joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042090
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xcc], 0xffffffff
mov byte [ebp - 0x80], 0
push 0x63
push 0
lea eax, [ebp - 0x7f]
push eax
call fcn.100139b0
add esp, 0xc
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x100420db
push 1
call sub.RtlIhvOid.dll_Ordinal_26
add esp, 4
mov dword [ebp - 0xcc], eax
jmp 0x100420eb
push 0
call sub.RtlIhvOid.dll_Ordinal_26
add esp, 4
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jne 0x100420fb
mov al, 1
jmp 0x100421a5
push 0x44
push 0
lea edx, [ebp - 0xc8]
push edx
call fcn.100139b0
add esp, 0xc
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.100139b0
add esp, 0xc
mov dword [ebp - 0xc8], 0x44
mov dword [ebp - 0x9c], 1
xor ecx, ecx
mov word [ebp - 0x98], cx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x10042156
push str.netsh_wlan_set_ho_modeallow
lea eax, [ebp - 0x80]
push eax
call fcn.10016875
add esp, 8
jmp 0x10042167
push str.netsh_wlan_set_ho_modedisallow
lea ecx, [ebp - 0x80]
push ecx
call fcn.10016875
add esp, 8
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc8]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
lea ecx, [ebp - 0x80]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10042197
xor al, al
jmp 0x100421a5
push 0xffffffffffffffff
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret

Function at 0x10042470
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x100a5346]
test eax, eax
jne 0x10042495
xor al, al
jmp 0x1004251c
push 0x24
lea ecx, [ebp - 0xe0]
push ecx
push 0xff0101ed
push 0
call sub.RtlIhvOid.dll_Ordinal_2
add esp, 0x10
test eax, eax
je 0x1004251a
lea edx, [ebp - 0xe0]
mov dword [ebp - 0x74], edx
mov eax, dword [ebp - 0x74]
cmp dword [eax], 0
jbe 0x100424e5
mov ecx, dword [ebp - 0x74]
cmp dword [ecx], 0x20
ja 0x100424e5
mov edx, dword [ebp - 0x74]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x74]
add ecx, 4
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10013640
add esp, 0xc
jmp 0x100424e9
xor al, al
jmp 0x1004251c
mov eax, dword [ebp + 8]
push eax
push str._UI_Get_Mesh_ID___s_
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
movzx edx, byte [0x1008af93]
test edx, edx
je 0x10042514
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, 1
jmp 0x1004251c
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x10042530
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push str._UI_Set_Mesh_ID___s_
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
movzx edx, byte [0x100a5346]
test edx, edx
jne 0x1004256b
xor al, al
jmp 0x100425f6
lea eax, [ebp - 0xe0]
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10013a30
add esp, 4
cmp eax, 0x20
jge 0x10042599
mov edx, dword [ebp + 8]
push edx
call fcn.10013a30
add esp, 4
mov dword [ebp - 0xe4], eax
jmp 0x100425a3
mov dword [ebp - 0xe4], 0x20
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xe4]
mov dword [eax], ecx
mov edx, dword [ebp - 0x74]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x74]
add edx, 4
push edx
call fcn.10013640
add esp, 0xc
push 0x24
lea eax, [ebp - 0xe0]
push eax
push 0xff0101ed
push 1
call sub.RtlIhvOid.dll_Ordinal_2
add esp, 0x10
movzx ecx, byte [0x1008af93]
test ecx, ecx
je 0x100425f4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x10043cf0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x1d], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xd8], eax
push 0x9c
push 0
lea eax, [ebp - 0xc8]
push eax
call fcn.100139b0
add esp, 0xc
mov dword [ebp - 0xc8], 0x9c
lea ecx, [ebp - 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xb8], 2
je 0x10043d51
mov al, byte [ebp - 0x1d]
jmp 0x10043de2
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0xd0], eax
push 0xf01ff
push str.WZCSVC
mov edx, dword [ebp - 0xd0]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jne 0x10043d9e
mov eax, dword [ebp - 0xd0]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 0x1d]
jmp 0x10043de2
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0xcc]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0x18], 4
jne 0x10043dc1
mov byte [ebp - 0x1d], 1
jmp 0x10043dc5
mov byte [ebp - 0x1d], 0
mov eax, dword [ebp - 0xcc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xd0]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret

Function at 0x10045450
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0xa
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.100139b0
add esp, 0xc
push 6
lea ecx, [ebp - 0x18]
push ecx
push 0x1010102
push 0
call sub.RtlIhvOid.dll_Ordinal_2
add esp, 0x10
mov byte [ebp - 5], al
movzx edx, byte [ebp - 5]
test edx, edx
je 0x10045505
lea eax, [ebp - 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx]
test edx, edx
jne 0x100454fa
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 1]
test ecx, ecx
jne 0x100454fa
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 2]
test eax, eax
jne 0x100454fa
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 3]
test edx, edx
jne 0x100454fa
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 4]
test ecx, ecx
jne 0x100454fa
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 5]
test eax, eax
jne 0x100454fa
movzx ecx, byte [0x1008af93]
test ecx, ecx
je 0x100454ed
push str.RT_IsUnplug__true__case_1_____n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [0x100a5346], 0
mov al, 1
jmp 0x10045524
mov byte [0x100a5346], 1
xor al, al
jmp 0x10045524
movzx edx, byte [0x1008af93]
test edx, edx
je 0x1004551b
push str.RT_IsUnplug__true__case_2_____n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [0x100a5346], 0
mov al, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x100455b0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x24], eax
push 0xf01ff
push str.WLANSVC
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100455fd
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100456fc
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x28], eax
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x1004567b
cmp dword [ebp - 0x18], 4
je 0x1004567b
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x10045679
mov eax, 1
test eax, eax
je 0x10045679
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x10045655
jmp 0x10045679
cmp dword [ebp - 0x18], 4
je 0x1004566b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x2c]
cmp eax, 0x7530
jbe 0x1004566f
jmp 0x10045679
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10045633
jmp 0x100456e8
movzx eax, byte [ebp + 8]
test eax, eax
jne 0x100456e8
cmp dword [ebp - 0x18], 1
je 0x100456e8
lea ecx, [ebp - 0x1c]
push ecx
push 1
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x100456e8
mov eax, 1
test eax, eax
je 0x100456e8
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x100456c4
jmp 0x100456e8
cmp dword [ebp - 0x18], 1
je 0x100456da
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x2c]
cmp eax, 0x7530
jbe 0x100456de
jmp 0x100456e8
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100456a2
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esp, ebp
pop ebp
ret
Function at 0x10045700
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 5], 0
movsx eax, byte [0x1008af94]
test eax, eax
jne 0x10045727
jmp 0x10045917
push 0x1008af94
push str.SoftwareMicrosoftWZCSVCParametersInterfaces_s
lea ecx, [ebp - 0x140]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0xf013f
push 0
lea eax, [ebp - 0x140]
push eax
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10045768
mov byte [ebp - 5], 1
jmp 0x1004576c
mov byte [ebp - 5], 0
movzx ecx, byte [ebp - 5]
test ecx, ecx
je 0x10045822
mov dword [ebp - 0x14c], 4
mov dword [ebp - 0x148], 4
lea edx, [ebp - 0x148]
push edx
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x14c]
push ecx
push 0
push 0x100783f0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10045822
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x144], 0
je 0x10045822
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x100457e7
mov edx, dword [ebp - 0x144]
or edx, 0x8000
mov dword [ebp - 0x144], edx
jmp 0x100457f8
mov eax, dword [ebp - 0x144]
and eax, 0xffff7fff
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp - 0x150]
cmp ecx, dword [ebp - 0x144]
je 0x10045822
push 4
lea edx, [ebp - 0x144]
push edx
push 4
push 0
push 0x10078400
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 4]
push edx
push 0xf023f
push 0
lea eax, [ebp - 0x140]
push eax
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10045853
mov byte [ebp - 5], 1
jmp 0x10045857
mov byte [ebp - 5], 0
movzx ecx, byte [ebp - 5]
test ecx, ecx
je 0x1004590d
mov dword [ebp - 0x15c], 4
mov dword [ebp - 0x158], 4
lea edx, [ebp - 0x158]
push edx
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x15c]
push ecx
push 0
push 0x10078410
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1004590d
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x154], 0
je 0x1004590d
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x100458d2
mov edx, dword [ebp - 0x154]
or edx, 0x8000
mov dword [ebp - 0x154], edx
jmp 0x100458e3
mov eax, dword [ebp - 0x154]
and eax, 0xffff7fff
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x160]
cmp ecx, dword [ebp - 0x154]
je 0x1004590d
push 4
lea edx, [ebp - 0x154]
push edx
push 4
push 0
push str.ControlFlags
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x10045930
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], 0
movsx eax, byte [0x1008af94]
test eax, eax
jne 0x10045959
xor al, al
jmp 0x10045ace
mov dword [ebp - 0xb0], 0x9c
lea ecx, [ebp - 0xb0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, 5
test edx, edx
je 0x1004598e
cmp dword [ebp - 0xa8], 0
jbe 0x1004598e
mov dword [ebp - 0x1fc], 1
jmp 0x10045998
mov dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jne 0x100459bf
cmp dword [ebp - 0xac], 6
jb 0x100459c3
cmp dword [ebp - 0xa8], 0
jb 0x100459c3
mov byte [ebp - 1], 1
push 0x1008af94
push 0x10078368
lea ecx, [ebp - 0x1e0]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 8]
push edx
push 0x20119
push 0
lea eax, [ebp - 0x1e0]
push eax
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10045a54
mov dword [ebp - 0x1e8], 4
lea ecx, [ebp - 0x1e8]
push ecx
lea edx, [ebp - 0x1e4]
push edx
lea eax, [ebp - 0x1ec]
push eax
push 0
push 0x1007839c
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10045a4a
mov edx, dword [ebp - 0x1e4]
and edx, 0x8000
je 0x10045a46
mov byte [ebp - 1], 1
jmp 0x10045a4a
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 8]
push ecx
push 0x20219
push 0
lea edx, [ebp - 0x1e0]
push edx
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10045acb
mov dword [ebp - 0x1f4], 4
lea eax, [ebp - 0x1f4]
push eax
lea ecx, [ebp - 0x1f0]
push ecx
lea edx, [ebp - 0x1f8]
push edx
push 0
push 0x100783ac
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10045ac1
mov ecx, dword [ebp - 0x1f0]
and ecx, 0x8000
je 0x10045abd
mov byte [ebp - 1], 1
jmp 0x10045ac1
mov byte [ebp - 1], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x10047300
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x9c
push 0
lea eax, [ebp - 0xa8]
push eax
call fcn.100139b0
add esp, 0xc
mov dword [ebp - 0xa8], 0x9c
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10047368
mov dword [ebp - 0xa8], 0x94
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10047368
xor al, al
jmp 0x10047379
cmp dword [ebp - 0xa4], 5
jae 0x10047377
mov al, 1
jmp 0x10047379
xor al, al
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret

Function at 0x10047420
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x30], eax
push 0x24
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.100139b0
add esp, 0xc
push 0x9c
push 0
lea ecx, [ebp - 0xd0]
push ecx
call fcn.100139b0
add esp, 0xc
mov dword [ebp - 0xd0], 0x9c
lea edx, [ebp - 0xd0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10047498
mov dword [ebp - 0xd0], 0x94
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10047498
xor eax, eax
jmp 0x1004750e
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100474c1
lea ecx, [ebp - 0x2c]
push ecx
call dword [ebp - 8]
jmp 0x100474cb
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 2
je 0x100474e2
jmp 0x1004750c
movzx ecx, word [ebp - 0x2c]
cmp ecx, 6
jne 0x100474f4
mov eax, 2
jmp 0x1004750e
movzx edx, word [ebp - 0x2c]
cmp edx, 9
jne 0x10047506
mov eax, 1
jmp 0x1004750e
xor eax, eax
jmp 0x1004750e
xor eax, eax
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x100475f0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0x1000
mov eax, dword [ebp - 8]
push eax
call fcn.10004590
add esp, 4
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x1000
mov edx, dword [ebp - 0xc]
push edx
call fcn.10004590
add esp, 4
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x90], 0
mov byte [ebp - 1], 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x10047774
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 8
push edx
call fcn.100028a0
add esp, 8
test eax, eax
je 0x10047743
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x199]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x198]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x197]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x196]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x195]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x194]
push edx
push str._02X:_02X:_02X:_02X:_02X:_02X
lea eax, [ebp - 0x80]
push eax
call fcn.10016875
add esp, 0x20
mov ecx, dword [ebp - 0x10]
add ecx, 0x1ac
mov dword [ebp - 0x90], ecx
cmp dword [ebp - 0x90], 0
je 0x10047743
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x90]
add eax, 4
push eax
call fcn.100028a0
add esp, 8
test eax, eax
je 0x10047733
mov byte [ebp - 1], 1
jmp 0x10047743
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx]
mov dword [ebp - 0x90], edx
jmp 0x1004770a
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 0x84]
push eax
call fcn.100139b0
add esp, 0xc
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x1004776a
jmp 0x10047774
cmp dword [ebp - 0x10], 0
jne 0x1004768d
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp - 0x9c]
push eax
call fcn.10004585
add esp, 4
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0xa0], ecx
mov edx, dword [ebp - 0xa0]
push edx
call fcn.10004585
add esp, 4
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret

Function at 0x100477c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008b454]
mov ecx, dword [eax + 0xacc]
mov dword [ebp - 4], ecx
push 8
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
add eax, 0x3814
push eax
call fcn.10013640
add esp, 0xc
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [0x1008b454]
push edx
push 0x10060790
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
mov esp, ebp
pop ebp
ret
Function at 0x100482d0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x550
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0xc], 0x100
mov dword [ebp - 8], 0
mov byte [ebp - 1], 0
mov byte [ebp - 0xd], 0
mov al, byte [0x1006fa7b]
mov byte [ebp - 0x218], al
push 0x1ff
push 0
lea ecx, [ebp - 0x217]
push ecx
call fcn.100139b0
add esp, 0xc
mov dl, byte [0x1006fa8b]
mov byte [ebp - 0x420], dl
push 0x1ff
push 0
lea eax, [ebp - 0x41f]
push eax
call fcn.100139b0
add esp, 0xc
push 0x101
push 0
lea ecx, [ebp - 0x550]
push ecx
call fcn.100139b0
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x14]
push ecx
call sym.RtlLib.dll_RT_Get_User_Token
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x440], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x438], str.Selection
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0
lea edx, [ebp - 0x444]
push edx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x1004842b
push 0x200
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10013640
add esp, 0xc
mov byte [ebp - 0xd], 1
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x100484d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.100139b0
add esp, 0xc
lea ecx, [ebp - 0x20]
push ecx
call sym.RtlLib.dll_RT_ACM_SoftAP_GetMacAddress
add esp, 4
movzx edx, al
test edx, edx
je 0x100485ec
mov byte [ebp - 0x30], 0x30
mov byte [ebp - 0x2f], 0x31
mov byte [ebp - 0x2e], 0x32
mov byte [ebp - 0x2d], 0x33
mov byte [ebp - 0x2c], 0x34
mov byte [ebp - 0x2b], 0x35
mov byte [ebp - 0x2a], 0x36
mov byte [ebp - 0x29], 0x37
mov byte [ebp - 0x28], 0x38
mov byte [ebp - 0x27], 0x39
mov byte [ebp - 0x26], 0x41
mov byte [ebp - 0x25], 0x42
mov byte [ebp - 0x24], 0x43
mov byte [ebp - 0x23], 0x44
mov byte [ebp - 0x22], 0x45
mov byte [ebp - 0x21], 0x46
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
jmp 0x10048560
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 6
jge 0x100485d6
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x20]
and edx, 0xf0
sar edx, 4
mov eax, dword [ebp - 0x34]
mov cl, byte [ebp + edx - 0x30]
mov byte [ebp + eax - 0x18], cl
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x38]
movsx ecx, byte [ebp + eax - 0x20]
and ecx, 0xf
mov edx, dword [ebp - 0x34]
mov al, byte [ebp + ecx - 0x30]
mov byte [ebp + edx - 0x18], al
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x38], 5
je 0x100485c3
mov edx, dword [ebp - 0x34]
mov byte [ebp + edx - 0x18], 0x3a
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
jmp 0x100485d4
mov ecx, dword [ebp - 0x34]
mov byte [ebp + ecx - 0x18], 0
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
jmp 0x10048557
push 0x14
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10013640
add esp, 0xc
mov al, 1
jmp 0x100485ee
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret