joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101c4d4
Capabilities:
Create process on windows
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x104e070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x38
lea eax, [ebp - 0x250]
push esi
push eax
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x254], esi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
mov dword [ebp - 0x214], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, 0xffff
mov edi, 0x80070000
test eax, eax
jne 0x101c54f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x101c541
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jge 0x101c54f
push esi
push 0xcf
jmp 0x101c56d
mov ecx, dword [0x104e188]
lea eax, [ebp - 0x210]
push eax
call fcn.01027948
mov esi, eax
test esi, esi
jge 0x101c586
push esi
push 0xd2
push 0x10057b8
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x101c6b3
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x240], eax
mov eax, dword [0x104e188]
mov dword [ebp - 0x248], 0x10057ac
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x250], 0x440
mov dword [ebp - 0x238], 1
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x218], eax
test eax, eax
je 0x101c626
push 0x28
call fcn.010361af
pop ecx
test eax, eax
je 0x101c5fb
mov edx, dword [0x104e188]
mov esi, dword [edx + 0x7c]
mov edx, dword [edx + 0x78]
push esi
push edx
mov ecx, eax
call fcn.0101c36b
jmp 0x101c5fd
xor eax, eax
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x101c614
mov esi, 0x8007000e
push esi
push 0xe7
jmp 0x101c68f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
test eax, eax
je 0x101c626
and dword [ebp - 0x218], 0
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x101c6ed
xor esi, esi
mov eax, dword [ebp - 0x21c]
xor edx, edx
mov dword [0x104e144], eax
cmp dword [ebp - 0x218], edx
je 0x101c6a3
mov ecx, dword [ebp - 0x214]
push edx
push edx
push ecx
push 0x101c1b2
push edx
push edx
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x104e180], eax
test eax, eax
je 0x101c679
cmp eax, 0xffffffff
jne 0x101c6b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101c687
and eax, ebx
or eax, edi
mov esi, eax
push esi
push 0xfc
push 0x10057b8
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
mov ecx, dword [ebp - 0x214]
test ecx, ecx
je 0x101c6b3
mov eax, dword [ecx]
push 1
call dword [eax]
cmp esi, 0x800704c7
jne 0x101c6be
xor esi, esi
inc esi
cmp dword [ebp - 0x210], 0
je 0x101c6dc
push dword [ebp - 0x210]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01036539
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101c6fb
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jge 0x101c63d
push esi
push 0xf1
jmp 0x101c68f
Function at 0x101c9ea
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x101c21f
push ebx
push ebx
mov dword [ebp - 8], ecx
mov dword [ecx], fcn.0101c3ee
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x101ca33
cmp eax, 0xffffffff
je 0x101ca33
push 0xffffffffffffffff
push eax
call esi
push dword [ebp - 4]
call edi
jmp 0x101ca61
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x101ca47
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x20a
push 0x10057dc
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
mov eax, dword [0x104e180]
cmp eax, ebx
je 0x101ca86
push 0xffffffffffffffff
push eax
call esi
mov eax, dword [0x104e180]
cmp eax, ebx
je 0x101ca86
cmp eax, 0xffffffff
je 0x101ca86
push eax
call edi
mov dword [0x104e180], ebx
mov eax, dword [0x104e134]
cmp eax, ebx
je 0x101caa5
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
cmp eax, ebx
je 0x101caa5
push 0xffffffffffffffff
push eax
call esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
cmp eax, ebx
je 0x101cabd
cmp eax, 0xffffffff
je 0x101cabd
push eax
call edi
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], ebx
call fcn.0103474f
call fcn.0101a54f
call fcn.01030c52
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 4]
lea esi, [esi + 0x104e0d0]
mov eax, dword [esi]
cmp eax, ebx
je 0x101cae8
cmp eax, 0xffffffff
je 0x101cae8
push eax
call edi
mov dword [esi], ebx
add dword [ebp - 4], 4
cmp dword [ebp - 4], 0x68
jb 0x101cacf
mov eax, dword [0x104e0c8]
cmp eax, ebx
je 0x101cb09
cmp eax, 0xffffffff
je 0x101cb09
push eax
call edi
mov dword [0x104e0c8], ebx
call fcn.0101309d
mov esi, dword [ebp - 8]
cmp dword [esi + 4], ebx
je 0x101cb1b
call sub.DUI70.dll_UnInitThread
cmp dword [esi + 8], ebx
pop edi
pop esi
pop ebx
je 0x101cb2d
push 0x1000000
call sub.DUI70.dll_UnInitProcessPriv
leave
ret
Function at 0x101f2eb
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [sym.imp.DUI70.dll_public:_static_class_UID___stdcall_DirectUI::Button::Click_void_]
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [edi + 4]
push eax
mov esi, ecx
call fcn.0100d67f
test al, al
je 0x101f39d
lea eax, [ebp - 4]
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x80]
push eax
mov ecx, esi
call fcn.0100c938
test eax, eax
jge 0x101f33c
push eax
push 0x370
jmp 0x101f381
mov eax, dword [edi]
cmp eax, dword [ebp - 4]
jne 0x101f39d
mov esi, dword [esi + 0x40]
cmp word [esi], 0x68
jne 0x101f371
push 1
push 0
push 0
push esi
push 0x10021b0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x101f397
push 0x80004005
push 0x381
jmp 0x101f381
push esi
call fcn.0102e12e
test eax, eax
jge 0x101f397
push eax
push 0x388
push 0x1006078
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x101f3a9
mov byte [edi + 8], 1
jmp 0x101f3a9
push edi
push dword [ebp + 8]
mov ecx, esi
call dword [sym.imp.DUI70.dll_protected_virtual:_void___thiscall_DirectUI::TaskPage::OnListenedEvent_class_DirectUI::Element___struct_DirectUI::Event__]
pop edi
pop esi
leave
ret 8
Function at 0x10247d0
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x104e070]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24c], 0
push esi
mov esi, dword [ebp + 8]
push 0x38
lea eax, [ebp - 0x248]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1024808
sub eax, edx
sar eax, 1
je 0x1024848
push esi
push 0x10068d0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0100dd8e
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x1024840
push esi
push 0xb2
jmp 0x10248ba
lea eax, [ebp - 0x20c]
jmp 0x102484d
mov eax, 0x1006868
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x24c], 0x3c
mov dword [ebp - 0x248], 0x400
mov dword [ebp - 0x240], 0x10021b0
mov dword [ebp - 0x23c], 0x1006850
mov dword [ebp - 0x230], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x102489a
xor esi, esi
jmp 0x10248ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10248ae
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jge 0x10248ce
push esi
push 0xc1
push 0x100683c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01036539
leave
ret 4
Function at 0x1027243
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x104e070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x260], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push 0x24c
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x250]
push esi
push eax
mov dword [ebp - 0x254], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov ebx, 0x208
push ebx
push esi
mov dword [ebp - 0x25c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x10272dc
mov eax, 0x8007000e
push eax
push 0x6e4
push 0x100746c
push 0x100189c
push 1
mov dword [ebp - 0x258], eax
call fcn.01014247
add esp, 0x14
jmp 0x102744b
push 0x100745c
push dword [ebp - 0x260]
push 0x100744c
push 0x104
push eax
call fcn.0100dd8e
add esp, 0x14
mov dword [ebp - 0x258], eax
test eax, eax
jge 0x102730f
push eax
push 0x6e7
jmp 0x102740f
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x26c], eax
test eax, eax
je 0x10273ef
cmp eax, 0xffffffff
je 0x10273ef
push ebx
push 0
call esi
push eax
call edi
mov edi, eax
xor ebx, ebx
mov dword [ebp - 0x25c], edi
cmp edi, ebx
jne 0x1027365
mov eax, 0x8007000e
push eax
mov dword [ebp - 0x258], eax
push 0x6ec
jmp 0x102740f
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x260]
push 0x1005adc
push 0x104
push edi
call fcn.0100dd8e
add esp, 0x14
cmp eax, ebx
mov dword [ebp - 0x258], eax
jge 0x1027397
push eax
push 0x6f4
jmp 0x102740f
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x10273c9
mov dword [ebp - 0x258], ebx
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x268]
mov dword [eax], edi
mov dword [ebp - 0x25c], ebx
jmp 0x1027423
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10273dd
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x258], eax
jge 0x10273ad
push eax
push 0x6fa
jmp 0x102740f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1027403
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp - 0x258], eax
push 0x6ea
push 0x100746c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
push dword [ebp - 0x264]
xor ebx, ebx
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
cmp dword [ebp - 0x25c], ebx
je 0x102744b
push dword [ebp - 0x25c]
push ebx
call esi
push eax
call edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x258]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01036539
leave
ret 8
Function at 0x102812d
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 8]
push edi
test ebx, ebx
jne 0x1028152
mov edi, 0x80070057
push edi
push 0x9a5
jmp 0x102816d
lea eax, [ebp - 4]
push eax
push 0x104
push ebx
call fcn.0101420b
mov edi, eax
test edi, edi
jge 0x1028183
push edi
push 0x9a8
push 0x1007680
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x10281cb
push esi
mov esi, dword [ebp - 4]
dec esi
je 0x10281a8
cmp word [ebx + esi*2], 0x5c
je 0x1028196
dec esi
jne 0x102818a
jmp 0x10281a4
inc esi
movzx eax, word [ebx + esi*2]
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebx + esi*2], ax
test esi, esi
ja 0x10281b5
mov edi, 0x80004005
push edi
push 0x9bc
jmp 0x10281f3
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x10281d3
xor edi, edi
mov ax, word [ebp - 8]
mov word [ebx + esi*2], ax
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10281e7
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jge 0x10281c2
push edi
push 0x9c0
push 0x1007680
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x10281ca
Function at 0x10298d7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x104e070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x1007cb8
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
ja 0x1029933
xor edi, edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
jne 0x1029952
mov eax, 0x8000ffff
push eax
push 0x62
jmp 0x102996a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1029947
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jge 0x1029916
push edi
push 0x5f
jmp 0x102996c
push 0x1007ca4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1029982
mov eax, 0x8000ffff
push eax
push 0x67
mov edi, eax
push 0x1007c94
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102998c
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01036539
leave
ret
Function at 0x102b7b7
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
xor ebx, ebx
push 0x208
push ebx
mov edi, ecx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x102b806
mov edi, 0x8007000e
push edi
push 0x667
push 0x1008140
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102b922
push esi
mov esi, 0x104
push esi
push eax
mov ecx, edi
call fcn.01029f9c
mov edi, eax
cmp edi, ebx
jge 0x102b826
push edi
push 0x66a
jmp 0x102b8c5
lea eax, [ebp - 8]
push eax
push ebx
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edi, eax
cmp edi, ebx
jge 0x102b843
push edi
push 0x670
jmp 0x102b8c5
push 0x10027a4
push esi
push dword [ebp - 4]
call fcn.01014151
mov edi, eax
cmp edi, ebx
jge 0x102b85f
push edi
push 0x673
jmp 0x102b8c5
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
call fcn.0102aca0
mov edi, eax
cmp edi, ebx
jge 0x102b87a
push edi
push 0x676
jmp 0x102b8c5
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 4]
push eax
call dword [ecx + 0x10]
mov edi, eax
cmp edi, ebx
jge 0x102b898
push edi
push 0x67c
jmp 0x102b8c5
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x102b8db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x102b8b9
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jge 0x102b8db
push edi
push 0x683
push 0x1008140
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102b921
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_GetHGlobalFromStream]
mov edi, eax
cmp edi, ebx
jge 0x102b910
push edi
push 0x68a
push 0x1008140
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102b91b
push dword [ebp - 0x10]
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x102b932
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 8], ebx
cmp dword [ebp - 4], ebx
je 0x102b948
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x102c319
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x400
mov dword [ebp - 0x30], 0x10021b0
mov dword [ebp - 0x2c], 0x1006850
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], 0x1008228
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x102c36e
xor esi, esi
jmp 0x102c3a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102c382
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jge 0x102c3a2
push esi
push 0x5df
push 0x1008214
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
mov eax, esi
pop esi
leave
ret
Function at 0x102d2ca
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push 0xa
pop ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x34], ebx
lea edi, [ebp - 0x30]
push 0x15f
rep stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
call fcn.0102c200
mov esi, eax
cmp esi, ebx
jge 0x102d316
push esi
push 0x433
push 0x100845c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102d507
push 0x208
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [section..data], 0x195
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x102d362
mov esi, 0x8007000e
push esi
push 0x436
push 0x100845c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102d4f3
lea eax, [ebp - 0x34]
push eax
call fcn.0103773b
push 0x1008178
push dword [0x104e198]
push 0x1005adc
push 0x104
push dword [ebp - 4]
call fcn.0100dd8e
mov esi, eax
add esp, 0x14
test esi, esi
jge 0x102d399
push esi
push 0x440
jmp 0x102d349
mov eax, dword [0x104e188]
lea ecx, [ebp - 0x34]
mov dword [section..data], 0x15f
mov eax, dword [eax + 0x6c]
push ecx
push eax
call fcn.01037fee
mov esi, eax
test esi, esi
jge 0x102d3c3
push esi
push 0x447
jmp 0x102d349
push 0x800
push 0
call ebx
push eax
call edi
mov edi, eax
test edi, edi
jne 0x102d3e5
mov esi, 0x8007000e
push esi
push 0x449
jmp 0x102d4cf
push dword [ebp - 0x20]
push 0x400
push edi
call fcn.0100d999
mov esi, eax
test esi, esi
jge 0x102d404
push esi
push 0x44c
jmp 0x102d4cf
mov ecx, dword [0x104e188]
push edi
call fcn.0101c2b1
mov eax, dword [0x104e188]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x34]
mov dword [section..data], 0x19a
mov eax, dword [eax + 0x74]
push ecx
push eax
xor edi, edi
call fcn.01038bc3
mov esi, eax
test esi, esi
jge 0x102d443
push esi
push 0x456
jmp 0x102d349
mov ecx, dword [0x104e188]
lea eax, [ebp - 0x34]
push 0x161
mov dword [ecx + 0xd8], eax
call fcn.0102c200
mov esi, eax
test esi, esi
jge 0x102d46d
push esi
push 0x45b
jmp 0x102d349
push dword [ebp - 4]
call fcn.0102c6a1
mov esi, eax
test esi, esi
jge 0x102d486
push esi
push 0x45e
jmp 0x102d349
jne 0x102d4f3
call fcn.010321fd
mov esi, eax
test esi, esi
jge 0x102d49e
push esi
push 0x466
jmp 0x102d349
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x102d4af
xor esi, esi
jmp 0x102d4f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102d4c3
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jge 0x102d4f3
push esi
push 0x469
push 0x100845c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
test edi, edi
je 0x102d4f3
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 4], 0
je 0x102d507
push dword [ebp - 4]
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [ebp - 0x34]
push eax
call fcn.01037ab3
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x102d69b
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
xor esi, esi
push 0x38
lea eax, [ebp - 0x44]
push esi
push eax
mov dword [ebp - 0x48], esi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x800
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
jne 0x102d6fa
mov edi, 0x8007000e
push edi
push 0x62d
push 0x100849c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102d7ec
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xc], eax
xor eax, eax
inc eax
cmp dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov esi, 0x400
jle 0x102d759
push 0x10027a4
push esi
push ebx
call fcn.01014151
mov edi, eax
test edi, edi
jl 0x102d789
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
push dword [eax + ecx*4]
push esi
push ebx
call fcn.01014151
mov edi, eax
test edi, edi
jl 0x102d791
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x102d723
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], 0x10021b0
mov dword [ebp - 0x38], 0x1008488
mov dword [ebp - 0x34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x102d799
xor edi, edi
jmp 0x102d7cd
push edi
push 0x634
jmp 0x102d7b9
push edi
push 0x637
jmp 0x102d7b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102d7ad
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jge 0x102d7cd
push edi
push 0x642
push 0x100849c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xc], 0
je 0x102d7ec
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102d8e2
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x38
xor esi, esi
lea eax, [ebp - 0x3c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x440
mov dword [ebp - 0x34], 0x10021b0
mov dword [ebp - 0x30], 0x1008488
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x2c], 0x10084dc
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, 0xffff
mov edi, 0x80070000
test eax, eax
jne 0x102d95f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x102d951
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jge 0x102d95f
push esi
push 0x5a3
jmp 0x102d9c0
cmp dword [ebp - 8], 0
je 0x102d9aa
cmp dword [ebp - 8], 0xffffffff
je 0x102d9aa
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x102d9d4
lea eax, [ebp - 4]
push eax
call fcn.01037b6c
mov esi, eax
test esi, esi
jge 0x102d991
push esi
push 0x5b0
jmp 0x102d9c0
cmp dword [ebp - 4], 0
je 0x102d9d4
call fcn.0102d69b
mov esi, eax
test esi, esi
jge 0x102d9d4
push esi
push 0x5b4
jmp 0x102d9c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102d9b8
and eax, ebx
or eax, edi
mov esi, eax
push esi
push 0x5a5
push 0x10084c4
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
cmp dword [ebp - 8], 0
je 0x102d9e9
cmp dword [ebp - 8], 0xffffffff
je 0x102d9e9
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x102e866
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x44
pop eax
push eax
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x102e8af
mov esi, 0x8007000e
push esi
push 0x29e
push 0x10085e4
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102e940
push ebx
push edi
lea ecx, [ebp - 8]
push ecx
push eax
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov ebx, 0xffff
mov edi, 0x80070000
test eax, eax
jne 0x102e8fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102e8dc
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jge 0x102e8fe
push esi
push 0x2a4
push 0x10085e4
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102e92c
push dword [ebp + 8]
xor esi, esi
push dword [ebp - 4]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x102e92c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x102e91f
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jge 0x102e92c
mov eax, dword [ebp + 8]
xor esi, esi
and dword [eax], esi
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret 4