joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10297ac
Capabilities:
Query service status
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10ed030]
mov esi, 0x10ed030
mov ebx, 0x10029d4
cmp eax, esi
je 0x10297ed
test byte [eax + 0x1c], 1
je 0x10297ed
cmp byte [eax + 0x19], 5
jb 0x10297ed
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push 0x3a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01082845
and dword [ebp - 0x28], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x102985b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10298f9
test byte [eax + 0x1c], 2
je 0x10298cc
cmp byte [eax + 0x19], 2
jb 0x10298cc
push edi
push ebx
push 0x3b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
jmp 0x10298c7
cmp dword [ebp - 0x24], 1
jne 0x102988a
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10298f9
test byte [eax + 0x1c], 2
je 0x10298cc
cmp byte [eax + 0x19], 5
jb 0x10298cc
push ebx
push 0x3c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
jmp 0x10298c7
cmp dword [ebp - 0x24], 3
jne 0x1029902
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10298b3
test byte [eax + 0x1c], 2
je 0x10298b3
cmp byte [eax + 0x19], 5
jb 0x10298b3
push ebx
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
push dword [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.010295bd
mov edi, eax
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10298f9
test byte [eax + 0x1c], 1
je 0x10298f9
movzx ecx, byte [eax + 0x19]
mov edx, edi
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x10298f9
push edi
push ebx
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x1029925
test byte [eax + 0x1c], 2
je 0x1029925
cmp byte [eax + 0x19], 5
jb 0x1029925
push ebx
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
lea eax, [ebp - 0x28]
push eax
push 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10298b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10298c5
Function at 0x102a9a2
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10ed030]
mov esi, 0x10ed030
mov edi, 0x10029d4
cmp eax, esi
je 0x102a9ea
test byte [eax + 0x1c], 1
je 0x102a9ea
cmp byte [eax + 0x19], 5
jb 0x102a9ea
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294de
mov eax, dword [0x10ed030]
and dword [ebp - 4], 0
cmp eax, esi
je 0x102aa34
test byte [eax + 0x1c], 2
je 0x102aa11
cmp byte [eax + 0x19], 5
jb 0x102aa11
push edi
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102aa34
test byte [eax + 0x1c], 2
je 0x102aa34
cmp byte [eax + 0x19], 5
jb 0x102aa34
push 0x1f4
push edi
push 0x2d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102aa62
test byte [eax + 0x1c], 2
je 0x102aa62
cmp byte [eax + 0x19], 5
jb 0x102aa62
push edi
push 0x2e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
je 0x102aaa9
mov dword [ebp - 8], 1
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102aaa0
test byte [eax + 0x1c], 2
je 0x102aaa0
cmp byte [eax + 0x19], 5
jb 0x102aaa0
push edi
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x102aad0
and dword [ebp - 8], 0
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102aad0
test byte [eax + 0x1c], 2
je 0x102aad0
cmp byte [eax + 0x19], 5
jb 0x102aad0
push edi
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0x14]
ja 0x102aaec
cmp dword [ebp - 8], 0
jne 0x102aa0c
jmp 0x102ab24
mov dword [ebp - 4], 0x5b4
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102ab59
test byte [eax + 0x1c], 2
je 0x102ab29
cmp byte [eax + 0x19], 2
jb 0x102ab29
push dword [ebp + 0x14]
call ebx
push eax
push dword [ebp + 0x10]
mov eax, dword [0x10ed030]
push edi
push 0x31
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01082845
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102ab59
test byte [eax + 0x1c], 1
je 0x102ab59
mov edx, dword [ebp - 4]
movzx ecx, byte [eax + 0x19]
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x102ab59
