joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415cd2
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x45c
lea eax, [esp + 4]
push ebx
push esi
push edi
mov esi, ecx
mov ebx, 0x208
push esi
push ebx
push eax
call fcn.00409282
push 0x41cfec
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.0040920d
add esp, 0x18
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 4
mov edi, eax
pop ebx
mov edx, 0x41cff4
lea ecx, [esp + 0x244]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x415d4f
test ax, ax
je 0x415d4b
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x415d4f
add ecx, ebx
add edx, ebx
test ax, ax
jne 0x415d2b
xor eax, eax
jmp 0x415d54
sbb eax, eax
or eax, 1
test eax, eax
je 0x415e3d
mov ecx, 0x41cff8
lea eax, [esp + 0x244]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x415d8c
test dx, dx
je 0x415d88
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x415d8c
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x415d68
xor eax, eax
jmp 0x415d91
sbb eax, eax
or eax, 1
test eax, eax
je 0x415e3d
push esi
lea eax, [esp + 0x14]
push 0x208
push eax
call fcn.00409282
push 0x41d000
lea eax, [esp + 0x20]
push 0x208
push eax
call fcn.0040920d
lea eax, [esp + 0x25c]
push eax
lea eax, [esp + 0x2c]
push 0x208
push eax
call fcn.0040920d
add esp, 0x24
test byte [esp + 0x218], 0x10
je 0x415e06
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x415df9
lea ecx, [esp + 0x10]
call fcn.00415cd2
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x415e2c
test byte [esp + 0x218], 1
je 0x415e21
lea eax, [esp + 0x10]
push 0x80
push eax
call fcn.004092e6
pop ecx
pop ecx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x415e3d
push ebx
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [esp + 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x415d1f
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x415e6f
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415e76
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push esi
push edi
push 0x208
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.00405930
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push esi
push edi
push str._s_s_s
push 0xffffffffffffffff
push 0x104
push eax
call fcn.004035d1
add esp, 0x28
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
je 0x415ee3
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.GDI32.dll_RemoveFontResourceW]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
leave
ret
Function at 0x415ee5
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push ecx
call fcn.00401fff
add esp, 0xc
test eax, eax
jne 0x415f10
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 4]
call fcn.004155e5
leave
ret

Function at 0x416450
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x401820
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x42149c], eax
ret
Function at 0x100012c0
Capabilities:
List user accounts for group

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c30
call fcn.1000d6a0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x1c20], eax
mov ebx, edx
mov dword [ebp - 0x1c10], edi
mov dword [ebp - 0x1c18], edi
mov dword [ebp - 0x1c24], edi
mov dword [ebp - 0x1c2c], edi
cmp esi, edi
je 0x10001314
lea ecx, [ebp - 0x1c0c]
push ecx
call fcn.10003ba0
add esp, 4
cmp ebx, edi
je 0x10001332
lea edx, [ebp - 0x140c]
push edx
mov esi, ebx
call fcn.10003ba0
add esp, 4
jmp 0x10001332
xor edi, edi
lea eax, [ebp - 0x1c2c]
push eax
lea ecx, [ebp - 0x1c24]
push ecx
lea edx, [ebp - 0x1c18]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x1c10]
push eax
push edi
lea ecx, [ebp - 0x140c]
push ecx
lea edx, [ebp - 0x1c0c]
push edx
call sub.NETAPI32.dll_NetGroupGetUsers
mov esi, eax
mov dword [ebp - 0x1c28], esi
cmp esi, edi
je 0x1000137c
cmp esi, 0xea
jne 0x100014ae
mov eax, dword [ebp - 0x1c10]
mov edi, eax
mov dword [ebp - 0x1c14], edi
test eax, eax
je 0x100014cc
cmp dword [ebp - 0x1c18], 0
mov dword [ebp - 0x1c1c], 0
jbe 0x100014ba
test edi, edi
je 0x100014ae
mov esi, dword [edi]
lea eax, [ebp - 0x40c]
push eax
mov ebx, 0x400
call fcn.10003a60
add esp, 4
test eax, eax
je 0x10001495
lea eax, [ebp - 0x40c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100013d8
sub eax, edx
cmp eax, 1
jbe 0x10001495
lea eax, [ebp - 0x40c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100013f3
sub eax, edx
cmp byte [ebp + eax - 0x40d], 0x24
lea eax, [ebp + eax - 0x40d]
jne 0x10001495
mov byte [eax], cl
mov eax, dword [ebp - 0x1c20]
test eax, eax
jne 0x1000143a
lea edi, [ebp - 0x80c]
lea ecx, [ebp - 0x40c]
call fcn.10003ab0
mov ecx, edi
push ecx
lea edx, [ebp - 0x40c]
push edx
jmp 0x10001476
push eax
lea eax, [ebp - 0x40c]
push eax
push str._s._s
lea ecx, [ebp - 0xc0c]
push 0x400
push ecx
call fcn.10004403
add esp, 0x14
lea edi, [ebp - 0x80c]
lea ecx, [ebp - 0xc0c]
call fcn.10003ab0
mov edx, edi
push edx
lea eax, [ebp - 0x40c]
push eax
push str.___23s__s_n
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 0xc
add dword [ebp - 0x1c14], 4
mov edi, dword [ebp - 0x1c14]
mov eax, dword [ebp - 0x1c1c]
inc eax
mov dword [ebp - 0x1c1c], eax
cmp eax, dword [ebp - 0x1c18]
jb 0x100013a9
mov eax, dword [ebp - 0x1c10]
mov esi, dword [ebp - 0x1c28]
test eax, eax
je 0x100014cc
push eax
call sub.NETAPI32.dll_NetApiBufferFree
xor eax, eax
mov dword [ebp - 0x1c10], eax
cmp esi, 0xea
je 0x10001330
test eax, eax
je 0x100014e2
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003ead
mov esp, ebp
pop ebp
ret
Function at 0x10001500
Capabilities:
Get domain controller name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov dword [ebp - 0xc10], 0
test edi, edi
jne 0x10001564
lea eax, [ebp - 0xc10]
push eax
push edi
push edi
call sub.NETAPI32.dll_NetGetDCName
test eax, eax
jne 0x10001631
mov esi, dword [ebp - 0xc10]
test esi, esi
je 0x1000165a
lea ecx, [ebp - 0x40c]
push ecx
mov ebx, 0x400
call fcn.10003a60
mov edx, dword [ebp - 0xc10]
add esp, 4
push edx
jmp 0x100015bb
lea eax, [ebp - 0xc0c]
push eax
mov esi, edi
call fcn.10003ba0
add esp, 4
lea ecx, [ebp - 0xc10]
push ecx
lea edx, [ebp - 0xc0c]
push edx
push 0
call sub.NETAPI32.dll_NetGetAnyDCName
test eax, eax
jne 0x10001631
mov esi, dword [ebp - 0xc10]
test esi, esi
je 0x1000165a
lea eax, [ebp - 0x40c]
push eax
mov ebx, 0x400
call fcn.10003a60
mov ecx, dword [ebp - 0xc10]
add esp, 4
push ecx
call sub.NETAPI32.dll_NetApiBufferFree
push str.IP_Address
push str.Server_Name
push str.___23s___32s_n
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 0xc
push str.__________
push str.___________
push str.___23s___32s_n
call fcn.100010b0
add esp, 0xc
push edi
mov edx, str.Domain_Controllers
lea ecx, [ebp - 0x40c]
call fcn.100012c0
add esp, 4
cmp dword [ebp + 8], 0
je 0x1000165a
push edi
mov edx, str.Domain_Computers
lea ecx, [ebp - 0x40c]
call fcn.100012c0
add esp, 4
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10003ead
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc10]
test eax, eax
je 0x10001641
push eax
call sub.NETAPI32.dll_NetApiBufferFree
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Error:__d_n
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 8
mov ecx, dword [ebp - 8]
pop esi
xor ecx, ebp
pop ebx
call fcn.10003ead
mov esp, ebp
pop ebp
ret
Function at 0x10001690
Capabilities:
List user account groups

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x808], ebx
mov dword [ebp - 0x810], ebx
mov dword [ebp - 0x814], ebx
cmp edi, ebx
je 0x100016d1
lea eax, [ebp - 0x804]
push eax
mov esi, edi
call fcn.10003ba0
add esp, 4
push 0x10011498
push str.Name
push str.___48s__s_n
mov esi, 0x10017ae0
call fcn.100010b0
push str._______
push str.____
push str.___48s__s_n
call fcn.100010b0
add esp, 0x18
neg edi
sbb edi, edi
lea ecx, [ebp - 0x804]
and edi, ecx
mov dword [ebp - 0x818], edi
jmp 0x10001726
mov edi, dword [ebp - 0x818]
push ebx
lea edx, [ebp - 0x814]
push edx
lea eax, [ebp - 0x810]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x808]
push ecx
push 1
push edi
cmp dword [ebp + 8], ebx
je 0x1000174d
call sub.NETAPI32.dll_NetLocalGroupEnum
jmp 0x10001752
call sub.NETAPI32.dll_NetGroupEnum
mov dword [ebp - 0x80c], eax
cmp eax, ebx
je 0x10001778
cmp eax, 0xea
je 0x10001778
push eax
push str.____Error:__d_n
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 8
jmp 0x100017b9
mov edi, dword [ebp - 0x808]
cmp edi, ebx
je 0x100017d9
cmp dword [ebp - 0x810], 0
jbe 0x100017bf
jmp 0x10001790
test edi, edi
je 0x100017b9
mov edx, dword [edi + 4]
mov eax, dword [edi]
push edx
push eax
push str.___48S__S_n
mov esi, 0x10017ae0
call fcn.100010b0
inc ebx
add esp, 0xc
add edi, 8
cmp ebx, dword [ebp - 0x810]
jb 0x10001790
mov edi, dword [ebp - 0x808]
xor ebx, ebx
cmp edi, ebx
je 0x100017d3
push edi
call sub.NETAPI32.dll_NetApiBufferFree
xor edi, edi
mov dword [ebp - 0x808], edi
mov eax, dword [ebp - 0x80c]
cmp eax, 0xea
je 0x10001720
cmp edi, ebx
je 0x100017ee
push edi
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003ead
mov esp, ebp
pop ebp
ret

Function at 0x10001800
Capabilities:
Get domain controller name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], 0
test ecx, ecx
jne 0x10001880
push esi
lea eax, [ebp - 0x408]
push eax
push ecx
push ecx
call sub.NETAPI32.dll_NetGetDCName
test eax, eax
jne 0x10001861
mov esi, dword [ebp - 0x408]
test esi, esi
je 0x10001871
push ebx
lea ecx, [ebp - 0x404]
push ecx
mov ebx, 0x400
call fcn.10003a60
push 0
lea ecx, [ebp - 0x404]
call fcn.10001690
add esp, 8
pop ebx
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x10001871
push eax
call sub.NETAPI32.dll_NetApiBufferFree
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003ead
mov esp, ebp
pop ebp
ret
push 0
call fcn.10001690
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
call fcn.10003ead
mov esp, ebp
pop ebp
ret
Function at 0x100018b0
Capabilities:
List user accounts for group

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.1000d6a0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0x1008], ebx
mov dword [ebp - 0x100c], ebx
mov dword [ebp - 0x1014], ebx
mov dword [ebp - 0x1010], ebx
cmp esi, ebx
je 0x100018fb
lea eax, [ebp - 0x804]
push eax
call fcn.10003ba0
add esp, 4
cmp edi, ebx
je 0x10001914
lea ecx, [ebp - 0x1004]
push ecx
mov esi, edi
call fcn.10003ba0
add esp, 4
jmp 0x10001914
xor ebx, ebx
lea edx, [ebp - 0x1010]
push edx
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x100c]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x1008]
push edx
push ebx
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x804]
push ecx
call sub.NETAPI32.dll_NetGroupGetUsers
mov ebx, eax
test ebx, ebx
je 0x10001954
cmp ebx, 0xea
jne 0x1000198d
mov esi, dword [ebp - 0x1008]
test esi, esi
je 0x100019a5
xor edi, edi
cmp dword [ebp - 0x100c], edi
jbe 0x10001993
test esi, esi
je 0x1000198d
mov edx, dword [esi]
push edx
push 0x100114d0
push 0x10017ae0
call fcn.10001110
inc edi
add esp, 0xc
add esi, 4
cmp edi, dword [ebp - 0x100c]
jb 0x10001968
mov esi, dword [ebp - 0x1008]
test esi, esi
je 0x100019a5
push esi
call sub.NETAPI32.dll_NetApiBufferFree
xor esi, esi
mov dword [ebp - 0x1008], esi
cmp ebx, 0xea
je 0x10001912
test esi, esi
je 0x100019bb
push esi
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003ead
mov esp, ebp
pop ebp
ret
Function at 0x100019d0
Capabilities:
List user accounts for group

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.1000d6a0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0x1008], ebx
mov dword [ebp - 0x100c], ebx
mov dword [ebp - 0x1014], ebx
mov dword [ebp - 0x1010], ebx
cmp esi, ebx
je 0x10001a1b
lea eax, [ebp - 0x804]
push eax
call fcn.10003ba0
add esp, 4
cmp edi, ebx
je 0x10001a30
lea ecx, [ebp - 0x1004]
push ecx
mov esi, edi
call fcn.10003ba0
add esp, 4
lea edx, [ebp - 0x1010]
push edx
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x100c]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x1008]
push edx
push 3
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x804]
push ecx
call sub.NETAPI32.dll_NetLocalGroupGetMembers
mov ebx, eax
test ebx, ebx
je 0x10001a86
cmp ebx, 0xea
je 0x10001a86
push ebx
push str.____Error:__d_n
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 8
jmp 0x10001ac5
mov esi, dword [ebp - 0x1008]
test esi, esi
je 0x10001add
xor edi, edi
cmp dword [ebp - 0x100c], edi
jbe 0x10001acb
lea ebx, [ebx]
test esi, esi
je 0x10001ac5
mov edx, dword [esi]
push edx
push 0x100114d0
push 0x10017ae0
call fcn.10001110
inc edi
add esp, 0xc
add esi, 4
cmp edi, dword [ebp - 0x100c]
jb 0x10001aa0
mov esi, dword [ebp - 0x1008]
test esi, esi
je 0x10001add
push esi
call sub.NETAPI32.dll_NetApiBufferFree
xor esi, esi
mov dword [ebp - 0x1008], esi
cmp ebx, 0xea
je 0x10001a30
test esi, esi
je 0x10001af3
push esi
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003ead
mov esp, ebp
pop ebp
ret

Function at 0x10001b10
Capabilities:
Get domain controller name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], 0
test ecx, ecx
jne 0x10001b88
lea eax, [ebp - 0x408]
push eax
push ecx
push ecx
call sub.NETAPI32.dll_NetGetDCName
test eax, eax
jne 0x10001b8f
push ebx
push esi
mov esi, dword [ebp - 0x408]
lea ecx, [ebp - 0x404]
push ecx
mov ebx, 0x400
call fcn.10003a60
add esp, 4
mov edx, edi
lea ecx, [ebp - 0x404]
call fcn.100018b0
mov edx, dword [ebp - 0x408]
push edx
call sub.NETAPI32.dll_NetApiBufferFree
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003ead
mov esp, ebp
pop ebp
ret
mov edx, edi
call fcn.100018b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003ead
mov esp, ebp
pop ebp
ret

Function at 0x10002b60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp edi, esi
jbe 0x10002ba4
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, edi
sub eax, esi
cmp eax, 0x2000
jbe 0x10002b85
mov eax, 0x2000
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push eax
lea eax, [esi + edx]
push eax
push ecx
call ebx
test eax, eax
je 0x10002baf
add esi, dword [ebp - 4]
cmp esi, edi
jb 0x10002b75
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003020
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x804]
mov esi, ecx
push eax
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x80c], edi
mov dword [ebp - 0x814], edi
mov dword [ebp - 0x810], edi
call fcn.10003ba0
add esp, 4
test eax, eax
je 0x1000315a
push 0x10011498
push str.Share_name
push 0x1001187c
mov esi, 0x10017ae0
call fcn.100010b0
push str._______
push str.__________
push 0x1001187c
call fcn.100010b0
add esp, 0x18
push ebx
lea esp, [esp]
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0x814]
push edx
lea eax, [ebp - 0x80c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x808]
push ecx
push 1
lea edx, [ebp - 0x804]
push edx
call sub.NETAPI32.dll_NetShareEnum
mov ebx, eax
cmp ebx, edi
je 0x100030f5
cmp ebx, 0xea
je 0x100030f5
push ebx
push str.____Error:__ld_n
mov esi, 0x10017ae0
call fcn.100010b0
mov esi, dword [ebp - 0x808]
add esp, 8
jmp 0x1000313d
mov esi, dword [ebp - 0x808]
cmp esi, edi
je 0x1000314d
mov edi, 1
cmp dword [ebp - 0x80c], edi
jb 0x1000313b
lea esp, [esp]
mov eax, dword [esi + 8]
mov ecx, dword [esi]
push eax
push ecx
push str.___32s__s_n
push 0x10017ae0
call fcn.10001110
inc edi
add esp, 0x10
add esi, 0xc
cmp edi, dword [ebp - 0x80c]
jbe 0x10003110
mov esi, dword [ebp - 0x808]
xor edi, edi
cmp esi, edi
je 0x1000314d
push esi
call sub.NETAPI32.dll_NetApiBufferFree
mov dword [ebp - 0x808], edi
cmp ebx, 0xea
je 0x100030a0
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10003ead
mov esp, ebp
pop ebp
ret
Function at 0x10003170
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x2d4], eax
mov esi, dword [ebp - 0x2d4]
push edi
mov edi, dword [ebp - 0x2d4]
xor ebx, ebx
xor eax, eax
nop
mov cl, byte [eax + str.___THREAD.C_____________________________________________________]
cmp cl, 0x21
jne 0x100031b3
lea esi, [eax + 0x100118b1]
jmp 0x100031bf
cmp cl, 0x2b
jne 0x100031c5
movsx edi, byte [eax + 0x100118b1]
mov byte [eax + str.___THREAD.C_____________________________________________________], bl
inc eax
cmp eax, 0x40
jl 0x100031a0
push str.___THREAD.C_____________________________________________________
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
jne 0x100031ed
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003ead
mov esp, ebp
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x100031da
push ebx
push 4
push ebx
add eax, edi
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x100031da
mov ecx, dword [ebp - 0x2d4]
lea edx, [ebp - 0x2d0]
push edx
push esi
mov dword [ecx], esi
mov dword [ebp - 0x2d0], 0x10007
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x100031da
lea eax, [ebp - 0x2d0]
push eax
push esi
mov dword [ebp - 0x220], 0x100021b0
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x100031da
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003ead
mov esp, ebp
pop ebp
ret

Function at 0x10003270
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
call fcn.10003170
add esp, 4
test eax, eax
mov eax, dword [ebp - 4]
jne 0x100032ae
test eax, eax
je 0x10003299
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x100021b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x100033c0
Capabilities:
Get domain trust relationships

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0x3b
xor ebx, ebx
push edx
mov dword [ebp - 8], ebx
call dword [sym.imp.NETAPI32.dll_DsEnumerateDomainTrustsA]
cmp eax, ebx
jne 0x100034ce
mov edi, dword [ebp - 8]
cmp edi, ebx
je 0x100034ee
cmp dword [ebp - 4], ebx
jbe 0x100034e1
add edi, 8
mov edi, edi
lea eax, [edi - 8]
test eax, eax
je 0x100034e1
mov ecx, dword [edi - 4]
mov edx, dword [edi - 8]
push ecx
push edx
push ebx
push str._____d:__s__s
mov esi, 0x10017ae0
call fcn.100010b0
mov eax, dword [edi]
add esp, 0x10
test al, 4
je 0x1000343b
push str.__Forest_tree_root_
call fcn.100010b0
add esp, 4
jmp 0x10003455
test al, 1
je 0x10003455
mov eax, dword [edi + 4]
push eax
push str.__Forest__d_
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 8
test byte [edi], 8
je 0x1000346c
push str.__Primary_Domain_
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 4
test byte [edi], 2
je 0x10003495
push str.__Direct_Outbound_
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 4
test byte [edi], 2
je 0x10003495
push str.__Direct_Inbound_
call fcn.100010b0
add esp, 4
test byte [edi], 0x10
je 0x100034ac
push str.__Native_
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 4
push 0x100119a4
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 4
add edi, 0x2c
inc ebx
sub dword [ebp - 4], 1
jne 0x10003400
jmp 0x100034e1
push eax
push str.____Error:__d_n
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 8
mov eax, dword [ebp - 8]
test eax, eax
je 0x100034ee
push eax
call sub.NETAPI32.dll_NetApiBufferFree
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100038e0
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x80c], edi
mov dword [ebp - 0x818], edi
mov dword [ebp - 0x810], edi
cmp esi, edi
je 0x10003924
lea eax, [ebp - 0x804]
push eax
call fcn.10003ba0
add esp, 4
neg esi
sbb esi, esi
lea ecx, [ebp - 0x804]
and esi, ecx
mov dword [ebp - 0x814], esi
push ebx
jmp 0x10003940
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0x818]
push eax
mov eax, dword [ebp - 0x814]
lea ecx, [ebp - 0x80c]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x808]
push edx
push 3
push 1
push eax
call sub.NETAPI32.dll_NetUserEnum
mov ebx, eax
cmp ebx, edi
je 0x10003991
cmp ebx, 0xea
je 0x10003991
push ebx
push str.____Error:__d_n
mov esi, 0x10017ae0
call fcn.100010b0
add esp, 8
jmp 0x100039d9
mov esi, dword [ebp - 0x808]
cmp esi, edi
je 0x100039f3
cmp dword [ebp - 0x80c], 0
jbe 0x100039df
test esi, esi
je 0x100039d9
test byte [esi + 0xc], 2
je 0x100039b8
mov ecx, dword [esi]
push ecx
push str._s__admin__n
jmp 0x100039c0
mov edx, dword [esi]
push edx
push 0x100114d0
push 0x10017ae0
call fcn.10001110
inc edi
add esp, 0xc
add esi, 0x20
cmp edi, dword [ebp - 0x80c]
jb 0x100039a4
mov esi, dword [ebp - 0x808]
xor edi, edi
cmp esi, edi
je 0x100039f3
push esi
call sub.NETAPI32.dll_NetApiBufferFree
xor esi, esi
mov dword [ebp - 0x808], esi
cmp ebx, 0xea
je 0x10003940
pop ebx
cmp esi, edi
je 0x10003a0a
push esi
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10003ead
mov esp, ebp
pop ebp
ret