joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f820
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x20c], 0
push 0xc
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.10019d20
add esp, 0xc
lea ecx, [ebp - 0x208]
push ecx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x1001f88a
push str.CollectSeclogFiles__:_____SHGetFolderPathA___CSIDL_LOCAL_APPDATA_failed
mov edx, dword [ebp - 0x21c]
push edx
call main
add esp, 8
jmp 0x1001f903
push 0
push str.Packages
push 0x1003430c
lea eax, [ebp - 0x208]
push eax
call fcn.100190c0
add esp, 0x10
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x1001f903
mov ecx, dword [ebp - 0x220]
push ecx
push str.CollectSeclogFiles__:_searching_in_wszAppDataPackages_S...
call fcn.10018570
add esp, 8
push 1
push 1
push 0
lea edx, [ebp - 0x218]
push edx
push 0x1001f780
push 5
push 1
push 0x10050100
mov eax, dword [ebp - 0x220]
push eax
call fcn.10021be0
add esp, 0x24
push 0xfffffffffffffffe
lea ecx, [ebp - 0x220]
push ecx
call fcn.10019b10
add esp, 8
lea edx, [ebp - 0x208]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x1001f93d
push str.CollectSeclogFiles__:_____SHGetFolderPathA___CSIDL_APPDATA_failed
mov eax, dword [ebp - 0x21c]
push eax
call main
add esp, 8
jmp 0x1001f9b6
push 0
push str.LocalLow
push 0x1003430c
lea ecx, [ebp - 0x208]
push ecx
call fcn.100190c0
add esp, 0x10
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x1001f9b6
mov edx, dword [ebp - 0x224]
push edx
push str.CollectSeclogFiles__:_searching_in_wszAppDataLocalLow_S...
call fcn.10018570
add esp, 8
push 1
push 1
push 0
lea eax, [ebp - 0x218]
push eax
push 0x1001f780
push 5
push 1
push 0x10050100
mov ecx, dword [ebp - 0x224]
push ecx
call fcn.10021be0
add esp, 0x24
push 0xfffffffffffffffe
lea edx, [ebp - 0x224]
push edx
call fcn.10019b10
add esp, 8
push 1
push 1
push 0
lea eax, [ebp - 0x218]
push eax
push 0x1001f780
push 5
push 1
push 0x10050100
push 0x1005195e
call fcn.10021be0
add esp, 0x24
push 0
mov ecx, dword [0x10050100]
push ecx
push 0x1003430c
push 0x10050940
call fcn.100190c0
add esp, 0x10
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x1001fa2f
mov edx, dword [ebp - 0x20c]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.1001f6b0
add esp, 8
push 0xfffffffffffffffe
lea ecx, [ebp - 0x20c]
push ecx
call fcn.10019b10
add esp, 8
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x214]
push eax
push str.CollectSeclogFiles__:_done__ctx.dwFilesCount_u_dwTotalLen_u
call fcn.10018570
add esp, 0xc
cmp dword [ebp - 0x210], 0
je 0x1001fa5e
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x218]
mov dword [ecx], edx
mov eax, dword [ebp - 0x210]
mov esp, ebp
pop ebp
ret
Function at 0x10020070
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x100200a1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
cmp dword [eax + edx], 0x4550
je 0x100200a5
xor eax, eax
jmp 0x10020107
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
cmp dword [edx], 0x4550
je 0x100200c4
xor eax, eax
jmp 0x10020107
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 0x14
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
movzx edx, word [ecx]
cmp edx, 0x10b
je 0x100200f2
xor eax, eax
jmp 0x10020107
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
add ecx, 0xe0
mov edx, dword [ebp + 0x14]
mov dword [edx], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10021600
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 0x238], 1
push str.EnumWinProcessesW__:_started
call fcn.10018570
add esp, 4
push 0
push 2
call dword [0x10052314]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x10021655
push str.EnumWinProcessesW__:_CreateToolhelp32Snapshot____failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
or eax, 0xffffffff
jmp 0x10021719
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.10019d20
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x100216b4
push str.EnumWinProcessesW__:_Process32FirstW__
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
mov eax, dword [ebp - 0x234]
push eax
call dword [0x100522b0]
mov eax, 0xfffffffe
jmp 0x10021719
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x230]
push edx
call dword [ebp + 8]
add esp, 8
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x100216d6
jmp 0x100216ed
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100216b4
push str.EnumWinProcessesW__:_Scan_finished._n
call fcn.10018570
add esp, 4
mov edx, dword [ebp - 0x234]
push edx
call dword [0x100522b0]
cmp dword [ebp - 0x238], 0
jne 0x10021717
mov eax, 1
jmp 0x10021719
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10021e70
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10021fb9
mov dx, word [0x10039c68]
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.MyMoveFile__:_cannot_copy__S_to__S
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 0x10
push 0xf4240
push 1
push 0x10050d7c
call fcn.1001bc80
add esp, 0xc
push eax
mov eax, dword [ebp + 0xc]
push eax
push str._S._06d
push 0x207
lea ecx, [ebp - 0x210]
push ecx
call fcn.10019e20
add esp, 0x14
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x10021f47
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str.MyMoveFile__:_MoveFile___failed___S_______S_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
jmp 0x10021fb7
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.MyMoveFile__:_MoveFile___success___S_______S_
call fcn.10018570
add esp, 0xc
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10021f98
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.MyMoveFile__:_2_cannot_copy_file__S___S
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
jmp 0x10021fb7
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.MyMoveFile__:_CopyFile___success___S_______S_
call fcn.10018570
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10021fd8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.MyMoveFile__:_copy_success___S_______S_
call fcn.10018570
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10021fe0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x200
push 0
lea ecx, [ebp - 0x200]
push ecx
call fcn.10019d20
add esp, 0xc
push 0x200
lea edx, [ebp - 0x200]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1001edd0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str.MyDeleteFileW__:_____do_DeleteFile__S_
call fcn.10018570
add esp, 8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret
Function at 0x100220f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [ebp - 4], 0xffffffff
setne cl
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10022125
mov dword [ebp - 0xc], str.TRUE
jmp 0x1002212c
mov dword [ebp - 0xc], str.FALSE
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.FileExistsA__:_____szFilePath_s_dwAttrib_08x_bRet_s
call fcn.10018570
add esp, 0x10
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10022150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0xffffffff
setne al
mov esp, ebp
pop ebp
ret

Function at 0x10022170
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x1002219a
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x1002219a
mov dword [ebp - 8], 1
jmp 0x100221a1
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x100221b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov ax, word [0x10039c68]
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x214], 0
push 0x10
call fcn.10019ae0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100222de
push 0x143
call fcn.1001b7e0
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x1002226e
push 0x207
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1002225f
mov ecx, dword [ebp - 0x214]
push ecx
push str.GetTmpLocations__:_GetEnvironmentVariableW___failed_wszAlluserprofileVar_S
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
call fcn.1001ba10
add esp, 4
lea eax, [ebp - 0x210]
push eax
push str.GetTmpLocations__:_wszAlluserprofileDir_S
call fcn.10018570
add esp, 8
push 0x10051b68
call fcn.10018df0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
lea edx, [ebp - 0x210]
push edx
call fcn.10018df0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
push 0x1005195e
call fcn.10018df0
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
push 0x10050940
call fcn.10018df0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
cmp dword [ebp + 8], 0
je 0x100222de
mov edx, dword [ebp + 8]
mov dword [edx], 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100234d2
Capabilities:
Schedule task via itaskscheduler
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10050324], 5
jbe 0x100234e4
pop ebp
jmp fcn.1002319a
pop ebp
jmp fcn.10022f70
Function at 0x100241b0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 5
push 8
call fcn.10023f70
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100241f6
xor eax, eax
jmp 0x100242c5
lea eax, [ebp - 0x10]
push eax
push 2
mov ecx, dword [ebp - 8]
push ecx
call fcn.10023ff0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10024216
jmp 0x100242a4
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call dword [0x10052358]
test eax, eax
jne 0x10024253
push str.AllocateAndInitializeSid___failed_n
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
jmp 0x100242a4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
jmp 0x1002426c
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [edx]
jae 0x1002429a
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*8 + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10024298
mov dword [ebp - 0x20], 1
jmp 0x1002429a
jmp 0x10024263
mov edx, dword [ebp - 0xc]
push edx
call dword [0x100522f8]
mov eax, dword [ebp - 8]
push eax
call dword [0x100522b0]
cmp dword [ebp - 4], 0
je 0x100242c2
push 0
lea ecx, [ebp - 4]
push ecx
call fcn.10019b10
add esp, 8
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret

Function at 0x100242d0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12
push 1
lea ecx, [ebp - 0xc]
push ecx
call dword [0x10052358]
test eax, eax
jne 0x10024331
push str.IsUserNTSystem__:_AllocateAndInitializeSid___failed_n
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
xor eax, eax
jmp 0x1002434f
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [0x100522f8]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10024880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
movzx edx, word [ebp + 0xc]
push edx
call fcn.10024960
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100248c7
xor eax, eax
jmp 0x10024959
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
add ecx, 8
push ecx
mov edx, dword [ebp - 0xc]
movzx eax, word [edx]
push eax
push str.SendPipeMsg__:_code_u_data_len_u
call fcn.10018570
add esp, 0xc
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
add eax, 8
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10024922
push str.SendPipeMsg__:_WriteFile___failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
jmp 0x10024944
mov eax, dword [ebp - 0x10]
push eax
push str.SendPipeMsg__:_sent__d_bytes_to_pipe
call fcn.10018570
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [ebp - 8], 1
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.10019b10
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10025540
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
xor eax, eax
mov word [ebp - 4], ax
cmp dword [0x100503c0], 0
je 0x10025560
mov ecx, 9
mov word [ebp - 4], cx
jmp 0x10025572
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x28]
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
cmp ecx, 9
jne 0x1002558a
push str.GetOsPlatform__:_PROCESSOR_ARCHITECTURE_AMD64__x64_
call fcn.10018570
add esp, 4
jmp 0x100255b3
movzx edx, word [ebp - 4]
test edx, edx
jne 0x100255a1
push str.GetOsPlatform__:_PROCESSOR_ARCHITECTURE_INTEL__x86_
call fcn.10018570
add esp, 4
jmp 0x100255b3
movzx eax, word [ebp - 4]
push eax
push str.GetOsPlatform__:_strange_platform_id:__04x
call fcn.10018570
add esp, 8
mov ax, word [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10026300
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
cmp dword [0x100503c0], 0
je 0x1002635a
mov dword [ebp - 0x14], 0x676
mov dword [ebp - 0x1c], 0x6f0
mov dword [ebp - 0x18], 0x19c7
jmp 0x1002636f
mov dword [ebp - 0x14], 0x1a20
mov dword [ebp - 0x1c], 0xcd9
mov dword [ebp - 0x18], 0x17bf
mov eax, dword [0x10051fc8]
and eax, 0x200
jne 0x100263b6
mov ecx, dword [0x10051fc8]
and ecx, 0x10
jne 0x100263b6
mov edx, dword [0x10051fc8]
and edx, 2
jne 0x100263b6
mov eax, dword [0x10051fc8]
and eax, 0x100
jne 0x100263b6
mov ecx, dword [0x10051fc8]
and ecx, 0x80
jne 0x100263b6
mov edx, dword [0x10051fc8]
and edx, 0x40
je 0x100263ca
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
jmp 0x100263dc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
shl eax, 2
push eax
call fcn.10019ae0
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10026402
xor eax, eax
jmp 0x1002649b
mov dword [ebp - 8], 0
jmp 0x10026414
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
jae 0x10026490
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x28]
push ecx
call fcn.1001b7e0
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x1002648b
push 0x104
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 8]
push eax
push str.____GetTrustedExes__:_i_d_wszExeEnv_S_wszTargetExe_S
call fcn.10018570
add esp, 0x10
lea ecx, [ebp - 0x2c]
push ecx
call fcn.1001ba10
add esp, 4
lea edx, [ebp - 0x240]
push edx
call fcn.10018df0
add esp, 4
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [edx + ecx*4], eax
jmp 0x1002640b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x100266d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x10026707
push str.RunMeInTrustedExeGo__:_ResumeThread__:_failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10026e10
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x10026de0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
jne 0x10026e64
push 2
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, 1
jmp 0x10026e66
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100272e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, dword [ebp + 0x10]
mov cl, byte [eax + 0x100]
mov byte [ebp - 2], cl
mov edx, dword [ebp + 0x10]
mov al, byte [edx + 0x101]
mov byte [ebp - 1], al
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
jmp 0x10027317
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jge 0x100273db
movzx ecx, byte [ebp - 2]
add ecx, 1
and ecx, 0x800000ff
jns 0x1002733a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 2], cl
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
movzx edx, byte [ebp - 1]
add ecx, edx
and ecx, 0x800000ff
jns 0x1002735e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 1], cl
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + eax]
mov byte [ebp - 9], dl
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov al, byte [esi + eax]
mov byte [edx + ecx], al
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0x10]
mov al, byte [ebp - 9]
mov byte [edx + ecx], al
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + ecx]
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0x10]
movzx ecx, byte [edx + ecx]
add eax, ecx
and eax, 0x800000ff
jns 0x100273b5
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0xa], al
movzx edx, byte [ebp - 0xa]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov byte [ecx], al
jmp 0x1002730e
mov edx, dword [ebp + 0x10]
mov al, byte [ebp - 2]
mov byte [edx + 0x100], al
mov ecx, dword [ebp + 0x10]
mov dl, byte [ebp - 1]
mov byte [ecx + 0x101], dl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10027400
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x5c], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x60], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x64], 0
pop ebp
ret