x458b12
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045819c
xor eax, eax
push ebp
push 0x458af5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x458a40
call fcn.00404344
jmp 0x458afc
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x458adf
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x458adf
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403c38
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x458adf
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040b5b0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x458b2c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x45ca3c]
mov dl, 1
mov eax, dword [0x4574ac]
call fcn.0040bee0
call fcn.00404298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458afc
mov eax, dword [ebp - 4]
call fcn.004581a8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458b19
lea eax, [ebp - 0x28]
call fcn.00404850
ret
Function at 0x458b78
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x458ce9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045819c
xor eax, eax
push ebp
push 0x458ccc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x458bdd
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x458bdd
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x458cb6
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x458bf0
call fcn.00404344
jmp 0x458cd3
lea eax, [ebp - 0x10]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x458c17
cmp dword [ebp - 0x10], 0
jle 0x458c17
cmp ebx, dword [ebp - 0x10]
jle 0x458c17
mov ebx, dword [ebp - 0x10]
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x458cb6
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x458cb6
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403c38
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x458cb6
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.0040b5b0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, 0x458d04
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea eax, [ebp - 0x28]
push eax
push 2
mov ecx, dword [0x45ca3c]
mov dl, 1
mov eax, dword [0x4574ac]
call fcn.0040bee0
call fcn.00404298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458cd3
mov eax, dword [ebp - 4]
call fcn.004581a8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458cf0
lea eax, [ebp - 0x2c]
call fcn.00404850
ret
Function at 0x10008aa0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
ret

Function at 0x100490d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x324
mov eax, dword [esp + 0x328]
xor ecx, ecx
xor edx, edx
push ebx
mov cl, byte [eax]
mov dl, byte [eax + 1]
mov dword [esp + 0xec], ecx
mov dword [esp + 0xf0], edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 2]
mov dl, byte [eax + 3]
mov dword [esp + 0xf4], ecx
mov dword [esp + 0xf8], edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 4]
mov dl, byte [eax + 5]
mov dword [esp + 0xfc], ecx
mov dword [esp + 0x100], edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 6]
mov dl, byte [eax + 7]
push ebp
push esi
push edi
mov dword [esp + 0x110], ecx
mov dword [esp + 0x114], edx
xor ebx, ebx
xor eax, eax
lea edi, [esp + 0x234]
mov dword [esp + 0x10], eax
mov esi, 0x10027630
sub eax, ebx
mov ecx, 7
mov ebp, dword [esp + eax + 0xf8]
mov eax, ebp
xor edx, edx
sar eax, cl
mov dl, byte [esi]
add edi, 4
and eax, 1
dec ecx
mov dword [edi - 4], eax
inc esi
cmp ecx, 0xffffffff
mov dword [esp + edx*4 + 0x130], eax
jg 0x10049162
mov eax, dword [esp + 0x10]
add eax, 4
cmp esi, 0x10027670
mov dword [esp + 0x10], eax
jl 0x10049154
xor ebp, ebp
xor esi, esi
lea edi, [esp + 0x134]
mov eax, esi
mov ecx, 7
sub eax, ebx
mov dword [esp + eax + 0xd8], ebp
mov eax, esi
sub eax, ebx
lea edx, [esp + eax + 0xd8]
mov eax, edi
mov edi, dword [eax]
add eax, 4
shl edi, cl
or dword [edx], edi
dec ecx
cmp ecx, 0xffffffff
jg 0x100491bc
add esi, 4
mov edi, eax
cmp esi, 0x20
jl 0x1004919f
add ebx, 0x20
cmp ebx, 0xe0
jl 0x10049142
mov edi, dword [esp + 0x33c]
xor edx, edx
lea eax, [edi + 4]
lea ecx, [esp + 0x34]
mov esi, 8
sub ecx, edi
mov ebx, dword [ecx + eax]
add eax, 4
xor ebx, edx
dec esi
mov dword [eax - 4], ebx
jne 0x100491fb
inc edx
cmp edx, 7
jl 0x100491f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x324
ret 8
Function at 0x1009393
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x102089c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10093fd
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10093f4
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [entry0]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.0101645a
leave
ret

Function at 0x1009584
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x102089c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x454], 0
push esi
mov esi, dword [ebp + 8]
push edi
push 0x38
lea eax, [ebp - 0x450]
push 0
push eax
call fcn.010165e0
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x1001670
push 0x1001664
push 1
push 0
mov dword [ebp - 0x418], 0x208
call dword [fcn.01001198]
mov edi, eax
test edi, edi
jl 0x1009635
lea eax, [ebp - 0x454]
push eax
mov dword [ebp - 0x454], 0x3c
mov dword [ebp - 0x450], 0x100
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x438], 0xa
call dword [fcn.01001188]
test eax, eax
jne 0x1009635
call dword [fcn.01001130]
test eax, eax
jle 0x1009633
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0101645a
leave
ret 4

Function at 0x1009c87
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
mov esi, ecx
call fcn.010165e0
lea eax, [esi + 0x64]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x58]
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0x10017e4
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x140
mov dword [ebp - 0x20], 5
call dword [fcn.01001188]
test eax, eax
jne 0x1009cf5
call dword [fcn.01001130]
test eax, eax
jle 0x1009cef
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x1009d36
cmp dword [ebp - 4], 0
je 0x1009d31
push 0xffffffffffffffff
push dword [ebp - 4]
xor edi, edi
call dword [fcn.01001068]
add esi, 0x60
push esi
push dword [ebp - 4]
call dword [0x1001064]
push dword [ebp - 4]
call dword [0x1001138]
cmp dword [esi], edi
jne 0x1009d36
cmp dword [ebp + 0xc], edi
jne 0x1009d36
push dword [ebp + 8]
call fcn.01009584
jmp 0x1009d36
mov edi, 0x80004005
mov eax, edi
pop edi
pop esi
leave
ret 8
Function at 0x100ad65
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
xor edi, edi
call fcn.01009db6
test eax, eax
mov eax, 0x1001b60
jne 0x100ad83
mov eax, 0x1001ad8
lea ecx, [ebp - 4]
push ecx
push 1
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100add8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x1001ab4
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100adcf
cmp dword [ebp - 0xc], 4
jne 0x100adcf
cmp dword [ebp - 0x10], 1
jne 0x100adcf
xor edi, edi
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret

Function at 0x100ade2
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x102089c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
push ebx
mov ebx, ecx
jne 0x100ae0b
mov eax, 0x80070057
jmp 0x100aee0
push esi
push edi
push eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010088d6
mov edi, eax
test edi, edi
jl 0x100aedc
push 0x1001be8
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01008910
mov edi, eax
test edi, edi
jl 0x100aedc
push 0x38
lea eax, [ebp - 0x244]
push 0
push eax
call fcn.010165e0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x234], eax
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x248], 0x3c
mov dword [ebp - 0x238], 0x1001bd0
mov dword [ebp - 0x244], 0x40
mov dword [ebp - 0x22c], 1
mov edi, 0x80004005
call dword [fcn.01001188]
test eax, eax
je 0x100aedc
push 0xffffffffffffffff
push dword [ebp - 0x210]
call dword [fcn.01001068]
test eax, eax
jne 0x100aed0
lea esi, [ebx + 0x60]
push esi
push dword [ebp - 0x210]
call dword [0x1001064]
test eax, eax
je 0x100aed0
cmp dword [esi], 0
jne 0x100aed0
xor edi, edi
push dword [ebp - 0x210]
call dword [0x1001138]
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0101645a
leave
ret 4

Function at 0x100b047
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01009f5a
Function at 0x100cd1b
Capabilities:
Download url
Receive data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102089c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
xor eax, eax
lea edi, [esi + 0x14]
cmp dword [edi], eax
mov dword [ebp - 0x214], eax
jne 0x100cd72
mov ecx, dword [esi + 0xc]
push eax
push eax
push 0x105
lea edx, [ebp - 0x210]
push edx
push ecx
push eax
call fcn.01019110
mov ebx, eax
test ebx, ebx
jl 0x100cdc6
lea eax, [ebp - 0x210]
push eax
mov ecx, edi
call fcn.0100cbdc
xor eax, eax
lea ecx, [ebp - 0x214]
push ecx
push 0x1001d28
push 1
push eax
push 0x1001d18
call dword [fcn.0100137c]
mov ebx, eax
test ebx, ebx
jl 0x100cdc6
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x28]
mov ebx, eax
test ebx, ebx
jl 0x100cdc6
mov edi, dword [edi]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x50]
mov ebx, eax
cmp ebx, 0x80004005
jne 0x100cdc6
cmp dword [esi + 0x1c], 0
je 0x100cdc6
xor ebx, ebx
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x100cdd6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0101645a
leave
ret