joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10056c1
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp eax, 0xffffffff
je 0x1009979
push edi
xor edi, edi
push edi
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x1009983
cmp eax, edi
je 0x10099a0
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push eax
push edi
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
cmp eax, edi
je 0x10099b4
push 2
pop ecx
cmp ebx, ecx
jne 0x100573b
push 4
pop ecx
push edi
push edi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
cmp eax, edi
je 0x10099b4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret 8
cmp ebx, 4
jne 0x10099a7
jmp 0x100571c
mov eax, 0x8000ffff
jmp 0x1005736
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1005735
and eax, 0xffff
or eax, 0x80070000
jmp 0x1005735
xor eax, eax
jmp 0x1005735
xor ecx, ecx
cmp ebx, 8
sete cl
jmp 0x100571c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1005734
and eax, 0xffff
or eax, 0x80070000
jmp 0x1005734

Function at 0x100f0db
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x39c
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x39c], esi
cmp byte [0x1017001], bl
je 0x100f138
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100f1cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x100f1d0
lea eax, [ebp - 0x394]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x100f1b8
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x100f165
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100f1d5
and eax, 0xffff
or eax, 0x80070000
jmp 0x100f1d5
call fcn.0100320b
mov dword [ebp - 0x398], esp
push ebx
push ebx
push edi
push dword [ebp - 0x398]
push 0xffffffffffffffff
push dword [ebp - 0x39c]
push ebx
push ebx
call esi
test eax, eax
je 0x100f14f
push dword [ebp - 0x398]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100f1cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x100f1d0
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x398]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, ebx
je 0x100f1d0
cmp eax, 0xffffffff
je 0x100f1d0
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x100f1d5
test al, 0x10
je 0x100f1c8
mov eax, 0x80070002
lea esp, [ebp - 0x3a8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 4
Function at 0x100f76c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 0xc]
push eax
push 0x20006
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x100f7b9
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x100f7c7
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
pop ebp
ret 0x10

Function at 0x100fa2a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x43
je 0x100fa61
cmp dword [ebp + 8], 0x57
je 0x100fa55
mov eax, 0x80070057
jmp 0x100fbad
mov dword [ebp - 0x214], 0x100fbbc
jmp 0x100fa6b
mov dword [ebp - 0x214], 0x100fbc4
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x218], ebx
mov edi, 0x104
push ebx
mov esi, 0x80000000
jmp 0x100fb58
cmp eax, ebx
jne 0x100fb9e
cmp byte [ebp - 0x108], 0x2e
jne 0x100fb3a
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x100fb9e
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x1009b4c
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x220], ebx
jne 0x100fb3a
mov eax, dword [ebp - 0x210]
cmp eax, ebx
je 0x100fb3a
mov byte [ebp + eax - 0x109], bl
push 1
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x214]
call fcn.0100f974
cmp eax, ebx
jl 0x100fbaa
inc dword [ebp - 0x218]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x218]
push esi
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x100fa98
mov eax, dword [ebp - 0x214]
push ebx
push 0x100fbcc
call fcn.0100f974
cmp eax, ebx
jl 0x100fbaa
mov eax, dword [ebp - 0x214]
push ebx
push 0x100fbd4
call fcn.0100f974
cmp eax, ebx
jl 0x100fbaa
xor eax, eax
jmp 0x100fbaa
jle 0x100fbaa
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 4
Function at 0x101374c
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [0x1017001], bl
je 0x1013788
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1013902
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
or edi, 0xffffffff
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x10137c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1013904
and eax, 0xffff
or eax, 0x80070000
jmp 0x1013904
call fcn.0100320b
mov dword [ebp - 0x18], esp
cmp esp, ebx
jne 0x10137d7
mov eax, 0x8007000e
jmp 0x1013904
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x18]
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x10137a4
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10137a4
call fcn.0100320b
mov dword [ebp - 0x14], esp
cmp esp, ebx
je 0x10137cd
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x14]
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x10137a4
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10137a4
call fcn.0100320b
mov dword [ebp - 0x10], esp
cmp esp, ebx
je 0x10137cd
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x10]
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
test eax, eax
je 0x10137a4
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x10138a7
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0x1c]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10137a4
call fcn.0100320b
mov dword [ebp - 0xc], esp
cmp esp, ebx
je 0x10137cd
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
push dword [ebp + 0x1c]
push ebx
push ebx
call esi
test eax, eax
je 0x10137a4
jmp 0x10138be
push 4
pop eax
call fcn.0100321e
mov eax, esp
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x10137cd
mov byte [eax], bl
mov esi, dword [ebp + 0x18]
lea eax, [esi + 1]
call fcn.0100320b
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x10137cd
push dword [ebp - 0x18]
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push dword [ebp + 0x14]
push edi
push dword [ebp - 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x10137a4
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 0x18
Function at 0x101391d
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [0x1017001], bl
je 0x1013953
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x1013a36
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
or edi, 0xffffffff
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x101398c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1013a3d
and eax, 0xffff
or eax, 0x80070000
jmp 0x1013a3d
call fcn.0100320b
mov dword [ebp - 0x10], esp
cmp esp, ebx
jne 0x10139a2
mov eax, 0x8007000e
jmp 0x1013a3d
push ebx
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x101396f
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x101396f
call fcn.0100320b
mov dword [ebp - 0xc], esp
cmp esp, ebx
je 0x1013998
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x101396f
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x101396f
call fcn.0100320b
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x1013998
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 8]
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
test eax, eax
je 0x101396f
push dword [ebp - 0x10]
push dword [ebp + 0x18]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 0x14
Function at 0x101407d
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x10174c8], edi
jne 0x1014199
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x10140e4
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x10174c8], edi
pop esi
je 0x101416c
dec eax
jne 0x1014199
cmp dword [ebp - 0x11c], 5
jne 0x1014159
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x101414d
dec eax
je 0x101413a
dec eax
je 0x1014120
mov dword [0x10174c8], 0x14
jmp 0x1014199
cmp word [ebp - 0xc], 1
jb 0x1014131
mov dword [0x10174c8], 0x10
or dword [0x10174c8], 4
jmp 0x1014199
cmp word [ebp - 0xc], 2
jb 0x1014131
mov dword [0x10174c8], 8
jmp 0x1014131
mov dword [0x10174c8], 4
jmp 0x1014199
cmp dword [ebp - 0x11c], 4
ja 0x10141ab
mov dword [0x10174c8], 2
cmp dword [ebp - 0x11c], 4
jne 0x1014199
cmp dword [ebp - 0x118], edi
je 0x101418f
cmp dword [ebp - 0x118], 0xa
je 0x101418f
cmp dword [ebp - 0x118], 0x5a
jne 0x1014199
mov dword [0x10174c8], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x10174c8]
xor ecx, ebp
pop edi
call fcn.01001335
leave
ret
mov dword [0x10174c8], 0x20
jmp 0x1014199

