joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10a7804
Capabilities:
Create thread

Disassembly:
push 0x58
mov eax, 0x10d3483
call fcn.01098804
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0xff
push 4
push 0x2b3
mov ebx, 0x1036098
push ebx
mov edi, 0x1035594
push edi
mov esi, 0x1035528
push esi
call fcn.01099386
lea ecx, [ebp - 0x64]
call fcn.0109a83a
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
cmp dword [0x10e4490], eax
je 0x10a7864
lea ecx, [ebp - 0x64]
call fcn.0109a8f3
xor eax, eax
jmp 0x10a79a3
push 0x10e4120
push 0x10
mov byte [ebp - 4], 1
call fcn.0109892b
pop ecx
pop ecx
xor ecx, ecx
cmp eax, ecx
je 0x10a788d
mov dword [eax + 4], ecx
mov dword [eax], 0x1035f60
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
jmp 0x10a788f
xor eax, eax
mov dword [0x10e4490], eax
cmp eax, ecx
jne 0x10a78c7
push 0x1036030
push 0x8007000e
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0xff
push 4
push 0x2c5
push ebx
push edi
push esi
call fcn.01099386
lea eax, [ebp - 0x64]
push eax
call fcn.0109b1b1
add eax, 8
push eax
push 0x103b5d4
call fcn.010aed07
push 0x1035fec
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0xff
push 4
push 0x2c9
push ebx
push edi
push esi
mov dword [ebp - 0x5c], eax
call fcn.01099386
lea eax, [ebp - 0x64]
push eax
call fcn.01046812
add esp, 0x60
lea eax, [ebp - 0x14]
push eax
xor eax, eax
push eax
push eax
push 0x10a6aea
push 0x40000
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x10a795b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1035fa8
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0xff
push 4
push 0x2cf
push ebx
push edi
push esi
call fcn.01099386
lea eax, [ebp - 0x64]
push eax
call fcn.0109b1b1
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10e4494]
and dword [ebp - 4], 0
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jge 0x10a7996
mov ecx, dword [0x10e4490]
test ecx, ecx
je 0x10a7996
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [0x10e4490], 0
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x64]
call fcn.0109a8f3
mov eax, esi
call fcn.010988b8
ret
Function at 0x10a9c5b
Capabilities:
Create thread

Disassembly:
push 0xb0
mov eax, 0x10d36aa
call fcn.01098804
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
mov edi, 0xff
push edi
push 4
push 0x1e7
mov ebx, 0x10371f4
push ebx
mov esi, 0x1036afc
push esi
push 0x1036a90
call fcn.01099386
lea ecx, [ebp - 0x58]
call fcn.0109a83a
and dword [ebp - 4], 0
cmp dword [0x10e44a0], 0
je 0x10a9cbb
lea ecx, [ebp - 0x58]
call fcn.0109a8f3
xor eax, eax
jmp 0x10a9ecd
push 0x10e4120
push 0x18
mov byte [ebp - 4], 1
call fcn.0109892b
pop ecx
pop ecx
xor ecx, ecx
cmp eax, ecx
je 0x10a9ce8
mov dword [eax + 4], ecx
mov dword [eax], 0x1037060
mov dword [eax + 0xc], ecx
mov dword [eax + 8], 0x1005a68
jmp 0x10a9cea
xor eax, eax
mov dword [0x10e44a0], eax
cmp eax, ecx
jne 0x10a9d22
push 0x1037198
push 0x8007000e
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
push 4
push 0x1f3
push ebx
push esi
push 0x1036a90
call fcn.01099386
lea eax, [ebp - 0x58]
push eax
call fcn.0109b1b1
lea eax, [ebp - 0x18]
push eax
push ecx
push ecx
push 0x10a8a66
push 0x40000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x10a9e30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1035fa8
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
push 4
push 0x204
push ebx
push 0x1036afc
push 0x1036a90
call fcn.01099386
lea eax, [ebp - 0x58]
push eax
call fcn.0109c23a
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
push 0x20e
push 0x10371f4
push 0x1036afc
push 0x1036a90
push dword [ebp - 0x60]
call fcn.0109a680
and dword [ebp - 4], 0
mov eax, 0x10a9da4
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10e449c]
and dword [ebp - 4], 0
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x10a9ec0
mov ecx, dword [0x10e44a0]
test ecx, ecx
je 0x10a9e69
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [0x10e44a0], 0
push 1
push 0xff
push 4
push 0x217
push 0x10371f4
push 0x1036afc
push 0x1036a90
lea ecx, [ebp - 0xbc]
call fcn.01099386
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x50]
push ecx
mov ecx, eax
call fcn.01099e1f
lea eax, [ebp - 0x58]
push 0x3036
push eax
call fcn.0109bb37
add esp, 0x64
lea ecx, [ebp - 0xbc]
call fcn.01099436
mov esi, dword [ebp - 0x50]
lea ecx, [ebp - 0x58]
call fcn.0109a8f3
mov eax, esi
call fcn.010988b8
ret
Function at 0x10aa617
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x50
mov eax, 0x10d2cf6
call fcn.010987cc
mov esi, ecx
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 0xb
push 0x2d1
push 0x1037cd0
mov ebx, 0x103775c
push ebx
mov edi, 0x10376f0
push edi
call fcn.01099386
lea ecx, [ebp - 0x5c]
call fcn.0109a83a
xor eax, eax
mov dword [ebp - 4], eax
cmp byte [esi + 0x18], al
je 0x10aa732
mov ecx, dword [esi + 0x14]
cmp ecx, eax
je 0x10aa732
mov edx, dword [esi + 0xc]
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x1c]
push edx
push eax
push eax
push eax
lea eax, [ebp - 0x10]
push eax
push ecx
push dword [esi + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10aa71f
cmp eax, 0x103
je 0x10aa6e6
push dword [ebp - 0x10]
push dword [esi + 0x14]
push dword [esi + 8]
push dword [esi]
push 0x1037c88
test eax, eax
jle 0x10aa6bc
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 0xb
push 0x2ea
push 0x1037cd0
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x5c]
push eax
call fcn.0109c3bb
push dword [esi + 4]
push dword [esi + 8]
push 0x1037c28
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 0xb
push 0x2ee
push 0x1037cd0
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x5c]
push eax
call fcn.0109c3bb
mov esi, dword [esi + 0x14]
lea ecx, [ebp - 0x5c]
call fcn.0109a8f3
mov eax, esi
call fcn.010988b8
ret
push 0x1037bd0
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 0xb
push 0x2d5
push 0x1037cd0
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x5c]
push eax
call fcn.0109b1b1
int3
Function at 0x10aa791
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x48
mov eax, 0x10ce2be
call fcn.010987cc
mov esi, ecx
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 0xb
push 0x460
push 0x1037d68
mov ebx, 0x103775c
push ebx
mov edi, 0x10376f0
push edi
call fcn.01099386
lea ecx, [ebp - 0x54]
call fcn.0109a83a
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp byte [esi + 0x21], cl
je 0x10aa8b8
mov eax, dword [esi + 0x14]
cmp eax, ecx
je 0x10aa8b8
cmp byte [esi + 0x20], cl
je 0x10aa7ff
lea ecx, [ebp - 0x54]
call fcn.0109a8f3
call fcn.010988b8
ret
mov edx, dword [esi + 0x18]
mov dword [ebp - 0x10], edx
lea edx, [esi + 0x1c]
push edx
push ecx
lea edx, [esi + 0xc]
push edx
push ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [esi + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10aa8af
cmp eax, 0x103
je 0x10aa876
push dword [ebp - 0x10]
push dword [esi + 0x14]
push dword [esi + 8]
push dword [esi]
push 0x1037d28
test eax, eax
jle 0x10aa84c
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 0xb
push 0x47c
push 0x1037d68
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x54]
push eax
call fcn.0109c3bb
push dword [esi + 4]
push dword [esi + 8]
push 0x1037c28
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 0xb
push 0x480
push 0x1037d68
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x54]
push eax
call fcn.0109c3bb
mov byte [esi + 0x20], 1
jmp 0x10aa7f1
push 0x1037bd0
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 0xb
push 0x464
push 0x1037d68
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x54]
push eax
call fcn.0109c3bb
int3
Function at 0x10ab2c2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x50
mov eax, 0x10d2cf6
call fcn.010987cc
mov esi, ecx
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0xff
push 0xb
push 0x3bd
push 0x1039a40
mov ebx, 0x103775c
push ebx
mov edi, 0x10376f0
push edi
call fcn.01099386
lea ecx, [ebp - 0x5c]
call fcn.0109a83a
and dword [ebp - 4], 0
mov ecx, esi
call fcn.010aa791
push 4
pop eax
cmp dword [esi + 0xc], eax
je 0x10ab34a
push 0x10399c0
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x3c3
push 0x1039a40
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x5c]
push eax
call fcn.0109c3bb
mov ecx, dword [esi + 0x1c]
cmp ecx, eax
je 0x10ab386
push eax
push ecx
push 0x1039958
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x3c8
push 0x1039a40
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x5c]
push eax
call fcn.0109c3bb
mov edx, dword [esi + 0x18]
mov dword [ebp - 0x14], edx
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x18]
push edx
xor ecx, ecx
lea edx, [ebp - 0x10]
push edx
push ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x14]
push eax
push dword [esi + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10ab433
cmp eax, 0x103
je 0x10ab40a
push dword [ebp - 0x14]
push dword [esi + 0x14]
push dword [esi + 8]
push dword [esi]
push 0x1037d28
test eax, eax
jle 0x10ab3e0
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x3e7
push 0x1039a40
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x5c]
push eax
call fcn.0109c3bb
push dword [esi + 4]
push dword [esi + 8]
push 0x1037c28
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x3e5
jmp 0x10ab371
mov esi, dword [esi + 0xc]
cmp dword [ebp - 0x10], esi
je 0x10ab462
push esi
push dword [ebp - 0x10]
push 0x10398c8
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x3df
jmp 0x10ab371
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
lea ecx, [ebp - 0x5c]
call fcn.0109a8f3
call fcn.010988b8
ret 4
Function at 0x10ac058
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x54
mov eax, 0x10d3825
call fcn.010987cc
mov esi, ecx
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0xff
push 0xb
push 0x42c
push 0x1039a40
mov ebx, 0x103775c
push ebx
mov edi, 0x10376f0
push edi
call fcn.01099386
lea ecx, [ebp - 0x60]
call fcn.0109a83a
and dword [ebp - 4], 0
mov ecx, esi
call fcn.010aa791
cmp dword [esi + 0xc], 7
je 0x10ac0de
push 0x10399c0
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x433
push 0x1039a40
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x60]
push eax
call fcn.0109c3bb
mov eax, dword [esi + 0x1c]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x1005a68
shr eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0104a2b5
mov eax, dword [esi + 0x18]
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
push ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x14]
push eax
push dword [esi + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10ac1bc
cmp eax, 0x103
je 0x10ac183
push dword [ebp - 0x14]
push dword [esi + 0x14]
push dword [esi + 8]
push dword [esi]
push 0x1037d28
test eax, eax
jle 0x10ac159
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x454
push 0x1039a40
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x60]
push eax
call fcn.0109c3bb
push dword [esi + 4]
push dword [esi + 8]
push 0x1037c28
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x452
push 0x1039a40
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x60]
push eax
call fcn.0109c3bb
mov esi, dword [esi + 0xc]
cmp dword [ebp - 0x10], esi
je 0x10ac1e8
push esi
push dword [ebp - 0x10]
push 0x10398c8
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x44c
jmp 0x10ac1a7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
and dword [ebp - 0x1c], 0
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
shr eax, 1
mov dword [ecx], eax
lea ecx, [ebp - 0x20]
call fcn.0104a17d
lea ecx, [ebp - 0x60]
call fcn.0109a8f3
call fcn.010988b8
ret 8
Function at 0x10af567
Capabilities:
Get disk information
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
xor eax, eax
push edi
mov edi, dword [ebp + 0x1c]
mov word [ebx], ax
mov word [ecx], ax
push 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push ebx
push eax
push esi
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 8]
mov dword [edi], ecx
cmp ebx, esi
je 0x10af5e8
cmp eax, esi
je 0x10af5e8
xor eax, eax
inc eax
jmp 0x10af5ea
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x10b1211
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push 0x103bf04
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 1
call fcn.010bce33
mov dword [ebp - 0xc], ebx
cmp dword [ebp + 8], ebx
jne 0x10b1278
push 0x57
pop ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10b13fd
test byte [eax + 0x1c], 8
je 0x10b13fd
push 0x103bef4
push ecx
push 0x103bd30
push 0x67
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010acaf3
jmp 0x10b13fd
cmp dword [ebp + 0xc], ebx
jne 0x10b12af
push 0x57
pop ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10b13fd
test byte [eax + 0x1c], 8
je 0x10b13fd
push 0x103bee8
push ecx
push 0x103bd30
push 0x68
jmp 0x10b1268
push esi
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x10b1318
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], ebx
call esi
mov dword [ebp - 4], eax
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10b13fc
test byte [eax + 0x1c], 8
je 0x10b13fc
push 0x103ae48
call esi
push eax
mov eax, dword [0x10e308c]
push 0x103bd30
push 0x69
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010acaf3
jmp 0x10b13fc
mov ecx, str.__xml_version_1.0__encoding_UTF_16___
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x10b1322
push edi
sub eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
sar eax, 1
push ebx
lea edi, [eax + eax]
lea eax, [ebp - 0xc]
push eax
push edi
push ecx
push dword [ebp + 8]
call esi
test eax, eax
je 0x10b13ae
cmp dword [ebp - 0xc], edi
jne 0x10b13ae
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10b1355
sub eax, edx
sar eax, 1
push ebx
lea edi, [eax + eax]
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0x10b137d
cmp dword [ebp - 0xc], edi
je 0x10b13ed
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], ebx
call esi
mov dword [ebp - 4], eax
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10b13ed
test byte [eax + 0x1c], 8
je 0x10b13ed
push 0x103ae48
call esi
push eax
push 0x103bd30
push 0x6b
jmp 0x10b13dd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], ebx
call esi
mov dword [ebp - 4], eax
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10b13ed
test byte [eax + 0x1c], 8
je 0x10b13ed
push 0x103ae48
call esi
push eax
push 0x103bd30
push 0x6a
mov eax, dword [0x10e308c]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010acaf3
pop edi
cmp dword [ebp + 8], ebx
je 0x10b13fc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
push 0x103bf04
call fcn.010bce68
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop ebx
leave
ret 8
Function at 0x10b923e
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push 0x103e190
mov dword [ebp - 4], edi
mov dword [ebp - 8], 1
call fcn.010bce33
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], edi
cmp eax, edi
je 0x10b92f2
cmp dword [ebp + 0xc], edi
jbe 0x10b9324
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x62
call esi
mov ebx, eax
test ebx, ebx
jge 0x10b9364
cmp ebx, 0xc0000023
je 0x10b9364
cmp ebx, 0x80000005
je 0x10b9364
cmp ebx, 0xc0000004
je 0x10b9364
and dword [ebp - 8], edi
mov ecx, ebx
call fcn.010bce9d
mov dword [ebp - 4], eax
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10b946f
test byte [eax + 0x1c], 8
je 0x10b946f
push 0x103d70c
push ebx
push 0x103de90
push 0x18
jmp 0x10b9464
push 0x57
pop ecx
mov dword [ebp - 8], edi
mov dword [ebp - 4], ecx
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10b9471
test byte [eax + 0x1c], 8
je 0x10b9471
push 0x103e184
push ecx
push 0x103de90
push 0x16
jmp 0x10b9354
push 0x57
pop ecx
mov dword [ebp - 8], edi
mov dword [ebp - 4], ecx
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10b9471
test byte [eax + 0x1c], 8
je 0x10b9471
push 0x103e174
push ecx
push 0x103de90
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010acaf3
jmp 0x10b9471
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x10b93b5
push 0xe
pop ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10b946f
test byte [eax + 0x1c], 8
je 0x10b946f
push 0x103e168
push ecx
push 0x103de90
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010acaf3
jmp 0x10b946f
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push 0x62
call esi
cmp eax, ebx
jge 0x10b9407
mov ecx, eax
mov dword [ebp - 8], ebx
call fcn.010bce9d
mov dword [ebp - 4], eax
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10b946f
test byte [eax + 0x1c], 8
je 0x10b946f
push 0x103e100
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push 0x62
call esi
push eax
push 0x103de90
push 0x1a
jmp 0x10b945f
movzx eax, word [edi]
shr eax, 1
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010474f0
cmp eax, ebx
jge 0x10b946f
mov ecx, eax
mov dword [ebp - 8], ebx
call fcn.010bcebf
mov dword [ebp - 4], eax
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10b946f
test byte [eax + 0x1c], 8
je 0x10b946f
movzx eax, word [edi]
push 0x103e080
shr eax, 1
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010474f0
push eax
push 0x103de90
push 0x1b
mov eax, dword [0x10e308c]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010acaf3
pop esi
pop ebx
push edi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0x103e190
call fcn.010bce68
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
leave
ret 8
Function at 0x10bd06b
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xor esi, esi
xor ebx, ebx
push 0x103f9c0
mov dword [ebp - 4], esi
inc ebx
call fcn.010bce33
push 9
pop ecx
push 0x1031e70
xor eax, eax
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x10bd0f3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
call esi
mov dword [ebp - 4], eax
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10bd1b2
test byte [eax + 0x1c], 8
je 0x10bd1b2
push 0x103ae48
call esi
push eax
mov eax, dword [0x10e308c]
push 0x103f990
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010acaf3
jmp 0x10bd1b2
mov edx, dword [ebp + 0x10]
cmp edx, 0xa
jle 0x10bd138
push 0x7a
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10bd1a9
test byte [eax + 0x1c], 8
je 0x10bd1a9
push edx
push 0x103c570
push ecx
push 0x103f990
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010b0c75
jmp 0x10bd1a9
xor eax, eax
cmp edx, esi
jle 0x10bd14f
lea ecx, [ebp + 0x10]
add ecx, 4
mov edi, dword [ecx]
mov dword [ebp + eax*4 - 0x30], edi
inc eax
cmp eax, edx
jl 0x10bd141
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push edx
push esi
push dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x10bd1a9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
call esi
mov dword [ebp - 4], eax
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10bd1a9
test byte [eax + 0x1c], 8
je 0x10bd1a9
push 0x103ae48
call esi
push eax
mov eax, dword [0x10e308c]
push 0x103f990
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010acaf3
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push 0x103f9c0
call fcn.010bce68
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x10bff89
Capabilities:
Check if file exists
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push 0x1040d4c
call fcn.010bce33
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, 0x1040bc8
cmp dword [ebp + 8], ebx
je 0x10bffaf
mov eax, 0x1040c48
push esi
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
call fcn.010c1d80
test eax, eax
jne 0x10c000a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
xor edi, edi
cmp eax, 2
jne 0x10bffd4
inc edi
jmp 0x10c006b
call esi
mov ebx, eax
mov eax, dword [0x10e308c]
cmp eax, 0x10e308c
je 0x10c006b
test byte [eax + 0x1c], 8
je 0x10c006b
push 0x103ab9c
call esi
push eax
mov eax, dword [0x10e308c]
push 0x1040bb8
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x10c0066
xor edi, edi
inc edi
cmp dword [ebp + 8], ebx
jne 0x10c0019
mov eax, 0x1040d2c
jmp 0x10c0028
mov eax, 0x1040d04
cmp dword [ebp + 8], edi
je 0x10c0028
mov eax, 0x1040cdc
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x10c006b
cmp eax, 2
je 0x10c006b
xor edi, edi
mov ebx, eax
mov ecx, dword [0x10e308c]
cmp ecx, 0x10e308c
je 0x10c006b
test byte [ecx + 0x1c], 8
je 0x10c006b
push 0x1040cc8
push eax
push 0x1040bb8
push 0x21
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010acaf3
cmp dword [ebp - 4], 0
pop esi
je 0x10c007f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
push 0x1040d4c
call fcn.010bce68
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop ebx
leave
ret 4