joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c7060
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024eac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push 0x208
lea eax, [ebp - 0x244]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x244]
push 0x104
push eax
push str.SESSIONNAME
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 8
xor eax, eax
mov dword [ebp - 0x2c], 0
push str.RDP_Tcp
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
call fcn.1001a600
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x244]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
lea edx, [ecx + 2]
mov word [ebp - 0x24], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c70f2
sub ecx, edx
lea eax, [ebp - 0x244]
push ebx
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.1001a600
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x14]
jbe 0x100c7122
xor bl, bl
jmp 0x100c7136
lea ecx, [ebp - 0x3c]
push ecx
push eax
push 0
lea ecx, [ebp - 0x24]
call fcn.1001e530
test eax, eax
sete bl
lea ecx, [ebp - 0x24]
call fcn.1001a5a0
lea ecx, [ebp - 0x3c]
call fcn.1001a5a0
mov ecx, dword [ebp - 0xc]
test bl, bl
pop ebx
setne al
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100c7220
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
lea eax, [esp]
push esi
push edi
push 0x2b4
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [esp + 0x2cc]
xor edi, edi
push esi
call sym.WMCommon.dll_public:_static_bool___cdecl_WM::GMFilePathUtils::IsDirectory_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 0x10
mov ecx, 0x10
test al, al
cmovne edi, ecx
xor eax, eax
cmp dword [esp + 0x2c4], 0x20
setl al
add eax, 0x110
cmp dword [esi + 0x14], 8
jb 0x100c726e
mov esi, dword [esi]
push eax
push 0x2b4
lea eax, [esp + 0x10]
push eax
push edi
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
pop edi
pop esi
test eax, eax
je 0x100c728e
mov eax, dword [esp]
test eax, eax
jne 0x100c7290
xor eax, eax
add esp, 0x2b4
ret
Function at 0x100c73a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024eafc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push 0x40
xor eax, eax
mov dword [ebp - 0x34], 0
push str.EK6K3S8yHuy_wOtV7hAOX_x6INzU1eEX4hb0E3BOt0udwIX5MZTzLD7qrj3h0o_A
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.1001a600
lea edx, [ebp - 0x44]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.100cb440
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.1001a5a0
push 0x10
push str.FeatureControl_
lea ecx, [ebp - 0x2c]
call fcn.1001a7c0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x100c7419
mov eax, dword [eax]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.1001a7c0
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x64]
push 1
cmovae eax, dword [ebp - 0x2c]
push 3
push eax
push reloc.WS2_32.dll_accept
call sym.WMCommon.dll_public:_bool___thiscall_WM::GMRegFile::OpenKey_struct_HKEY_____wchar_t_const___unsigned_long_int__bool_
xor bl, bl
test al, al
jne 0x100c746d
mov eax, dword [ebp - 0x4c]
jmp 0x100c750b
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100c747b
mov eax, dword [esi]
lea ecx, [ebp + 8]
mov dword [ebp - 0x14], 4
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], 4
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push ecx
push 0
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100c74bc
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x48], eax
jb 0x100c74b7
mov esi, dword [esi]
mov eax, dword [ebp + 0x10]
jmp 0x100c74cc
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x10], eax
je 0x100c74f0
cmp dword [esi + 0x14], 8
jb 0x100c74cc
mov esi, dword [esi]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
push 0
push esi
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100c74ee
xor bl, bl
mov dword [ebp - 0x48], eax
jmp 0x100c74f0
mov bl, 1
mov eax, dword [ebp - 0x4c]
pop esi
test eax, eax
je 0x100c7504
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 0
test eax, eax
je 0x100c751d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x48], 0
call fcn.1001a5a0
lea ecx, [ebp - 0x2c]
call fcn.1001a5a0
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100c7550
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push esi
mov esi, dword [ebp + 8]
push esi
call sym.WMCommon.dll_public:_static_bool___cdecl_WM::GMFilePathUtils::IsExistsFile_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 4
push esi
test al, al
je 0x100c7578
call sym.WMCommon.dll_public:_static_bool___cdecl_WM::GMShellUtils::Locate_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
call sym.WMCommon.dll_public:_static_bool___cdecl_WM::GMFilePathUtils::IsDirectory_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 4
test al, al
je 0x100c761f
cmp dword [esi + 0x14], 8
jb 0x100c7590
mov esi, dword [esi]
xorps xmm0, xmm0
mov dword [esp + 4], 0x3c
movlpd qword [esp + 8], xmm0
movlpd qword [esp + 0x10], xmm0
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [esp + 0xc], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 0x14], 0x10266aac
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x100c761f
cmp dword [esp + 0x24], 0x20
seta al
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100c77f0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x100c77fc
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push 0x10266aac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x100c78e0
Capabilities:
Acquire debug privileges
Check os version

Disassembly:
mov eax, dword [0x103213c4]
sub esp, 0x120
test eax, eax
jne 0x100c7922
push 0x118
push eax
lea eax, [esp + 0x10]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 4], 0x11c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100c7960
mov eax, dword [esp + 8]
mov dword [0x103213c4], eax
cmp eax, 5
jbe 0x100c7960
lea eax, [esp]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100c7944
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push str.SeDebugPrivilege
push dword [esp + 8]
call sym.WMCommon.dll_public:_static_int___cdecl_WM::GMShellUtils::SetPrivilege_void___wchar_t_const___int_
add esp, 0xc
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x12c]
push dword [esp + 0x12c]
push dword [esp + 0x12c]
call dword [sym.imp.KERNEL32.dll_OpenProcess]
add esp, 0x120
ret

Function at 0x100c7990
Capabilities:
Compare security identifiers

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_EqualSid]
push esi
push edi
push ebx
push dword [esp + 0x18]
call ebp
test eax, eax
jne 0x100c79cc
mov edi, dword [esp + 0x18]
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x100c79c5
push ebx
push dword [esi]
call ebp
test eax, eax
jne 0x100c79cc
add esi, 4
cmp esi, dword [edi + 4]
jne 0x100c79b4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x24]
mov dl, 1
sub eax, 0
je 0x100c7a0b
sub eax, 1
jne 0x100c7a34
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
cmp eax, ecx
je 0x100c7a34
mov esi, dword [esp + 0x20]
nop dword [eax]
test dword [eax], esi
je 0x100c7a02
add eax, 4
cmp eax, ecx
jne 0x100c79f0
pop edi
pop esi
pop ebp
mov al, dl
pop ebx
ret
pop edi
pop esi
xor dl, dl
pop ebp
mov al, dl
pop ebx
ret
mov ecx, dword [esp + 0x28]
xor dl, dl
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
cmp eax, ecx
je 0x100c7a34
mov esi, dword [esp + 0x20]
nop
test dword [eax], esi
jne 0x100c7a32
add eax, 4
cmp eax, ecx
jne 0x100c7a20
pop edi
pop esi
pop ebp
mov al, dl
pop ebx
ret
mov dl, 1
pop edi
pop esi
pop ebp
mov al, dl
pop ebx
ret
Function at 0x100c7a40
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024eb30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
call fcn.1001a380
cmp dword [ebp - 0x3c], 8
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
push ecx
push 1
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
push 0
push eax
push 0
call dword [sym.imp.NETAPI32.dll_NetUserGetLocalGroups]
lea ecx, [ebp - 0x50]
mov esi, eax
call fcn.1001a5a0
test esi, esi
jne 0x100c7be8
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x100c7be8
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
jbe 0x100c7bdd
push ebx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x100c7bd8
mov edx, dword [esi]
xor eax, eax
mov word [ebp - 0x50], ax
mov eax, edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
lea ebx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100c7b00
sub eax, ebx
lea ecx, [ebp - 0x50]
sar eax, 1
push eax
push edx
call fcn.1001a600
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x68]
call fcn.1001a380
mov byte [ebp - 4], 1
lea edx, [ebp - 0x68]
cmp dword [ebp - 0x54], 8
mov dword [ebp - 0x28], 0
cmovae edx, dword [ebp - 0x68]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c7b54
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x38]
call fcn.1001a600
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
call sym.WMCommon.dll_private:_static_bool___cdecl_WM::GMShellUtils::GetAccountNameSID_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___struct__SID___
add esp, 8
lea ecx, [ebp - 0x38]
mov bl, al
call fcn.1001a5a0
lea ecx, [ebp - 0x68]
call fcn.1001a5a0
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.1001a5a0
test bl, bl
je 0x100c7bc5
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x100c7bc5
mov eax, dword [edi + 4]
cmp dword [edi + 8], eax
je 0x100c7bb9
mov dword [eax], ecx
add dword [edi + 4], 4
jmp 0x100c7bc5
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, edi
call fcn.10020f70
mov eax, dword [ebp - 0x1c]
add esi, 4
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x14]
jb 0x100c7ad5
mov esi, dword [ebp - 0x18]
pop edi
pop ebx
test esi, esi
je 0x100c7be8
push esi
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100c7c00
Capabilities:
Get user security identifier

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor bl, bl
mov dword [esp + 0xc], 0
mov eax, edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 1
cmp dword [edi + 0x14], 8
jb 0x100c7c2e
mov eax, dword [edi]
push esi
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
push ecx
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push dword [esp + 0x14]
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call esi
mov ecx, dword [esp + 0x14]
mov ebp, eax
add ecx, ecx
push ecx
call esi
add esp, 8
mov esi, eax
mov dword [esp + 0x20], esi
test ebp, ebp
je 0x100c7cd2
test esi, esi
je 0x100c7ce0
cmp dword [edi + 0x14], 8
jb 0x100c7c7b
mov edi, dword [edi]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x20]
push eax
push ebp
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x100c7cd2
push ebp
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, eax
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0x24]
push ebp
push eax
push esi
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov esi, dword [esp + 0x20]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
test esi, esi
je 0x100c7ce0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop esi
test ebp, ebp
je 0x100c7cef
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret
Function at 0x100c86f0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024eba9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100c8737
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
push edi
lea eax, [ebp - 0x14]
xor edi, edi
push eax
push 4
push dword [ebp + 8]
push 0x12
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x100c8845
xor esi, esi
push ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x30]
push 0xc
xor eax, eax
mov dword [ebp - 0x20], esi
push 0x10267598
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.1001a600
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x100c8799
xor bl, bl
jmp 0x100c87a0
mov esi, eax
mov bl, 1
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x30]
call fcn.1001a5a0
test bl, bl
pop ebx
je 0x100c8860
test esi, esi
je 0x100c8860
push str.CreateWellKnownSid
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c8860
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x44
push ecx
lea ecx, [ebp - 0x74]
push ecx
push 0
push 0x1a
call eax
mov eax, dword [ebp + 8]
add esp, 0x10
cmp dword [eax], 3
jne 0x100c882e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 0
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp + 0xc]
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x18]
test eax, eax
mov ecx, 1
cmovne edi, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100c883e
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ecx, dword [ebp + 0xc]
mov edi, 1
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100c8874
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100c8950
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024ebcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
xor eax, eax
mov dword [ebp - 0x54], 0
push esi
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2c]
push 0x40
push str.EK6K3S8yHuy_wOtV7hAOX_x6INzU1eEX4hb0E3BOt0udwIX5MZTzLD7qrj3h0o_A
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.1001a600
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.100cb440
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.1001a5a0
push 0x29
push str.FeatureControlFEATURE_BROWSER_EMULATION
lea ecx, [ebp - 0x44]
call fcn.1001a7c0
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
push 1
cmovae eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x64]
push 3
push eax
push reloc.WS2_32.dll_accept
call sym.WMCommon.dll_public:_bool___thiscall_WM::GMRegFile::OpenKey_struct_HKEY_____wchar_t_const___unsigned_long_int__bool_
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100c89fa
mov eax, dword [esi]
lea ecx, [ebp + 8]
mov dword [ebp - 0x14], 4
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], 4
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push ecx
push 0
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100c8a59
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x48], eax
jb 0x100c8a36
mov esi, dword [esi]
mov eax, dword [ebp + 0xc]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
push 0
push esi
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100c8a8b
mov dword [ebp - 0x48], eax
jmp 0x100c8a8b
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x10], eax
je 0x100c8a8b
cmp dword [esi + 0x14], 8
jb 0x100c8a69
mov esi, dword [esi]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
push 0
push esi
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x48]
test eax, eax
cmovne ecx, eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x4c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x100c8aa2
push eax
call esi
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x48], 0
call fcn.1001a5a0
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x100c8ac2
push eax
call esi
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x48], 0
call fcn.1001a5a0
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100c8ae0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
xor bl, bl
push 0
push 1
call sym.WMCommon.dll_public:_static_void____cdecl_WM::GMShellUtils::MyOpenProcess_unsigned_long_int__int__unsigned_long_int_
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100c8b17
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
movzx ebx, bl
mov ecx, 1
push esi
cmovne ebx, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
ret
Function at 0x100c8b20
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1024ebe5
push eax
mov dword fs:[0], esp
sub esp, 0x278
push ebx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100c8b89
push 0x228
lea eax, [ebp - 0x280]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x284], 0x22c
lea eax, [ebp - 0x284]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x100c8b9a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [ebp + 8]
mov byte [ebp - 0xd], 1
xor eax, eax
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
lea eax, [ebp - 0x260]
mov dword [ebp - 0x44], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100c8bc0
sub eax, edx
lea ecx, [ebp - 0x58]
sar eax, 1
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.1001a600
mov dword [ebp - 4], 0
mov edx, edi
cmp dword [edi + 0x14], 8
jb 0x100c8bf0
mov edx, dword [edi]
mov ecx, edx
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c8c10
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.1001a600
mov byte [ebp - 4], 1
lea edx, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
mov dword [ebp - 0x18], 0
cmovae edx, dword [ebp - 0x58]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100c8c51
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.1001a600
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x40]
cmp edx, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovb edx, dword [ebp - 0x30]
cmp dword [ebp - 0x2c], 8
push edx
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call sym.WMCommon.dll_public:_static_int___cdecl_WM::GMStringUtils::CompareNoCase_wchar_t_const___wchar_t_const___unsigned_int_
add esp, 0xc
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.1001a5a0
lea ecx, [ebp - 0x40]
call fcn.1001a5a0
test esi, esi
jne 0x100c8cd9
push dword [ebp - 0x27c]
push esi
push 1
call sym.WMCommon.dll_public:_static_void____cdecl_WM::GMShellUtils::MyOpenProcess_unsigned_long_int__int__unsigned_long_int_
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100c8cd9
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
neg eax
push esi
sbb al, al
and byte [ebp - 0xd], al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0xffffffff
call fcn.1001a5a0
lea eax, [ebp - 0x284]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100c8ba3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret