joyce8/EMBER2024-capa huggingface dataset:
Function at 0x76e45ad8
Capabilities:
Print debug messages

Disassembly:
push 8
push 0x76e45be8
call fcn.76e42b25
xor ebx, ebx
mov dword [0x76e5f424], ebx
mov dword [ebp - 4], ebx
mov esi, 0x76e5f5a0
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
or dword [ebp - 4], 0xffffffff
mov ecx, 0x76e5f424
call fcn.76e45576
test eax, eax
jne 0x76e4810a
push 0x76e5f43c
push ebx
push 0x76e45bf4
push 0x76e46bb4
call fcn.76e46ae9
mov edi, eax
cmp edi, ebx
jne 0x76e4816b
push 0x76e5f590
push 0x20019
push ebx
push dword [0x76e5f43c]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebx
jne 0x76e4816b
mov dword [0x76e5f42c], 1
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x76e5f440], eax
cmp eax, ebx
je 0x76e48121
push 0x18
push 0xffffffffffffffff
push ebx
push fcn.76e4a2f7
push dword [0x76e5f3c0]
push 0x76e5f65c
call dword [sym.imp.ntdll.dll_RtlRegisterWait]
cmp eax, ebx
jl 0x76e48129
mov eax, dword [0x76e5f440]
mov dword [0x76e5f3c4], eax
or dword [0x76e5f3c8], 0xffffffff
mov dword [0x76e5f3cc], ebx
mov eax, dword [0x76e5f590]
mov dword [0x76e5f3d0], eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x76e5f3c4
call fcn.76e44e05
test eax, eax
je 0x76e48134
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.76e42b65
ret 8
push dword [0x76e5f424]
push 0x76e481ac
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
jmp 0x76e45bdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x76e48130
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
jmp 0x76e4816b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push dword [0x76e5f65c]
call dword [sym.imp.ntdll.dll_RtlDeregisterWait]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x76e4816b
push edi
push 0x76e48184
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
push ebx
push ebx
call fcn.76e4a2f7
jmp 0x76e45bdb

Function at 0x76e45e72
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
push esi
push edi
je 0x76e45ef9
cmp word [eax], bx
je 0x76e45ef9
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push ebx
push edi
call fcn.76e44d4a
cmp eax, ebx
jne 0x76e45ef2
cmp dword [ebp + 8], ebx
je 0x76e49b5d
push dword [ebp + 8]
call fcn.76e44d27
mov esi, eax
cmp esi, ebx
je 0x76e49b67
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x76e49b6b
cmp eax, ebx
jne 0x76e49b72
cmp dword [ebp - 4], 7
jne 0x76e49b76
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
push 0x57
jmp 0x76e49b86
mov eax, 0x863
jmp 0x76e45ef2
push 8
jmp 0x76e49b86
mov edi, 0x863
jmp 0x76e49b79
mov edi, eax
jmp 0x76e49b79
push 0xd
pop edi
push esi
call fcn.76e42450
mov eax, edi
jmp 0x76e45ef2
pop eax
jmp 0x76e45ef2
Function at 0x76e46806
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor edi, edi
push edi
push 0x76e46898
push 0x80000002
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x76e46864
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x76e46874
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x76e4686a
mov dword [ebp - 4], edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
leave
ret
cmp dword [ebp - 0x10], 4
je 0x76e4685b
jmp 0x76e46858

Function at 0x76e4776e
Capabilities:
Install driver

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 0x6a]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x76e48398
push edi
lea eax, [ebp + 8]
push eax
push 1
mov dword [ebp + 8], 0xa
call fcn.76e475a9
mov edi, eax
test edi, edi
jne 0x76e483a0
push 0x76e46bd8
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
push ebx
push esi
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_NtLoadDriver]
mov edi, eax
call fcn.76e47813
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x76e47801
cmp edi, 0xc000010e
jne 0x76e483ae
push edi
call fcn.76e42a13
pop edi
pop esi
pop ebx
leave
ret 4
push 8
pop eax
jmp 0x76e47808
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
jmp 0x76e47807
push edi
lea eax, [ebp - 4]
push eax
push 1
push 1
push 0x165f
mov dword [ebp - 4], ebx
call fcn.76e4b849
jmp 0x76e47801
Function at 0x76e4783e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitString]
push edi
push 0x76e479ac
lea eax, [ebp - 0x18]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
call esi
lea eax, [ebp - 0xc]
push eax
push 0x76e5f51c
lea eax, [ebp - 0x18]
push eax
call sub.Secur32.dll_LsaRegisterLogonProcess
cmp eax, edi
jl 0x76e4939c
push ebx
push 0x76e47984
lea eax, [ebp - 0x18]
push eax
call esi
push 0x76e5f520
lea eax, [ebp - 0x18]
push eax
push dword [0x76e5f51c]
call sub.Secur32.dll_LsaLookupAuthenticationPackage
mov ebx, eax
cmp ebx, edi
mov dword [0x76e5f450], edi
jl 0x76e478fb
lea eax, [ebp - 8]
push eax
push 0x20019
push edi
push 0x76e47938
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x76e478fb
push 4
pop esi
lea eax, [ebp - 4]
push eax
push 0x76e5f450
lea eax, [ebp - 0x10]
push eax
push edi
push 0x76e47910
push dword [ebp - 8]
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x76e47906
cmp dword [ebp - 0x10], esi
jne 0x76e47906
cmp dword [ebp - 4], esi
jne 0x76e47906
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.76e42a13
pop ebx
pop edi
pop esi
leave
ret
mov dword [0x76e5f450], edi
jmp 0x76e478f2
push eax
call fcn.76e42a13
jmp 0x76e47902
Function at 0x76e47c04
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x76e47d3f
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x76e47d14
test eax, eax
jne 0x76e47d14
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x76e47c54
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0x76e47d3f
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x76e47d14
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc
Function at 0x76e4a192
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
inc dword [0x76e5f3b4]
mov edi, eax
call fcn.76e457b1
test byte [ebp + 8], 0x40
je 0x76e4a1b3
call fcn.76e4cbc3
push ebx
xor ebx, ebx
inc ebx
test byte [ebp + 8], 8
je 0x76e4a1df
push ebx
push 0
push dword [0x76e5f658]
call dword [sym.imp.RPCRT4.dll_RpcServerUnregisterIf]
mov esi, eax
test esi, esi
je 0x76e4a1df
push esi
push 0x76e4a2b8
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
test byte [ebp + 0xb], 0x30
je 0x76e4a1fb
test byte [ebp + 0xb], 0x20
je 0x76e4a1f0
call fcn.76e4ba0c
test byte [ebp + 0xb], 0x10
je 0x76e4a1fb
call fcn.76e4ca3e
call fcn.76e4c85c
test byte [ebp + 8], 2
je 0x76e4a20d
call fcn.76e4b60a
mov esi, eax
push 0x76e5f080
call dword [sym.imp.ntdll.dll_RtlDeleteResource]
test byte [ebp + 8], 0x20
je 0x76e4a223
call fcn.76e4ca62
test byte [ebp + 8], bl
je 0x76e4a234
push dword [0x76e5f3c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.76e4fdc2
push 0
push ebx
push 0
push ebx
push dword [0x76e5f3bc]
call sub.ADVAPI32.dll_I_ScSetServiceBitsW
xor ecx, ecx
cmp edi, ecx
mov dword [0x76e5f3a4], ebx
mov dword [0x76e5f3a8], ecx
pop ebx
jne 0x76e4a278
mov eax, 0x702
cmp esi, eax
jne 0x76e4a26a
mov edi, eax
jmp 0x76e4a292
mov dword [0x76e5f3ac], ecx
mov dword [0x76e5f3b0], ecx
jmp 0x76e4a29e
cmp edi, 0x834
jb 0x76e4a292
cmp edi, 0x170b
mov dword [0x76e5f3ac], 0x42a
jbe 0x76e4a298
mov dword [0x76e5f3ac], edi
mov dword [0x76e5f3b0], edi
mov dword [0x76e5f3b4], ecx
mov dword [0x76e5f3b8], ecx
call fcn.76e457b1
pop edi
pop esi
pop ebp
ret 4

Function at 0x76e4b102
Capabilities:
Unload driver

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 0x6a]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x76e4b12d
push 8
pop eax
jmp 0x76e4b194
push edi
lea eax, [ebp - 4]
push eax
push 1
mov dword [ebp - 4], 0xa
call fcn.76e475a9
mov edi, eax
test edi, edi
je 0x76e4b151
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
jmp 0x76e4b193
push 0x76e46bd8
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
push dword [ebp + 8]
push esi
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_NtUnloadDriver]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.76e47813
push edi
call fcn.76e42a13
pop edi
pop esi
leave
ret 4
Function at 0x76e4b4c4
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x76e5f434], 0
jne 0x76e4b4e0
push 0x76e49d4c
call fcn.76e4b102
leave
ret
push 0x76e46ca8
call fcn.76e4b102
test eax, eax
jne 0x76e4b4f8
push 0x76e46c9c
call fcn.76e4b102
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x76e46c48
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x76e4b53b
and dword [ebp - 8], eax
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x76e49d2c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x76e4b60a
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x76e5f514]
push esi
mov dword [ebp - 4], eax
call fcn.76e4b56d
xor esi, esi
cmp eax, esi
jne 0x76e4b6f9
push ebx
push edi
push 6
pop ebx
push esi
push esi
push esi
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0x140194
push dword [0x76e5f538]
mov dword [ebp - 0x24], ebx
call fcn.76e42a4e
push dword [0x76e5f538]
mov edi, dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0x7c], eax
call edi
cmp dword [ebp - 0x7c], 0x702
mov dword [0x76e5f538], esi
je 0x76e4b6a3
mov eax, dword [0x76e5f518]
cmp eax, esi
je 0x76e4b69c
push esi
push esi
push esi
push 0x50
lea ecx, [ebp - 0x78]
push ecx
push 0x13000b
push eax
mov dword [ebp - 0x74], ebx
call fcn.76e42abd
push dword [0x76e5f518]
call edi
mov dword [0x76e5f518], esi
call fcn.76e4b4c4
jmp 0x76e4b6ea
lea eax, [ebp - 0x80]
push eax
push 0xf003f
push esi
push 0x76e46c48
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x76e4b6ef
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push esi
push 0x76e49d2c
push dword [ebp - 0x80]
mov dword [ebp - 0x84], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], esi
je 0x76e4b6f4
call fcn.76e46093
mov eax, dword [ebp - 0x7c]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.76e42a30
leave
ret
Function at 0x76e4c0f3
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2a8
mov eax, dword [0x76e5f514]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push 6
push 0x24
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
push 0
mov dword [ebp - 0x2a4], eax
call sub.NETAPI32.dll_I_NetNameCanonicalize
test eax, eax
jne 0x76e4c275
lea eax, [ebp - 0x2a0]
push eax
push 0x76e4c284
push esi
call fcn.76e4b77f
test eax, eax
mov dword [ebp - 0x29c], eax
jne 0x76e4c275
push edi
call fcn.76e50892
test eax, eax
mov dword [ebp - 0x294], eax
jne 0x76e4c166
push 8
pop esi
jmp 0x76e4c267
push esi
call fcn.76e50892
test eax, eax
mov dword [ebp - 0x298], eax
jne 0x76e4c183
push dword [ebp - 0x294]
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x76e4c15e
xor eax, eax
mov ecx, 0xa3
lea edi, [ebp - 0x290]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x294]
lea edx, [ebp - 0x290]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x76e4c1a0
mov eax, dword [ebp - 0x294]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x76e4c1b3
sub eax, ecx
lea ecx, [ebp + eax - 0x28f]
mov eax, dword [ebp - 0x298]
mov esi, ecx
sub esi, eax
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x76e4c1cd
mov eax, dword [ebp - 0x298]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x76e4c1e0
movzx edi, word [ebp + 0x14]
push edi
push dword [ebp - 0x2a4]
sub eax, esi
lea esi, [ecx + eax + 1]
push esi
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
push 0
lea eax, [ebp - 0x2a8]
push eax
add esi, edi
mov byte [esi], 0
lea eax, [ebp - 0x290]
sub esi, eax
inc esi
push esi
push eax
push dword [ebp - 0x2a0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x76e4c24b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
mov dword [ebp - 0x29c], eax
je 0x76e4c241
cmp eax, 0x43
jne 0x76e4c24b
mov dword [ebp - 0x29c], 0x8e1
push dword [ebp - 0x294]
call sub.NETAPI32.dll_NetApiBufferFree
push dword [ebp - 0x298]
call sub.NETAPI32.dll_NetApiBufferFree
mov esi, dword [ebp - 0x29c]
push dword [ebp - 0x2a0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.76e42a30
leave
ret 0x10
Function at 0x76e4cc67
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
push 0x20019
push edi
push 0x76e4cd38
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
mov esi, 0x76e4cd18
jne 0x76e4ccd6
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
pop ebx
jne 0x76e4ccd6
mov eax, dword [ebp - 0xc]
jmp 0x76e4cd11
push edi
push 0x76e45bf4
push edi
lea eax, [ebp - 4]
push eax
call fcn.76e45c1d
test eax, eax
jne 0x76e4cd0e
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push dword [ebp - 4]
call fcn.76e44e87
push dword [ebp - 4]
mov esi, eax
call fcn.76e46353
cmp esi, edi
jne 0x76e4cd0e
mov eax, dword [ebp - 0x10]
cmp eax, 0xf
jae 0x76e4cd11
push 0xf
pop eax
pop edi
pop esi
leave
ret

Function at 0x76e4d1cf
Capabilities:
Get domain information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor edi, edi
push edi
lea eax, [ebp - 8]
push eax
call fcn.76e4d12d
mov ebx, eax
cmp ebx, edi
jl 0x76e4d280
lea eax, [ebp - 4]
push eax
push 1
push edi
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
test eax, eax
jne 0x76e4d277
mov eax, dword [ebp - 4]
test byte [eax + 4], 1
je 0x76e4d20e
mov byte [0x76e5fb20], 1
mov ecx, dword [eax + 8]
cmp ecx, edi
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
je 0x76e4d23f
push ecx
call esi
pop ecx
push edi
push edi
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 4]
push dword [eax + 8]
push 0x6811c
push dword [ebp - 8]
call fcn.76e4d196
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
cmp ecx, edi
je 0x76e4d269
push ecx
call esi
pop ecx
push edi
push edi
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x68120
push dword [ebp - 8]
call fcn.76e4d196
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.NETAPI32.dll_DsRoleFreeMemory
mov byte [0x76e5f430], 1
pop esi
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x76e4d28b
Capabilities:
Get domain controller name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
mov byte [esi], 1
call fcn.76e454eb
cmp eax, 1
jne 0x76e4d2ac
mov eax, 0xc00000df
jmp 0x76e4d3da
push ebx
xor ebx, ebx
cmp dword [0x76e5f474], ebx
jne 0x76e4d2c1
call fcn.76e45df7
mov dword [0x76e5f474], eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
or eax, 0x10
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
mov edi, eax
cmp edi, ebx
je 0x76e4d322
cmp byte [0x76e5f438], bl
jne 0x76e4d2f8
push dword [0x76e5f474]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [0x76e5f438], 1
cmp edi, 8
je 0x76e4d318
xor eax, eax
cmp edi, 0x4cf
sete al
dec eax
and eax, 0xfffffe88
add eax, 0xc000023c
jmp 0x76e4d3d8
mov eax, 0xc000009a
jmp 0x76e4d3d8
cmp dword [ebp + 0xc], ebx
jne 0x76e4d32c
call sub.ntdll.dll_DbgBreakPoint
mov byte [esi], bl
call fcn.76e4d1cf
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
jmp 0x76e4d341
cmp ax, bx
je 0x76e4d34a
inc esi
inc esi
mov ax, word [esi]
cmp ax, 0x5c
je 0x76e4d33a
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
push esi
call edi
cmp eax, 1
pop ecx
jb 0x76e4d366
lea eax, [esi + eax*2 - 2]
cmp word [eax], 0x2e
jne 0x76e4d366
mov word [eax], bx
push esi
call edi
test eax, eax
pop ecx
ja 0x76e4d375
mov esi, 0xc00000c4
jmp 0x76e4d385
push ebx
lea eax, [ebp - 4]
push eax
call fcn.76e4d12d
cmp eax, ebx
jge 0x76e4d38f
mov esi, eax
push dword [ebp + 0xc]
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x76e4d3d6
push esi
call edi
pop ecx
push ebx
push ebx
lea eax, [eax + eax + 2]
push eax
push esi
push 0x680a4
push dword [ebp - 4]
call fcn.76e4d196
push dword [ebp + 0xc]
mov esi, eax
call sub.NETAPI32.dll_NetApiBufferFree
cmp byte [0x76e5f438], bl
jne 0x76e4d3cd
push dword [0x76e5f474]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [0x76e5f438], 1
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x76e4d3e4
Capabilities:
Get domain controller name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
or dword [ebp - 0xc], 0xffffffff
push ebx
xor ebx, ebx
cmp dword [0x76e5f474], ebx
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
jne 0x76e4d416
call fcn.76e45df7
mov dword [0x76e5f474], eax
call fcn.76e4d1cf
push ebx
lea eax, [ebp - 0xc]
push eax
call fcn.76e4d12d
mov esi, eax
cmp esi, ebx
jl 0x76e4d4ce
cmp byte [0x76e5fb20], 0
je 0x76e4d441
lea eax, [ebp - 0x10]
push eax
call fcn.76e47b19
push edi
mov edi, dword [ebp - 0x10]
cmp edi, ebx
je 0x76e4d509
cmp word [edi], 0x5c
jne 0x76e4d466
push 0x5c
pop eax
cmp ax, bx
je 0x76e4d466
inc edi
inc edi
mov ax, word [edi]
cmp ax, 0x5c
je 0x76e4d456
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push edi
call esi
cmp eax, 1
pop ecx
jb 0x76e4d482
lea eax, [edi + eax*2 - 2]
cmp word [eax], 0x2e
jne 0x76e4d482
mov word [eax], bx
push edi
call esi
pop ecx
lea ebx, [eax + eax + 2]
mov eax, dword [0x76e5f3a4]
inc dword [ebp - 0x14]
cmp eax, 3
je 0x76e4d505
cmp eax, 1
je 0x76e4d505
push 0
push 0
push ebx
push edi
push 0x680a4
push dword [ebp - 0xc]
call fcn.76e4d196
call fcn.76e4cd97
mov esi, eax
test esi, esi
jne 0x76e4d4fd
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x14], 0x30
jbe 0x76e4d48a
xor ebx, ebx
pop edi
cmp dword [ebp - 0x10], ebx
je 0x76e4d4db
push dword [ebp - 0x10]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 4], ebx
je 0x76e4d4e8
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0xc], 0xffffffff
je 0x76e4d4f7
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
pop esi
pop ebx
leave
ret
cmp esi, 0xc0000023
jne 0x76e4d4cb
xor esi, esi
jmp 0x76e4d4cb
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
cmp dword [ebp - 4], ebx
je 0x76e4d51f
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
mov dword [ebp - 4], ebx
mov eax, dword [0x76e5f3a4]
cmp eax, 3
je 0x76e4d5f7
cmp eax, 1
je 0x76e4d5f7
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
cmp eax, ebx
je 0x76e4d57c
cmp eax, 8
je 0x76e4d56b
xor ecx, ecx
cmp eax, 0x4cf
sete cl
dec ecx
and ecx, 0xfffffe88
add ecx, 0xc000023c
mov esi, ecx
jmp 0x76e4d570
mov esi, 0xc000009a
test byte [ebp - 8], 1
jne 0x76e4d4cd
jmp 0x76e4d5df
mov eax, dword [ebp - 4]
mov esi, dword [eax]
jmp 0x76e4d58a
cmp ax, bx
je 0x76e4d593
inc esi
inc esi
mov ax, word [esi]
cmp ax, 0x5c
je 0x76e4d583
push esi
call edi
cmp eax, 1
pop ecx
jb 0x76e4d5a9
lea eax, [esi + eax*2 - 2]
cmp word [eax], 0x2e
jne 0x76e4d5a9
mov word [eax], bx
push esi
call edi
test eax, eax
pop ecx
jbe 0x76e4d50f
push esi
call edi
pop ecx
push ebx
push ebx
lea eax, [eax + eax + 2]
push eax
push esi
push 0x680a4
push dword [ebp - 0xc]
call fcn.76e4d196
call fcn.76e4cd97
mov esi, eax
cmp esi, ebx
jne 0x76e4d5eb
test byte [ebp - 8], 1
jne 0x76e4d5fe
mov dword [ebp - 8], 0x11
jmp 0x76e4d50f
cmp esi, 0xc0000023
jne 0x76e4d4cd
xor esi, esi
jmp 0x76e4d4cd
mov esi, 0xc000023c
jmp 0x76e4d4cd