push dword [ebp - 4]
push edi
push 0x32
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.01028079
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x102db0f
Capabilities:
Get session information
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10ed030]
mov edi, 0x10ed030
cmp eax, edi
je 0x102db43
test byte [eax + 0x1c], 1
je 0x102db43
push 0x1002b50
push 0x13e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
lea ecx, [ebp - 8]
push ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
inc eax
xor esi, esi
push eax
push esi
push esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
mov ebx, eax
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x102db99
test byte [eax + 0x1c], 2
je 0x102db99
cmp byte [eax + 0x19], 5
jb 0x102db99
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push 0x1002b50
push 0x13f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01082845
mov eax, dword [0x10ed030]
cmp ebx, esi
je 0x102dc7c
cmp dword [ebp - 8], esi
je 0x102dc69
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xc], esi
xor ebx, ebx
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
jae 0x102dc5f
mov eax, dword [ebp - 4]
add eax, ebx
mov ecx, dword [eax + 8]
cmp ecx, esi
je 0x102dbd7
cmp ecx, 2
jle 0x102dc50
cmp ecx, 4
jg 0x102dc50
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 5
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
push dword [eax]
push esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov dword [ebp - 0x1c], eax
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x102dc2b
test byte [eax + 0x1c], 2
je 0x102dc2b
cmp byte [eax + 0x19], 5
jb 0x102dc2b
push dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
push dword [ebp - 0x1c]
push dword [ebx + ecx]
push dword [ebp - 0xc]
push 0x1002b50
push 0x140
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010a6d63
cmp dword [ebp - 0x1c], esi
je 0x102dc49
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x102dc49
xor ecx, ecx
cmp cx, word [eax]
je 0x102dc41
inc dword [ebp - 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x102dc50
mov dword [ebp - 0x20], 1
inc dword [ebp - 0xc]
add ebx, 0xc
cmp dword [ebp - 0x10], esi
je 0x102dbb5
cmp dword [ebp - 0x20], esi
jne 0x102dc6c
cmp dword [ebp - 0x10], esi
jne 0x102dc6c
mov dword [ebp - 0x14], esi
push dword [ebp - 4]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [0x10ed030]
mov dword [ebp - 4], esi
cmp eax, edi
pop edi
pop esi
pop ebx
je 0x102dca7
test byte [eax + 0x1c], 1
je 0x102dca7
cmp byte [eax + 0x19], 5
jb 0x102dca7
push dword [ebp - 0x14]
push 0x1002b50
push 0x141
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov eax, dword [ebp - 0x14]
leave
ret
Function at 0x102e48f
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10ed030]
mov edi, dword [ebp + 0x18]
mov esi, 0x1002b50
cmp eax, 0x10ed030
je 0x102e4de
test byte [eax + 0x1c], 1
je 0x102e4de
cmp byte [eax + 0x19], 5
jb 0x102e4de
push dword [ebp + 0x1c]
push dword [edi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102cde2
mov eax, dword [0x10ed030]
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
cmp ecx, 0xffffffff
je 0x102e50f
cmp ecx, ebx
je 0x102e50f
mov ecx, dword [ebp + 0x10]
cmp ecx, ebx
je 0x102e50f
xor edx, edx
cmp dx, word [ecx]
jne 0x102e550
mov ecx, 0x80070057
mov dword [ebp + 0x18], ecx
cmp eax, 0x10ed030
je 0x102e65d
test byte [eax + 0x1c], 2
je 0x102e629
cmp byte [eax + 0x19], 2
jb 0x102e629
push dword [ebp + 0x1c]
push dword [edi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push esi
push 0x1d
jmp 0x102e619
mov eax, dword [ebp + 0x14]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x102e578
xor ecx, ecx
cmp cx, word [eax]
je 0x102e578
push 0x2011f
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.010292e8
mov ebx, eax
jmp 0x102e584
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0102e420
test ebx, ebx
jne 0x102e5b9
and dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
call fcn.0102c669
mov ebx, eax
test ebx, ebx
jne 0x102e5a5
mov eax, dword [ebp - 4]
mov dword [edi], eax
cmp dword [ebp + 0x1c], 1
jne 0x102e5b9
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
cmp ebx, 0x490
je 0x102e5c6
cmp ebx, 2
jne 0x102e5c8
xor ebx, ebx
test ebx, ebx
je 0x102e624
jle 0x102e5da
and ebx, 0xffff
or ebx, 0x80070000
mov dword [ebp + 0x18], ebx
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x102e65d
test byte [eax + 0x1c], 2
je 0x102e629
movzx ecx, byte [eax + 0x19]
xor edx, edx
cmp ebx, edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp ecx, edx
jl 0x102e629
push dword [ebp + 0x1c]
push dword [edi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push esi
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102cc64
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x102e65d
test byte [eax + 0x1c], 1
je 0x102e65d
movzx ecx, byte [eax + 0x19]
xor edx, edx
cmp dword [ebp + 0x18], edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp ecx, edx
jl 0x102e65d
push dword [ebp + 0x18]
push esi
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
lea ecx, [ebp - 0x1c]
call fcn.010292ca
lea ecx, [ebp - 0x10]
call fcn.010292ca
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x102f792
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push 0x1c
mov eax, 0x10da64a
call fcn.010a0c60
mov esi, ecx
mov eax, dword [0x10ed030]
mov ebx, 0x10ed030
cmp eax, ebx
je 0x102f7c6
test byte [eax + 0x1c], 1
je 0x102f7c6
push 0x1002b50
push 0x4f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
xor edi, edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
push 0x20119
push 0x10027a0
push 0x80000002
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], edi
call fcn.010292e8
test eax, eax
jne 0x102f846
lea eax, [ebp - 0x10]
push eax
push 0x1003054
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], edi
call fcn.0102c669
test eax, eax
jne 0x102f846
mov eax, dword [0x10ed030]
cmp eax, ebx
je 0x102f970
test byte [eax + 0x1c], 2
je 0x102f970
cmp byte [eax + 0x19], 5
jb 0x102f970
push 0x1002b50
push 0x50
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
jmp 0x102f970
push 1
lea eax, [esi + 0x1dc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0102eef8
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [esi + 0x200]
mov ecx, dword [0x10ed050]
sbb edx, dword [esi + 0x204]
xor edi, edi
cmp edx, edi
ja 0x102f88d
jb 0x102f87f
cmp eax, ecx
jae 0x102f88d
mov eax, dword [esi + 0x1fc]
mov dword [ebp - 0x14], eax
jmp 0x102f95d
lea edi, [esi + 0x1f8]
cmp dword [edi], 0
jne 0x102f8f2
push edi
push 0x1003044
push 1
push 0
push 0x1003034
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10ed030]
cmp ecx, ebx
je 0x102f8f2
test byte [ecx + 0x1c], 2
je 0x102f8f2
movzx eax, byte [ecx + 0x19]
xor edx, edx
cmp dword [ebp - 0x10], edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp eax, edx
jl 0x102f8ed
push dword [edi]
push dword [ebp - 0x10]
push 0x1002b50
push 0x51
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0102cb22
mov ebx, 0x10ed030
mov edi, dword [edi]
test edi, edi
je 0x102f95d
mov eax, dword [edi]
lea ecx, [ebp - 0x10]
push ecx
push 0x1003004
push edi
call dword [eax + 0x6c]
test eax, eax
jl 0x102f918
or eax, 0xffffffff
cmp ax, word [ebp - 0x10]
je 0x102f918
and dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [esi + 0x200], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x204], edx
mov dword [esi + 0x1fc], eax
mov eax, dword [0x10ed030]
cmp eax, ebx
je 0x102f95d
test byte [eax + 0x1c], 2
je 0x102f95d
cmp byte [eax + 0x19], 5
jb 0x102f95d
push dword [ebp - 0x14]
push 0x1002b50
push 0x52
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
cmp byte [ebp - 0x18], 0
mov byte [ebp - 4], 0
je 0x102f970
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0x204]
add esi, 0x58
push dword [esi + 0x1a8]
push esi
call fcn.0102a3a9
mov eax, dword [0x10ed030]
cmp eax, ebx
je 0x102f9af
test byte [eax + 0x1c], 1
je 0x102f9af
cmp byte [eax + 0x19], 5
jb 0x102f9af
push dword [ebp - 0x14]
push 0x1002b50
push 0x53
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
lea ecx, [ebp - 0x28]
call fcn.010292ca
mov eax, dword [ebp - 0x14]
call fcn.010a0d4c
ret
Function at 0x104d92e
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
jne 0x104d965
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x104d95a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x104d967
test al, 0x10
jne 0x104d965
mov eax, 0x10b
jmp 0x104d967
xor eax, eax
pop ebp
ret 4
Function at 0x104de1c
Capabilities:
Delete directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x254], ebx
call fcn.01056cb8
test eax, eax
je 0x104e00d
call fcn.01056c5d
test eax, eax
je 0x104e00d
cmp esi, ebx
je 0x104e008
cmp dword [ebp + 0xc], 0x104
jb 0x104e008
push edi
push esi
push ebx
push ebx
push 0x1c
xor eax, eax
push ebx
mov word [esi], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jl 0x104dfaa
push 0x1005108
push dword [ebp + 0xc]
push esi
call fcn.0104dd86
cmp eax, ebx
jl 0x104dfaa
push esi
call fcn.0104d92e
mov edi, eax
cmp edi, ebx
jne 0x104dff1
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x104debe
sub eax, edx
push 0x10050cc
push dword [ebp + 0xc]
sar eax, 1
lea eax, [esi + eax*2]
push esi
mov dword [ebp - 0x258], eax
call fcn.0104dd86
cmp eax, ebx
jl 0x104dfaa
push esi
mov edi, 0x124
push edi
lea eax, [ebp - 0x24c]
push eax
call fcn.0104dd4c
cmp eax, ebx
jl 0x104dfaa
push 0x10050b4
push edi
lea eax, [ebp - 0x24c]
push eax
call fcn.0104dd86
cmp eax, ebx
jl 0x104dfaa
push esi
call fcn.0104d92e
mov edi, eax
cmp edi, ebx
jne 0x104dfdb
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x104df35
sub eax, edx
sar eax, 1
lea eax, [esi + eax*2]
push esi
mov dword [ebp - 0x250], eax
call fcn.0104db9e
mov edi, eax
cmp edi, ebx
jne 0x104dfc5
push 0x10050a8
push dword [ebp + 0xc]
push esi
call fcn.0104dd86
cmp eax, ebx
jl 0x104dfaa
push esi
call fcn.0104d92e
mov edi, eax
cmp edi, ebx
jne 0x104dfc5
push esi
call fcn.0104da87
mov edi, eax
cmp edi, ebx
jne 0x104dfc5
lea eax, [ebp - 0x24c]
push eax
call fcn.0104d92e
mov edi, eax
cmp edi, ebx
jne 0x104dfc5
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x254], 1
call fcn.0104d970
mov edi, eax
cmp edi, ebx
je 0x104dff8
cmp dword [ebp - 0x254], ebx
je 0x104dfc5
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp - 0x250]
cmp eax, ebx
je 0x104dfdb
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp - 0x258]
cmp eax, ebx
je 0x104dff1
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [esi], ax
jmp 0x104e003
mov ecx, dword [ebp - 0x250]
xor eax, eax
mov word [ecx], ax
mov eax, edi
pop edi
jmp 0x104e012
push 0x57
pop eax
jmp 0x104e012
mov eax, 0x8000ffff
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.010a0c4b
leave
ret 8
Function at 0x1051d62
Capabilities:
Monitor local ipv4 address changes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call fcn.01056cb8
test eax, eax
je 0x1051ea5
call fcn.01056c5d
test eax, eax
je 0x1051ea5
push ebx
push edi
mov ebx, 0x10efed8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov edi, 0x10efec4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
mov dword [0x10eff04], esi
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
xor edi, edi
inc edi
mov dword [0x10efed4], eax
cmp eax, esi
je 0x1051ddc
push esi
push 0xffffffffffffffff
push esi
push 0x1051a4f
push eax
push 0x10eff00
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x1051de7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1051e22
push 0x10efec4
push 0x10efefc
mov dword [ebp - 8], edi
call sub.IPHLPAPI.DLL_NotifyAddrChange
mov dword [ebp - 4], eax
cmp eax, 0x3e5
jne 0x1051e22
mov esi, 0x10efef8
mov dword [ebp - 0xc], edi
call fcn.0104ef8e
mov dword [ebp - 4], eax
test eax, eax
jne 0x1051e29
and dword [ebp - 4], eax
mov dword [0x10eff20], edi
xor esi, esi
cmp dword [ebp - 4], esi
je 0x1051e97
jmp 0x1051e2b
xor esi, esi
push ebx
mov dword [0x10eff04], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 8], esi
je 0x1051e43
mov dword [0x10eff00], esi
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0xc], esi
je 0x1051e59
push 0x10efec4
call sub.IPHLPAPI.DLL_CancelIPChangeNotify
mov eax, dword [0x10efed4]
cmp eax, esi
je 0x1051e69
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, 0x10efec4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x10efef8]
cmp eax, esi
je 0x1051e8b
push eax
call fcn.010a0a51
pop ecx
mov dword [0x10efef8], esi
mov dword [0x10efefc], esi
mov dword [0x10eff20], esi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
pop edi
pop ebx
jmp 0x1051ed7
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x1051ed2
test byte [eax + 0x1c], 4
je 0x1051ed2
cmp byte [eax + 0x19], 2
jb 0x1051ed2
push 0x1005120
push 0x88
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov eax, 0x8000ffff
pop esi
leave
ret
Function at 0x105213f
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x268
mov eax, 0x10dc027
call fcn.010a0cd3
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x26c], ecx
mov eax, dword [0x10ed030]
mov ebx, 0x1005120
cmp eax, 0x10ed030
je 0x105219b
test byte [eax + 0x1c], 1
je 0x105219b
cmp byte [eax + 0x19], 5
jb 0x105219b
mov ecx, dword [ecx + 4]
mov edx, dword [esi]
mov edi, dword [edi]
push ecx
push edx
push edi
push ebx
push 0xd1
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01066461
and dword [ebp - 0x260], 0
push 0x24c
lea eax, [ebp - 0x25c]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi]
add esp, 0xc
lea ecx, [ebp - 0x260]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x268], eax
xor eax, eax
cmp dword [ebp - 0x268], 0xffffffff
jne 0x10521df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x10ed030]
mov edi, 0x10ed030
cmp ecx, edi
je 0x1052235
test byte [ecx + 0x1c], 2
je 0x1052235
movzx edx, byte [ecx + 0x19]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffffd
add edi, 5
cmp edx, edi
jl 0x1052230
push dword [ebp - 0x268]
mov esi, dword [esi]
lea edx, [ebp - 0x234]
push edx
push esi
push eax
push ebx
push 0xd2
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0102cb54
mov ecx, dword [0x10ed030]
mov edi, 0x10ed030
cmp dword [ebp - 0x268], 0xffffffff
je 0x105234e
push 0x10f1178
lea ecx, [ebp - 0x264]
call fcn.0102847f
and dword [ebp - 4], 0
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x1052283
test byte [eax + 0x1c], 2
je 0x1052283
cmp byte [eax + 0x19], 5
jb 0x1052283
lea ecx, [ebp - 0x234]
push ecx
push ebx
push 0xd3
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
push dword [ebp - 0x26c]
lea eax, [ebp - 0x234]
push eax
call fcn.0105019e
test eax, eax
jne 0x105231f
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x274]
lea eax, [ebp - 0x270]
push eax
call fcn.0103f1ed
push eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 1
call fcn.01028a4c
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.01028079
push dword [ebp - 0x264]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10522f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x105231f
test byte [eax + 0x1c], 2
je 0x105231f
cmp byte [eax + 0x19], 5
jb 0x105231f
push esi
push dword [ebp - 0x264]
push ebx
push 0xd4
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059d60
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1052256
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.01028079
mov ecx, dword [0x10ed030]
cmp ecx, edi
je 0x1052369
test byte [ecx + 0x1c], 1
je 0x1052369
push ebx
push 0xd5
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01027e15
call fcn.010a0d65
ret 0xc