joyce8/EMBER2024-capa huggingface dataset:
Function at 0x676aa0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
cmp eax, 1
push edi
jne 0x676ae8
mov ecx, dword [ecx + 4]
push 0
lea eax, [esp + 0x10]
push eax
push 8
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0xc], 8
je 0x676ada
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi]
mov eax, dword [esi + 4]
bswap edx
bswap eax
mov dword [esi + 4], edx
jmp 0x676b35
xor edi, edi
cmp eax, edi
jne 0x676b32
mov edx, dword [ecx + 4]
lea eax, [ecx + 4]
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x676b0c
xor ebx, ebx
jmp 0x676b14
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push eax
call fcn.0048b230
sub edi, eax
sbb ebx, edx
add edi, 8
adc ebx, 0
mov dword [esi + 4], ebx
mov ebx, dword [ebp + 8]
mov dword [esi], edi
jmp 0x676b37
mov dword [esi + 4], edi
mov dword [esi], eax
cmp dword [ebx], 1
mov edi, 8
jne 0x676b46
mov edi, 0x10
cmp dword [ebx + 4], 0x75756964
jne 0x676b52
add edi, 0x10
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor edx, edx
cmp eax, edx
ja 0x676b6b
jb 0x676ad0
cmp ecx, edi
jb 0x676ad0
sub ecx, edi
sbb eax, edx
pop edi
mov dword [esi + 4], eax
mov dword [esi], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x685570
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x41c
push esi
push edi
mov esi, eax
call fcn.0065a0f0
test al, al
jne 0x68558e
xor eax, eax
pop edi
pop esi
add esp, 0x41c
ret
push 0
push 0
push 0x410
lea eax, [esp + 0x1c]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x427], 0
call fcn.006046e0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x685583
test edi, edi
jne 0x685583
mov eax, dword [esp + 0xc]
push eax
call fcn.00604770
test eax, eax
jl 0x685583
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
push edi
push ecx
call fcn.006047b0
test eax, eax
jl 0x685583
mov ecx, dword [esp + 0xc]
call fcn.0065a290
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call fcn.00604730
pop edi
mov eax, esi
pop esi
add esp, 0x41c
ret
Function at 0x68ab80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x208
push eax
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x214]
call fcn.0049a340
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
add esp, 0x208
ret 4

Function at 0x68c030
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xdfc], 0
mov esi, eax
jne 0x68c063
push 2
mov edi, ebx
call fcn.0067f880
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
lea eax, [esp + 0x10]
mov byte [esp + 0xc], 2
call fcn.00408a40
fld qword [esi + 0x40]
cmp byte [edi + 0xde7], 0
fstp qword [esp + 0x50]
fld qword [esi + 0x48]
mov al, byte [esi + 0x58]
fstp qword [esp + 0x58]
mov byte [esp + 0x68], al
fld qword [esi + 0x50]
fstp qword [esp + 0x60]
je 0x68c0ca
lea ecx, [esp + 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x18]
imul edx, dword [esp + 0x14]
cmp edx, 0x7e9000
mov eax, dword [esp + 0x88]
jb 0x68c0c4
shr eax, 1
jne 0x68c0c4
mov eax, 1
mov dword [edi + 0xdec], eax
mov eax, dword [edi + 0xde8]
sub eax, 0
je 0x68c11c
sub eax, 1
je 0x68c0ea
sub eax, 2
jne 0x68c12d
lea eax, [esp + 0x10]
call fcn.0068ef80
jmp 0x68c127
cmp dword [edi + 0xbd7], 1
jne 0x68c0ff
push edi
lea eax, [esp + 0x14]
call fcn.0068ee00
jmp 0x68c10a
lea ecx, [esp + 0x10]
push ecx
push edi
call fcn.0068e9f0
cmp eax, 0xfffffffe
mov dword [edi + 0xe00], eax
jne 0x68c12d
mov byte [esp + 0xc], 9
jmp 0x68c12d
lea eax, [esp + 0x10]
mov ecx, edi
call fcn.0068e810
mov dword [edi + 0xe00], eax
cmp dword [edi + 0xe00], 0
jge 0x68c14d
mov edx, dword [esp + 0xc]
push edx
mov edi, ebx
call fcn.0067f880
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x7b6eec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x736614], 1
push 0x7b6eec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x80
call fcn.0069e704
add esp, 4
test eax, eax
jne 0x68c19b
call fcn.004b05b0
xor eax, eax
mov dword [ebx + 4], eax
pop edi
mov dword [ebx], 0x721418
add word [eax + 0x7a], 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
mov esi, eax
call fcn.00690eb0
jmp 0x68c182
Function at 0x696610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push 1
mov edi, eax
mov eax, dword [edi + 4]
lea esi, [esp + 0x14]
push esi
xor edx, edx
push edx
add eax, 0x10
mov eax, dword [eax]
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x696644
xor esi, esi
xor ebx, ebx
jmp 0x69664c
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov edx, dword [edi + 4]
xor ecx, ecx
bswap ecx
add edx, 0x10
mov dword [esp + 0x10], ecx
push edx
mov ecx, 4
lea edx, [esp + 0x14]
call fcn.005de770
mov eax, dword [edi + 4]
add eax, 0x10
push eax
mov ecx, 4
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0x70797466
call fcn.005de770
mov ecx, dword [edi + 4]
add ecx, 0x10
push ecx
mov ecx, 4
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0x20207471
call fcn.005de770
mov eax, dword [edi + 4]
mov edx, 0x200
bswap edx
add eax, 0x10
mov dword [esp + 0x10], edx
push eax
mov ecx, 4
lea edx, [esp + 0x14]
call fcn.005de770
mov ecx, dword [edi + 4]
add ecx, 0x10
push ecx
mov ecx, 4
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0x20207471
call fcn.005de770
push ebx
push esi
call fcn.00693d50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6a1a38
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x7308c4]
jne 0x6a1a42
repz ret
jmp fcn.006ab64c

Function at 0x6a1b8d
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x7308d8]
je 0x6a1ba8
inc edi
cmp edi, 0x17
jb 0x6a1b99
cmp edi, 0x17
jae 0x6a1d28
push ebp
push 3
call fcn.006abb42
cmp eax, 1
pop ecx
je 0x6a1cf4
push 3
call fcn.006abb42
test eax, eax
pop ecx
jne 0x6a1bdc
cmp dword [0x730060], 1
je 0x6a1cf4
cmp ebx, 0xfc
je 0x6a1d27
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x734358
push ebp
call fcn.006a7e29
add esp, 0xc
test eax, eax
je 0x6a1c12
push esi
push esi
push esi
push esi
push esi
call fcn.0069d321
add esp, 0x14
push 0x104
mov esi, 0x734371
push esi
push 0
mov byte [0x734475], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6a1c56
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.006a7e29
add esp, 0xc
test eax, eax
je 0x6a1c56
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0069d321
add esp, 0x14
push esi
call fcn.006a6220
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x6a1c9b
push esi
call fcn.006a6220
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x73466c
push 0x6b991c
sub ecx, eax
push ecx
push eax
call fcn.006a7d76
add esp, 0x14
test eax, eax
je 0x6a1c9b
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0069d321
add esp, 0x14
jmp 0x6a1c9d
xor esi, esi
push 0x6b9918
push ebx
push ebp
call fcn.006a7cb0
add esp, 0xc
test eax, eax
je 0x6a1cbd
push esi
push esi
push esi
push esi
push esi
call fcn.0069d321
add esp, 0x14
push dword [edi*8 + 0x7308dc]
push ebx
push ebp
call fcn.006a7cb0
add esp, 0xc
test eax, eax
je 0x6a1cdf
push esi
push esi
push esi
push esi
push esi
call fcn.0069d321
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.006ab985
add esp, 0xc
jmp 0x6a1d27
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x6a1d27
cmp ebp, 0xffffffff
je 0x6a1d27
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x7308dc]
push dword [esi]
call fcn.006a6220
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x6ab985
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0069fbbb
xor ebx, ebx
cmp dword [0x734c80], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x6aba5b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x6abb3b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x6abb3b
push eax
call fcn.0069fb4d
mov dword [esp], 0x6ba438
push edi
mov dword [0x734c80], eax
call esi
push eax
call fcn.0069fb4d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x734c84], eax
call esi
push eax
call fcn.0069fb4d
mov dword [0x734c88], eax
lea eax, [ebp - 0xc]
push eax
call fcn.006a2307
test eax, eax
pop ecx
pop ecx
je 0x6aba29
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0069d321
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x6aba5b
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0069fb4d
cmp eax, ebx
pop ecx
mov dword [0x734c90], eax
je 0x6aba5b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0069fb4d
pop ecx
mov dword [0x734c8c], eax
mov eax, dword [0x734c8c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x6abae0
cmp dword [0x734c90], ecx
je 0x6abae0
push eax
call fcn.0069fbc4
push dword [0x734c90]
mov esi, eax
call fcn.0069fbc4
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x6abae0
cmp edi, ebx
je 0x6abae0
call esi
cmp eax, ebx
je 0x6abaad
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x6abaad
test byte [ebp - 0x18], 1
jne 0x6abae0
lea eax, [ebp - 0x10]
push eax
call fcn.006a233e
test eax, eax
pop ecx
je 0x6abac8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0069d321
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x6abad7
or dword [ebp + 0x10], 0x200000
jmp 0x6abb1b
or dword [ebp + 0x10], 0x40000
jmp 0x6abb1b
mov eax, dword [0x734c84]
cmp eax, dword [ebp - 8]
je 0x6abb1b
push eax
call fcn.0069fbc4
cmp eax, ebx
pop ecx
je 0x6abb1b
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x6abb1b
mov eax, dword [0x734c88]
cmp eax, dword [ebp - 8]
je 0x6abb1b
push eax
call fcn.0069fbc4
cmp eax, ebx
pop ecx
je 0x6abb1b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x734c80]
call fcn.0069fbc4
cmp eax, ebx
pop ecx
je 0x6abb3b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x6abb3d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100df80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x1072ae4
sub esi, edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 0xc]
push eax
push 0x40
push esi
push edi
call ebx
cmp byte [ebp + 0x18], 0
je 0x100dfb4
mov eax, dword [ebp + 0x14]
sub dword [edi], eax
mov eax, edi
sub eax, dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push esi
push edi
call fcn.0100dfef
add esp, 0x10
cmp byte [ebp + 0x18], 0
je 0x100dfd2
mov eax, dword [ebp + 0x14]
add dword [edi], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push esi
push edi
call ebx
push 0x1072ae4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x100e290
Capabilities:
Allocate thread local storage
Resolve function by parsing pe exports
Terminate process

Disassembly:
pushal
pushfd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.010107ee
push eax
lea edx, [0xff0213c]
lea ecx, [0x1990c5b0]
sub esp, 0x10
mov dword [esp], edx
push ecx
sub dword [esp + 4], 0xeef3e64
pop ebx
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
jmp fcn.0100e2fc
Function at 0x10105ac
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [0x1072c98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 8]
push dword [edi + 0x64]
mov esi, eax
push dword [0x1072c98]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp esi, 0x32
jae 0x10105fb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 0x60]
cmp eax, 0x2710
jae 0x10105f3
mov dword [esi*8 + 0x1072b08], 1
jmp 0x1010601
and dword [esi*8 + 0x1072b08], 0
push edi
call fcn.01010d56
pop edi
pop esi
pop ebp
ret 4

Function at 0x101062b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x20]
push ebx
movzx ebx, word [eax]
push esi
mov esi, dword [ebp + 0x10]
push edi
push 0xfffffffffffffffe
inc esi
pop edi
and esi, edi
mov dword [ebp + 0x10], esi
jmp 0x1010659
push dword [ebp + 0x14]
movzx eax, ax
add eax, dword [ebp + 8]
push eax
call fcn.010107df
inc esi
and esi, edi
movzx eax, word [esi]
inc esi
xor eax, ebx
inc esi
cmp ax, 0xffff
jne 0x1010647
inc esi
and esi, edi
movzx ecx, word [esi]
inc esi
inc esi
xor ecx, ebx
cmp byte [ebp + 0x28], 0
jne 0x1010693
cmp byte [ebp + 0x24], 0
jne 0x1010693
cmp cx, ax
je 0x10106c8
inc esi
and esi, edi
movzx eax, word [esi]
inc esi
xor eax, ebx
inc esi
cmp ax, 0xffff
jne 0x1010681
jmp 0x10106c8
xor edi, edi
jmp 0x10106c2
mov eax, dword [ebp + 0x20]
movzx eax, word [eax + edi*2]
mov edx, dword [ebp + 0x18]
and eax, 0xfffffff0
add eax, edx
push eax
movzx eax, cx
add eax, dword [ebp + 8]
inc edi
push eax
and edi, 3
call fcn.010107df
inc esi
and esi, 0xfffffffe
movzx ecx, word [esi]
inc esi
inc esi
xor ecx, ebx
cmp cx, 0xffff
jne 0x1010697
mov ecx, dword [ebp + 0x1c]
push dword [ebp + 0x20]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [esi + 7]
and eax, 0xfffffff8
mov edx, dword [eax]
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
movzx eax, word [ebp + 0xc]
add eax, dword [ebp + 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.01010789
cmp byte [ebp + 0x24], 0
jne 0x1010706
cmp dword [ebp + 0x14], 0
jne 0x101070c
cmp byte [ebp + 0x28], 0
je 0x101077c
mov esi, dword [ebp + 0x10]
movzx eax, word [esi]
inc esi
xor eax, ebx
inc esi
cmp ax, 0xffff
je 0x101073f
mov edi, dword [ebp + 0x14]
neg edi
movzx eax, ax
add eax, dword [ebp + 8]
push edi
push eax
call fcn.010107df
inc esi
and esi, 0xfffffffe
movzx eax, word [esi]
inc esi
xor eax, ebx
inc esi
cmp ax, 0xffff
jne 0x1010721
cmp byte [ebp + 0x28], 0
je 0x101077c
xor edi, edi
jmp 0x101076b
mov eax, dword [ebp + 0x20]
movzx eax, word [eax + edi*2]
mov edx, dword [ebp + 0x18]
and eax, 0xfffffff0
add eax, edx
neg eax
push eax
movzx eax, cx
add eax, dword [ebp + 8]
inc edi
push eax
and edi, 3
call fcn.010107df
inc esi
and esi, 0xfffffffe
movzx ecx, word [esi]
inc esi
xor ecx, ebx
inc esi
cmp cx, 0xffff
jne 0x1010749
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x24
Function at 0x1010b8a
Capabilities:
Check for time delay via gettickcount
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov ebx, 0x1072b08
push edi
mov esi, ebx
push 2
xor eax, eax
pop ecx
inc eax
lock cmpxchg dword [esi], ecx
cmp eax, 1
jne 0x1010bc7
mov edi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 0x60]
cmp eax, 0x2710
jb 0x1010c17
and dword [esi], 0
push edi
call fcn.01010d56
inc dword [ebp - 4]
add esi, 8
cmp dword [ebp - 4], 0x32
jl 0x1010b9c
call fcn.01010c85
mov esi, eax
xor edi, edi
mov ecx, ebx
push 2
pop edx
xor eax, eax
lock cmpxchg dword [ecx], edx
test eax, eax
je 0x1010c57
inc edi
add ecx, 8
cmp edi, 0x32
jl 0x1010bde
push dword [0x1072c98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov dword [esi + 0x64], eax
push dword [0x1072c98]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
push dword [0x1072c98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [ebp - 4]
mov dword [edi + 0x64], eax
push dword [0x1072c98]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1010c53
mov eax, edi
jmp 0x1010c12
push dword [0x1072c98]
mov dword [edi*8 + 0x1072b0c], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov dword [esi + 0x64], eax
push dword [0x1072c98]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x60], eax
jmp 0x1010c10

Function at 0x1010c85
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1072b00]
mov ecx, dword [eax + 0x3c]
sub esp, 0x24
push ebx
push esi
mov esi, dword [ecx + eax + 0x50]
mov ebx, eax
push edi
lea eax, [ebp - 0x24]
push eax
add esi, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
lea ecx, [eax - 0x80000000]
cmp esi, ecx
mov edi, eax
jb 0x1010cbd
lea edi, [esi - 0x80000000]
mov eax, dword [ebp - 0x18]
lea ecx, [eax - 0x7fffffff]
cmp ebx, ecx
ja 0x1010cd0
lea eax, [ebx + 0x7fffffff]
mov ebx, dword [ebp - 8]
sub eax, edi
xor edx, edx
div ebx
lea esi, [eax - 1]
push 0x40
push 0x3000
push 0x4000
push esi
push 0
call fcn.01010d05
imul eax, ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1010cdc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10170d5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
push 0x1010dd0
push 0x80000002
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1017138
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1010db8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x101712a
mov dword [ebp - 8], esi
cmp dword [ebp - 4], esi
je 0x1017138
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], esi
pop esi
setne al
leave
ret

Function at 0x1017143
Capabilities:
Get domain information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
and dword [ebp - 4], esi
push 1
push esi
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
test eax, eax
mov ecx, dword [ebp - 4]
jne 0x101716e
mov eax, dword [ecx]
test eax, eax
je 0x101716e
cmp eax, 2
je 0x101716e
inc esi
test ecx, ecx
je 0x1017178
push ecx
call sub.NETAPI32.dll_DsRoleFreeMemory
mov eax, esi
pop esi
leave
ret

Function at 0x101731f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
lea eax, [ebp - 4]
push eax
xor eax, eax
cmp dword [ebp + 8], esi
push 0x1010e48
setne al
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x101738b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1010e34
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x101737d
mov dword [ebp - 8], esi
cmp dword [ebp - 4], esi
je 0x101738b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
xor eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x1017cb3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
push 0x20019
push 0
push 0x10111b4
push dword [eax + 0x68]
xor edi, edi
inc edi
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1017d16
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1011194
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1017d0d
cmp dword [ebp - 8], eax
jne 0x1017d0d
xor edi, edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret 4

Function at 0x1018506
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x107342c]
and dword [ebp - 0x78], 0
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x74]
push eax
call esi
and dword [ebp - 0x8c], 0
and dword [ebp - 0x80], 0
and dword [ebp - 0x7c], 0
lea eax, [ebp - 0x74]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x90]
push eax
push 0x20019
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x90], 0x18
mov dword [ebp - 0x84], 0x40
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jge 0x10185d6
jmp dword [0x1072380]
push edi
lea eax, [ebp - 0x74]
push eax
call esi
lea eax, [ebp - 0x94]
push eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 2
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jl 0x101860c
cmp dword [ebp - 0x60], 4
jne 0x101860c
cmp dword [ebp - 0x64], 4
mov esi, dword [ebp - 0x5c]
je 0x101866b
jmp dword [0x1072150]
push dword [ebp - 0x6c]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0103e4d8
leave
ret 8