joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d5fd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, ecx
nop
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6d8cd0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [esi], 0
lea eax, [esi + 4]
mov dword [ebp - 0x2c], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x28
call fcn.0071993d
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0x24], eax
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
mov dword [ebp - 0x28], eax
movaps xmm0, xmmword [0x7d3740]
movups xmmword [esi + 0xc], xmm0
mov dword [esi + 0x1c], 8
mov dword [ebp - 0x20], esi
mov dword [esi], 0x3f800000
mov dword [ebp - 0x10], 0
push 0x40
call fcn.0071993d
add esp, 4
nop
mov edx, dword [ebp - 0x20]
mov dword [edx + 0xc], eax
mov ecx, eax
add ecx, 0x40
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
movd xmm0, dword [ebp - 0x24]
pshufd xmm0, xmm0, 0
movdqu xmmword [eax], xmm0
movdqu xmmword [eax + 0x10], xmm0
movdqu xmmword [eax + 0x20], xmm0
movdqu xmmword [eax + 0x30], xmm0
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
mov ecx, edx
je 0x6d60c4
nop word [eax + eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 1
push eax
lea edx, [ebp - 0x34]
push edx
call fcn.006d6500
nop
mov eax, dword [ebp - 0x24]
add eax, 0x20
cmp eax, dword [ebp + 0xc]
nop
mov ecx, dword [ebp - 0x20]
jne 0x6d60a0
nop
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x6d80f0
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [0x8759db]
cmp al, 0x79
je 0x6d8110
mov cl, 0x2b
nop dword [eax]
mov al, 0x34
lock cmpxchg byte [0x8759db], cl
je 0x6d8111
cmp al, 0x79
jne 0x6d8100
ret
push edi
push esi
mov esi, 0xffffffe5
mov ecx, 0xf3684c94
mov edi, 0x2f684bdb
nop word cs:[eax + eax]
nop dword [eax]
mov eax, ecx
mov dword [0x8774a8], 0xb307e364
mul edi
mov eax, ecx
inc ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0xffffffe5
movzx eax, byte [eax + esi - 0xc192561]
xor al, 0x14
add byte [esi + 0x8759db], al
inc esi
jne 0x6d8130
mov al, 0x79
xchg byte [0x8759db], al
pop esi
pop edi
ret

