joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405aef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f460]
jne 0x405af9
repz ret
jmp fcn.0040701e

Function at 0x408cab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40f460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406450
and dword [ebp - 0x14], 0
cmp dword [0x411248], 0
mov dword [ebp - 0x18], eax
jne 0x408d5e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408e06
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408e06
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411248], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41124c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x411250], eax
call edi
push eax
call esi
mov dword [0x411258], eax
test eax, eax
je 0x408d5e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411254], eax
mov eax, dword [0x411254]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408db7
cmp dword [0x411258], ecx
je 0x408db7
push eax
call esi
push dword [0x411258]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408db7
test ebx, ebx
je 0x408db7
call edi
test eax, eax
je 0x408dae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408dae
test byte [ebp - 8], 1
jne 0x408db7
or dword [ebp + 0x10], 0x200000
jmp 0x408dea
mov eax, dword [0x41124c]
cmp eax, dword [ebp - 0x18]
je 0x408dea
push eax
call esi
test eax, eax
je 0x408dea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408dea
mov eax, dword [0x411250]
cmp eax, dword [ebp - 0x18]
je 0x408dea
push eax
call esi
test eax, eax
je 0x408dea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411248]
call esi
test eax, eax
je 0x408e06
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408e08
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405aef
leave
ret
Function at 0x6912b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x6950a0
push edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
dec dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.006911ad
test eax, eax
jne 0x691323
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x691340
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x691323
cmp dword [ebp - 0x10], 4
jne 0x691323
cmp dword [ebp - 8], 1
jne 0x691323
cmp dword [esi + 0xc], ebx
je 0x69136e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x69133b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
leave
ret 4
lea eax, [ebp + 8]
push eax
mov eax, dword [esi + 4]
mov dword [ebp + 8], ebx
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
je 0x691323
mov eax, dword [esi + 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 4]
mov dword [eax + 8], ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
jmp 0x691323
Function at 0x6925d1
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
cmp eax, edi
jne 0x692d32
mov eax, dword [esi + 0x30]
cmp eax, edi
jne 0x69303e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, edi
je 0x692616
push dword [eax + 0x64]
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
cmp dword [esi + 0x34], edi
jne 0x6932d7
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
test byte [esi + 0x38], bl
jne 0x6932c4
push ebx
lea ecx, [esi + 0x20]
push ecx
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi + 0x14]
push eax
call fcn.00692d61
test eax, eax
jne 0x6925ec
jmp 0x6932bd
shl eax, 0xa
push eax
jmp 0x692610
xor eax, eax
jmp 0x69262b
push 4
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x6925ec
jmp 0x6932bd
push ebx
push edi
push ebx
call dword [sym.imp.ntdll.dll_RtlSetProcessIsCritical]
add esp, 0xc
jmp 0x69261f
Function at 0x6e01b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006e0140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006e0140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006e0140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006e0140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6e0bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6e0c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6f287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6e0c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6e0c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100ef57
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
test esi, esi
jne 0x100ef6c
push 0xd
pop eax
jmp 0x100ef97
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x100ef6f
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x101000d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x1001990
push 0x80000002
mov byte [ebp - 1], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1010067
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x1001824
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1010067
cmp dword [ebp - 0x10], eax
je 0x1010067
mov byte [ebp - 1], al
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
leave
ret

Function at 0x10101da
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x102b3ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push 0xff
push 0x100
push eax
call dword [sym.imp.MSVCR90.dll__vsnwprintf_s]
xor eax, eax
mov word [ebp - 6], ax
xor edi, edi
add esp, 0x14
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
cmp dword [esi + 0x24c], edi
jne 0x1010239
push eax
call dword [sym.imp.MSVCR90.dll__putws]
pop ecx
add esi, 0x2c
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
cmp esi, edi
je 0x1010268
push edi
lea eax, [ebp - 0x208]
push eax
push edi
push 1
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01017610
leave
ret
Function at 0x1010af5
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x102b3ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.0100edf9
mov ebx, eax
cmp ebx, esi
je 0x1010b62
lea ecx, [ebp - 0x20c]
call fcn.0100ed76
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01017610
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1010b80
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x20c]
call fcn.01010af5
cmp eax, esi
jne 0x1010bc7
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], 0x100
call ebx
test eax, eax
je 0x1010b6a
lea ecx, [ebp - 0x20c]
call fcn.0100ed76
push dword [ebp - 0x214]
mov ecx, edi
call fcn.0100ed12
lea ecx, [ebp - 0x20c]
mov esi, eax
call fcn.0100ed76
mov eax, esi
jmp 0x1010b51

Function at 0x101177e
Capabilities:
Create service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa10
mov eax, dword [0x102b3ac]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
call fcn.01010571
test eax, eax
je 0x10117a7
xor eax, eax
inc eax
jmp 0x101184d
push ebx
push esi
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20e]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
je 0x1011849
cmp eax, ebx
je 0x1011849
push 0x22
pop ecx
mov word [ebp - 0x210], cx
add eax, eax
push 0xf003f
mov word [ebp + eax - 0x20e], cx
push esi
xor ecx, ecx
push esi
mov word [ebp + eax - 0x20c], cx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, esi
jne 0x101185a
mov ebx, 0x400
push ebx
lea eax, [ebp - 0xa10]
push eax
push 0xd80a
call fcn.0100eb34
add esp, 0xc
test eax, eax
jne 0x1011836
push 0x1005d60
lea eax, [ebp - 0xa10]
push ebx
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
push eax
call fcn.0100ea00
add esp, 0x10
add edi, 0x2c
push esi
push edi
lea eax, [ebp - 0xa10]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01017610
leave
ret
push esi
push esi
push 0x1005d50
push esi
push esi
lea eax, [ebp - 0x210]
push eax
push 1
push 3
push 0x10
push 0xf01ff
add edi, 0x2c
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, esi
jne 0x10118cb
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, 0x400
push ebx
lea eax, [ebp - 0xa10]
push eax
push 0xd80b
call fcn.0100eb34
add esp, 0xc
test eax, eax
jne 0x1011839
push 0x1005d20
lea eax, [ebp - 0xa10]
push ebx
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
push eax
call fcn.0100ea00
add esp, 0x10
jmp 0x1011839
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push ebx
call esi
xor eax, eax
inc eax
jmp 0x101184b
Function at 0x10118e4
Capabilities:
Delete service
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.01017630
mov eax, dword [0x102b3ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.01010571
test eax, eax
jne 0x101190f
inc eax
jmp 0x1011ae4
push ebx
push edi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x1010], edi
cmp edi, ebx
jne 0x101197e
mov edi, 0x400
push edi
lea eax, [ebp - 0x804]
push eax
push 0xd80a
call fcn.0100eb34
add esp, 0xc
test eax, eax
jne 0x1011966
push 0x1005d60
lea eax, [ebp - 0x804]
push edi
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
push eax
call fcn.0100ea00
add esp, 0x10
push ebx
add esi, 0x2c
push esi
lea eax, [ebp - 0x804]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1011ae0
push 0x10020
lea ebx, [esi + 0x2c]
push ebx
push edi
mov dword [ebp - 0x1008], ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x10119e9
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, 0x400
push edi
lea eax, [ebp - 0x804]
push eax
push 0xd80c
call fcn.0100eb34
add esp, 0xc
test eax, eax
jne 0x10119db
push 0x1005e04
lea eax, [ebp - 0x804]
push edi
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
push eax
call fcn.0100ea00
add esp, 0x10
push 0
push ebx
lea eax, [ebp - 0x804]
push eax
push 0
jmp 0x1011973
lea eax, [ebp - 0x102c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 0x400
test eax, eax
jne 0x1011a6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x1011a6d
cmp eax, 0x425
jne 0x1011a25
cmp dword [ebp - 0x1028], 3
je 0x1011a6d
push edi
lea eax, [ebp - 0x804]
push eax
push 0xd80e
call fcn.0100eb34
add esp, 0xc
test eax, eax
jne 0x1011a5a
push 0x1005dd4
lea eax, [ebp - 0x804]
push edi
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
push eax
call fcn.0100ea00
add esp, 0x10
push 0
push dword [ebp - 0x1008]
lea eax, [ebp - 0x804]
push eax
push 0
call ebx
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x100c], eax
call esi
push dword [ebp - 0x1010]
call esi
xor esi, esi
cmp dword [ebp - 0x100c], esi
je 0x1011a9a
xor eax, eax
inc eax
jmp 0x1011ae2
push edi
lea eax, [ebp - 0x1004]
push eax
push 0xd80d
call fcn.0100eb34
add esp, 0xc
test eax, eax
jne 0x1011acf
push 0x1005da0
lea eax, [ebp - 0x1004]
push edi
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
push eax
call fcn.0100ea00
add esp, 0x10
push esi
push dword [ebp - 0x1008]
lea eax, [ebp - 0x1004]
push eax
push esi
call ebx
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01017610
leave
ret

Function at 0x101253f
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push esi
push ecx
xor esi, esi
lea eax, [ecx + 0x10]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
add ecx, 0x54
call fcn.0101127b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
ret
Function at 0x1014a2a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10223f7
call fcn.01017725
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x1014a83
call fcn.0100eb7f
mov esi, eax
jmp 0x1014b8c
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x1014a9c
call fcn.0100eb7f
jmp 0x1014b7e
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x1014a92
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x420], edi
cmp eax, edi
jae 0x1014b02
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1014ae8
lea ecx, [ebp - 0x418]
call fcn.01010199
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.0101007a
mov eax, esi
call fcn.01017790
ret 0x10
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.010125c5
mov dword [ebp - 4], 1
jmp 0x1014b30
cmp dword [ebp - 0x418], esi
jne 0x1014b3f
mov esi, 0x8007000e
jmp 0x1014b80
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x1014a92
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.01014098
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1014aed
lea ecx, [ebp - 0x418]
call fcn.01010199
jmp 0x1014aed
Function at 0x1017610
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102b3ac]
jne 0x101761a
repz ret
jmp fcn.01017df7

Function at 0x1018f85
Capabilities:
Listen for remote procedure calls

Disassembly:
mov edi, edi
push esi
push 1
push dword [ecx + 8]
push dword [ecx + 4]
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov esi, eax
cmp esi, 0x6b1
je 0x1018fbd
test esi, esi
je 0x1018fbd
push 0x1006f24
call fcn.0101d4e4
pop ecx
xor ecx, ecx
or eax, esi
or edx, ecx
or edx, 0x2133
pop esi
ret
mov edx, 0x80
xor eax, eax
pop esi
ret
Function at 0x101a3f7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x40
mov eax, 0x1022d6b
call fcn.010176ea
mov dword [ebp - 0x40], ecx
push 0x1006ff8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x48], 0x12c
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x1007c00
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push 0x1006fe8
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], ebx
jae 0x101a452
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ecx
push 1
push ebx
push eax
mov edi, 0x80000002
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
pop esi
test eax, eax
jne 0x101a4b5
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push 0x1006fd4
push dword [ebp - 0x38]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push 0x1006fc4
push dword [ebp - 0x38]
mov dword [ebp - 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
imul ecx, ecx, 0x3e8
mov dword [eax], ecx
mov ecx, dword [ebp - 0x48]
imul ecx, ecx, 0x3e8
mov dword [eax + 4], ecx
mov byte [eax + 8], 1
lea eax, [ebp - 0x3c]
push eax
push 1
push ebx
push 0x1001990
push edi
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101a524
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push 0x1001824
push dword [ebp - 0x3c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101a51b
mov eax, dword [ebp - 0x40]
mov byte [eax + 8], bl
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x40]
call fcn.0101777c
ret
Function at 0x101bc06
Capabilities:
Get token privileges

Disassembly:
push 0x23c
mov eax, 0x1023211
call fcn.010176ea
mov esi, ecx
mov dword [ebp - 0x21c], esi
call fcn.0101b4e8
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [esi + 0x18], bl
mov dword [ebp - 0x214], ebx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x214]
push eax
push 0x20028
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, ebx
je 0x101bd71
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 3
push dword [ebp - 0x214]
mov dword [ebp - 0x218], ebx
call esi
mov edi, dword [ebp - 0x218]
cmp edi, ebx
jbe 0x101bd71
mov eax, edi
call fcn.01017830
mov ebx, esp
push 0xc
pop ecx
xor edx, edx
lea eax, [edi - 0x10]
div ecx
inc eax
mov dword [ebx], eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x218]
push ebx
push 3
push dword [ebp - 0x214]
call esi
xor edi, edi
test eax, eax
je 0x101bd6f
lea esi, [ebx + 0xc]
cmp edi, dword [ebx]
jae 0x101bd6f
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov dword [ebp - 0x220], 0x100
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [esi - 8]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
test eax, eax
je 0x101bd66
mov eax, dword [esi]
cmp eax, 2
je 0x101bd1b
cmp eax, 1
je 0x101bd1b
xor al, al
jmp 0x101bd1d
mov al, 1
lea ecx, [ebp - 0x210]
mov byte [ebp - 0x224], al
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.0101b15b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x248]
push eax
call fcn.0101bbad
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.0101c479
inc edi
add esi, 0xc
jmp 0x101bcbd
xor ebx, ebx
mov byte [ebp - 4], 0
cmp dword [ebp - 0x214], ebx
je 0x101bd88
lea ecx, [ebp - 0x214]
call fcn.0100ebb6
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
lea esp, [ebp - 0x258]
call fcn.0101777c
ret