joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b9a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
jne 0x1003b9cb
jmp 0x1003ba22
mov esi, esp
push str.GetNativeSystemInfo
mov edi, esp
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp edi, esp
call fcn.100705ff
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1003ba0f
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
cmp esi, esp
call fcn.100705ff
jmp 0x1003ba22
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, esp
call fcn.100705ff
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 4

Function at 0x1003bb90
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov esi, esp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x2c], eax
mov esi, esp
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
cmp esi, esp
call fcn.100705ff
test eax, eax
je 0x1003bc02
mov esi, esp
push 0
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x14], eax
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x14], 0
jne 0x1003bc24
cmp dword [ebp - 0x20], 0
je 0x1003bcc0
mov esi, esp
push 1
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp esi, esp
call fcn.100705ff
test eax, eax
je 0x1003bcc0
mov esi, esp
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call fcn.100705ff
mov esi, esp
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp esi, esp
call fcn.100705ff
mov esi, esp
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp esi, esp
call fcn.100705ff
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp esi, esp
call fcn.100705ff
mov esi, esp
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp esi, esp
call fcn.100705ff
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
cmp esi, esp
call fcn.100705ff
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 4
Function at 0x1003d970
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xe4]
mov ecx, 0x39
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 0x11], 0
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1003d9bb
mov byte [ebp - 0x11], 1
mov al, byte [ebp - 0x11]
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 8

Function at 0x1003d9e0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x100]
mov ecx, 0x40
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x15], 0
mov esi, esp
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x30]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1003da7d
mov esi, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1003da6a
mov byte [ebp - 0x15], 1
mov esi, esp
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.100705ff
mov al, byte [ebp - 0x15]
push edx
mov ecx, ebp
push eax
lea edx, [0x1003dab4]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0x100
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003daf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10c]
mov ecx, 0x43
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x3c], 4
mov esi, esp
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1003db98
mov esi, esp
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1003db85
mov byte [ebp - 0x15], 1
mov esi, esp
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.100705ff
mov al, byte [ebp - 0x15]
push edx
mov ecx, ebp
push eax
lea edx, [0x1003dbcc]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0x10c
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1003dc10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10c]
mov ecx, 0x43
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x3c], 0x104
mov esi, esp
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1003dcb8
mov esi, esp
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1003dca5
mov byte [ebp - 0x15], 1
mov esi, esp
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.100705ff
mov al, byte [ebp - 0x15]
push edx
mov ecx, ebp
push eax
lea edx, [0x1003dcec]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0x10c
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1003dd30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x100]
mov ecx, 0x40
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x15], 0
mov esi, esp
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1003ddd7
mov esi, esp
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1003ddc4
mov byte [ebp - 0x15], 1
mov esi, esp
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.100705ff
mov al, byte [ebp - 0x15]
push edx
mov ecx, ebp
push eax
lea edx, [0x1003de0c]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0x100
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1003de40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x100]
mov ecx, 0x40
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x15], 0
mov esi, esp
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1003defb
mov esi, esp
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.100705ff
shl eax, 1
mov esi, esp
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 2
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1003dee8
mov byte [ebp - 0x15], 0
mov esi, esp
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.100705ff
mov al, byte [ebp - 0x15]
push edx
mov ecx, ebp
push eax
lea edx, [0x1003df30]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0x100
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1003df70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xf4]
mov ecx, 0x3d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x15], 0
mov esi, esp
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1003e018
mov esi, esp
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.100705ff
shl eax, 1
mov esi, esp
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1003e005
mov byte [ebp - 0x15], 1
mov esi, esp
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.100705ff
mov al, byte [ebp - 0x15]
push edx
mov ecx, ebp
push eax
lea edx, [0x1003e04c]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0xf4
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1003e070
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x100]
mov ecx, 0x40
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x15], 0
mov esi, esp
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1003e12b
mov esi, esp
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.100705ff
shl eax, 1
mov esi, esp
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1003e118
mov byte [ebp - 0x15], 1
mov esi, esp
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.100705ff
mov al, byte [ebp - 0x15]
push edx
mov ecx, ebp
push eax
lea edx, [0x1003e160]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0x100
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1003e220
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xfc]
mov ecx, 0x3f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp esi, esp
call fcn.100705ff
test eax, eax
je 0x1003e324
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
mov esi, esp
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1003e315
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x1003e302
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006daa9
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1003e302
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.1006e6e1
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp esi, esp
call fcn.100705ff
mov esi, esp
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp esi, esp
call fcn.100705ff
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
add esp, 0xfc
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 4
Function at 0x1003e340
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xfc]
mov ecx, 0x3f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], 0
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp esi, esp
call fcn.100705ff
test eax, eax
je 0x1003e472
mov esi, esp
call dword [sym.imp.USER32.dll_EmptyClipboard]
cmp esi, esp
call fcn.100705ff
test eax, eax
je 0x1003e463
mov eax, dword [ebp + 0xc]
push eax
call fcn.10070622
add esp, 4
lea ecx, [eax + eax + 2]
mov esi, esp
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1003e463
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10070622
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp - 0x20]
push edx
call fcn.1006e6e1
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
call fcn.10070622
add esp, 4
xor ecx, ecx
mov edx, dword [ebp - 0x20]
mov word [edx + eax*2], cx
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp esi, esp
call fcn.100705ff
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x1003e450
mov dword [ebp - 0x2c], 1
jmp 0x1003e463
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp esi, esp
call fcn.100705ff
mov esi, esp
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp esi, esp
call fcn.100705ff
mov eax, dword [ebp - 0x2c]
pop edi
pop esi
pop ebx
add esp, 0xfc
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 8
Function at 0x1003e770
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xe8]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp esi, esp
call fcn.100705ff
test eax, eax
je 0x1003e7db
mov esi, esp
push 0
push 0
push 3
push 0
push 7
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x18], eax
jmp 0x1003e800
mov esi, esp
push 0
push 0
push 2
push 0
push 7
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x1003e847
mov dword [ebp - 0x24], 0
mov esi, esp
push 2
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, esp
call fcn.100705ff
mov esi, esp
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.100705ff
mov esi, esp
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100705ff
push edx
mov ecx, ebp
push eax
lea edx, [0x1003e88c]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0xe8
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003e9e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x31c]
mov ecx, 0xc7
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
push 0x208
call fcn.1006daa9
add esp, 4
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x1003ea30
xor eax, eax
jmp 0x1003eade
push 0x208
push 0
mov eax, dword [ebp - 0x24c]
push eax
call fcn.1006ff30
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xffffffff
jne 0x1003ea6c
xor eax, eax
jmp 0x1003eade
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x258]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1003eac2
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp + 8]
jne 0x1003eaab
lea eax, [ebp - 0x21c]
push eax
push 0x104
mov ecx, dword [ebp - 0x24c]
push ecx
call fcn.1006e6e1
add esp, 0xc
jmp 0x1003eac2
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x258]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1003ea83
mov esi, esp
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100705ff
mov eax, dword [ebp - 0x24c]
push edx
mov ecx, ebp
push eax
lea edx, [0x1003eb10]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0x31c
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 4

Function at 0x1003eb30
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xfc]
mov ecx, 0x3f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 5
mov esi, esp
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x1003ebd6
mov esi, esp
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp esi, esp
call fcn.100705ff
mov esi, esp
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp esi, esp
call fcn.100705ff
cmp dword [ebp - 0x34], 1
jne 0x1003ebe8
mov dword [ebp - 0xfc], 1
jmp 0x1003ebf2
mov dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0xfc]
push edx
mov ecx, ebp
push eax
lea edx, [0x1003ec28]
call fcn.100705a7
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
add esp, 0xfc
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret