joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ea1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007ea140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007ea140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007ea140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007ea140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7eabfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7eac50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x7fc87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7eac43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7eac52
xor eax, eax
pop esi
leave
ret 4

Function at 0x408960
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop edx
inc ebx
call fcn.0040898b
and ebx, esi
add esi, 0xc1af88e4
xor dword [ecx], edx
inc ebx
inc ecx
add ebx, 1
sub esi, esi
cmp ecx, edi
jne fcn.00408960
and esi, ebx
ret
Function at 0x65996d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x662168
cmp edx, dword [eax]
je 0x65998f
add eax, 8
inc ecx
cmp eax, 0x6621f8
jl 0x659980
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x662168]
jne 0x659abd
mov eax, dword [0xa67a90]
cmp eax, 1
je 0x659a97
test eax, eax
jne 0x6599c0
cmp dword [0x662094], 1
je 0x659a97
cmp edx, 0xfc
je 0x659abd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6599f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0065a350
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a7e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659a3a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a7e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65edfc
push edi
call fcn.0065c6b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0065a350
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a360
lea eax, [ebp - 0xa0]
push 0x65eddc
push eax
call fcn.0065a360
push dword [esi + 0x66216c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a360
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065c624
add esp, 0x2c
pop edi
jmp 0x659abd
lea eax, [ebp + 8]
lea esi, [esi + 0x66216c]
push 0
push eax
push dword [esi]
call fcn.0065a7e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10016cf6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x105d8a64], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x105d8a64], ecx
inc edx
cmp edx, esi
jl 0x10016d0b
mov dword [0x105d8a60], esi
pop esi
pop ebp
ret 8

Function at 0x10016d31
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x105d8a64
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x105d8df0
jl 0x10016d3f
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x105d9094
jl 0x10016d7f
mov ecx, dword [0x105d9de0]
xor ecx, dword [0x105d8a64]
and ecx, edi
xor ecx, dword [0x105d9de0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x105d8a60], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x105d9094]
mov dword [0x105d9420], eax
pop esi
ret
Function at 0x10035eef
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10144100
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x10036013
cmp byte [ebx + 0x45], 0
je 0x10036013
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10035f39
xor al, al
jmp 0x10036015
xor eax, eax
mov dword [esp + 0x24], 0xf
push eax
push 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov byte [esp + 0x18], al
call fcn.10021eb3
and dword [esp + 0x34], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
lea eax, [esp + 0xc]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x14]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10035f9e
dec eax
je 0x10035fa2
dec eax
dec eax
je 0x10036000
xor bl, bl
jmp 0x10036002
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x10]
cmp ecx, 0x10
mov esi, dword [esp + 0xc]
cmovae eax, edx
sub esi, eax
je 0x10035fe1
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x14]
push esi
cmovae eax, edx
push 1
push eax
call fcn.10126811
add esp, 0x10
cmp esi, eax
jne 0x10035f9a
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
cmp byte [ebx + 0x45], 0
je 0x10036000
test esi, esi
jne 0x10035f64
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.100358a1
jmp 0x10035f5c
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.10014485
mov al, bl
jmp 0x10036015
mov al, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038e8d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10145c04
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
mov esi, ecx
push edi
test dl, dl
je 0x10038eb9
call fcn.10039552
and dword [esp + 0x38], 0
xor eax, eax
push 7
pop edi
mov dword [esp + 0x3c], edi
mov word [esp + 0x28], ax
and dword [esp + 0x84], eax
push 0x64
pop ebx
push 5
pop edx
lea ecx, [esp + 0x58]
call fcn.100162fe
push eax
mov edx, esi
mov byte [esp + 0x88], 1
lea ecx, [esp + 0x14]
call fcn.10028a72
pop ecx
push 0
push 1
lea ecx, [esp + 0x60]
mov byte [esp + 0x8c], 3
call fcn.10014706
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.10038dc0
test eax, eax
jne 0x10038f28
lea edx, [esp + 0x28]
lea ecx, [esp + 0x10]
call fcn.10038656
push 0
push 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x8c], 0
call fcn.10014706
dec ebx
jne 0x10038ed6
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x10039096
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
push dword [esp + 0xc]
cmovae eax, dword [esp + 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea eax, [eax + ecx*2]
lea ecx, [esp + 0x2c]
cmovae ecx, dword [esp + 0x2c]
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.10039be6
lea eax, [esp + 0xc]
mov byte [esp + 0x84], 4
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], ebx
call fcn.100396e5
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
lea ecx, [esp + 0x14]
call fcn.100396e5
xor eax, eax
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], ax
push 0xa
mov byte [esp + 0x88], 5
mov ebx, dword [esp + 0x14]
pop esi
xor ecx, ecx
mov dword [esp + 0x5c], 3
mov eax, 0x414
mov dword [esp + 0x58], ecx
mov word [esp + 0x68], ax
cmp edi, 8
lea eax, [esp + 0x40]
mov dword [esp + 0x60], ebx
cmovae eax, dword [esp + 0x40]
mov dword [esp + 0x72], eax
lea eax, [esp + 0x58]
push eax
push 0x45884
push 0x5200c
mov dword [esp + 0x70], ecx
mov dword [esp + 0x76], ecx
mov dword [esp + 0x7a], ecx
call fcn.10027b51
pop ecx
pop ecx
call eax
cmp eax, 0x20
jne 0x10039056
push esi
mov edi, 0x5c4a9
push edi
push 0x36e11
call fcn.10027b51
pop ecx
pop ecx
call eax
push eax
push edi
push 0x15d4f
call fcn.10027b51
pop ecx
pop ecx
call eax
add esi, 0xa
cmp esi, 0x6e
jge 0x10039056
mov edi, dword [esp + 0x54]
jmp 0x10038fcb
cmp byte [ebp + 8], 0
je 0x10039080
lea ecx, [esp + 0x28]
call fcn.100387ca
test al, al
je 0x10039080
sub esp, 0x18
lea eax, [esp + 0x40]
mov ecx, esp
push eax
call fcn.10014099
call fcn.10038e0d
add esp, 0x18
push 0
push 1
lea ecx, [esp + 0x48]
call fcn.10014706
lea ecx, [esp + 0x10]
call fcn.100194af
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.10014706
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a346
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10145ccc
call fcn.1014399c
sub esp, 0x78
push ebx
mov ebx, ecx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor eax, eax
push esi
push edi
mov dword [ebx + 0x14], 7
mov esi, edx
mov dword [ebx + 0x10], ecx
mov dword [ebp - 0x20], ebx
mov word [ebx], ax
mov dword [ebp - 4], ecx
mov edx, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x38], 0x66032d02
mov dword [ebp - 0x34], 0x3f0b7805
mov dword [ebp - 0x30], 0x5f08360a
mov dword [ebp - 0x2c], 0x64078101
mov dword [ebp - 0x28], 0x50065709
mov dword [ebp - 0x24], 0x89007804
movzx ecx, byte [ebp + edx - 0x37]
sub ecx, edx
dec ecx
jns 0x1003a3c6
or eax, 0xffffffff
sub eax, ecx
add ecx, 0x100
and eax, 0xffffff00
add ecx, eax
movzx eax, byte [ebp + edx - 0x38]
add edx, 2
mov word [ebp + eax*2 - 0x84], cx
cmp edx, 0x18
jb 0x1003a3aa
xor eax, eax
lea ecx, [ebp - 0x50]
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x84]
push eax
call fcn.100140d4
xor eax, eax
mov dword [ebp - 4], 1
push 6
cmp dword [ebp - 0x3c], 8
lea edi, [ebp - 0x84]
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
cmp dword [esi + 0x14], 8
jb 0x1003a419
mov esi, dword [esi]
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.10125905
add esp, 0xc
xor edi, edi
test eax, eax
jne 0x1003a4bb
cmp dword [ebp - 0x14], eax
je 0x1003a4bb
push 2
push edi
push dword [ebp - 0x14]
call fcn.10126d1e
push dword [ebp - 0x14]
call fcn.10126c23
push edi
push edi
push dword [ebp - 0x14]
mov esi, eax
call fcn.10126d1e
add esp, 0x1c
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
push eax
lea eax, [esi + 1]
push eax
call fcn.10019473
mov byte [ebp - 4], 2
push dword [ebp - 0x14]
push esi
push 2
push dword [ebp - 0x2c]
call fcn.1012658d
push dword [ebp - 0x14]
call fcn.10126e0d
add esp, 0x14
lea ecx, [ebp - 0x68]
push dword [ebp - 0x2c]
call fcn.100140d4
push eax
mov ecx, ebx
call fcn.10018f5a
push edi
push 1
lea ecx, [ebp - 0x68]
call fcn.10014706
lea ecx, [ebp - 0x2c]
call fcn.100194af
push edi
push 1
lea ecx, [ebp - 0x50]
call fcn.10014706
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003e942
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x10146354
call fcn.1014399c
sub esp, 0x1b0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xe0], ecx
push edi
mov dword [ebp - 0xdc], 0x6e4b681b
mov ecx, ebx
mov dword [ebp - 0xd8], 0x7e0e3335
mov esi, ebx
mov dword [ebp - 0xd4], 0x37526d46
mov dword [ebp - 0xd0], 0x83208027
mov dword [ebp - 0xcc], 0x74557a32
mov dword [ebp - 0xc8], 0x5948431d
mov dword [ebp - 0xc4], 0x8f167b18
mov dword [ebp - 0xc0], 0x84144659
mov dword [ebp - 0xbc], 0x9134942e
mov dword [ebp - 0xb8], 0x9c458843
mov dword [ebp - 0xb4], 0x94239038
mov dword [ebp - 0xb0], 0x9b449641
mov dword [ebp - 0xac], 0xa503a531
mov dword [ebp - 0xa8], 0x5f09570a
mov dword [ebp - 0xa4], 0xa9eb580f
mov dword [ebp - 0xa0], 0x97298d3c
mov dword [ebp - 0x9c], 0x1d208cb7
mov dword [ebp - 0x98], 0x490a7029
mov dword [ebp - 0x94], 0x56912a8
mov dword [ebp - 0x90], 0x2bac4cad
mov dword [ebp - 0x8c], 0x407e5aa2
mov dword [ebp - 0x88], 0x1ab35673
mov dword [ebp - 0x84], 0x22ae1faa
mov dword [ebp - 0x80], 0x7bd42c3
mov dword [ebp - 0x7c], 0x3dbb39b6
mov dword [ebp - 0x78], 0x37cb24bd
mov dword [ebp - 0x74], 0x3ace0fc2
mov dword [ebp - 0x70], 0x13c01ec9
mov dword [ebp - 0x6c], 0x11c81ccf
mov dword [ebp - 0x68], 0xdcd54d7
mov dword [ebp - 0x64], 0xccc4dd8
mov dword [ebp - 0x60], 0x21d402df
mov dword [ebp - 0x5c], 0xbe601da
mov dword [ebp - 0x58], 0x2fe929d7
mov dword [ebp - 0x54], 0x50dc17de
mov dword [ebp - 0x50], 0x47a151f0
mov dword [ebp - 0x4c], 0x2af728e6
mov dword [ebp - 0x48], 0x57fc00ea
mov dword [ebp - 0x44], 0x58fa33fc
mov dword [ebp - 0x40], 0x15fa4ff2
mov dword [ebp - 0x3c], 0x30fc3b08
mov dword [ebp - 0x38], 0x4e042cf8
mov dword [ebp - 0x34], 0x10c8260b
mov dword [ebp - 0x30], 0x2d182502
mov dword [ebp - 0x2c], 0x191506cf
mov dword [ebp - 0x28], 0x3e0d0815
mov dword [ebp - 0x24], 0x3c1e3f1d
mov dword [ebp - 0x20], 0x41e4a14
mov dword [ebp - 0x1c], 0x36d35310
mov byte [ebp - 0x18], 0x1d
cmp ecx, 0x38
jne 0x1003eb0e
push 0xf
pop esi
push 0x45
pop ecx
jmp 0x1003eb41
movzx eax, byte [ebp + ecx - 0xdb]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x1003eb31
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0xdc]
mov word [ebp + eax*2 - 0x1bc], dx
add ecx, 2
cmp ecx, 0xc5
jb 0x1003eb01
xor eax, eax
lea ecx, [ebp - 0x104]
mov word [ebp - 0x106], ax
lea eax, [ebp - 0x1bc]
push eax
call fcn.100140d4
mov dword [ebp - 4], ebx
lea eax, [ebp - 0xec]
push dword [ebp - 0xe0]
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xec], ebx
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0xe8], ebx
push eax
push ebx
mov dword [ebp - 0xe4], ebx
call fcn.100372de
push fcn.10014131
push 1
push 0x18
lea eax, [ebp - 0x104]
mov byte [ebp - 4], 2
push eax
call fcn.10123e3b
push 0x2e
pop ecx
xor eax, eax
lea edi, [ebp - 0x1bc]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0xe0]
lea edx, [ebp - 0xec]
push 3
call fcn.10043856
pop ecx
lea ecx, [ebp - 0xec]
call fcn.1002897c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004536d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10144100
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x10045498
cmp byte [ebx + 0x46], 0
je 0x10045498
mov eax, dword [ebx]
mov esi, 0xffff
push esi
call dword [eax + 0xc]
movzx eax, ax
cmp si, ax
jne 0x100453be
xor al, al
jmp 0x1004549a
xor eax, eax
mov dword [esp + 0x24], 0xf
push eax
push 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov byte [esp + 0x18], al
call fcn.10021eb3
and dword [esp + 0x34], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
lea eax, [esp + 0xc]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x14]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10045423
dec eax
je 0x10045427
dec eax
dec eax
je 0x10045485
xor bl, bl
jmp 0x10045487
mov byte [ebx + 0x46], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x10]
cmp ecx, 0x10
mov esi, dword [esp + 0xc]
cmovae eax, edx
sub esi, eax
je 0x10045466
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x14]
push esi
cmovae eax, edx
push 1
push eax
call fcn.10126811
add esp, 0x10
cmp esi, eax
jne 0x1004541f
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
cmp byte [ebx + 0x46], 0
je 0x10045485
test esi, esi
jne 0x100453e9
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.100358a1
jmp 0x100453e1
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.10014485
mov al, bl
jmp 0x1004549a
mov al, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004f9f9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x10147331
call fcn.1014399c
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [esi]
mov dword [edi], eax
lea ecx, [edi + 0x18]
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [esi + 0x18]
push eax
call fcn.10018f9d
and dword [ebp - 4], 0
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10018f9d
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100594e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push esi
push edi
mov edi, ecx
test dl, dl
je 0x1005955e
mov esi, dword [ebp + 8]
test esi, esi
je 0x1005956d
cmp dword [ebp + 0x10], 0
je 0x1005956d
mov ecx, dword [ebp + 0x14]
mov edx, 0x59ff
push 0x67aa
push esi
push 1
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
call fcn.10059440
add esp, 0x18
mov ecx, edi
call fcn.10058e97
mov edi, eax
cmp edi, 0xffffffff
je 0x1005956d
push 0
lea eax, [esp + 0x10]
push eax
push dword [ebp + 0x10]
push esi
push edi
mov esi, 0x5c4a9
push esi
push 0x63267
call fcn.10027b51
pop ecx
pop ecx
call eax
push edi
push esi
push 0x2ec5f
call fcn.10027b51
pop ecx
pop ecx
call eax
jmp 0x1005956d
push 0x1aad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005e5c6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1005e604
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push dword [eax + 0x18]
push 0
call fcn.1005bba8
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x1005e632
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1005e632
push 0
push 0x2043
push 0
push 0
push 0x1014
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x10069750
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10069791
push 0
push 0x1e7e
push 0xecb
push 0x1c47
push 0xc8f
push 0x39b
push 0x273
push 0x1d9a
push 0x1e69
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
jmp 0x100697a9
push 0
push 0x2043
push 0
push 0
push 0x1014
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1006ced9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1006cefd
xor eax, eax
jmp 0x1006d04c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1006cf1b
xor eax, eax
jmp 0x1006d04c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 0x2b88
push 1
call fcn.1006c4ea
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1006cf3e
xor eax, eax
jmp 0x1006d04c
lea eax, [ebp - 0x24]
push eax
push 0x127e
push 0x44f1
push 0x6486
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 4]
push eax
call fcn.1006cbf4
add esp, 0x24
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x113a
lea eax, [ebp - 8]
push eax
push 1
call fcn.1006cca7
add esp, 0x14
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
push eax
push 1
call fcn.1006cd21
add esp, 0xc
push dword [ebp - 4]
call fcn.1006b08f
pop ecx
test eax, eax
jne 0x1006cfb8
xor eax, eax
jmp 0x1006d04c
push 0x3337
push 0x25bc
push 0x66f4
push 0x33d2
lea eax, [ebp - 4]
push eax
push 0x5fbe
push 1
call fcn.1006cd97
add esp, 0x1c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1006d034
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x1006cffe
xor eax, eax
jmp 0x1006d04c
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1006d017
xor eax, eax
jmp 0x1006d04c
push 0x22b8
push 1
push 0x7beb
push 0x256c
lea eax, [ebp - 4]
push eax
call fcn.1006ce3a
add esp, 0x14
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1006d045
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x1006d049
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret