joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459b30
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x459b47
add esp, 0xfffffff0
call fcn.00403bcc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042211c
mov eax, dword [0x4a7de8]
cmp word [eax + 2], 0
jne 0x459b6f
mov eax, dword [0x4a7de8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b298
mov eax, dword [0x4a7f40]
cmp word [eax + 2], 0
jne 0x459b89
mov eax, dword [0x4a7f40]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b490
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4168c4]
call fcn.00403838
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4168c4]
call fcn.00403838
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x424650]
call fcn.0042bb80
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x459d10
mov eax, dword [0x4a7c6c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042bf50
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45ba30
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4a7c6c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d080
test eax, eax
je 0x459c7e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004091ec
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d0a8
test eax, eax
je 0x459c92
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004048ec
mov eax, dword [0x4a7a20]
cmp byte [eax], 0
jne 0x459cc6
mov eax, ebx
call fcn.00459e38
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045bc0c
mov eax, ebx
call fcn.0045c5d0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x459d06
call fcn.00403c24
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a0b8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a9be0]
cmp dword [eax + 0x30], 0
je 0x45a162
cmp dword [ebx + 0x94], 0
jne 0x45a15c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45a048
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45a15c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45a122
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45a15c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419200
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45a131
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45acc4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45acf9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040476c
jmp 0x45ad06
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046d0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45bde8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45be29
mov eax, esi
call fcn.00442520
test al, al
je 0x45be29
mov eax, dword [ebx + 0x84]
call fcn.0044221c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45be29
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044221c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x460b2c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
test dl, dl
je 0x460b3a
add esp, 0xfffffff0
call fcn.00403bcc
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00403838
push 0x40
push 0x1000
push 0x800
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [esi + 4], eax
mov eax, esi
test bl, bl
je 0x460b72
call fcn.00403c24
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x478860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
cmp dword [ebx + 0xc], 0
jle 0x4788e7
cmp dword [ebx + 0x10], 0
jle 0x4788e7
mov ecx, edx
mov eax, dword [0x478628]
mov dl, 1
call fcn.00478ab0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4788e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
call fcn.00402938
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00478cd0
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 4]
mov eax, dword [ebp - 4]
call fcn.0041bc8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4788e7
mov eax, dword [ebp - 4]
call fcn.00403868
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x489c34
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x489c3c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x489e2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x489e44
mov eax, esi
call fcn.00487ac0
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004046d0
lea ecx, [ebp - 0x10]
mov edx, 0x489e58
mov eax, esi
call fcn.00487ac0
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004046d0
lea ecx, [ebp - 0x14]
mov edx, 0x489e70
mov eax, esi
call fcn.00487ac0
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004046d0
lea ecx, [ebp - 0x18]
mov edx, 0x489e8c
mov eax, esi
call fcn.00487ac0
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004046d0
lea ecx, [ebp - 0x1c]
mov edx, 0x489ea8
mov eax, esi
call fcn.00487ac0
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004046d0
lea ecx, [ebp - 0x24]
mov edx, 0x489ec0
mov eax, esi
call fcn.00487ac0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408880
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408c60
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x489ed8
mov eax, esi
call fcn.00487ac0
mov eax, dword [ebp - 0x28]
call fcn.00481598
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x489ee8
mov eax, esi
call fcn.00487ac0
mov eax, dword [ebp - 0x2c]
call fcn.00481598
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x489f00
mov eax, esi
call fcn.00487ac0
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408c60
inc eax
je 0x489dd1
lea ecx, [ebp - 0x34]
mov edx, 0x489f00
mov eax, esi
call fcn.00487ac0
mov eax, dword [ebp - 0x34]
call fcn.00408c24
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a178
fstp qword [ebp - 0x3c]
wait
call fcn.0040a4dc
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x489dec
lea ecx, [ebp - 0x40]
mov edx, 0x489f00
mov eax, esi
call fcn.00487ac0
mov eax, dword [ebp - 0x40]
call fcn.00481598
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x489f10
mov eax, esi
call fcn.00487ac0
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004046d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489e35
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004046a0
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004046a0
ret
Function at 0x490bc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x490c1a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00490bb0
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00480204
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0047fe04
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490c21
lea eax, [ebp - 4]
call fcn.0040467c
ret

Function at 0x4a420c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404b2c
xor eax, eax
push ebp
push 0x4a4269
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0x4a4274
push 0x4a4274
mov eax, dword [ebp - 4]
call fcn.00404b3c
push eax
push 0x4a4278
mov eax, ebx
call fcn.0044221c
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4270
lea eax, [ebp - 4]
call fcn.0040467c
ret
Function at 0x100541b
Capabilities:
Print debug messages

Disassembly:
push 0x11c
push 0x100c7b0
call fcn.01008e24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x12c], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1005459
cmp eax, esi
jbe 0x100546b
push 0x1001520
push esi
lea eax, [ebp - 0x120]
push eax
call fcn.010052e3
push 0x5c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.msvcrt.dll_strrchr]
pop ecx
pop ecx
mov ebx, eax
test ebx, ebx
je 0x1005485
inc ebx
jmp 0x100548b
lea ebx, [ebp - 0x120]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1005490
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 0x124]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10054a4
sub eax, ecx
mov ecx, eax
mov eax, dword [ebp - 0x12c]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10054b8
sub eax, esi
add eax, ecx
lea esi, [eax + edi + 0x80]
and dword [ebp - 4], 0
mov eax, esi
call fcn.01008e80
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x128], eax
push dword [ebp - 0x12c]
push dword [ebp - 0x124]
push ebx
push dword [ebp + 0xc]
push 0x10014e4
push esi
push eax
call fcn.0100b064
add esp, 0x1c
jmp 0x1005512
mov dword [ebp - 4], 0xfffffffe
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
lea esp, [ebp - 0x13c]
call fcn.01008e6c
ret 0xc

Function at 0x100553e
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100e324]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x808]
push 0x402
push eax
call fcn.01004bc3
add esp, 0x10
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01008d3f
leave
ret
Function at 0x10060fa
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x100e324]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x414], eax
xor ebx, ebx
xor eax, eax
push edi
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x424], 0x10031ac
mov dword [ebp - 0x420], 0x1003190
mov word [ebp - 0x40c], ax
xor edi, edi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
push dword [ebp + edi*4 - 0x424]
mov dword [ebp - 0x418], 0x104
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100618b
xor eax, eax
mov word [ebp - 0x20c], ax
lea esi, [ebp - 0x20c]
cmp word [ebp - 0x20c], bx
je 0x10061bc
push ebx
push esi
push dword [ebp - 0x414]
call fcn.0100995f
cmp eax, 0xffffffff
jne 0x10061c4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x100619a
inc edi
cmp edi, 2
jb 0x100614b
jmp 0x10061fd
push 0xff
lea eax, [ebp - 0x40c]
push eax
push 0x5bcc
push dword [0x100e874]
mov dword [ebp - 0x410], 1
call dword [sym.imp.USER32.dll_LoadStringW]
push esi
lea eax, [ebp - 0x40c]
push eax
push 7
call fcn.01004bfe
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x410]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008d3f
leave
ret 8

Function at 0x1006219
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100e324]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x20c]
push eax
push 0x10031c4
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov dword [ebp - 0x208], eax
test eax, eax
jne 0x1006289
push 0xff
lea eax, [ebp - 0x204]
push eax
push 0x5dc0
push dword [0x100e874]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 4
call fcn.01004ca7
add esp, 0xc
jmp 0x10062ea
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x20c]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10062de
push 0xff
lea eax, [ebp - 0x204]
push eax
push 0x5e24
push dword [0x100e874]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 4
call fcn.01004ca7
add esp, 0xc
and dword [ebp - 0x208], 0
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x208]
xor ecx, ebp
call fcn.01008d3f
leave
ret
Function at 0x1006db5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x100e324]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 4
xor edx, edx
pop ebx
mov dword [ebp - 0x234], eax
mov dword [eax], edx
lea eax, [ebp - 0x228]
push eax
mov edi, 0x20019
push edi
push edx
xor esi, esi
push 0x10032b8
mov word [ebp - 0x220], si
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ecx
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x23c], ebx
call esi
mov dword [ebp - 0x224], eax
test eax, eax
je 0x1006e53
push 0xff
lea eax, [ebp - 0x220]
push eax
push 0x59d8
push dword [0x100e874]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x224]
push ebx
call fcn.01004ca7
jmp 0x1006f9f
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x240]
push eax
push 0
push 0x10032a8
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x224], eax
test eax, eax
je 0x1006e98
push 0xff
lea eax, [ebp - 0x220]
push eax
push 0x5a3c
jmp 0x1006e2f
cmp dword [ebp - 0x22c], 9
ja 0x1006f6f
cmp dword [ebp - 0x22c], 0
je 0x1006f6f
movzx ax, byte [ebp - 0x22c]
add ax, 0x30
push 0x100328c
movzx ebx, ax
push 0xe
lea eax, [ebp - 0x20]
push eax
call fcn.0100534b
push 0xff
lea eax, [ebp - 0x220]
push eax
push 0x5b04
push dword [0x100e874]
mov word [ebp - 8], bx
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
call ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x220]
push eax
push 2
call fcn.01004bfe
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push edi
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x230]
call esi
mov dword [ebp - 0x224], eax
test eax, eax
je 0x1006f5f
push 0xff
lea eax, [ebp - 0x220]
push eax
push 0x5b68
push dword [0x100e874]
call ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x224]
push 4
call fcn.01004ca7
add esp, 0x10
jmp 0x1006fa2
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x234]
mov dword [ecx], eax
jmp 0x1006fab
push 0xff
lea eax, [ebp - 0x220]
push eax
push 0x5aa0
push dword [0x100e874]
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [ebp - 0x22c]
lea eax, [ebp - 0x220]
push eax
push ebx
call fcn.01004bfe
add esp, 0xc
cmp dword [ebp - 0x228], 0
je 0x1006fb7
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x224]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008d3f
leave
ret 4
Function at 0x1006fd3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100e324]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x218], ecx
xor ecx, ecx
mov word [ebp - 0x204], cx
lea ecx, [ebp - 0x214]
push ecx
push 0x20019
xor edi, edi
mov esi, edx
push edi
push esi
push eax
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x208], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x20c], eax
cmp eax, edi
lea eax, [ebp - 0x204]
je 0x100706b
push 0xff
push eax
push 0x3a98
push dword [0x100e874]
call dword [sym.imp.USER32.dll_LoadStringW]
push esi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
push 4
call fcn.01004ca7
add esp, 0x10
jmp 0x100720b
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push ebx
mov ebx, 0xff
push ebx
push eax
push 0x3afc
push dword [0x100e874]
call esi
push dword [ebp - 0x210]
lea eax, [ebp - 0x204]
push eax
push 2
call fcn.01004bfe
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push dword [0x100e05c]
push dword [ebp - 0x214]
call fcn.01006068
mov edi, eax
mov dword [ebp - 0x20c], edi
test edi, edi
je 0x1007127
push ebx
lea eax, [ebp - 0x204]
push eax
cmp edi, 2
jne 0x10070f7
push 0x3b60
push dword [0x100e874]
call esi
push dword [0x100e05c]
lea eax, [ebp - 0x204]
push dword [ebp - 0x210]
push eax
push 4
call fcn.01004bfe
jmp 0x1007119
push 0x3bc4
push dword [0x100e874]
call esi
push dword [0x100e05c]
lea eax, [ebp - 0x204]
push eax
push edi
push 4
call fcn.01004ca7
mov edi, dword [ebp - 0x208]
add esp, 0x10
jmp 0x100720a
mov edi, dword [ebp - 0x208]
push 0x25
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x10071ca
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x210], eax
test eax, eax
jbe 0x10071ca
push 0
push 0x5c3
push 0x1003164
add eax, eax
push eax
call fcn.010058aa
mov dword [ebp - 0x208], eax
test eax, eax
jne 0x1007182
mov dword [ebp - 0x20c], 8
jmp 0x100720a
push dword [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jbe 0x10071bd
cmp dword [ebp - 0x210], eax
jb 0x10071bd
push dword [ebp - 0x208]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10071bd
push 0
push edi
call fcn.01005b7d
mov edi, dword [ebp - 0x208]
jmp 0x10071ca
push 0
push dword [ebp - 0x208]
call fcn.01005b7d
push ebx
lea eax, [ebp - 0x204]
push eax
push 0x3c28
push dword [0x100e874]
call esi
push edi
lea eax, [ebp - 0x204]
push eax
push 2
call fcn.01004bfe
mov ebx, dword [ebp - 0x218]
add esp, 0xc
push dword [ebp - 0x214]
mov dword [ebx], edi
call fcn.01006301
mov dword [ebp - 0x20c], eax
pop ebx
xor esi, esi
cmp dword [ebp - 0x214], esi
je 0x1007221
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20c], esi
je 0x1007234
cmp edi, esi
je 0x1007234
push esi
push edi
call fcn.01005b7d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20c]
pop edi
xor ecx, ebp
pop esi
call fcn.01008d3f
leave
ret 4
Function at 0x1008d25
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x100c830
call fcn.01008d9c
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100e884
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1008b3a
cmp eax, esi
jne 0x1008b2d
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1008b3d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1008b14
xor esi, esi
inc esi
mov eax, dword [0x100e880]
cmp eax, esi
jne 0x1008b50
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1008b8b
mov eax, dword [0x100e880]
test eax, eax
jne 0x1008b85
mov dword [0x100e880], esi
push 0x100126c
push 0x1001260
call fcn.01008a91
pop ecx
pop ecx
test eax, eax
je 0x1008b8b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1008c55
mov dword [0x100e400], esi
mov eax, dword [0x100e880]
cmp eax, esi
jne 0x1008baf
push 0x100125c
push 0x100124c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100e880], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1008bbc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100e888], ebx
je 0x1008bdd
push 0x100e888
call fcn.01008fb9
pop ecx
test eax, eax
je 0x1008bdd
push ebx
push 2
push ebx
call dword [0x100e888]
push dword [0x100e3e8]
push dword [0x100e3ec]
push dword [0x100e3e4]
call fcn.01004e46
add esp, 0xc
mov dword [0x100e3fc], eax
cmp dword [0x100e3f0], ebx
jne 0x1008c3b
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x100e400], ebx
jne 0x1008c49
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100e3fc]
call fcn.01008de1
ret
call fcn.010091ac
jmp 0x1008af2

Function at 0x100a380
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e324]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x100a3ea
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x100a3e1
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.01008d3f
leave
ret