joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x4014d1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0x134]
sub esp, 0x154
mov dword [ebp - 0x134], 0
mov dword [esp], eax
lea ebx, [ebp - 0x10c]
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x118], 6
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x120], 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push ecx
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp - 4]
leave
sub eax, 3
ret

Function at 0x40159e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.004014d1
test eax, eax
jne 0x401638
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x4020ce
sub eax, 0x40166c
mov dword [esp], 0x40166c
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401638
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.004013d1
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.0040144c
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b600
mov dword [esp], str.g_n_p
call fcn.00401dd1
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x75222a76
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0xa36c82
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4c102c
Capabilities:
Packed with generic packer

Disassembly:
clc
jmp 0x4c1044
pushal
jae 0x4c104c
movsd dword es:[edi], dword [esi]
les edx, [ecx + 0x2fe8441f]
add byte [eax], al
add ah, cl
sar dword [ecx], cl
xchg dword [ebx + 0x63], ecx
popfd
pop esp
or dh, byte [eax - 0x6d51b19e]
mov ch, byte [ebx + 0x38966461]
fadd st(4), st(0)
inc edx
sbb eax, ebp
xchg esp, eax
outsd dx, dword [esi]
clc
cmp al, 0x44
popal
pop ebx
mov cl, 0x54
sub dl, byte [esi - 8]
adc al, 0x66
imul ebx, dword [edi + 0x7fab29af], 0x67
pop esi
jmp 0x4c1085
call 0x4c1080
int3
add esi, 0xffffffaf
jmp 0x4c10b4
cmp dword [esi], 0
stc
jmp 0x4c10d8
je 0x4c1299
jmp 0x4c10e8
mov edi, esi
jb 0x4c10fa
invalid
add esi, 4
jmp 0x4c1127
mov eax, dword [esi]
jmp 0x4c1146
add eax, esi
clc
jmp 0x4c114e
mov edx, dword [esi + 4]
jmp 0x4c117c
sub dword [eax], 0xe5f017af
jmp 0x4c11a6
add eax, 4
jmp 0x4c11da
sub edx, 1
stc
jb 0x4c11f4
push esp
add al, 0x7a
mov dh, 0x9a
shl dword [edi + 0x21], cl
add al, ch
xchg ebx, eax
popfd
into
cld
and cl, ah
in eax, dx
fcompi st(7)
push ss
jne 0x4c1151
jb 0x4c1223
aad 0x43
push edi
mov ah, 0xc4
dec ecx
or cl, byte [eax + 0x172c62b7]
imul esp, dword [edx + 0x14], 0xffffffeb
xchg edx, eax
dec eax
xchg ebx, eax
sbb al, 0x31
adc edi, dword [esi + eax*8 + 0x47]
xlatb
arpl word [edx + 0x74a40faf], di
inc edi
xor eax, 0x90524ea8
arpl word [ebx + 0x19eb08c6], ax
sbb ecx, dword [esi + 0x21]
adc eax, 0x6383d2dc
fisttp qword [edi - 0x3c]
mov ch, 0xe0
xchg esi, eax
inc ecx
mov bh, byte [ebp + 0x4ab5392c]
mov al, byte [0x837d53d1]
das
add ebx, ebp
adc dword [eax], eax
aad 0x39
xlatb
dec ebx
cmc
pop ss
mov edx, 0xefae9367
and edx, dword [eax + 0xf1b1c5f]
test dword [eax - 0x7000002], esp
add esi, 8
jmp 0x4c1241
sub dword [edi], 1
jmp 0x4c1257
jne 0x4c10fd
clc
jae 0x4c1273
int 0xf4
div dword [edi]
invalid
mov ebx, esi
jae 0x4c1294
popal
adc dh, bl
lahf
and dh, byte [edi - 0x5ecd9a6f]
mov edi, 0x47a72657
sub byte [esi + 0x866552d], dh
push ecx
fmul dword [edi + 0x32]
sub esp, edi
cli
call fcn.004c12f3
jmp 0x4c12c5
popal
clc
jae 0x4c12ee
hlt
jmp loc.0044bf06
Function at 0x1002ba9
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [esi], eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0xc
pop eax
push eax
push 0x40
mov dword [ebp - 0xc], eax
call edi
mov ebx, eax
test ebx, ebx
je 0x100ef06
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
push ebx
push 2
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
mov dword [ebp - 0x14], eax
jge 0x1002e0a
cmp eax, 0x80000005
je 0x1002e0a
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x14]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
je 0x1002e1b
cmp dword [ebp - 8], 0
ja 0x1002e3c
test eax, eax
je 0x1002e1b
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
jmp 0x1002c16
cmp dword [ebp - 0x10], 2
je 0x1002f94
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x1002ffc
xor eax, eax
jmp 0x1002c4d
push dword [ebp - 8]
push 0x40
call edi
test eax, eax
mov dword [ebp - 4], eax
je 0x100ef0e
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01002e6e
jmp 0x1002c38
cmp dword [ebp - 4], 0
je 0x1002e25
push 1
lea eax, [ebp + 0x12]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
cmp ebx, 1
jbe 0x100ef2e
lea eax, [ebx + ebx]
push eax
push 0x40
call edi
test eax, eax
mov dword [esi], eax
je 0x1002ff4
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
cmp edi, ebx
ja 0x100ef16
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x100ef26
jmp 0x1002e35
push 8
pop esi
jmp 0x1002c42
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
jmp 0x1002e35
push 8
pop eax
jmp 0x1002c26
push 8
pop eax
jmp 0x1002c4d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [esi], 0
jmp 0x1002ff4
lea ecx, [edi + edi]
jmp 0x1002fff
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1002e35
mov dword [eax], 2
jmp 0x1002e35
Function at 0x1002e6e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x1002e89
test esi, esi
je 0x100ee39
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor eax, eax
test esi, esi
je 0x1002e9e
mov eax, dword [esi]
push ebx
add eax, 0xc
push eax
push 0x40
mov dword [ebp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x100ee41
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 8]
push ebx
push 2
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ecx, eax
test ecx, ecx
mov dword [ebp + 0x1c], ecx
jl 0x1005360
test esi, esi
je 0x1002ee5
mov eax, dword [ebx + 8]
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x1002f1f
test ecx, ecx
jl 0x1002f08
test edi, edi
je 0x1002f08
mov ecx, dword [ebx + 8]
mov eax, ecx
shr ecx, 2
lea esi, [ebx + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp + 0x1c]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
pop ebx
pop edi
pop esi
leave
ret 0x18
mov edx, dword [ebx + 4]
mov dword [eax], edx
jmp 0x1002eec
cmp ecx, 0x80000005
je 0x1002edc
jmp 0x1002eec
push 0x57
pop eax
jmp 0x1002f19
push 8
pop eax
jmp 0x1002f18

Function at 0x1003461
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x101a10c]
mov dword [ebp - 4], eax
mov eax, dword [0x10034bc]
push esi
mov dword [ebp - 0xc], eax
mov eax, dword [0x10034c0]
push edi
xor esi, esi
xor edi, edi
mov dword [ebp - 8], eax
inc esi
mov word [ebp - 0xc], 0x41
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
je 0x100ed1c
inc word [ebp - 0xc]
shl esi, 1
cmp word [ebp - 0xc], 0x5a
jbe 0x100348e
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0100155d
leave
ret
or edi, esi
jmp 0x10034a1
Function at 0x10064b1
Capabilities:
Install driver

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x24], 0
jne 0x10064d4
push esi
call fcn.0100328a
test eax, eax
mov dword [ebp + 8], eax
jne 0x1006594
push ebx
push dword [esi + 8]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 0x6c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x100e5bb
push 0x10065b8
push ebx
call dword [sym.imp.msvcrt.dll_wcscpy]
push dword [esi + 8]
push ebx
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
push ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 4]
push eax
push 1
mov dword [ebp - 4], 0xa
call fcn.01001596
test eax, eax
mov dword [ebp + 8], eax
jne 0x1006593
push edi
mov edi, 0x101a024
push edi
call dword [sym.imp.ntdll.dll_RtlReleaseResource]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_NtLoadDriver]
push 1
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.ntdll.dll_RtlAcquireResourceExclusive]
call fcn.010016a6
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 8]
xor eax, eax
cmp ecx, eax
pop edi
jl 0x100e5c7
inc dword [esi + 0x1c]
push esi
mov dword [esi + 0x2c], 4
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
call fcn.0100d247
pop ebx
mov eax, dword [ebp + 8]
pop esi
leave
ret 4
mov dword [ebp + 8], 8
jmp 0x1006593
cmp ecx, 0xc000010e
jne 0x100e5db
mov dword [ebp + 8], 0x420
jmp 0x1006570
cmp ecx, 0xc000000e
jne 0x100e5ef
mov dword [ebp + 8], 0x14
jmp 0x1006593
push ecx
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp + 8], eax
jmp 0x1006593
Function at 0x1006eeb
Capabilities:
Connect pipe
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
lea eax, [ebp - 0x24]
push eax
push esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1006f6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100967a
push dword [0x101a2c0]
lea eax, [ebp - 8]
push edi
push eax
xor eax, eax
cmp ebx, edi
setne al
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x100deab
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x100dea0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 8]
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006fce
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x3e5
jne 0x1006fd8
push dword [0x101a2c0]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x100dec7
cmp eax, edi
jne 0x1006fce
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x100dee7
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp eax, 0x217
jne 0x1006fd8
jmp 0x1006f6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1006fd8
push esi
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [ebp + 0x10]
push dword [0x101a2c0]
push 5
call fcn.0100d30d
add esp, 0xc
jmp 0x100dedd
push esi
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [0x101a2c0]
push 6
call fcn.0100d30d
pop ecx
pop ecx
mov eax, 0x41d
jmp 0x1006fd8
call ebx
jmp 0x1006fd8
Function at 0x10070d6
Capabilities:
Create pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x101a10c]
push ebx
push esi
push edi
push 0xd
pop ecx
mov esi, 0x10071b0
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x64], eax
movsw word es:[edi], word [esi]
xor eax, eax
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x58], eax
push 0xa
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
mov byte [ebp - 0x60], 0
mov byte [ebp - 0x5f], 0
mov byte [ebp - 0x5e], 0
mov dword [ebp - 0x5c], 0x10000000
call dword [sym.imp.msvcrt.dll__itow]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
mov eax, dword [0x101a4e8]
push eax
push eax
push 1
lea eax, [ebp - 0x60]
push eax
call fcn.01007374
xor esi, esi
cmp eax, esi
jl 0x100de87
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x70]
push eax
push 0x7530
push 8
push 0x1f40
push 1
push 6
push 0x40080003
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x70], 0xc
mov dword [ebp - 0x68], esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
mov dword [ebx], eax
je 0x100de93
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.ntdll.dll_RtlDeleteSecurityObject]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100155d
leave
ret 0xc
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x10071a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1007194

Function at 0x100723c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
test esi, esi
jne 0x100ee49
mov eax, esi
pop esi
leave
ret 0x18
push esi
push dword [ebp + 0xc]
push 0x100ee64
push 2
call fcn.0100d30d
add esp, 0x10
jmp 0x100727a
Function at 0x10076d4
Capabilities:
Impersonate user

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x10]
push esi
xor esi, esi
push 0x100625c
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x100771a
or dword [ebp - 0x1c], 8
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x100f3a6
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
pop esi
leave
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100f3c8
push 1
call fcn.0100d30d
mov eax, dword [ebp + 0x14]
add esp, 0xc
mov dword [eax], esi
jmp 0x1007737
Function at 0x100837c
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
push esi
mov esi, 0x101a51c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or dword [0x101a534], 4
test byte [0x101a534], 8
je 0x100d73d
call fcn.010083b9
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0xc]
push eax
push 0x20019
xor esi, esi
push esi
push 0x100d870
push 0x80000002
call fcn.01002ccf
test eax, eax
jne 0x10083b1
push ebx
push 0x410
push esi
mov dword [ebp - 0x10], 0x208
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, esi
je 0x100d863
lea eax, [ebx + 0x208]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push esi
push 0x1002f80
push dword [ebp - 0xc]
call fcn.01002e6e
test eax, eax
je 0x100d7c5
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100d863
cmp dword [ebp - 4], 1
je 0x100d7d1
cmp dword [ebp - 4], 2
jne 0x100d84c
cmp dword [ebp - 4], 2
jne 0x100d7ef
push edi
mov edi, 0x104
push edi
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
pop edi
jbe 0x100d7f2
jmp 0x100d7b9
mov dword [ebp - 8], ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push 8
push esi
push esi
push esi
push esi
push dword [ebp - 8]
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x80
mov word [ebp - 0x34], si
mov word [ebp - 0x32], si
mov dword [ebp - 0x30], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100d84c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
pop ebx
jmp 0x10083b1