Function at 0x6d8170
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [0x8759fa]
cmp al, 0x13
je 0x6d8190
mov cl, 0xf1
nop dword [eax]
mov al, 0xe8
lock cmpxchg byte [0x8759fa], cl
je 0x6d8191
cmp al, 0x13
jne 0x6d8180
ret
push edi
push esi
mov esi, 0xffffffe6
mov ecx, 0xcad00356
mov edi, 0xaaaaaaab
nop word cs:[eax + eax]
nop dword [eax]
mov eax, ecx
inc ecx
mul edi
shr edx, 1
and edx, 0xfffffff8
lea eax, [edx + edx*2]
neg eax
movzx eax, byte [esi + eax - 0x34b16e80]
xor al, 0xa
add byte [esi + 0x8759fa], al
inc esi
jne 0x6d81b0
mov al, 0x13
xchg byte [0x8759fa], al
pop esi
pop edi
ret
Function at 0x6e1e30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
nop
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6e1f60
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [esi + 4]
mov dword [ebp - 0x24], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x10
call fcn.0071993d
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0x28], eax
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
mov dword [ebp - 0x20], eax
movaps xmm0, xmmword [0x7d3740]
movups xmmword [esi + 0xc], xmm0
mov dword [esi + 0x1c], 8
mov dword [ebp - 0x2c], esi
mov dword [esi], 0x3f800000
mov dword [ebp - 0x10], 0
push 0x40
call fcn.0071993d
add esp, 4
nop
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0xc], eax
mov ecx, eax
add ecx, 0x40
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
mov ecx, dword [ebp - 0x28]
add ecx, dword [0x889c14]
movd xmm0, ecx
pshufd xmm0, xmm0, 0
movdqu xmmword [eax], xmm0
movdqu xmmword [eax + 0x10], xmm0
movdqu xmmword [eax + 0x20], xmm0
movdqu xmmword [eax + 0x30], xmm0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x6e55e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
nop
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6e5fe0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call fcn.006e5f40
mov edx, dword [0x879040]
mov ecx, dword [0x879034]
mov edi, 0xffff7304
sub edi, eax
mov dword [ebp - 0x28], edi
sub ecx, edi
add ecx, edx
call dword [0x834360]
call ecx
mov dword [esi], 0x751528
mov edx, eax
xor edx, 0xf9dad82b
lea ecx, [esi + edx]
mov dword [ebp - 0x34], ecx
mov dword [esi + edx], 0
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edx
mov dword [esi + edx + 4], 0
movzx ecx, byte [0x878f6b]
mov dword [ebp - 0x24], eax
xor al, 0xda
mov byte [ebp - 0x1d], al
cmp cl, al
je 0x6e5705
mov eax, dword [ebp - 0x24]
mov ecx, eax
xor cl, 0x14
mov edx, eax
xor dl, 0x49
nop word cs:[eax + eax]
mov eax, ecx
lock cmpxchg byte [0x878f6b], dl
je 0x6e56a3
cmp al, byte [ebp - 0x1d]
jne 0x6e5690
jmp 0x6e5705
nop
mov ebx, dword [ebp - 0x24]
mov eax, ebx
xor eax, 0x83d0f661
mov dword [ebp - 0x38], eax
mov esi, ebx
xor esi, 0xf9dad837
mov eax, ebx
xor eax, 0xf9dad834
cmp eax, 2
mov edi, 1
cmovge edi, eax
xor ecx, ecx
nop dword [eax]
nop
mov eax, dword [ebp - 0x38]
add eax, ecx
xor edx, edx
div esi
not edx
movzx eax, byte [esi + edx + 0x7e97f0]
xor al, bl
xor al, 0x6a
add byte [ecx + 0x878f50], al
inc ecx
cmp edi, ecx
jne 0x6e56d0
nop
movzx eax, byte [ebp - 0x1d]
xchg byte [0x878f6b], al
mov dword [ebp - 0x10], 0
nop
mov dword [ebp - 0x40], 0x878f50
mov eax, dword [ebp - 0x30]
mov byte [ebp + eax - 0x40], 1
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x40]
push dword [ebp - 0x34]
push eax
call fcn.007314e7
add esp, 8
nop
mov ebx, dword [ebp - 0x2c]
mov dword [ebx], 0x7e96e4
mov eax, dword [0x879044]
mov ecx, dword [0x879030]
sub ecx, dword [ebp - 0x28]
add ecx, eax
mov esi, dword [ebp - 0x24]
mov edi, esi
xor edi, 0xf9dad823
add edi, ebx
xor esi, 0xf9dadafb
mov dword [ebp - 0x10], 0xffffffff
call dword [0x834360]
push esi
push dword [ebp + 8]
push edi
call ecx
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x6e9890
Capabilities:
Get common file path

Disassembly:
push edi
push esi
sub esp, 0x108
nop
mov esi, dword [esp + 0x114]
lea edi, [esp + 4]
push 0x104
push 0
push edi
call fcn.007311f0
sub esp, 8
mov dword [esp + 0x10], edi
movsd xmm0, qword [0x7e99c0]
movups xmmword [esp], xmm0
call dword [0x834318]
cmp byte [0x889ae1], 0
jne 0x6e9915
test eax, eax
jns 0x6e9915
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0xe
movzx eax, byte [0x87946f]
cmp al, 0xa1
je 0x6e99ab
mov cl, 0xd
nop word cs:[eax + eax]
mov al, 0xb1
lock cmpxchg byte [0x87946f], cl
je 0x6e996d
cmp al, 0xa1
jne 0x6e9900
jmp 0x6e99ab
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
push edi
call fcn.00700090
add esp, 4
cmp eax, 0xf
jbe 0x6e9950
sub esp, 0xc
movzx ecx, byte [esp + 0xc]
mov byte [esp + 4], cl
mov dword [esp + 8], edi
mov dword [esp], eax
mov ecx, esi
call fcn.0045afa0
jmp 0x6e996b
mov dword [esi + 0x10], eax
test eax, eax
je 0x6e9967
nop
push eax
push edi
push esi
mov edi, eax
call fcn.00731570
mov eax, edi
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x6e99c9
nop
movsd xmm0, qword [0x879460]
xorps xmm0, xmmword [0x7e99d0]
movlps qword [0x879460], xmm0
xor dword [0x879468], 0x648ecad6
xor byte [0x87946c], 0xba
xor byte [0x87946d], 0xb0
xor byte [0x87946e], 0x51
mov al, 0xa1
xchg byte [0x87946f], al
nop
movsd xmm0, qword [0x879466]
movsd qword [esi + 6], xmm0
movsd xmm0, qword [0x879460]
movsd qword [esi], xmm0
mov byte [esi + 0xe], 0
mov eax, esi
add esp, 0x108
pop esi
pop edi
ret

Function at 0x6eeba0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6f1ae0
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ecx], 0x7d6648
mov dword [ecx + 4], 0x751528
lea eax, [ecx + 8]
mov dword [ecx + 0xc], 0
mov dword [ebp - 0x20], ecx
mov dword [ecx + 8], 0
lea ecx, [esi + 4]
mov dword [ebp - 0x10], 0
push eax
push ecx
call fcn.007314e7
add esp, 8
mov eax, dword [ebp - 0x20]
mov dword [eax + 4], 0x7d6e44
mov ecx, dword [ebp + 8]
movsd xmm0, qword [ecx + 0xc]
movsd qword [eax + 0x10], xmm0
mov ecx, dword [ecx + 0x14]
mov dword [eax + 0x18], ecx
movaps xmm0, xmmword [0x7d6370]
movups xmmword [eax + 0x20], xmm0
mov dword [eax + 0x30], 0xffffffff
mov dword [eax], 0x7edda0
mov dword [eax + 4], 0x7eddb0
mov dword [eax + 0x1c], 0x7eddbc
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x6ef6e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6f1b90
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ecx], 0x7d6648
mov dword [ecx + 4], 0x751528
lea eax, [ecx + 8]
mov dword [ecx + 0xc], 0
mov dword [ebp - 0x20], ecx
mov dword [ecx + 8], 0
lea ecx, [esi + 4]
mov dword [ebp - 0x10], 0
push eax
push ecx
call fcn.007314e7
add esp, 8
mov eax, dword [ebp - 0x20]
mov dword [eax + 4], 0x7d6e44
mov ecx, dword [ebp + 8]
movsd xmm0, qword [ecx + 0xc]
movsd qword [eax + 0x10], xmm0
mov ecx, dword [ecx + 0x14]
mov dword [eax + 0x18], ecx
movaps xmm0, xmmword [0x7d6370]
movups xmmword [eax + 0x20], xmm0
mov dword [eax + 0x30], 0xffffffff
mov dword [eax], 0x7ee040
mov dword [eax + 4], 0x7ee050
mov dword [eax + 0x1c], 0x7ee05c
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x70a79e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0070a614

Function at 0x401080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x13c
mov eax, dword [0x404008]
xor eax, esp
mov dword [esp + 0x138], eax
push esi
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionOpenWith
xorps xmm0, xmm0
mov dword [esp + 0x18], 0
push reloc.OLEAUT32.dll_SysReAllocString
movaps xmmword [esp + 0x34], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401191
mov esi, dword [esp + 8]
test esi, esi
je 0x401191
push pe_nt_image_headers32
push eax
lea eax, [esp + 0x40]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x1c], pe_nt_image_headers32
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0x403224
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401191
lea ecx, [esp + 0x38]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401130
sub ecx, edx
sar ecx, 1
cmp ecx, 0x26
jne 0x401191
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
js 0x401191
lea eax, [esp + 4]
mov dword [esp + 0xc], 0x6a283fe2
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x4599ecfa
push eax
push 4
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x24], 0x9e8c491
push eax
mov dword [esp + 0x2c], 0x267b1357
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
call fcn.004012f0
mov esp, ebp
pop ebp
ret

Function at 0x4011b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.00401080
mov ebx, eax
push 0
push ebx
call dword [sym.imp.ole32.dll_CoAllowSetForegroundWindow]
push str..pdf
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
je 0x401232
mov edi, dword [ebx]
push 4
push esi
push dword [ebp - 4]
mov edi, dword [edi + 0xc]
mov ecx, edi
push ebx
call dword [0x403110]
call edi
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x403110]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x8007000e
call fcn.00401030
int3
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0xa14000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xa1400a
jmp 0xa1600f
jmp fcn.007d80b0

Function at 0x401020
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41900c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401097
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401097
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 1
push eax
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401289
leave
ret
Function at 0x100b9fb
Capabilities:
Allocate thread local storage
Set global application hook
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x104e158], 0
push esi
push edi
jne 0x100ba66
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100ba4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100ba2c
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x314
push 0x1001f20
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x100bb16
push 0
push esi
push 0x104e158
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100ba66
push esi
call dword [sym.imp.KERNEL32.dll_TlsFree]
call fcn.0100b8d5
mov esi, eax
test esi, esi
jne 0x100ba7e
mov edi, 0x8007000e
push edi
push 0x31f
jmp 0x100bae9
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.DUI70.dll_public:_long_int___thiscall_DirectUI::HWNDHost::Initialize_unsigned_int__unsigned_int__class_DirectUI::Element___unsigned_long_int__]
mov edi, eax
test edi, edi
jge 0x100baa0
push edi
push 0x322
jmp 0x100bae9
push esi
push dword [0x104e158]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x100b6c8
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0xc8], eax
test eax, eax
jne 0x100baff
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100bae1
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x32d
push 0x1001f20
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x100bb08
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
xor esi, esi
xor edi, edi
test esi, esi
je 0x100bb16
push 1
mov ecx, esi
call dword [sym.imp.DUI70.dll_public:_long_int___thiscall_DirectUI::Element::Destroy_bool_]
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x14

Function at 0x100c9d5
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
and dword [ebp - 4], edi
test eax, eax
jne 0x100ca0b
lea eax, [ebp - 4]
push eax
call fcn.01031307
mov edi, eax
test edi, edi
jge 0x100c9ff
push edi
push 0x2de
jmp 0x100ca31
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x28]
test eax, eax
je 0x100ca45
push 1
push 0
push 0
push eax
push 0x10021b0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x100ca45
mov eax, 0x80004005
push eax
mov edi, eax
push 0x2ee
push 0x1002190
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
mov eax, edi
pop edi
leave
ret 4
Function at 0x10142a6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebx
jge 0x10142ef
push edi
push 0xea
push 0x10043d4
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x1014359
cmp dword [ebp - 4], ebx
jne 0x10142f9
xor edi, edi
inc edi
jmp 0x1014367
push esi
mov esi, dword [ebp + 0x1c]
mov eax, dword [esi]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0x18]
push dword [eax]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jle 0x1014329
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jge 0x101434b
push edi
push 0xfe
push 0x10043d4
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x1014358
mov eax, dword [ebp + 0x10]
cmp dword [eax], 4
je 0x1014358
mov eax, dword [ebp - 8]
mov dword [esi], eax
pop esi
cmp dword [ebp - 4], ebx
je 0x1014367
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
leave
ret 0x18

Function at 0x1014374
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
mov edi, 0xffff
mov esi, 0x80070000
jle 0x10143ae
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jge 0x10143bc
push ebx
push 0x13d
jmp 0x10143e7
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push 0
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jle 0x10143db
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jge 0x10143fb
push ebx
push 0x146
push 0x10043e4
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
cmp dword [ebp - 4], 0
je 0x101440a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x18
Function at 0x1015448
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x104e070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x54], eax
push 1
lea eax, [ebp - 0x50]
xor ebx, ebx
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 0x50], bl
mov byte [ebp - 0x4f], bl
mov byte [ebp - 0x4e], bl
mov byte [ebp - 0x4d], bl
mov byte [ebp - 0x4c], bl
mov byte [ebp - 0x4b], 2
call dword [sym.imp.ntdll.dll_RtlInitializeSid]
cmp eax, ebx
mov edi, 0x80070000
jge 0x10154c6
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
cmp esi, ebx
jle 0x10154a8
and esi, 0xffff
or esi, edi
cmp esi, ebx
jge 0x10154c6
push esi
push 0x6e1
push 0x100454c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x1015507
push ebx
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
push dword [ebp - 0x54]
mov dword [eax], 1
lea eax, [ebp - 0x48]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1015505
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10154fa
and eax, 0xffff
or eax, edi
mov esi, eax
cmp esi, ebx
jge 0x1015507
mov eax, dword [ebp - 0x54]
mov dword [eax], ebx
xor esi, esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01036539
leave
ret 4

Function at 0x101c3ee
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x68
xor esi, esi
push esi
push 0x104e0d0
mov dword [ebp - 4], ecx
call sub.msvcrt.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 0xc
xor ebx, ebx
push esi
push esi
push esi
push esi
call edi
mov dword [ebx + 0x104e0d0], eax
cmp eax, esi
je 0x101c480
cmp eax, 0xffffffff
je 0x101c480
add ebx, 4
cmp ebx, 0x68
jb 0x101c415
push esi
push esi
push esi
push esi
call edi
mov dword [0x104e0c8], eax
cmp eax, esi
je 0x101c49b
cmp eax, 0xffffffff
je 0x101c49b
push esi
push esi
push esi
push 0x102da5c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
cmp eax, esi
je 0x101c465
cmp eax, 0xffffffff
jne 0x101c4c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x101c479
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x42
jmp 0x101c4b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x101c494
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x35
jmp 0x101c4b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x101c4af
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x39
push 0x10057a0
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret