joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100062d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100062ea
mov eax, 0xc000000a
jmp 0x100063ac
mov ecx, dword [ebp - 4]
add ecx, 0x10
push ecx
mov edx, dword [ebp - 4]
add edx, 4
push edx
call fcn.10011a66
movzx eax, al
test eax, eax
jne 0x1000630e
mov eax, 0xc0000001
jmp 0x100063ac
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x30], 0
jne 0x1000631e
xor eax, eax
jmp 0x100063ac
push 1
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
call sym.TKCtrlU.dll_TKCtrlSetPauseDataQueue
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x24], 0
je 0x10006365
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x28], 0
je 0x100063aa
push 0xbb8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10006393
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100064b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
jne 0x100064e8
jmp 0x10006638
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x100064fc
cmp dword [ebp + 0xc], 0
je 0x100064fc
cmp dword [ebp + 0x10], 0
jne 0x10006506
jmp 0x10006638
mov edx, dword [ebp - 4]
add edx, 0x10
push edx
mov eax, dword [ebp - 4]
add eax, 4
push eax
call fcn.10011a66
movzx ecx, al
test ecx, ecx
jne 0x1000652a
jmp 0x10006638
push 0x34
call fcn.10019329
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10006547
jmp 0x10006638
push 0x34
push 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.10019150
add esp, 0xc
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10006578
jmp 0x10006638
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x20], edx
mov eax, dword [ebp + 0x14]
cdq
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], edx
lea edx, [ebp - 0xc]
push edx
push 0x34
mov eax, dword [ebp - 0x10]
push eax
push 0x34
mov ecx, dword [ebp - 0x10]
push ecx
push 0x220444
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call fcn.100010f0
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100065da
jmp 0x10006638
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0x100021b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0xc], 0
jne 0x10006609
jmp 0x10006638
mov eax, 1
test eax, eax
je 0x10006627
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x24], 0
je 0x1000661d
jmp 0x10006627
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10006609
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x28], 0
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x10006651
mov eax, dword [ebp - 0x10]
push eax
call sym.TKCtrlU.dll_TKCtrlCloseDataQueueEx
add esp, 4
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10006960
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
jne 0x1000698a
jmp 0x10006ae8
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x10006998
cmp dword [ebp + 0xc], 0
jne 0x100069a2
jmp 0x10006ae8
push 0x34
call fcn.10019329
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x100069bf
jmp 0x10006ae8
push 0x34
push 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.10019150
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [eax], edx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 8], 0
jne 0x10006a00
jmp 0x10006ae8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0xc], 0
jne 0x10006a27
jmp 0x10006ae8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x20], eax
mov eax, dword [ebp + 0x14]
cdq
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0x100022c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x14], 0
jne 0x10006a89
jmp 0x10006ae8
mov eax, 1
test eax, eax
je 0x10006aa7
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x24], 0
je 0x10006a9d
jmp 0x10006aa7
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10006a89
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x28], 0
lea eax, [ebp - 0xc]
push eax
push 0x34
mov ecx, dword [ebp - 0x10]
push ecx
push 0x34
mov edx, dword [ebp - 0x10]
push edx
push 0x220450
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call fcn.100010f0
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10006ae1
jmp 0x10006ae8
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x10006b43
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x14], 0
je 0x10006b04
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
cmp dword [edx + 8], 0
je 0x10006b1a
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0xc], 0
je 0x10006b30
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call fcn.100193ec
add esp, 4
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10006eb0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x10006edb
cmp dword [ebp + 8], 0xffffffff
je 0x10006edb
cmp dword [ebp + 0xc], 0
je 0x10006edb
cmp dword [ebp + 0x10], 0
jne 0x10006edf
jmp 0x10006f37
push 1
push 0x10034b14
call fcn.10002b80
add esp, 8
test eax, eax
jne 0x10006ef6
jmp 0x10006f37
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.10002d30
add esp, 8
test eax, eax
jne 0x10006f0e
jmp 0x10006f37
push 0
push 0
push 0
push 0
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sym.TKCtrlU.dll_TKCtrlControlACI
add esp, 0x1c
test eax, eax
jne 0x10006f30
jmp 0x10006f37
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10006f40
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x10006f6b
cmp dword [ebp + 8], 0xffffffff
je 0x10006f6b
cmp dword [ebp + 0xc], 0
je 0x10006f6b
cmp dword [ebp + 0x10], 0
jne 0x10006f6f
jmp 0x10006fc7
push 0
push 0
push 0
push 0
push 2
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sym.TKCtrlU.dll_TKCtrlControlACI
add esp, 0x1c
test eax, eax
jne 0x10006f91
jmp 0x10006fc7
push 1
push str.SeDebugPrivilege
call fcn.10002b80
add esp, 8
test eax, eax
jne 0x10006fa8
jmp 0x10006fc7
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10002e70
add esp, 8
test eax, eax
jne 0x10006fc0
jmp 0x10006fc7
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1000d420
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
je 0x1000d450
cmp dword [ebp + 0x1c], 0
jne 0x1000d457
xor eax, eax
jmp 0x1000d4fb
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.1001a1e0
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.1001a1e0
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000d4ba
xor eax, eax
jmp 0x1000d4fb
mov esi, dword [ebp - 0xc]
xor edi, edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.1001a1e0
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x30]
jne 0x1000d4f2
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
je 0x1000d4f6
xor eax, eax
jmp 0x1000d4fb
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000df90
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x57
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x1000dfbd
cmp dword [ebp + 0xc], 0
je 0x1000dfc7
cmp dword [ebp + 0x10], 0
jne 0x1000dfc7
jmp 0x1000e0d7
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
je 0x1000e01c
mov edx, dword [ebp + 0x34]
push edx
mov eax, dword [ebp + 0x30]
push eax
mov ecx, dword [ebp + 0x2c]
push ecx
mov edx, dword [ebp + 0x28]
push edx
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 8], eax
jmp 0x1000e0d7
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], 0
je 0x1000e065
cmp dword [ebp + 0x10], 0
je 0x1000e065
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
je 0x1000e061
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 0x4a]
test ecx, ecx
jle 0x1000e05f
mov edx, dword [ebp - 0xc]
movzx eax, word [edx + 0x4a]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], eax
jb 0x1000e054
jmp 0x1000e05f
mov dword [ebp - 8], 0xea
jmp 0x1000e0d7
jmp 0x1000e065
jmp 0x1000e0d7
cmp dword [ebp + 0x18], 0
je 0x1000e076
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x14]
mov dword [edx], ecx
cmp dword [ebp + 0x24], 0
je 0x1000e087
mov edx, dword [ebp + 0x24]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
mov dword [edx], ecx
cmp dword [ebp + 0x34], 0
je 0x1000e0a4
mov edx, dword [ebp + 0x34]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov edx, dword [ebp + 0x34]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov dword [edx + 4], ecx
mov edx, dword [ebp + 0x30]
push edx
mov eax, dword [ebp + 0x2c]
push eax
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.1000f8a0
add esp, 0x1c
test eax, eax
jne 0x1000e0d0
jmp 0x1000e0d7
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1000e350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x57
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x1000e396
cmp dword [ebp + 0xc], 0
jb 0x1000e396
cmp dword [ebp + 0x10], 0
je 0x1000e396
cmp dword [ebp + 0x14], 0
je 0x1000e396
cmp dword [ebp + 0x20], 0
je 0x1000e3a0
cmp dword [ebp + 0x24], 0
jne 0x1000e3a0
jmp 0x1000e477
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0
je 0x1000e3e5
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x10], eax
jmp 0x1000e477
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.1000ee90
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000e405
jmp 0x1000e477
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 0x24]
jae 0x1000e465
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.1000ef50
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000e436
jmp 0x1000e477
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.1000f150
add esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1000e463
jmp 0x1000e477
jmp 0x1000e470
mov dword [ebp - 0x10], 0x103
jmp 0x1000e477
mov dword [ebp - 0x10], 0
cmp dword [ebp - 4], 0
je 0x1000e489
mov eax, dword [ebp - 4]
push eax
call fcn.100193ec
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x1000e49b
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100193ec
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x1000f3a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
je 0x1000f3e5
cmp dword [ebp + 0x10], 0
je 0x1000f3e5
cmp dword [ebp + 0x14], 0x2000
jbe 0x1000f3ec
xor eax, eax
jmp 0x1000f4e3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x2210]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
cmp dword [edx + 0xc], 0
je 0x1000f428
mov eax, dword [ebp - 0x24]
shl eax, 0xc
cmp dword [ebp + 0xc], eax
jb 0x1000f428
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x24]
shl edx, 0xc
add edx, 0x2000
cmp ecx, edx
jbe 0x1000f4a0
mov eax, dword [ebp + 0xc]
shr eax, 0xc
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, 0x1000
mul ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0x2000
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
add ecx, 0x210
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000f47f
xor eax, eax
jmp 0x1000f4e3
cmp dword [ebp - 0xc], 0x1000
jae 0x1000f48c
xor eax, eax
jmp 0x1000f4e3
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [eax + 0xc], 1
mov dword [ebp - 0x28], 1
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp - 0x24]
shl ecx, 0xc
mov edx, dword [ebp + 0xc]
sub edx, ecx
lea eax, [eax + edx + 0x210]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10019480
add esp, 0xc
cmp dword [ebp - 0x28], 0
je 0x1000f4de
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x2210], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10010d80
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x10010d9f
jmp 0x10010e23
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.10003c00
add esp, 4
test eax, eax
je 0x10010db7
jmp 0x10010e23
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 4], eax
jmp 0x10010dc9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
je 0x10010e16
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10003c30
add esp, 4
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
je 0x10010e08
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call fcn.100193ec
add esp, 4
jmp 0x10010dc1
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret

Function at 0x10010f20
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x28]
push eax
call fcn.10010e70
add esp, 4
test eax, eax
je 0x10010f3d
mov eax, 1
jmp 0x10010f6a
call fcn.10010ee0
test eax, eax
je 0x10010f52
lea ecx, [ebp - 0x24]
push ecx
call dword [0x1003afa4]
jmp 0x10010f5c
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
xor ecx, ecx
cmp eax, 9
sete cl
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x10011160
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0x104
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.10019329
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.10019329
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 4], 0
je 0x100111b3
cmp dword [ebp - 0x14], 0
jne 0x100111b7
jmp 0x10011222
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.10019150
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x14]
push edx
call fcn.10019150
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x10011205
jmp 0x10011222
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
jne 0x1001121b
jmp 0x10011222
mov dword [ebp - 0x10], 1
cmp dword [ebp - 4], 0
je 0x10011234
mov eax, dword [ebp - 4]
push eax
call fcn.100193ec
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x10011246
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100193ec
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x10011340
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10011377
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1001135e
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1001136f
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10011379
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10011354
xor eax, eax
pop edi
pop esi
ret
Function at 0x10011964
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x100119b0
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
ror byte [ecx - 0x35c4f7b3], 1
ror byte [ecx - 0x35c4f7b3], 1
jae 0x100119ab
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10011995
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1001199d
cmp edx, ebx
jne 0x10011aeb
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1001196c
add eax, dword [eax + 4]
jmp 0x10011959
mov dword [ebp + 0xc], ebx
jmp 0x100119bb
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100119d3
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100119f1
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10011a4f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10011a36
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10011a3f
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10011a49
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10011a2b
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100119b5

Function at 0x100142ee
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
and dword [eax], 0
and dword [eax + 4], 0
test ecx, ecx
jne 0x1001433b
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
jmp 0x10014373
mov dword [eax + 8], 0xc1059ed8
mov dword [eax + 0xc], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0xf70e5939
mov dword [eax + 0x18], 0xffc00b31
mov dword [eax + 0x1c], 0x68581511
mov dword [eax + 0x20], 0x64f98fa7
mov dword [eax + 0x24], 0xbefa4fa4
mov dword [eax + 0xe8], ecx
ret 8