Function at 0x10141bc
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1014210
push 3
lea eax, [ebp - 0x44]
push 0x1014220
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.01001335
leave
ret

Function at 0x101422b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x10174cc]
jne 0x10142c6
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x10143b8
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10142c5
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1014470
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x10142c5
push 3
push dword [esi*8 + 0x10142d8]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x10142b7
inc esi
cmp esi, 0x1c
jae 0x10142c5
jmp 0x1014296
mov ax, word [esi*8 + 0x10142dc]
mov word [0x10174cc], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x10174cc]
xor ecx, ebp
call fcn.01001335
leave
ret
Function at 0x1000ebb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push 4
pop edx
push ebx
push esi
sub ecx, 0x100d73e0
xor eax, eax
push edi
mov esi, dword [ecx + eax + 0x100d73e0]
mov dword [eax + 0x100d73e0], esi
add eax, edx
cmp eax, 0x14
jb 0x1000ebc2
push 9
xor eax, eax
pop ecx
mov edi, 0x100d73f8
mov dword [0x100d73f4], 5
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
xor esi, esi
xor eax, eax
mov ecx, dword [eax + 0x100d1598]
mov ecx, dword [ecx*4 + 0x100d73e0]
mov ebx, dword [eax + 0x100d15d4]
xor ecx, dword [ebx*4 + 0x100d73e0]
lea ebx, [eax + esi]
rol ecx, 3
xor ecx, ebx
xor dword [eax + 0x100d73e0], ecx
add eax, edx
cmp eax, 0x3c
jb 0x1000ebf3
mov dword [ebp - 4], edx
xor ecx, ecx
mov ebx, dword [ecx + 0x100d0a44]
mov ebx, dword [ebx*4 + 0x100d73e0]
and ebx, 0x1ff
mov ebx, dword [ebx*4 + 0x100d0d98]
add ebx, dword [ecx + 0x100d73e0]
rol ebx, 9
mov dword [ecx + 0x100d73e0], ebx
add ecx, edx
cmp ecx, 0x3c
jb 0x1000ec27
dec dword [ebp - 4]
jne 0x1000ec25
mov eax, edi
xor ecx, ecx
mov edi, dword [ecx + 0x100d1610]
mov edi, dword [edi*4 + 0x100d73e0]
mov dword [eax], edi
add ecx, edx
add eax, edx
cmp ecx, 0x28
jb 0x1000ec60
inc esi
mov edi, eax
cmp esi, edx
jb 0x1000ebf1
mov dword [ebp - 4], 5
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea esi, [eax + ecx*4]
mov ecx, dword [esi]
mov edx, ecx
or edx, 3
mov eax, edx
shr eax, 1
mov edi, edx
not edi
xor eax, edi
and eax, 0x7fffffff
mov edi, eax
shr edi, 2
mov ebx, eax
shr ebx, 1
and edi, ebx
and eax, edi
mov edi, eax
mov ebx, eax
shr edi, 6
shr ebx, 3
and edi, ebx
and eax, edi
je 0x1000ecf8
mov ebx, dword [ebp + 8]
add eax, eax
lea edi, [eax + eax]
or eax, edi
and ecx, 3
mov edi, eax
shl edi, 2
or eax, edi
mov edi, dword [ecx*4 + 0x100d164c]
mov ecx, dword [ebp - 4]
mov cl, byte [ebx + ecx*4 - 4]
rol edi, cl
mov ecx, eax
shl ecx, 4
or ecx, eax
and edi, ecx
and edi, 0xfffffffc
xor edx, edi
add dword [ebp - 4], 2
cmp dword [ebp - 4], 0x25
mov dword [esi], edx
jb 0x1000ec8a
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1000f610
Capabilities:
Enumerate processes

Disassembly:
push 0x24c
mov eax, 0x100974b7
call fcn.1007684e
mov esi, ecx
mov ebx, esi
call fcn.1000f7b0
xor ebx, ebx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000f63e
xor al, al
jmp 0x1000f69c
lea eax, [ebp - 0x258]
push eax
push edi
mov dword [ebp - 0x258], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x1000f68f
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000f6ca
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.1000f739
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.1000f89d
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1000f658
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
call fcn.100768d1
ret
Function at 0x10010335
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push str.Shell_TrayWnd
mov dword [ebp - 4], edi
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
jne 0x10010355
xor eax, eax
jmp 0x100103bb
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 4], edi
je 0x10010351
push esi
push dword [ebp - 4]
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
jne 0x1001037f
xor eax, eax
jmp 0x100103ba
lea eax, [ebp - 8]
push eax
push 2
push esi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [ebp - 0xc]
push eax
push 1
push 2
push edi
push 0xf01ff
push dword [ebp - 8]
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0xc]
pop esi
pop edi
leave
ret

Function at 0x100103be
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
mov dword [ebp - 0x120], 0x11c
call fcn.1005d3f0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call esi
test eax, eax
jne 0x1001041c
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
test eax, eax
je 0x10010426
cmp dword [ebp - 0x11c], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005c747
leave
ret

Function at 0x10010433
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100cc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
xor esi, esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10010499
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10010488
cmp dword [ebp - 0x14], ebx
je 0x10010490
xor esi, esi
inc esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005c747
leave
ret
Function at 0x10010bf8
Capabilities:
Create directory
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0x50
mov eax, 0x1009b05e
call fcn.1007684e
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.1000a422
push str.DLLTYPE
push 0x6a
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
push 0x2bd
cmp ebx, esi
jne 0x10010c4c
xor ebx, ebx
inc ebx
mov dword [0x100d9614], ebx
call fcn.1001d6bd
pop ecx
push esi
push ebx
lea ecx, [ebp + 8]
call fcn.1000f89d
xor eax, eax
call fcn.100768d1
ret 0x1c
call fcn.1001d6bd
pop ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x54], eax
push 0x2be
cmp eax, esi
je 0x10010c29
call fcn.1001d6bd
pop ecx
call fcn.1000c78f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x4c], eax
push 0x2bf
cmp eax, esi
je 0x10010c29
call fcn.1001d6bd
pop ecx
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x50], eax
push 0x2c0
cmp eax, esi
je 0x10010c29
call fcn.1001d6bd
pop ecx
xor eax, eax
push 0xffffffffffffffff
mov word [ebp - 0x2c], ax
push esi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
call fcn.1000f802
xor ebx, ebx
inc ebx
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x58]
mov byte [ebp - 4], bl
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x58], 0x5c
call fcn.100140ae
push eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10013ee3
mov byte [ebp - 4], 2
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x10010cff
lea eax, [ebp - 0x48]
push esi
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0x2c1
call fcn.1001d6bd
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
pop ecx
jae 0x10010d1f
lea eax, [ebp - 0x2c]
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
call fcn.10001ec6
push 0x2c2
call fcn.1001d6bd
pop ecx
push esi
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2c3
test eax, eax
jne 0x10010d91
mov dword [0x100d9614], ebx
call fcn.1001d6bd
pop ecx
xor edi, edi
push esi
push ebx
lea ecx, [ebp - 0x48]
call fcn.1000f89d
push esi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.1000f89d
push esi
push ebx
lea ecx, [ebp + 8]
call fcn.1000f89d
mov eax, edi
jmp 0x10010c44
call fcn.1001d6bd
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edi, ebx
jmp 0x10010d6c