joyce8/EMBER2024-capa huggingface dataset:
Function at 0x109883c
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x10dd3c0
call fcn.01098918
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x10e47bc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10985f7
cmp eax, esi
jne 0x10985ea
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10985fa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10985d1
xor esi, esi
inc esi
mov eax, dword [0x10e47b8]
cmp eax, esi
jne 0x109860d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x109863c
mov eax, dword [0x10e47b8]
test eax, eax
jne 0x1098636
mov dword [0x10e47b8], esi
push 0x1001610
push 0x1001604
call fcn.01098533
pop ecx
pop ecx
test eax, eax
je 0x109863c
jmp 0x1098760
mov dword [0x10e4140], esi
mov eax, dword [0x10e47b8]
cmp eax, esi
jne 0x1098660
push 0x1001600
push 0x10015b8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10e47b8], 2
cmp dword [ebp - 0x20], ebx
jne 0x109866d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10e47c8], ebx
je 0x109868e
push 0x10e47c8
call fcn.01098f79
pop ecx
test eax, eax
je 0x109868e
push ebx
push 2
push ebx
call dword [0x10e47c8]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1098760
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x10986f8
cmp cx, bx
je 0x10986b3
cmp dword [ebp - 0x1c], ebx
jne 0x10986f8
movzx ecx, word [eax]
cmp cx, bx
je 0x10986c8
cmp cx, 0x20
ja 0x10986c8
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x10986b3
test byte [ebp - 0x40], 1
je 0x10986d4
movzx ecx, word [ebp - 0x3c]
jmp 0x10986d7
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x10e413c], eax
cmp dword [0x10e4130], ebx
jne 0x109873d
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1098709
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x109869d
cmp dword [0x10e4140], ebx
jne 0x109874b
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10e413c]
jmp 0x109876c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0109895d
ret
call fcn.010990c6
jmp 0x1098594
Function at 0x109a27d
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x10e3200]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call sub.VssTrace.DLL_Ordinal_11
cmp eax, dword [esi + 4]
je 0x109a385
and dword [ebp - 0x808], 0
mov dword [esi + 4], eax
lea eax, [ebp - 0x808]
push eax
push dword [esi + 0x1c]
push dword [esi + 0x18]
call sub.VssTrace.DLL_Ordinal_8_1
test eax, eax
je 0x109a2cb
mov eax, dword [ebp - 0x808]
jmp 0x109a2de
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x109a2d9
call fcn.0109a583
jmp 0x109a2de
call sub.VssTrace.DLL_Ordinal_6
mov dword [esi], eax
mov eax, dword [0x10e3224]
cmp eax, dword [esi + 4]
je 0x109a385
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x400
lea eax, [ebp - 0x804]
push eax
mov ecx, esi
call fcn.01099d42
push dword [esi + 4]
lea eax, [ebp - 0x804]
push dword [0x10e3224]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x10306d0
push 0x78
push 0x10306b0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x80c], esp
push 0xff
push 0xb
push 0x250
push 0x1030648
push 0x1030634
push 0x10305d0
call fcn.0109958e
push esi
call fcn.01099c82
mov eax, dword [esi + 4]
add esp, 0x7c
mov dword [0x10e3224], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.010989ab
leave
ret
Function at 0x109fe32
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
xor ebx, ebx
push ebx
sub esp, 0x58
mov dword [ebp - 4], esp
mov esi, ecx
mov ecx, esp
push 0xff
push 0xb
push 0x399
push 0x1033174
push 0x1033128
push 0x10330c8
call fcn.0109958e
lea ecx, [ebp - 0x44]
call fcn.0109aa5f
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x109fea4
mov eax, dword [ebp + 8]
cmp dword [eax + 4], ebx
setne al
cmp al, bl
sete al
movzx eax, al
push eax
lea ecx, [ebp - 0x44]
call fcn.0104693b
lea ecx, [ebp - 0x44]
mov bl, al
call fcn.0109ab18
pop esi
mov al, bl
pop ebx
leave
ret 4
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
cmp ecx, ebx
jne 0x109feb1
push ebx
jmp 0x109fe8a
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x109fe86

Function at 0x10a01cb
Capabilities:
Get token membership

Disassembly:
push 0x70
mov eax, 0x10d2ef0
call fcn.01098a6e
xor ebx, ebx
push ebx
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0xff
push 0xb
push 0xdd
push 0x10332e8
mov edi, 0x1033128
push edi
mov esi, 0x10330c8
push esi
call fcn.0109958e
lea ecx, [ebp - 0x7c]
call fcn.0109aa5f
or dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], 0x10059a0
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push 0x20
push 2
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
jne 0x10a0299
push 0x1018d94
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10a026f
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0xff
push 0xb
push 0xf9
push 0x10332e8
push edi
push esi
call fcn.0109958e
lea eax, [ebp - 0x7c]
push eax
call fcn.0109c361
mov byte [ebp - 4], 2
cmp byte [ebp + 0xc], bl
je 0x10a02c6
lea ecx, [ebp - 0x2c]
call fcn.01047383
lea eax, [ebp - 0x28]
push eax
push ebx
push 1
call fcn.0109ff85
cmp al, bl
je 0x10a02c6
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
jmp 0x10a02ce
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp eax, ebx
jne 0x10a030b
push 0x10332bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10a02f1
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0xff
push 0xb
push 0x119
jmp 0x10a0284
mov dword [ebp - 4], 1
jmp 0x10a03d2
cmp dword [ebp - 0x20], ebx
je 0x10a03e0
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x74], ebx
lea ecx, [ebp - 0x7c]
jge 0x10a03ed
call fcn.0109a832
cmp dword [ebp - 0x24], ebx
setne al
movzx eax, al
push eax
call fcn.0104693b
lea ecx, [ebp - 0x2c]
mov bl, al
call fcn.0104a1c0
lea ecx, [ebp - 0x7c]
call fcn.0109ab18
mov al, bl
call fcn.01098ad9
ret 8
Function at 0x10a17dd
Capabilities:
Get user security identifier

Disassembly:
push 0x64
mov eax, 0x10d30a6
call fcn.010989c0
mov dword [ebp - 0x20], ecx
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0xff
push 0xb
push 0x563
mov ebx, 0x1033ee0
push ebx
mov edi, 0x1033128
push edi
mov esi, 0x10330c8
push esi
call fcn.0109958e
lea ecx, [ebp - 0x70]
call fcn.0109aa5f
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x100599c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x100599c
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
cmp ecx, eax
je 0x10a19dd
cmp word [ecx], ax
je 0x10a19dd
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x10]
push edx
push eax
lea edx, [ebp - 0x14]
push edx
push eax
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
jne 0x10a1983
cmp dword [ebp - 0x14], ecx
je 0x10a1983
cmp dword [ebp - 0x10], ecx
je 0x10a1983
cmp eax, 0x534
jne 0x10a18d7
push dword [ebp + 8]
push 0x1033e30
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x57e
push ebx
push edi
push esi
call fcn.0109958e
lea eax, [ebp - 0x70]
push eax
call fcn.0109a735
add esp, 0x64
jmp 0x10a19bd
cmp eax, 0x7a
je 0x10a1912
push eax
push dword [ebp + 8]
push 0x1033d78
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x583
push ebx
push edi
push esi
call fcn.0109958e
lea eax, [ebp - 0x70]
push eax
call fcn.0109a735
add esp, 0x68
jmp 0x10a19bd
push dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.0104a2be
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x30]
call fcn.0104a2be
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
push dword [ebp + 8]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x10a1973
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x1033ce0
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x595
jmp 0x10a18f9
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.010a0fa0
jmp 0x10a19bd
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
push dword [ebp + 8]
push 0x1033be8
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x579
push ebx
push edi
push esi
call fcn.0109958e
lea eax, [ebp - 0x70]
push eax
call fcn.0109a735
add esp, 0x74
lea ecx, [ebp - 0x30]
call fcn.0104a1a3
lea ecx, [ebp - 0x28]
call fcn.0104a1a3
lea ecx, [ebp - 0x70]
call fcn.0109ab18
call fcn.01098aac
ret 8
push 0x1033bb0
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x572
push ebx
push edi
push esi
call fcn.0109958e
lea eax, [ebp - 0x70]
push eax
call fcn.0109b3d6
int3
Function at 0x10a1f37
Capabilities:
Compare security identifiers

Disassembly:
push 0x60
mov eax, 0x10d3135
call fcn.010989c0
mov esi, ecx
xor edi, edi
push edi
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0xff
push 0xb
push 0x6dc
push 0x10340d8
push 0x1033128
mov ebx, 0x10330c8
push ebx
call fcn.0109958e
lea ecx, [ebp - 0x6c]
call fcn.0109aa5f
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], edi
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
push 0xc
lea eax, [ebp - 0x2c]
push eax
push dword [esi + 0x10]
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
and dword [ebp - 0x14], 0
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x2c], 0
jbe 0x10a20f7
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
push dword [esi + 0x10]
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [ebp - 0x20]
movzx ecx, byte [eax]
xor edx, edx
sub ecx, edx
je 0x10a20c3
dec ecx
jne 0x10a20e8
add eax, 8
push eax
push dword [ebp + 8]
cmp dword [ebp - 0x14], edx
jne 0x10a20b1
call edi
test eax, eax
je 0x10a20e8
mov byte [ebp - 0xe], 1
lea ecx, [ebp - 0x6c]
call fcn.0109a583
test eax, eax
je 0x10a20a1
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x100599c
call fcn.0109fd60
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x10a2099
cmp byte [ebp - 0xd], 0
je 0x10a2044
cmp byte [ebp - 0xe], 0
mov ecx, 0x10340c8
je 0x10a2049
mov ecx, 0x10340b8
cmp byte [ebp - 0xd], 0
jne 0x10a205a
cmp byte [ebp - 0xe], 0
mov eax, 0x10340a0
je 0x10a205f
mov eax, 0x1034088
push ecx
push eax
push dword [ebp - 0x18]
push 0x1034048
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x736
push 0x10340d8
push 0x1033128
push ebx
call fcn.0109958e
lea eax, [ebp - 0x6c]
push eax
call fcn.0109a735
add esp, 0x6c
lea ecx, [ebp - 0x1c]
call fcn.0104a1a3
cmp byte [ebp - 0xd], 0
je 0x10a2109
cmp byte [ebp - 0xe], 0
jne 0x10a2109
mov al, 1
jmp 0x10a210b
lea eax, [ebp - 0x6c]
push eax
mov ecx, esi
call fcn.010a1224
test al, al
jmp 0x10a1ff6
add eax, 8
push eax
push dword [ebp + 8]
cmp dword [ebp - 0x14], edx
jne 0x10a20d5
call edi
test eax, eax
jmp 0x10a20e2
lea eax, [ebp - 0x6c]
push eax
mov ecx, esi
call fcn.010a1224
test al, al
je 0x10a20e8
mov byte [ebp - 0xd], 1
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x2c]
jb 0x10a1fbb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jb 0x10a1fad
jmp 0x10a2000
xor al, al
push eax
lea ecx, [ebp - 0x6c]
call fcn.0104693b
lea ecx, [ebp - 0x6c]
mov bl, al
call fcn.0109ab18
mov al, bl
call fcn.01098aac
ret 4
Function at 0x10a318a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x258
mov eax, 0x10d329c
call fcn.01098a33
mov esi, dword [ebp + 8]
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x21c], esp
push 0xff
push 4
push 0x469
push 0x1034970
mov ebx, 0x1034498
push ebx
mov edi, 0x1034428
push edi
call fcn.0109958e
lea ecx, [ebp - 0x264]
call fcn.0109aa5f
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], 0x100599c
mov byte [ebp - 4], 1
cmp word [esi], ax
jne 0x10a3222
push eax
lea ecx, [ebp - 0x264]
call fcn.0104693b
lea ecx, [ebp - 0x224]
mov bl, al
call fcn.0104a1a3
lea ecx, [ebp - 0x264]
call fcn.0109ab18
mov al, bl
call fcn.01098ac5
ret 4
push esi
lea ecx, [ebp - 0x224]
call fcn.0104b27e
mov esi, dword [ebp - 0x220]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10a3239
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], 0x5c
jne 0x10a3269
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10a3254
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x10a32c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1034920
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x21c], esp
push 0xff
push 4
push 0x47f
push 0x1034970
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x264]
push eax
call fcn.0109a735
add esp, 0x68
push 0
jmp 0x10a31f5
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10a32cf
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x21a], 0x5c
jne 0x10a3309
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10a32f1
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x21a], cx
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10a330e
jmp 0x10a33ac
lea eax, [ebp - 0x218]
push esi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x10a32bf
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10a337e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x10348d0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x21c], esp
push 0xff
push 4
push 0x49e
push 0x1034970
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x264]
push eax
call fcn.0109a735
add esp, 0x68
jmp 0x10a3385
test eax, 0x400
jne 0x10a33be
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x10a32bf
xor ecx, ecx
mov word [eax], cx
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10a33a2
sub eax, edx
sar eax, 1
cmp eax, 3
jae 0x10a331d
jmp 0x10a32bf
push esi
push 0x103489c
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x21c], esp
push 0xff
push 4
push 0x4a2
push 0x1034970
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x264]
push eax
call fcn.0109a735
add esp, 0x64
push 1
jmp 0x10a31f5
Function at 0x10a7a63
Capabilities:
Create thread

Disassembly:
push 0x58
mov eax, 0x10d37e8
call fcn.010989f8
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0xff
push 4
push 0x2b3
mov ebx, 0x10361c0
push ebx
mov edi, 0x10356bc
push edi
mov esi, 0x1035650
push esi
call fcn.0109958e
lea ecx, [ebp - 0x64]
call fcn.0109aa5f
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
cmp dword [0x10e4490], eax
je 0x10a7ac3
lea ecx, [ebp - 0x64]
call fcn.0109ab18
xor eax, eax
jmp 0x10a7c02
push 0x10e4120
push 0x10
mov byte [ebp - 4], 1
call fcn.01098b1f
pop ecx
pop ecx
xor ecx, ecx
cmp eax, ecx
je 0x10a7aec
mov dword [eax + 4], ecx
mov dword [eax], 0x1036088
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
jmp 0x10a7aee
xor eax, eax
mov dword [0x10e4490], eax
cmp eax, ecx
jne 0x10a7b26
push 0x1036158
push 0x8007000e
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0xff
push 4
push 0x2c5
push ebx
push edi
push esi
call fcn.0109958e
lea eax, [ebp - 0x64]
push eax
call fcn.0109b3d6
add eax, 8
push eax
push 0x103b6fc
call fcn.010aefec
push 0x1036114
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0xff
push 4
push 0x2c9
push ebx
push edi
push esi
mov dword [ebp - 0x5c], eax
call fcn.0109958e
lea eax, [ebp - 0x64]
push eax
call fcn.010468d9
add esp, 0x60
lea eax, [ebp - 0x14]
push eax
xor eax, eax
push eax
push eax
push 0x10a6d53
push 0x40000
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x10a7bba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10360d0
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0xff
push 4
push 0x2cf
push ebx
push edi
push esi
call fcn.0109958e
lea eax, [ebp - 0x64]
push eax
call fcn.0109b3d6
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10e4494]
and dword [ebp - 4], 0
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jge 0x10a7bf5
mov ecx, dword [0x10e4490]
test ecx, ecx
je 0x10a7bf5
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [0x10e4490], 0
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x64]
call fcn.0109ab18
mov eax, esi
call fcn.01098aac
ret
Function at 0x10a9ebc
Capabilities:
Create thread

Disassembly:
push 0xb0
mov eax, 0x10d3a0f
call fcn.010989f8
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
mov edi, 0xff
push edi
push 4
push 0x1e7
mov ebx, 0x103731c
push ebx
mov esi, 0x1036c24
push esi
push 0x1036bb8
call fcn.0109958e
lea ecx, [ebp - 0x58]
call fcn.0109aa5f
and dword [ebp - 4], 0
cmp dword [0x10e44a0], 0
je 0x10a9f1c
lea ecx, [ebp - 0x58]
call fcn.0109ab18
xor eax, eax
jmp 0x10aa12e
push 0x10e4120
push 0x18
mov byte [ebp - 4], 1
call fcn.01098b1f
pop ecx
pop ecx
xor ecx, ecx
cmp eax, ecx
je 0x10a9f49
mov dword [eax + 4], ecx
mov dword [eax], 0x1037188
mov dword [eax + 0xc], ecx
mov dword [eax + 8], 0x100599c
jmp 0x10a9f4b
xor eax, eax
mov dword [0x10e44a0], eax
cmp eax, ecx
jne 0x10a9f83
push 0x10372c0
push 0x8007000e
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
push 4
push 0x1f3
push ebx
push esi
push 0x1036bb8
call fcn.0109958e
lea eax, [ebp - 0x58]
push eax
call fcn.0109b3d6
lea eax, [ebp - 0x18]
push eax
push ecx
push ecx
push 0x10a8cc5
push 0x40000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x10aa091
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10360d0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
push 4
push 0x204
push ebx
push 0x1036c24
push 0x1036bb8
call fcn.0109958e
lea eax, [ebp - 0x58]
push eax
call fcn.0109c45f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
push 0x20e
push 0x103731c
push 0x1036c24
push 0x1036bb8
push dword [ebp - 0x60]
call fcn.0109a8a5
and dword [ebp - 4], 0
mov eax, 0x10aa005
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10e449c]
and dword [ebp - 4], 0
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x10aa121
mov ecx, dword [0x10e44a0]
test ecx, ecx
je 0x10aa0ca
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [0x10e44a0], 0
push 1
push 0xff
push 4
push 0x217
push 0x103731c
push 0x1036c24
push 0x1036bb8
lea ecx, [ebp - 0xbc]
call fcn.0109958e
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x50]
push ecx
mov ecx, eax
call fcn.0109a044
lea eax, [ebp - 0x58]
push 0x3036
push eax
call fcn.0109bd5c
add esp, 0x64
lea ecx, [ebp - 0xbc]
call fcn.0109963e
mov esi, dword [ebp - 0x50]
lea ecx, [ebp - 0x58]
call fcn.0109ab18
mov eax, esi
call fcn.01098aac
ret
Function at 0x10aa8af
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x50
mov eax, 0x10d3033
call fcn.010989c0
mov esi, ecx
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 0xb
push 0x2d1
push 0x1037df8
mov ebx, 0x1037884
push ebx
mov edi, 0x1037818
push edi
call fcn.0109958e
lea ecx, [ebp - 0x5c]
call fcn.0109aa5f
xor eax, eax
mov dword [ebp - 4], eax
cmp byte [esi + 0x18], al
je 0x10aa9ca
mov ecx, dword [esi + 0x14]
cmp ecx, eax
je 0x10aa9ca
mov edx, dword [esi + 0xc]
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x1c]
push edx
push eax
push eax
push eax
lea eax, [ebp - 0x10]
push eax
push ecx
push dword [esi + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10aa9b7
cmp eax, 0x103
je 0x10aa97e
push dword [ebp - 0x10]
push dword [esi + 0x14]
push dword [esi + 8]
push dword [esi]
push 0x1037db0
test eax, eax
jle 0x10aa954
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 0xb
push 0x2ea
push 0x1037df8
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x5c]
push eax
call fcn.0109c5e0
push dword [esi + 4]
push dword [esi + 8]
push 0x1037d50
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 0xb
push 0x2ee
push 0x1037df8
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x5c]
push eax
call fcn.0109c5e0
mov esi, dword [esi + 0x14]
lea ecx, [ebp - 0x5c]
call fcn.0109ab18
mov eax, esi
call fcn.01098aac
ret
push 0x1037cf8
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 0xb
push 0x2d5
push 0x1037df8
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x5c]
push eax
call fcn.0109b3d6
int3
Function at 0x10aaa29
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x48
mov eax, 0x10d1ac3
call fcn.010989c0
mov esi, ecx
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 0xb
push 0x460
push 0x1037e90
mov ebx, 0x1037884
push ebx
mov edi, 0x1037818
push edi
call fcn.0109958e
lea ecx, [ebp - 0x54]
call fcn.0109aa5f
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp byte [esi + 0x21], cl
je 0x10aab50
mov eax, dword [esi + 0x14]
cmp eax, ecx
je 0x10aab50
cmp byte [esi + 0x20], cl
je 0x10aaa97
lea ecx, [ebp - 0x54]
call fcn.0109ab18
call fcn.01098aac
ret
mov edx, dword [esi + 0x18]
mov dword [ebp - 0x10], edx
lea edx, [esi + 0x1c]
push edx
push ecx
lea edx, [esi + 0xc]
push edx
push ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [esi + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10aab47
cmp eax, 0x103
je 0x10aab0e
push dword [ebp - 0x10]
push dword [esi + 0x14]
push dword [esi + 8]
push dword [esi]
push 0x1037e50
test eax, eax
jle 0x10aaae4
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 0xb
push 0x47c
push 0x1037e90
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x54]
push eax
call fcn.0109c5e0
push dword [esi + 4]
push dword [esi + 8]
push 0x1037d50
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 0xb
push 0x480
push 0x1037e90
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x54]
push eax
call fcn.0109c5e0
mov byte [esi + 0x20], 1
jmp 0x10aaa89
push 0x1037cf8
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 0xb
push 0x464
push 0x1037e90
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x54]
push eax
call fcn.0109c5e0
int3