joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10067ff
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
push 0x2001f
xor ebx, ebx
push ebx
push 0x1006898
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1006863
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
mov esi, 0x1006868
push esi
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp dword [ebp - 4], 2
je 0x1009028
push dword [ebp - 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
pop esi
pop ebx
leave
ret
push 4
lea eax, [ebp - 4]
push eax
push 4
push ebx
push esi
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
jmp 0x1006859

Function at 0x1006909
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x1003670
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1006960
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1006968
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x1006a07
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, 0x3c
lea eax, [esi + esi]
push eax
call fcn.01006a60
mov dword [ebp - 4], eax
test eax, eax
je 0x1008e0e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
push esi
push eax
push dword [ebp + 8]
call ebx
mov edi, eax
test edi, edi
je 0x1008e8a
cmp edi, esi
jg 0x1008e3f
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
leave
ret 4
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1008e38
test byte [eax + 0x1c], 1
je 0x1008e38
cmp byte [eax + 0x19], 2
jb 0x1008e38
push 0x100a6f0
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
xor eax, eax
jmp 0x1006a56
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1008e69
test byte [eax + 0x1c], 1
je 0x1008e69
cmp byte [eax + 0x19], 5
jb 0x1008e69
push 0x100a6f0
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
lea eax, [ebp - 4]
push eax
call fcn.0100575d
lea eax, [edi + edi]
push eax
call fcn.01006a60
mov dword [ebp - 4], eax
mov esi, edi
test eax, eax
je 0x1008ec6
push edi
jmp 0x1006a39
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1008eb4
test byte [eax + 0x1c], 1
je 0x1008eb4
cmp byte [eax + 0x19], 2
jb 0x1008eb4
push 0x100a6f0
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
lea eax, [ebp - 4]
push eax
call fcn.0100575d
and dword [ebp - 4], 0
jmp 0x1006a51
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1006a51
test byte [eax + 0x1c], 1
je 0x1006a51
cmp byte [eax + 0x19], 2
jb 0x1006a51
push 0x100a6f0
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
jmp 0x1006a51
Function at 0x1006a7f
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x58]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x18]
add esp, 0xc
push 5
mov edi, dword [ebp + 8]
xor ebx, ebx
inc ebx
or eax, ebx
mov dword [ebp - 0x2c], eax
pop eax
mov word [ebp - 0x28], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], esi
xor esi, esi
push esi
push dword [ebp + 0x1c]
or eax, 0x400
push eax
push esi
push esi
push esi
push edi
push esi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x4c], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1007a63
mov eax, dword [ebp + 0x24]
cmp eax, esi
jne 0x1006b88
cmp dword [ebp + 0x20], esi
je 0x1006b7d
test byte [ebp + 0x20], bl
jne 0x1007a28
test byte [ebp + 0x20], 2
je 0x1006b63
push 0x14
call fcn.01006a60
mov esi, eax
mov dword [ebp + 0x20], esi
test esi, esi
je 0x1006b7d
push edi
call fcn.01006b9b
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
push 8
push 0xffffffffffffffff
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [esi + 0x10], eax
push 0x100b87f
push dword [ebp - 0x14]
mov edi, eax
lea eax, [esi + 8]
shl edi, 2
push eax
mov dword [edi + 0x1015600], ebx
call dword [sym.imp.ntdll.dll_RtlRegisterWait]
mov ebx, eax
test ebx, ebx
jl 0x1007a4b
mov dword [edi + 0x1015618], esi
mov eax, dword [ebp + 0x28]
test eax, eax
jne 0x1006b8f
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x24
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1006b63
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
jmp 0x1006b63
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
jmp 0x1006b73
mov eax, dword [0x1015794]
cmp eax, 0x40
jae 0x1006b07
mov ecx, dword [ebp - 0x14]
mov dword [eax*4 + 0x1015798], ecx
inc eax
mov dword [0x1015794], eax
jmp 0x1006b07
lea eax, [ebp + 0x20]
push eax
call fcn.0100575d
push ebx
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 4], eax
jmp 0x1006b63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1006b73
test byte [eax + 0x1c], 2
je 0x1006b73
cmp byte [eax + 0x19], 2
jb 0x1006b73
push dword [ebp - 4]
push edi
push 0x10025ac
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100abe1
jmp 0x1006b73
Function at 0x1006d75
Capabilities:
Listen for remote procedure calls

Disassembly:
mov edi, edi
push edi
push 0
push 0x1006de8
push 0xa
push 0x1006e08
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov edi, eax
test edi, edi
jne 0x1008c02
push esi
push 0x100c768
mov esi, 0x4d2
push esi
push 8
push 0
push 0
push dword [0x10156b0]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov edi, eax
test edi, edi
jne 0x1008c3e
xor eax, eax
inc eax
push eax
push esi
push eax
mov dword [0x10150dc], eax
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov edi, eax
cmp edi, 0x6b1
jne 0x1006ddb
xor edi, edi
test edi, edi
jne 0x1008c6c
pop esi
mov eax, edi
pop edi
ret
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1006de4
test byte [eax + 0x1c], 8
je 0x1006de4
cmp byte [eax + 0x19], 2
jb 0x1006de4
push edi
push 0x1002214
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
jmp 0x1006de4
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1006de3
test byte [eax + 0x1c], 8
je 0x1006de3
cmp byte [eax + 0x19], 2
jb 0x1006de3
push edi
push 0x1002214
push 0x12
jmp 0x1008c98
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1006de3
test byte [eax + 0x1c], 8
je 0x1006de3
cmp byte [eax + 0x19], 2
jb 0x1006de3
push edi
push 0x1002214
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
jmp 0x1006de3

Function at 0x1006e1d
Capabilities:
Listen for remote procedure calls

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1006e28
push esi
sub eax, edx
sar eax, 1
push edi
lea esi, [eax + eax + 0x10]
push esi
call fcn.010038e9
mov edi, eax
test edi, edi
je 0x1008ca8
push 0x1006ee4
push esi
push edi
call fcn.01003908
push dword [ebp + 8]
push esi
push edi
call fcn.01003945
push 0
push edi
push 0xa
push 0x1006ed0
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov esi, eax
test esi, esi
jne 0x1008cb0
push fcn.0100c661
push 0x4d2
push 0x10
push 0
push 0
push dword [ebp + 0xc]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov esi, eax
test esi, esi
jne 0x1008cea
xor eax, eax
inc eax
push eax
push 0x3039
push eax
mov dword [0x10150e0], eax
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov esi, eax
cmp esi, 0x6b1
jne 0x1006ec0
xor esi, esi
push edi
call fcn.01006ef7
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
push 0xe
pop esi
jmp 0x1006ec6
cmp esi, 0x6cc
je 0x1006e7c
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1006ec0
test byte [eax + 0x1c], 8
je 0x1006ec0
cmp byte [eax + 0x19], 2
jb 0x1006ec0
push esi
push 0x1002214
push 0xa
jmp 0x1008d16
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1006ec0
test byte [eax + 0x1c], 8
je 0x1006ec0
cmp byte [eax + 0x19], 2
jb 0x1006ec0
push esi
push 0x1002214
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
jmp 0x1006ec0
Function at 0x1006f16
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1007078
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x100940b
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x1006fdc
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, edi
jne 0x10093cd
cmp dword [ebp - 0xc], 1
jne 0x100938c
mov eax, dword [0x10150c0]
mov esi, 0x10150c0
cmp eax, esi
je 0x1006fa4
test byte [eax + 0x1c], 1
je 0x1006fa4
cmp byte [eax + 0x19], 4
jb 0x1006fa4
push 0x10030e4
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
push 1
call fcn.01006ff7
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push 0x10030a6
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10150f4], eax
cmp eax, edi
je 0x100934f
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
pop esi
mov eax, edi
pop edi
leave
ret
mov eax, dword [0x10150c0]
cmp eax, esi
je 0x1009382
test byte [eax + 0x1c], 1
je 0x1009382
cmp byte [eax + 0x19], 2
jb 0x1009382
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x10150c0]
push 0x10030e4
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
mov edi, 0xc000009a
jmp 0x1006fcb
call fcn.01002f01
test eax, eax
je 0x1006fcb
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x10093c3
test byte [eax + 0x1c], 1
je 0x10093c3
cmp byte [eax + 0x19], 2
jb 0x10093c3
push 0x10030e4
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
mov edi, 0xc0000260
jmp 0x1006fcb
mov ecx, dword [0x10150c0]
cmp ecx, 0x10150c0
je 0x1006fcb
test byte [ecx + 0x1c], 1
je 0x1006fcb
cmp byte [ecx + 0x19], 2
jb 0x1006fcb
push eax
push 0x10030e4
push 0x17
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01002f89
jmp 0x1006fcb
mov ecx, dword [0x10150c0]
cmp ecx, 0x10150c0
je 0x1006fd5
test byte [ecx + 0x1c], 1
je 0x1006fd5
cmp byte [ecx + 0x19], 2
jb 0x1006fd5
push eax
push 0x10030e4
push 0x18
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01002f89
jmp 0x1006fd5
Function at 0x1007239
Capabilities:
Listen for remote procedure calls

Disassembly:
push 0x134
push 0x1007350
call fcn.010027d1
mov esi, dword [ebp + 8]
mov dword [ebp - 0x144], 0xd
xor edi, edi
mov dword [ebp - 4], edi
push esi
call dword [sym.imp.ntdll.dll_NtAllocateLocallyUniqueId]
cmp eax, edi
jl 0x100986f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x1d4]
push dword [esi]
push dword [esi + 4]
push 0x1007330
push 0x91
lea eax, [ebp - 0x140]
push eax
call fcn.01002691
add esp, 0x18
test eax, eax
jl 0x1007315
push edi
lea eax, [ebp - 0x140]
push eax
push 0xa
push 0x1006e08
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov dword [ebp - 0x144], eax
cmp eax, edi
jne 0x1009881
push 0x1011c08
mov esi, 0x4d2
push esi
push 0x28
push edi
push edi
push dword [0x10156ec]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov dword [ebp - 0x144], eax
cmp eax, edi
jne 0x10098b4
xor ebx, ebx
inc ebx
mov dword [0x1015124], ebx
push ebx
push esi
push ebx
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov dword [ebp - 0x144], eax
cmp eax, 0x6b1
je 0x10098e7
cmp dword [ebp - 0x144], edi
jne 0x10098f2
mov dword [ebp - 4], 0xfffffffe
call fcn.01007371
mov eax, dword [ebp - 0x144]
call fcn.0100228c
ret 4
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 0x144], eax
jmp 0x1007315
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1007315
test byte [eax + 0x1c], 1
je 0x1007315
cmp byte [eax + 0x19], 2
jb 0x1007315
push dword [ebp - 0x144]
push 0x100ab60
push 0x12
jmp 0x1009922
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1007315
test byte [eax + 0x1c], 1
je 0x1007315
cmp byte [eax + 0x19], 2
jb 0x1007315
push dword [ebp - 0x144]
push 0x100ab60
push 0x13
jmp 0x1009922
mov dword [ebp - 0x144], edi
jmp 0x1007309
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1007315
test byte [eax + 0x1c], bl
je 0x1007315
cmp byte [eax + 0x19], 2
jb 0x1007315
push dword [ebp - 0x144]
push 0x100ab60
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
jmp 0x1007315
Function at 0x100ad82
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100adb1
test byte [eax + 0x1c], 2
je 0x100adb1
cmp byte [eax + 0x19], 5
jb 0x100adb1
push 0x10025ac
push 0x5c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
inc esi
cmp dword [0x10150fc], 0
push edi
mov edi, dword [ebp + 8]
je 0x100ae07
call fcn.0100ec21
lea eax, [ebp + 0xc]
push eax
push 0x2001b
push 0
push 0x1003670
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ae01
push 0x100a6ac
push dword [ebp + 0xc]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
push dword [ebp + 0xc]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov dword [edi], esi
mov dword [ebx], esi
jmp 0x100ae23
cmp dword [0x10150f8], 2
jne 0x100ae23
call fcn.0100ec21
push ebx
call fcn.0100e5fe
neg eax
sbb eax, eax
neg eax
mov dword [edi], eax
cmp dword [edi], 0
jne 0x100ae35
call fcn.0100e688
cmp eax, esi
jne 0x100ae35
mov dword [edi], esi
mov dword [ebx], esi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x100ae5d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10150c0]
mov esi, 0x10150c0
mov edi, 0x10025ac
cmp eax, esi
je 0x100ae96
test byte [eax + 0x1c], 8
je 0x100ae96
cmp byte [eax + 0x19], 4
jb 0x100ae96
push dword [ebp + 8]
push edi
push 0x62
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x1006898
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x100aedb
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
push 0x100af08
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
push dword [ebp - 4]
mov ebx, eax
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x100aeff
mov eax, dword [0x10150c0]
cmp eax, esi
je 0x100aeff
test byte [eax + 0x1c], 8
je 0x100aeff
cmp byte [eax + 0x19], 3
jb 0x100aeff
push ebx
push edi
push 0x63
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x100b2e3
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10150c0]
mov edi, 0x10150c0
cmp eax, edi
je 0x100b319
test byte [eax + 0x1c], 8
je 0x100b319
cmp byte [eax + 0x19], 5
jb 0x100b319
push 0x10025ac
push 0x5f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
push 0x80000001
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
push 1
push 0x13
call fcn.01012131
push 0x20
push 6
push 0x3e9
call fcn.0100e301
cmp dword [ebp + 8], 1
push 0x15
pop ebx
jne 0x100b348
push 0x17
jmp 0x100b350
cmp dword [ebp + 8], 2
jne 0x100b351
push 0x1d
pop ebx
push ebx
push 0x100b4b0
call fcn.0100b01a
xor esi, esi
push esi
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x100b372
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x100b4c0
call fcn.0100b01a
mov eax, dword [0x10150c0]
cmp eax, edi
je 0x100b3a5
test byte [eax + 0x1c], 8
je 0x100b3a5
cmp byte [eax + 0x19], 5
jb 0x100b3a5
push esi
push 0x10025ac
push 0x60
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
test esi, esi
je 0x100b3c6
push 0
lea eax, [ebp - 8]
push eax
push 8
push 0xc0000bbd
push 1
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
call fcn.0100e37b
add esp, 0x14
push 0x100b470
call fcn.0100afd3
call fcn.0100acef
push 0x100b480
call fcn.0100afd3
push 0x100b490
call fcn.0100afd3
push 0x100ae43
call fcn.0100fb37
push 0x100b4a0
call fcn.0100afd3
push 0x10
push 6
push 0x3ea
call fcn.0100e301
call fcn.0100af80
call fcn.0100acaa
mov eax, dword [0x10150c0]
cmp eax, edi
je 0x100b43f
test byte [eax + 0x1c], 8
je 0x100b43f
cmp byte [eax + 0x19], 4
jb 0x100b43f
push dword [ebp + 8]
push 0x10025ac
push 0x61
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
push 0x100b4d0
call fcn.0100afd3
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
push 0
push 0x13
call fcn.01012131
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x100bc14
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0x18
pop eax
push 0x1a
mov word [ebp - 0xc], ax
pop eax
mov esi, 0x5c000
xor edi, edi
push esi
mov dword [ebp - 4], edi
mov word [ebp - 0xa], ax
mov dword [ebp - 8], 0x100bd94
call fcn.01006a60
mov dword [ebp - 4], eax
cmp eax, edi
je 0x100bd8e
push ebx
push edi
push esi
push eax
push 5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, edi
jge 0x100bcf3
mov ecx, dword [0x10150c0]
mov ebx, 0x10150c0
mov edi, 0x1002214
cmp ecx, ebx
je 0x100bc91
test byte [ecx + 0x1c], 0x20
je 0x100bc91
cmp byte [ecx + 0x19], 2
jb 0x100bc91
push eax
push edi
push 0x58
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01002f89
push dword [ebp + 8]
push 0x3c
push 2
push dword [0x7ffe02d8]
call fcn.01011880
test eax, eax
je 0x100bcd7
mov ecx, dword [0x10150c0]
cmp ecx, ebx
je 0x100bcd7
test byte [ecx + 0x1c], 0x20
je 0x100bcd7
cmp byte [ecx + 0x19], 2
jb 0x100bcd7
push eax
push dword [0x7ffe02d8]
mov eax, dword [0x10150c0]
push edi
push 0x59
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100b8d6
xor esi, esi
inc esi
push dword [ebp + 8]
push 0x3c
push 2
push esi
call fcn.01011880
inc esi
cmp esi, 0x64
ja 0x100bd84
jmp 0x100bcda
mov esi, dword [ebp - 4]
cmp dword [esi], edi
je 0x100bd84
mov ebx, 0x10150c0
mov edi, 0x1002214
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
test eax, eax
jne 0x100bd7d
mov eax, dword [0x10150c0]
cmp eax, ebx
je 0x100bd42
test byte [eax + 0x1c], 0x20
je 0x100bd42
cmp byte [eax + 0x19], 4
jb 0x100bd42
push dword [esi + 0x50]
push edi
push 0x5a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
push dword [ebp + 8]
push 0x3c
push 2
push dword [esi + 0x50]
call fcn.01011880
test eax, eax
je 0x100bd7d
mov ecx, dword [0x10150c0]
cmp ecx, ebx
je 0x100bd7d
test byte [ecx + 0x1c], 0x20
je 0x100bd7d
cmp byte [ecx + 0x19], 2
jb 0x100bd7d
push eax
push dword [esi + 0x50]
push edi
push 0x5b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0100b8d6
add esi, dword [esi]
cmp dword [esi], 0
jne 0x100bd08
lea eax, [ebp - 4]
push eax
call fcn.0100575d
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x100c22b
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10150c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x124]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1002618
push 0x80000002
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x12c], 4
mov dword [ebp - 0x124], edi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x100c2e9
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x130]
push eax
push edi
push 0x100c380
push dword [ebp - 0x124]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, edi
jne 0x100c2e9
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100c2db
test byte [eax + 0x1c], 8
je 0x100c2db
cmp byte [eax + 0x19], 4
jb 0x100c2db
push dword [ebp - 0x128]
push 0x1002214
push 0x67
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
mov eax, dword [0x10150c0]
mov esi, dword [ebp - 0x128]
imul esi, esi, 0xea60
jmp 0x100c32e
push 0x118
lea eax, [ebp - 0x11c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100c324
cmp byte [ebp - 6], 1
mov esi, 0x2bf20
je 0x100c329
mov esi, 0xdbba0
mov eax, dword [0x10150c0]
cmp dword [ebp - 0x124], edi
je 0x100c347
push dword [ebp - 0x124]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100c36d
test byte [eax + 0x1c], 8
je 0x100c36d
cmp byte [eax + 0x19], 5
jb 0x100c36d
push esi
push 0x1002214
push 0x68
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.010015a4
leave
ret
Function at 0x100c661
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
mov dword [ebp + 0xc], eax
cmp eax, ebx
jne 0x100c740
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
inc esi
push esi
push 8
push 0xfffffffffffffffe
mov dword [ebp - 0xc], esi
call dword [sym.imp.ntdll.dll_NtOpenThreadToken]
cmp eax, ebx
jge 0x100c6af
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp + 0xc], eax
jmp 0x100c73f
push edi
push 0x13
pop edi
lea eax, [ebp - 0x10]
push eax
push dword [0x10151c8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x100c735
cmp dword [ebp - 0x10], ebx
je 0x100c6d4
push 0x18
pop edi
xor ebx, ebx
and dword [ebp - 0x14], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ntdll.dll_NtPrivilegeCheck]
test eax, eax
jge 0x100c700
cmp eax, 0xc0000061
jne 0x100c719
push dword [ebp - 8]
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp - 4]
push 0
push 0x101517c
call dword [sym.imp.ntdll.dll_NtPrivilegeObjectAuditAlarm]
test eax, eax
jge 0x100c726
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x100c73b
cmp byte [ebp - 8], 0
jne 0x100c73e
mov dword [ebp + 0xc], 5
jmp 0x100c73e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0xc], eax
pop edi
pop esi
cmp dword [ebp - 4], 0
pop ebx
je 0x100c750
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0xc], 0
je 0x100c75c
call dword [sym.imp.RPCRT4.dll_RpcRevertToSelf]
mov eax, dword [ebp + 0xc]
leave
ret 8