joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b400
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [ebp - 4]
push edi
xor edi, edi
push edi
push 1
push edi
push 0x421068
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x40b455
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x40b4f8
push 8
push 1
push edi
push 0x421068
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x40b4f8
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40b4f8
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40b4f8
lea eax, [ebp - 8]
push eax
push 0x800001
push dword [ebp - 0xc]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x40b4f8
mov esi, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x24]
push esi
push dword [ebp + 0x10]
mov eax, dword [ebx]
push dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
call fcn.0040cf00
mov eax, dword [ebp + 0x20]
add esp, 0xc
mov dword [ebx], esi
cmp dword [ebp + 0x28], edi
je 0x40b4dd
push dword [ebp - 0x10]
push ebx
push eax
push 0
push 1
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
jmp 0x40b4ee
push ebx
push eax
push 0
push 1
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x40b4f7
mov edi, 1
pop ebx
mov eax, dword [ebp - 8]
test eax, eax
je 0x40b506
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40b514
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40b524
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x417006
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040ed7b
mov dword [ebp - 0x14], eax
cmp dword [0x42e708], esi
jne 0x4170f9
push 0x800
push esi
push 0x424fa0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x417086
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4171d9
push esi
push esi
push 0x424fa0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4171d9
push 0x424fb8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4171d9
push eax
call ebx
push 0x424fc4
push edi
mov dword [0x42e708], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x424fd4
push edi
mov dword [0x42e70c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x424fe8
push edi
mov dword [0x42e710], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42e718], eax
test eax, eax
je 0x4170f6
push 0x425004
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42e714], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41711e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x417111
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x417133
push 4
pop eax
jmp 0x4171db
cmp dword [ebp - 0x14], esi
je 0x417133
push dword [0x42e708]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x417118
mov eax, dword [0x42e714]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x417191
cmp dword [0x42e718], edi
je 0x417191
push eax
call ebx
push dword [0x42e718]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x417191
test eax, eax
je 0x417191
call ecx
test eax, eax
je 0x417186
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x417186
test byte [ebp - 8], 1
jne 0x417191
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4171c1
mov eax, dword [0x42e70c]
cmp eax, edi
je 0x4171be
push eax
call ebx
test eax, eax
je 0x4171be
call eax
mov esi, eax
test esi, esi
je 0x4171be
mov eax, dword [0x42e710]
cmp eax, edi
je 0x4171be
push eax
call ebx
test eax, eax
je 0x4171be
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x42e708]
call ebx
test eax, eax
je 0x4171d9
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4171db
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b815
mov esp, ebp
pop ebp
ret
Function at 0x10014317
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10014359
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10014357
push 0x180f
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
jmp 0x10014373
push 0x5cd
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret

Function at 0x100144ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100145ad
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.1001898f
push 0
mov ecx, dword [ebp - 4]
call fcn.1001898f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
push 0
mov ecx, dword [ebp - 0x14]
call fcn.1001898f
cmp dword [eax], esi
je 0x10014534
mov dword [ebp - 0x2c], 1
jmp 0x10014538
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.1001898f
cmp dword [eax], 0
jne 0x10014558
mov dword [ebp - 0x10], 1
jmp 0x1001455c
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.1001898f
mov esi, eax
push 0
mov ecx, dword [ebp - 4]
call fcn.1001898f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10014591
mov dword [ebp - 0x34], 1
jmp 0x10014595
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0xc]
mov esi, 0x4f402e31
sub esi, dword [eax]
push 2
mov ecx, dword [ebp - 0x14]
call fcn.1001898f
mov dword [eax], esi
jmp 0x100145c7
push 0x5cd
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001f4be
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001f4d8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1001f505
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x1001f578
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001f5d3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001f5b4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1001f5d1
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001898f
mov dword [eax], 0xffff
jmp 0x1001f5a9
jmp 0x1001f5ed
push 0x5cd
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret

Function at 0x100205b7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100205e4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100205e2
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
jmp 0x100205fe
push 0x5cd
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x10029d2d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10029d60
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10029d5e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
jmp 0x10029dac
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 2
jmp 0x10029d82
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x10029dac
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10029daa
push 0xb37
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10029d77
mov esp, ebp
pop ebp
ret
Function at 0x100309a5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100309fd
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100309e1
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x100309fb
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.1001898f
and dword [eax], 0
jmp 0x100309d6
jmp 0x10030a11
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10030a11
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esp, ebp
pop ebp
ret
Function at 0x10032689
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100326ad
xor eax, eax
jmp 0x1003280c
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.10031abb
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x100326d5
xor eax, eax
jmp 0x1003280c
lea eax, [ebp - 0xc]
push eax
push 0x19f9
lea eax, [ebp - 8]
push eax
push 1
call fcn.10031b21
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x100326f9
xor eax, eax
jmp 0x1003280c
push 1
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push 0x72f4
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
call fcn.10031985
add esp, 0x1c
push dword [ebp + 8]
push 0x451
push 0
push dword [ebp - 8]
push dword [ebp - 4]
push 0x4987
push 0x4dd4
call fcn.1002a6d0
add esp, 0x1c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10031b73
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x10032781
push 0x3277
push 0x175b
push 1
push 0x104a
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x35b2
push 0x9bf
call fcn.10031ba1
add esp, 0x20
push dword [ebp - 4]
call fcn.10031772
pop ecx
test eax, eax
jne 0x10032792
xor eax, eax
jmp 0x1003280c
push dword [ebp - 4]
push 0
push 0x2803
call fcn.1002b5ff
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x100327f4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x100327c3
xor eax, eax
jmp 0x1003280c
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100327dc
xor eax, eax
jmp 0x1003280c
push 0x61a4
push 0x72ee
push 1
lea eax, [ebp - 4]
push eax
call fcn.10032612
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10032805
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10032809
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1004a060
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004a0bb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004a09c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1004a0b9
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001898f
mov dword [eax], 1
jmp 0x1004a091
jmp 0x1004a0d5
push 0x5cd
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret

Function at 0x1004a4b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1004a50f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
mov dword [ecx + eax], edx
jmp 0x1004a53f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1004a53f
push 0x5cd
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret

Function at 0x1004b299
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004b2e0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x1004b2f6
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004b2f6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esp, ebp
pop ebp
ret
Function at 0x1004b3b7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004b424
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
add ecx, eax
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.10050e68
jmp 0x1004b431
push 0
push 0x205a
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esp, ebp
pop ebp
ret
Function at 0x10050b25
Capabilities:
Create process on windows
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
mov dword [ebp - 8], 1
xor ebx, ebx
push esi
mov dword [ebp - 0x10], 0x2a30a4cc
mov esi, ecx
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x28]
push edi
mov dword [ebp - 0xc], 0x6d8bc0d
push 2
pop edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0xc], 0xb780f885
mov dword [ebp - 0x14], 0x4491d0b
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0x14], 0xdabac8ef
mov dword [ebp - 0x14], 0x82f744ed
mov dword [ebp - 0x14], 0x6ed55c59
mov dword [ebp - 0x14], 0x254f8d3
push 3
call fcn.100188f1
mov dword [ebp - 0xc], ebx
jmp 0x10050ba0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10050b90
mov dword [ebp - 0xc], ebx
jmp 0x10050bb9
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1c], 0xfffffffa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x10050bab
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, 0xa17d0b0a
setge dl
cmp eax, edx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
neg ecx
sbb ecx, ecx
add eax, 0x26f3
inc ecx
xor edx, edx
add eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 8]
jg 0x10050c64
mov dword [ebp - 0xc], ebx
jmp 0x10050c5c
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10050c53
push ebx
push 0x9c3
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffee
jle 0x10050c3e
jmp 0x10050c74
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10050c74
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
call fcn.10018973
push 0x5f24
push 1
push esi
call fcn.1004b486
push esi
call fcn.10032689
mov esi, eax
add esp, 0x10
mov eax, 0x1a04
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], 0x971c1ec2
mov dword [ebp - 0xc], ebx
jmp 0x10050cc2
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x38], 0x2212
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10050cb4
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10050ce6
push 0x5cd
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret