joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100037b4
Capabilities:
Get common file path

Disassembly:
push 0x658
mov eax, 0x10058666
call fcn.10040d9a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x62c], eax
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.10044e90
add esp, 0xc
xor eax, eax
push esi
push eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push eax
call fcn.10044e90
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
mov ebx, 0x1006146c
xor ecx, ecx
call fcn.100270b2
lea eax, [ebp - 0x628]
push eax
mov ebx, str.cachedump
xor ecx, ecx
call fcn.100270b2
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1000399e
xor eax, eax
push esi
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.10044e90
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.client_log
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea esi, [ebp - 0x218]
call fcn.10026a50
mov eax, esi
push eax
lea ebx, [ebp - 0x420]
call fcn.10026e9e
lea eax, [ebp - 0x648]
push eax
call fcn.10004930
lea eax, [ebp - 0x628]
xor ebx, ebx
push eax
lea esi, [ebp - 0x664]
mov dword [ebp - 4], ebx
call fcn.100048d8
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x634]
mov ecx, dword [ebp - 0x648]
push eax
push ecx
mov eax, esi
push eax
lea edi, [ebp - 0x648]
call fcn.10004e69
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.10004dfd
lea eax, [ebp - 0x218]
push eax
lea esi, [ebp - 0x664]
call fcn.100048d8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x634]
mov ecx, dword [ebp - 0x648]
push eax
push ecx
mov eax, esi
push eax
call fcn.10004e69
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.10004dfd
lea ecx, [ebp - 0x664]
call fcn.100393cf
push eax
mov eax, edi
mov byte [ebp - 4], 3
call fcn.1000497f
push ebx
push 1
lea esi, [ebp - 0x664]
mov byte [ebp - 4], bl
call fcn.10004dfd
lea ecx, [ebp - 0x664]
call fcn.10039448
push eax
mov byte [ebp - 4], 4
mov eax, edi
call fcn.1000497f
push ebx
push 1
lea esi, [ebp - 0x664]
mov byte [ebp - 4], bl
call fcn.10004dfd
mov ebx, dword [ebp - 0x62c]
mov ecx, edi
call fcn.1003a787
lea esi, [ebp - 0x218]
mov ebx, eax
call fcn.10027030
call fcn.10004ef2
push dword [ebp - 0x648]
call fcn.1003f52e
xor eax, eax
test ebx, ebx
pop ecx
sete al
call fcn.10040e1d
ret
Function at 0x10006d28
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push 0x19c
mov eax, 0x10059d7e
call fcn.10040d31
mov eax, 0x1001b573
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10006dbf
xor edi, edi
mov esi, 0x10074738
cmp dword [0x10074af0], edi
jne 0x10006da1
push 0x190
lea eax, [ebp - 0x1a8]
push edi
push eax
call fcn.10044e90
add esp, 0xc
lea eax, [ebp - 0x1a8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push dword [0x10074ad0]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push edi
push edi
push edi
push 0x1000657f
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100747b8], eax
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.10006e16
push esi
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10040e09
ret
Function at 0x10008aba
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005d382
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x10071118]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push edi
mov eax, dword [0x10071118]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
cmp esi, ebx
je 0x10008b5b
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10008b5b
push esi
call fcn.10008a96
pop ecx
test al, al
je 0x10008b27
mov al, 1
jmp 0x10008b5d
lea edi, [esp + 0x3c]
call fcn.1003936a
mov dword [esp + 0xa0], ebx
cmp dword [esp + 0x54], 0x10
mov edx, dword [esp + 0x40]
jae 0x10008b46
lea edx, [esp + 0x40]
call fcn.10027764
test eax, eax
jne 0x10008b81
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.10004d05
xor al, al
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.1003f03d
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x54], 0x10
mov eax, dword [esp + 0x40]
jae 0x10008b90
lea eax, [esp + 0x40]
push 0x32e3
push eax
push str.https:___s:_d_globalSmallFile
lea esi, [esp + 0x80]
call fcn.10028b00
add esp, 0xc
push ebx
push ebx
lea eax, [esp + 0x2c]
call fcn.10030a94
sub esp, 0x18
mov byte [esp + 0xb8], 4
mov esi, esp
mov dword [esp + 0x30], esp
push str.processico
call fcn.1002fad2
lea eax, [esp + 0x3c]
push eax
mov edx, str.type
mov byte [esp + 0xbc], 5
call fcn.10030dc9
mov edi, eax
mov byte [esp + 0xb8], 4
call fcn.1002fdd8
sub esp, 0x18
mov esi, esp
mov dword [esp + 0x30], esp
push dword [esp + 0x38]
call fcn.1002fad2
lea eax, [esp + 0x3c]
push eax
mov edx, str.name
mov byte [esp + 0xbc], 6
call fcn.10030dc9
mov edi, eax
mov byte [esp + 0xb8], 4
call fcn.1002fdd8
sub esp, 0x18
mov esi, esp
mov dword [esp + 0x30], esp
push ebx
call fcn.1002fa74
lea eax, [esp + 0x3c]
push eax
mov edx, str.clean
mov byte [esp + 0xbc], 7
call fcn.10030dc9
mov edi, eax
mov byte [esp + 0xb8], 4
call fcn.1002fdd8
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x5c]
call fcn.1003125d
mov byte [esp + 0xa0], 8
cmp dword [esp + 0x70], 0x10
mov ecx, dword [esp + 0x5c]
jae 0x10008c88
lea ecx, [esp + 0x5c]
cmp dword [esp + 0x8c], 0x10
mov eax, dword [esp + 0x78]
jae 0x10008c9a
lea eax, [esp + 0x78]
push ebx
push ebx
push ebx
push ebx
push ecx
push str.desc
push dword [esp + 0x34]
push str.file
push eax
call fcn.1002b429
push ebx
test eax, eax
push 1
lea ecx, [esp + 0x60]
setne byte [esp + 0x1f]
call fcn.10004d05
lea esi, [esp + 0x24]
mov byte [esp + 0xa0], 1
call fcn.1002fd55
push ebx
push 1
lea ecx, [esp + 0x7c]
call fcn.10004d05
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.10004d05
mov al, byte [esp + 0x17]
jmp 0x10008b5d
Function at 0x10008cf8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x1005d326
call fcn.10040d31
test edi, edi
je 0x10008d20
push edi
push str.default
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10008d20
xor eax, eax
inc eax
jmp 0x10008dc3
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push str.Softwareprojonepodlp_smpcacheprocicons_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x10008d56
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
call fcn.10028c01
jmp 0x10008d58
xor eax, eax
test eax, eax
jne 0x10008d18
push edi
lea ecx, [ebp - 0x50]
call fcn.10004842
and dword [ebp - 4], 0
push 0x1006188c
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10009ea3
add esp, 0xc
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 0x10
jb 0x10008d8a
mov eax, dword [eax + 4]
jmp 0x10008d8d
add eax, 4
push eax
call fcn.10008a96
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
mov bl, al
call fcn.10004d05
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.10004d05
test bl, bl
je 0x10008dc1
push edi
call fcn.100083cd
jmp 0x10008d18
xor eax, eax
call fcn.10040e09
ret
Function at 0x10008f5c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x10071118]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x158], 0
push ebx
push esi
push edi
mov dword [ebp - 0x144], eax
xor eax, eax
lea edi, [ebp - 0x154]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x158]
mov esi, ecx
push eax
push esi
mov byte [ebp - 0x13d], 0
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
jne 0x10008fb0
xor al, al
jmp 0x100090fe
lea eax, [ebp - 0x198]
push eax
push 0x18
push dword [ebp - 0x148]
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x118
xor edi, edi
lea eax, [ebp - 0x138]
push edi
push eax
call fcn.10044e90
add esp, 0xc
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x13c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp word [ebp - 0x186], 0x20
jne 0x10009099
cmp dword [ebp - 0x138], 5
je 0x10009099
push dword [ebp - 0x148]
call fcn.10008359
mov edi, eax
pop ecx
mov esi, edi
call fcn.100082e6
mov ebx, eax
call fcn.100082c6
and dword [ebp - 0x168], 0
and dword [ebp - 0x164], 0
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], ebx
call fcn.10008306
lea ecx, [ebp - 0x180]
push ecx
push eax
push 1
lea eax, [ebp - 0x168]
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipBitmapLockBits
test eax, eax
je 0x10009069
mov dword [edi + 8], eax
push 0x10
call sub.gdiplus.dll_GdipAlloc
test eax, eax
je 0x10009095
push dword [ebp - 0x170]
mov esi, eax
push dword [ebp - 0x178]
push dword [ebp - 0x17c]
push dword [ebp - 0x180]
call fcn.10008322
jmp 0x100090a0
xor eax, eax
jmp 0x100090a0
push esi
call fcn.10008391
pop ecx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call fcn.10008ed2
pop ecx
test al, al
je 0x100090ca
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x144]
call fcn.100082a6
test eax, eax
jne 0x100090ca
mov byte [ebp - 0x13d], 1
test esi, esi
je 0x100090d6
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
test edi, edi
je 0x100090e2
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
push dword [ebp - 0x148]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0x14c]
call esi
mov al, byte [ebp - 0x13d]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003f03d
leave
ret
Function at 0x1000910d
Capabilities:
Check if file exists
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x10071118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x2c4], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
test eax, eax
je 0x1000914c
push esi
call fcn.10026a68
cmp edx, ebx
ja 0x10009145
cmp eax, ebx
jbe 0x1000914c
mov al, 1
jmp 0x100091e5
push 0x2b0
lea eax, [ebp - 0x2bc]
push ebx
push eax
mov dword [ebp - 0x2c0], ebx
call fcn.10044e90
add esp, 0xc
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2c0]
push eax
push ebx
push dword [ebp - 0x2c4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 0x2c8]
push eax
push 0x1005e5ac
push 2
mov dword [ebp - 0x2c8], ebx
call dword [sym.imp.SHELL32.dll_SHGetImageList]
test eax, eax
jne 0x100091e3
mov eax, dword [ebp - 0x2c8]
lea edx, [ebp - 0x2c4]
push edx
push 1
push dword [ebp - 0x2bc]
mov dword [ebp - 0x2c4], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov ecx, dword [ebp - 0x2c4]
cmp ecx, ebx
je 0x100091e3
push esi
call fcn.10008f5c
pop ecx
push dword [ebp - 0x2c4]
mov bl, al
call dword [sym.imp.USER32.dll_DestroyIcon]
mov al, bl
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1003f03d
leave
ret

Function at 0x10009531
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call sub.gdiplus.dll_GdiplusStartup
push esi
push esi
push esi
push 0x100093be
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1007539c]
cmp eax, esi
jne 0x10009599
push str.B30715A7
call fcn.1002acb6
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1007539c], eax
cmp eax, esi
je 0x100095a1
push esi
push 0x100091f2
call eax
pop esi
leave
ret
Function at 0x1000a0d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x112c
call fcn.10050050
mov eax, dword [0x10071118]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
push str.SoftwareSASGeneration
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10028b5a
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push str.Local::ProcessMonitor
push 0x32
push str.._rcmgr.cpp
push str._s._d:_s
lea eax, [ebp - 0x1008]
push 0x800
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x1008]
push eax
push str.assists.exe
mov ebx, 0x1000a1d6
push ebx
call fcn.1002b3c1
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push 0x118
lea eax, [ebp - 0x1124]
push 0
push eax
mov dword [ebp - 0x1128], 0x11c
call fcn.10044e90
add esp, 0xc
lea eax, [ebp - 0x1128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1124], 5
jbe 0x1000a1c7
cmp dword [ebp - 0x1124], 6
jne 0x1000a190
cmp dword [ebp - 0x1120], 0
je 0x1000a1c7
push str.Local::ProcessMonitor
push 0x38
push str.._rcmgr.cpp
push str._s._d:_s
lea eax, [ebp - 0x1008]
push 0x800
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x1008]
push eax
push str.assisths.exe
push ebx
call fcn.1002b3c1
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003f03d
leave
ret
Function at 0x1000a3cc
Capabilities:
Delete registry value

Disassembly:
push 0xdc
mov eax, 0x1005c028
call fcn.10040d31
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x54]
mov dword [ebp - 0x18], esi
call fcn.10030a94
xor ebx, ebx
push 3
pop edi
inc ebx
mov dword [ebp - 4], edi
cmp dword [ebp + 0xc], esi
je 0x1000a43c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x3c]
call fcn.10004842
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 4
push eax
mov dword [ebp - 0x18], ebx
call fcn.1002c84b
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
mov dword [ebp - 4], 5
push eax
mov dword [ebp - 0x18], edi
call fcn.1002c8af
test al, al
je 0x1000a43c
cmp byte [ebp - 0x4c], 7
mov byte [ebp - 0x11], 0
je 0x1000a43f
mov byte [ebp - 0x11], bl
test byte [ebp - 0x18], 2
je 0x1000a454
and dword [ebp - 0x18], 0xfffffffd
lea eax, [ebp - 0xe8]
call fcn.1002f0fb
mov dword [ebp - 4], edi
test byte [ebp - 0x18], bl
je 0x1000a46a
and dword [ebp - 0x18], 0xfffffffe
push esi
push ebx
lea ecx, [ebp - 0x3c]
call fcn.10004d05
cmp byte [ebp - 0x11], 0
je 0x1000a496
push esi
push esi
lea eax, [ebp - 0x3c]
call fcn.10030a94
push eax
push str.invalid_json
mov byte [ebp - 4], 8
push 0xb
push dword [ebp + 8]
call fcn.1002b699
add esp, 0x10
jmp 0x1000a556
lea eax, [ebp - 0x54]
mov esi, str.mode
push eax
mov edx, esi
call fcn.10030dc9
cmp byte [eax + 8], 4
jne 0x1000a4db
lea eax, [ebp - 0x54]
push eax
mov edx, esi
call fcn.10030dc9
push eax
lea ecx, [ebp - 0x3c]
call fcn.1002ff43
mov byte [ebp - 4], 9
or dword [ebp - 0x18], 8
push 0x10061be0
call fcn.1000611c
pop ecx
mov byte [ebp - 0x11], 0
test al, al
jne 0x1000a4de
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], edi
xor esi, esi
test byte [ebp - 0x18], 8
je 0x1000a4f7
and dword [ebp - 0x18], 0xfffffff7
push esi
push ebx
lea ecx, [ebp - 0x3c]
call fcn.10004d05
cmp byte [ebp - 0x11], 0
je 0x1000a50f
push esi
push esi
lea eax, [ebp - 0x3c]
call fcn.10030a94
push eax
mov byte [ebp - 4], 0xc
push esi
jmp 0x1000a54a
mov ebx, 0x10061be4
push ebx
mov edi, str.Softwareprojonepodlp_smpcache_
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.1000a316
push 2
push ebx
push edi
push esi
call fcn.10028bc7
xor edx, edx
push edx
mov esi, eax
push edx
lea eax, [ebp - 0x3c]
call fcn.10030a94
push eax
mov byte [ebp - 4], 0xf
push edx
push esi
push dword [ebp + 8]
call fcn.1002b699
add esp, 0x10
or dword [ebp - 0x18], 4
lea esi, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.1002fd55
lea esi, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1002fd55
mov eax, dword [ebp + 8]
call fcn.10040e09
ret
Function at 0x1000ca69
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push 0x270
mov eax, 0x100585a0
call fcn.10040d9a
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x244], esi
call fcn.100095cd
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x230]
push eax
xor edi, edi
inc edi
push edi
mov dword [ebp - 4], esi
push esi
push esi
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], esi
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x1000cc36
mov dword [ebp - 0x23c], esi
cmp dword [ebp - 0x234], esi
jbe 0x1000cc2b
mov dword [ebp - 0x238], esi
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x238]
lea esi, [ecx + eax]
cmp dword [esi + 4], 4
jbe 0x1000cc0c
xor eax, eax
mov ebx, 0xfe
push ebx
push eax
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x10e]
push eax
call fcn.10044e90
add esp, 0xc
xor eax, eax
push ebx
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov dword [ebp - 0x248], 0x80
call fcn.10044e90
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x24c], 0x80
push dword [esi + 0xc]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x1000cc0c
lea eax, [ebp - 0x110]
push eax
lea esi, [ebp - 0x22c]
call fcn.100048d8
lea eax, [ebp - 0x258]
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.1000d823
mov esi, eax
lea eax, [ebp - 0x268]
lea ecx, [ebp - 0x22c]
call fcn.1000d843
mov ebx, eax
lea eax, [ebp - 0x270]
lea ecx, [ebp - 0x22c]
call fcn.1000d823
push dword [esi + 4]
push dword [esi]
push dword [ebx + 4]
push dword [ebx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x260]
push eax
call fcn.1000da5c
add esp, 0x1c
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x240]
lea ebx, [ebp - 0x27c]
call fcn.1000962b
push 0
push edi
lea esi, [ebp - 0x22c]
mov byte [ebp - 4], 0
call fcn.10004dfd
inc dword [ebp - 0x23c]
mov eax, dword [ebp - 0x23c]
add dword [ebp - 0x238], 0x10
cmp eax, dword [ebp - 0x234]
jb 0x1000cae0
push dword [ebp - 0x230]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x240]
call fcn.10040e1d
ret
Function at 0x1000d10a
Capabilities:
Add user account
Add user account to group
Delete user account
Get user security identifier

Disassembly:
push 0xe78
mov eax, 0x10058ad5
call fcn.10040d9a
mov eax, dword [ebp + 8]
mov dword [ebp - 0xe38], eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0xe84]
push eax
mov dword [ebp - 0xe34], ecx
call fcn.10039186
xor ebx, ebx
push eax
lea ecx, [ebp - 0xe30]
mov dword [ebp - 4], ebx
call fcn.10001206
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0xe84]
mov byte [ebp - 4], 2
call fcn.10004d05
xor eax, eax
mov esi, 0xfe
push esi
mov word [ebp - 0x114], ax
lea eax, [ebp - 0x112]
push ebx
push eax
call fcn.10044e90
xor eax, eax
push esi
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.10044e90
add esp, 0x18
lea edi, [esi - 0x7e]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push edi
push dword [ebp - 0xe38]
lea eax, [ebp - 0x114]
push eax
call esi
cmp dword [ebp - 0xe18], 8
mov eax, dword [ebp - 0xe2c]
jae 0x1000d1c2
lea eax, [ebp - 0xe2c]
push edi
push eax
lea eax, [ebp - 0x214]
push eax
call esi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0xe64]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0xe68], eax
lea eax, [ebp - 0x214]
push ebx
mov dword [ebp - 0xe64], eax
lea eax, [ebp - 0xe68]
xor esi, esi
push eax
inc esi
push esi
push ebx
mov dword [ebp - 0xe5c], esi
mov dword [ebp - 0xe50], 0x201
call sub.NETAPI32.dll_NetUserAdd
test eax, eax
jne 0x1000d315
push 0x3ff
lea eax, [ebp - 0x613]
push ebx
push eax
mov byte [ebp - 0x614], bl
call fcn.10044e90
xor eax, eax
push 0x7fe
mov word [ebp - 0xe14], ax
lea eax, [ebp - 0xe12]
push ebx
mov edi, 0x400
push eax
mov dword [ebp - 0xe40], edi
call fcn.10044e90
add esp, 0x18
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0xe44]
push eax
lea eax, [ebp - 0xe14]
push eax
lea eax, [ebp - 0xe40]
push eax
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0xe38]
mov dword [ebp - 0xe44], edi
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x1000d2f6
lea eax, [ebp - 0x614]
mov dword [ebp - 0xe3c], eax
mov eax, str.Administrators
cmp dword [ebp + 0x10], ebx
jne 0x1000d2b2
mov eax, str.Users
push esi
lea ecx, [ebp - 0xe3c]
push ecx
push ebx
push eax
push ebx
call sub.NETAPI32.dll_NetLocalGroupAddMembers
test eax, eax
jne 0x1000d2ef
push 0x10061d98
push dword [ebp - 0xe34]
call fcn.10004dd6
mov edi, esi
push ebx
push esi
lea esi, [ebp - 0xe30]
call fcn.10004dfd
mov eax, edi
call fcn.10040e1d
ret 0xc
push 0x10061da8
jmp 0x1000d2fb
push 0x10061dbc
push dword [ebp - 0xe34]
call fcn.10004dd6
lea eax, [ebp - 0x114]
push eax
push ebx
call sub.NETAPI32.dll_NetUserDel
jmp 0x1000d325
push 0x10061dd0
push dword [ebp - 0xe34]
call fcn.10004dd6
xor edi, edi
jmp 0x1000d2d8
Function at 0x1000df0d
Capabilities:
Create directory

Disassembly:
push 0x1c
mov eax, 0x10057bf5
call fcn.10040d31
mov edi, dword [ebp + 8]
mov dword [edi], vtable.CAutoRunMgr.0
add edi, 4
xor esi, esi
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], esi
mov word [edi + 4], ax
mov ebx, str.cache_autorunico
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.100395d9
push 0xffffffffffffffff
push edi
xor ebx, ebx
mov byte [ebp - 4], 1
call fcn.10004d50
push esi
push 1
lea esi, [ebp - 0x28]
call fcn.10004dfd
cmp dword [edi + 0x18], 8
jb 0x1000df6b
mov edi, dword [edi + 4]
jmp 0x1000df6e
add edi, 4
push 0
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [ebp + 8]
call fcn.10040e09
ret 4
Function at 0x1000ed04
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
call fcn.100095cd
push esi
push esi
push dword [ebp + 8]
push 0x1000ed4d
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 4], eax
pop esi
je 0x1000ed3e
cmp eax, 0xffffffff
je 0x1000ed3e
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
call fcn.100011b0
mov eax, dword [ebp + 8]
leave
ret 4

Function at 0x1000f2c9
Capabilities:
Check if file exists
Delete file
Get file attributes
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x10071118]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x18], 8
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x2c4], eax
lea esi, [ebx + 4]
jb 0x1000f2f4
mov eax, dword [esi]
jmp 0x1000f2f6
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000f391
cmp dword [ebx + 0x18], 8
jb 0x1000f310
mov edi, dword [esi]
jmp 0x1000f312
mov edi, esi
call fcn.10026946
cmp dword [ebx + 0x18], 8
jb 0x1000f31f
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
push 0x2b0
lea eax, [ebp - 0x2bc]
push esi
push eax
mov dword [ebp - 0x2c0], esi
call fcn.10044e90
mov eax, dword [ebp - 0x2c4]
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x1000f354
mov eax, dword [eax + 4]
jmp 0x1000f357
add eax, 4
push 0x100
push 0x2b4
lea ecx, [ebp - 0x2c0]
push ecx
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [ebp - 0x2c0]
cmp ecx, esi
jne 0x1000f37e
xor eax, eax
jmp 0x1000f394
mov edx, ebx
call fcn.10026180
push dword [ebp - 0x2c0]
call dword [sym.imp.USER32.dll_DestroyIcon]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1003f03d
leave
ret 4