joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a9ff
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x181cd008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov esi, ecx
push dword [ebx + 4]
push dword [ebx]
call fcn.1800a151
mov eax, dword [ebx]
mov edx, esi
push ecx
push ecx
lea ecx, [ebp - 0x260]
mov dword [ebx + 4], eax
call fcn.1800cb97
push 0x250
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.18147be0
push edi
lea edx, [ebp - 0x260]
lea ecx, [ebp - 0x268]
call fcn.18006c3e
add esp, 0x18
lea ecx, [ebp - 0x25c]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x268]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.180046a5
cmp esi, 0xffffffff
jne 0x1800aa8f
call fcn.18013db1
mov edi, eax
jmp 0x1800aafc
cmp dword [ebp - 0x25c], 0x80
je 0x1800aaa4
test byte [ebp - 0x25c], 0x10
jne 0x1800aad9
lea eax, [ebp - 0x230]
push eax
lea edx, [ebp - 0x260]
lea ecx, [ebp - 0x264]
call fcn.18006c3e
pop ecx
lea eax, [ebp - 0x264]
mov ecx, ebx
push eax
call fcn.18009e88
mov ecx, dword [ebp - 0x264]
lea ecx, [ecx - 0x10]
call fcn.180046a5
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800aa8f
call fcn.18013db1
mov edi, eax
cmp edi, 0x80070012
jne 0x1800aafc
xor edi, edi
cmp esi, 0xffffffff
je 0x1800ab08
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x260]
add ecx, 0xfffffff0
call fcn.180046a5
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.181450cb
leave
ret

Function at 0x1800b069
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push 0
push eax
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800b093
call fcn.18013db1
jmp 0x1800b0ae
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
test ecx, ecx
je 0x1800b09f
mov dword [ecx], eax
add dword [esi + 0xc], eax
sub eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
leave
ret 0xc
Function at 0x1800b5e2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x181cd008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x802
lea eax, [ebp - 0x808]
mov edi, edx
push 0
push eax
mov ebx, ecx
call fcn.18147be0
mov esi, dword [0x181d4c8c]
lea ecx, [ebp - 0x80c]
xor edx, edx
call fcn.1800e740
push edi
push str.baselogging.cc
push 0
push esi
push dword [ebp - 0x80c]
lea eax, [ebp - 0x808]
push ebx
push str.Exception__x_in__s__s__u_r_n_r_n_hs:_d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x80c]
add esp, 0x2c
lea ecx, [ecx - 0x10]
call fcn.180046a5
lea ecx, [ebp - 0x808]
call fcn.18013def
push 0x250012
push str.Exception
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebx
sub eax, 3
je 0x1800b696
sub eax, 1
jne 0x1800b687
int3
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.181450cb
leave
ret
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1800cd20
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
jle 0x1800ce3c
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
cmp edi, 2
jle 0x1800cd9f
sub edx, 4
js 0x1800ce3c
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, dword [ebp + 0x10]
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [ebx + 2]
movzx ecx, byte [ebx + 1]
shr eax, 6
and ecx, 0xf
add eax, dword [ebp + 0x10]
mov al, byte [eax + ecx*4]
mov ecx, dword [ebp + 0x10]
mov byte [esi + 2], al
movzx eax, byte [ebx + 2]
add ebx, 3
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 3], al
add esi, 4
sub edi, 3
jmp 0x1800cd3b
sub edi, 1
je 0x1800cdff
sub edi, 1
jne 0x1800ce35
sub edx, 3
js 0x1800ce3c
movzx eax, byte [ebx]
mov edi, dword [ebp + 0x10]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, edi
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [ebx + 1]
and eax, 0xf
mov al, byte [edi + eax*4]
mov byte [esi + 2], al
add esi, 3
cmp byte [ebp + 0x14], 0
je 0x1800ce35
lea eax, [edx - 1]
test eax, eax
js 0x1800ce3c
mov byte [esi], 0x3d
inc esi
jmp 0x1800ce35
sub edx, 2
js 0x1800ce3c
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx eax, byte [ebx]
and eax, 3
add eax, eax
mov al, byte [ecx + eax*8]
mov byte [esi + 1], al
add esi, 2
cmp byte [ebp + 0x14], 0
je 0x1800ce35
lea eax, [edx - 2]
test eax, eax
js 0x1800ce3c
mov word [esi], 0x3d3d
add esi, 2
sub esi, dword [ebp + 8]
mov eax, esi
jmp 0x1800ce3e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1800e5d5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x181cd008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov ecx, esi
call fcn.18006e7e
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.18147be0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
jns 0x1800e66f
movzx ecx, bl
cmp ecx, 0x26
jne 0x1800e633
mov edx, str.ProgramFiles
jmp 0x1800e63d
cmp ecx, 0x1c
jne 0x1800e65e
mov edx, str.LocalAppData
lea ecx, [ebp - 0x210]
call fcn.18005248
push eax
mov ecx, esi
call fcn.18006d7c
mov ecx, dword [ebp - 0x210]
lea ecx, [ecx - 0x10]
call fcn.180046a5
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x1800e66b
xor eax, eax
inc eax
jmp 0x1800e68d
mov eax, edi
jmp 0x1800e68d
lea eax, [ebp - 0x20c]
push eax
call fcn.1814bb43
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.1800708f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.181450cb
leave
ret

Function at 0x1800ec96
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea esi, [ecx + 4]
push esi
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
jne 0x1800ecd7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
jne 0x1800ecd7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jb 0x1800ecb2
xor al, al
jmp 0x1800ecd9
mov al, 1
pop esi
leave
ret 4
Function at 0x1800ed32
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x181cd008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x25c], ebx
push dword [ebx + 4]
mov esi, ecx
push dword [ebx]
call fcn.1800a151
mov eax, dword [ebx]
mov dword [ebx + 4], eax
mov ecx, dword [esi]
call fcn.180050f2
test al, al
jne 0x1800ed79
mov eax, 0x80070003
jmp 0x1800ee32
push edi
mov edx, esi
lea ecx, [ebp - 0x260]
call fcn.1800ee41
mov dword [esp], 0x250
lea eax, [ebp - 0x258]
xor ebx, ebx
push ebx
push eax
call fcn.18147be0
mov edi, dword [ebp - 0x260]
lea eax, [ebp - 0x258]
add esp, 0xc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1800edc4
call fcn.18013db1
mov ebx, eax
jmp 0x1800ee28
mov edi, dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
push eax
call fcn.18007a54
pop ecx
test al, al
je 0x1800ee09
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x25c]
call fcn.18006dd4
lea eax, [ebp - 0x25c]
mov ecx, edi
push eax
call fcn.18009e88
mov ecx, dword [ebp - 0x25c]
lea ecx, [ecx - 0x10]
call fcn.180046a5
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800edca
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 0x260]
lea ecx, [edi - 0x10]
call fcn.180046a5
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.181450cb
leave
ret

Function at 0x1800f84b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x181cd008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x234], ecx
push edi
push 2
mov dword [ebx], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x1800f8e7
push 0x22c
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.18147be0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800f8e7
mov ecx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x228]
cmp eax, dword [ecx + 0x1c]
jne 0x1800f8ca
mov eax, dword [ebp - 0x218]
test eax, eax
jne 0x1800f8e3
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800f8af
mov edi, 0x80004005
jmp 0x1800f8ee
mov dword [ebx], eax
jmp 0x1800f8ee
call fcn.18013db1
mov edi, eax
cmp esi, 0xffffffff
je 0x1800f8fa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.181450cb
leave
ret 4
Function at 0x1800fdfc
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1220
call fcn.1816c7a0
mov eax, dword [0x181cd008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
xor ebx, ebx
mov edi, edx
push ebx
push 0x410
mov dword [ebp - 0x1210], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1800ff8c
push 0x5c
pop edx
mov ecx, edi
call fcn.1800d564
mov edi, eax
cmp edi, 0xffffffff
setne byte [ebp - 0x1220]
call fcn.18004041
push eax
lea ecx, [ebp - 0x1218]
call fcn.1800710c
cmp edi, 0xffffffff
je 0x1800fe8a
mov ecx, dword [ebp - 0x1210]
lea edx, [ebp - 0x1218]
call fcn.1800ff9d
test eax, eax
js 0x1800ff77
mov edi, dword [ebp - 0x1218]
mov dword [ebp - 0x1210], edi
jmp 0x1800fe90
mov edi, dword [ebp - 0x1210]
push 0x1000
lea eax, [ebp - 0x120c]
push ebx
push eax
call fcn.18147be0
add esp, 0xc
mov dword [ebp - 0x121c], ebx
lea eax, [ebp - 0x121c]
push eax
push 4
lea eax, [ebp - 0x120c]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x1800fef2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1801042b
test al, al
je 0x1800ff77
push dword [ebp - 0x1220]
mov edx, edi
mov ecx, esi
call fcn.1800fd55
pop ecx
mov bl, al
jmp 0x1800ff77
mov edi, dword [ebp - 0x121c]
shr edi, 2
cmp edi, 1
jbe 0x1800ff03
xor edi, edi
inc edi
mov dword [ebp - 0x1214], ebx
test edi, edi
je 0x1800ff77
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.18147be0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
mov eax, dword [ebp - 0x1214]
push dword [ebp + eax*4 - 0x120c]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x1800ff62
push dword [ebp - 0x1220]
mov edx, dword [ebp - 0x1210]
lea ecx, [ebp - 0x20c]
call fcn.1800fcbe
pop ecx
test al, al
jne 0x1800ff75
mov eax, dword [ebp - 0x1214]
inc eax
mov dword [ebp - 0x1214], eax
cmp eax, edi
jl 0x1800ff0d
jmp 0x1800ff77
mov bl, 1
mov ecx, dword [ebp - 0x1218]
add ecx, 0xfffffff0
call fcn.180046a5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.181450cb
leave
ret
Function at 0x180105a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
lea ecx, [ebp - 0x24]
mov ebx, edx
call fcn.180082db
push 0x40
xor esi, esi
mov dword [ebp - 0x6c], 0x44
lea eax, [ebp - 0x68]
push esi
push eax
call fcn.18147be0
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x6c]
add esp, 0xc
mov dword [ebp - 0x40], 0x80
push edi
push eax
push esi
cmp dword [ebp + 8], esi
jne 0x180105e8
push esi
push esi
jmp 0x180105f0
push dword [ebp + 8]
push 0x400
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x18010608
call fcn.18013db1
mov esi, eax
jmp 0x18010648
movzx ecx, byte [0x181d59e6]
neg ecx
sbb ecx, ecx
and ecx, 0x181d4bb0
je 0x18010648
push 7
pop edx
xor eax, eax
mov dword [ebp - 0x14], ecx
inc eax
mov dword [ebp - 0x10], edx
push eax
push edx
mov dword [ebp - 0xc], eax
call fcn.18005de9
push dword [edi + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push str._Started_process___u_
push eax
call fcn.180041e3
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.18008335
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x18010762
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 0x14]
call fcn.180082db
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.18007189
add eax, 0x10
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.1800f04e
push 0x20
lea ecx, [ebp - 4]
call fcn.18006eb3
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.18006ee0
push 0x40
xor ebx, ebx
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.18147be0
mov esi, dword [ebp - 4]
xor ecx, ecx
mov dword [ebp - 0x58], str.WinSta0Default
inc ecx
mov edx, 0x104
add esp, 0xc
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or ecx, eax
jge 0x180107ec
push edx
lea ecx, [ebp - 4]
call fcn.180071e2
mov esi, dword [ebp - 4]
push dword [ebp + 0x14]
lea eax, [ebp - 0x60]
push eax
push ebx
push dword [ebp + 0x10]
push 0x400
push ebx
push ebx
push ebx
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
mov edi, eax
call fcn.18006e2f
test edi, edi
jne 0x1801081f
call fcn.18013db1
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.180046a5
lea ecx, [ebp - 0x14]
call fcn.18008335
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x180109aa
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x181cd008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x18]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18010a20
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], esi
push eax
push str.SeDebugPrivilege
push esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x18010a20
mov eax, dword [ebp - 0x20]
push esi
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x18010a27
call fcn.18013db1
mov esi, eax
cmp dword [ebp - 0x18], 0
je 0x18010a36
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.181450cb
leave
ret

Function at 0x18010abd
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
call fcn.18010a45
mov ebx, eax
or edi, 0xffffffff
xor ecx, ecx
cmp ebx, edi
je 0x18010b14
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ecx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ecx
push eax
push 8
push ebx
push ecx
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x18010b08
mov eax, dword [ebp - 8]
push esi
push eax
mov esi, dword [eax]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test esi, esi
pop esi
sete al
xor ecx, ecx
jmp 0x18010b0c
xor ecx, ecx
mov al, cl
test al, al
je 0x18010b14
mov eax, ebx
jmp 0x18010b5c
lea eax, [ebp - 4]
mov dword [ebp - 0xc], ecx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 4], ecx
push eax
push 1
push ecx
push ecx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
je 0x18010b5a
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp dword [ebp - 4], eax
jbe 0x18010b53
lea edx, [ecx + 8]
cmp dword [edx], 0
je 0x18010b4d
inc eax
add edx, 0xc
cmp eax, dword [ebp - 4]
jb 0x18010b3d
jmp 0x18010b53
imul eax, eax, 0xc
mov edi, dword [eax + ecx]
push ecx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x18010b60
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x181cd008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xe8], 0x181a7f74
mov edi, ecx
mov dword [ebp - 0xcc], esi
push ecx
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd0], esi
mov ebx, edx
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xdc], esi
call fcn.18010570
test al, al
jne 0x18010bbe
mov esi, 0x80004005
jmp 0x18010d48
lea ecx, [ebp - 0xc8]
call fcn.18007544
push ecx
push ecx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xe8]
call fcn.1800a4a2
test al, al
jne 0x18010beb
mov esi, 0x80004005
jmp 0x18010d3d
lea ecx, [ebp - 0x114]
mov dword [ebp - 0xd8], 0x181a7bdc
mov dword [ebp - 0xd4], esi
call fcn.18004b0a
push 0x12
push 1
lea eax, [ebp - 0x68]
push 0x181a71f8
push eax
call fcn.18004751
add esp, 0x10
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x114]
push esi
push 0xc0100000
push eax
call fcn.18004b87
lea ecx, [ebp - 0x68]
call fcn.1800483a
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x68]
push 0x181a71f8
push eax
call fcn.18004751
add esp, 0x14
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x114]
push esi
push 0xc0100000
push eax
call fcn.18004b87
lea ecx, [ebp - 0x68]
call fcn.1800483a
push esi
push 0xc0100000
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x114]
call fcn.18004b87
push ecx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0xd8]
call fcn.18007c0f
lea ecx, [ebp - 0xd8]
call fcn.18007cf0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xf0], eax
lea eax, [ebp - 0xf4]
push esi
push eax
lea eax, [ebp - 0xd0]
mov dword [ebp - 0xf4], 0xc
push eax
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xec], 1
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x18010d16
push esi
push 1
push dword [ebp - 0xcc]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x18010d16
mov eax, dword [ebp - 0xcc]
mov dword [edi], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xd0], esi
mov dword [ebx], eax
jmp 0x18010d1d
call fcn.18013db1
mov esi, eax
lea ecx, [ebp - 0x114]
call fcn.18004b50
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0xd8], 0x181a7bdc
call fcn.18004f1f
lea ecx, [ebp - 0xc8]
call fcn.1800483a
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xe8], 0x181a7f74
call fcn.18007f68
cmp dword [ebp - 0xd0], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x18010d74
push dword [ebp - 0xd0]
call edi
cmp dword [ebp - 0xcc], 0
je 0x18010d85
push dword [ebp - 0xcc]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.181450cb
leave
ret
Function at 0x18011572
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x181cd008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x124]
push pe_nt_image_headers32
push ebx
mov dword [ebp - 0x12c], ebx
push eax
mov dword [ebp - 0x128], 0x11c
call fcn.18147be0
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je case.0x180116d4.2
mov edi, dword [ebp - 0x124]
xor esi, esi
inc esi
cmp edi, 6
je 0x18011665
cmp edi, 0xa
je 0x18011665
cmp edi, 5
jne case.0x180116d4.2
cmp dword [ebp - 0x120], 2
jne 0x1801164f
cmp byte [ebp - 0xe], 1
jne 0x18011615
lea ecx, [ebp - 0x130]
call fcn.180112d8
push 0x181a8a60
mov ecx, eax
mov dword [ebp - 0x12c], esi
call fcn.1800c2d8
test eax, eax
jne 0x18011615
mov bl, 1
inc eax
jmp 0x1801161b
mov eax, dword [ebp - 0x12c]
test al, 1
je 0x1801162d
mov ecx, dword [ebp - 0x130]
lea ecx, [ecx - 0x10]
call fcn.180046a5
test bl, bl
jne case.0x180116d4.1
test dword [ebp - 0x10], 0x8000
je case.0x180116d4.7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.181450cb
leave
ret
cmp dword [ebp - 0x120], esi
jne case.0x180116d4.2
test dword [ebp - 0x10], 0x200
jne case.0x180116d4.2
xor eax, eax
inc eax
jmp 0x18011640
mov eax, dword [ebp - 0x120]
mov ecx, str.kernel32.dll
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x130], eax
call fcn.18009d69
mov esi, eax
test esi, esi
je case.0x180116d4.2
push str.GetProductInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x180116ab
lea ecx, [ebp - 0x12c]
push ecx
push ebx
push ebx
push dword [ebp - 0x130]
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je case.0x180116d4.2
mov eax, dword [ebp - 0x12c]
cmp eax, 0x1b
ja 0x180116e3
je case.0x180116d4.4
dec eax
cmp eax, 0x18
ja case.0x180116d4.2
movzx eax, byte [eax + 0x18011746]
jmp dword [eax*4 + 0x18011736]
push 2
pop eax
jmp 0x18011640
cmp eax, 0x54
ja 0x18011703
je case.0x180116d4.4
sub eax, 0x30
je case.0x180116d4.1
sub eax, 0x16
je case.0x180116d4.4
dec eax
sub eax, 1
je case.0x180116d4.4
jmp case.0x180116d4.2
cmp eax, 0x79
jb case.0x180116d4.2
cmp eax, 0x7a
jbe 0x18011731
cmp eax, 0x7c
jbe case.0x180116d4.2
cmp eax, 0x7e
jbe case.0x180116d4.4
add eax, 0xffffff7f
cmp eax, 1
ja case.0x180116d4.2
push 3
jmp 0x180116dd
push 4
jmp 0x180116dd
Function at 0x18012467
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
mov esi, ecx
push eax
call fcn.180130a0
cmp byte [ebp - 8], 0
je 0x18012487
mov eax, dword [ebp - 0xc]
jmp 0x180124b0
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jle 0x1801249f
movzx eax, ax
or eax, 0x80070000
cmp eax, 0x80070002
je 0x180124ad
cmp eax, 0x80070003
jne 0x180124b0
xor eax, eax
inc eax
pop esi
leave
ret 4

Function at 0x18012727
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edx
mov edi, 0x80070003
call fcn.18006dd4
lea ecx, [ebp - 8]
call fcn.18013238
mov esi, dword [ebp - 8]
test eax, eax
je 0x18012846
and dword [ebp - 0x10], 0
or edx, 0xf003f
push 0
push ecx
push edx
push ecx
push ecx
push esi
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x181a7ff8
mov dword [ebp - 0xc], 0x200
call fcn.18012511
mov edi, eax
test edi, edi
jne 0x18012837
mov eax, dword [ebp + 8]
sub eax, 1
je 0x18012819
sub eax, 1
je 0x18012815
sub eax, 1
je 0x180127e9
sub eax, 1
je 0x180127da
sub eax, 3
je 0x180127c7
sub eax, 4
je 0x180127b5
mov edi, 0x8007065d
jmp 0x18012829
push dword [ebx + 4]
lea ecx, [ebp - 0x14]
push dword [ebx]
push dword [ebp - 4]
call fcn.18012ca5
jmp 0x18012827
push 7
push dword [ebp + 0x10]
lea ecx, [ebp - 0x14]
push ebx
push dword [ebp - 4]
call fcn.18012d0a
jmp 0x18012827
push dword [ebx]
lea ecx, [ebp - 0x14]
push dword [ebp - 4]
call fcn.18012c7c
jmp 0x18012827
mov eax, ebx
neg eax
sbb eax, eax
and eax, dword [ebp + 0x10]
push eax
push ebx
push 3
push 0
push dword [ebp - 4]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jle 0x18012829
movzx edi, di
or edi, 0x80070000
jmp 0x18012829
push 2
jmp 0x1801281b
push 1
push ebx
push dword [ebp - 4]
lea ecx, [ebp - 0x14]
call fcn.18012cce
mov edi, eax
lea ecx, [ebp - 0x14]
call fcn.180124e5
test edi, edi
jne 0x18012837
mov edi, eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x181a7ff8
call fcn.180124e5
lea ecx, [esi - 0x10]
call fcn.180046a5
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret