joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100032b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004aacb
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x10061070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x254], 0
lea ecx, [ebp - 0x268]
call fcn.100049d0
mov dword [ebp - 4], 0
mov dword [ebp - 0x23c], 0
push 0x228
push 0
lea eax, [ebp - 0x238]
push eax
call fcn.1002ef20
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x248], eax
lea ecx, [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10003447
mov byte [ebp - 0x23d], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24c], eax
lea ecx, [ebp - 0x244]
push ecx
mov ecx, dword [ebp - 0x24c]
call fcn.100046a0
lea edx, [ebp - 0x258]
push edx
mov ecx, dword [ebp - 0x24c]
call fcn.10004640
jmp 0x1000338e
lea ecx, [ebp - 0x244]
call fcn.10004600
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x244]
call fcn.10004430
movzx ecx, al
test ecx, ecx
je 0x1000340e
lea ecx, [ebp - 0x244]
call fcn.10002530
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
call fcn.10004b20
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.10031573
add esp, 8
test eax, eax
jne 0x10003409
mov dword [ebp - 0x250], 0xffffffff
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov edx, dword [ebp - 0x250]
cmp edx, dword [ebp + 0xc]
jne 0x10003409
mov byte [ebp - 0x23d], 1
jmp 0x1000340e
jmp 0x10003383
movzx eax, byte [ebp - 0x23d]
test eax, eax
je 0x1000342b
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x268]
call fcn.10004780
lea edx, [ebp - 0x23c]
push edx
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1000334d
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x268]
push edx
mov ecx, dword [ebp + 8]
call fcn.10004960
mov eax, dword [ebp - 0x254]
or eax, 1
mov dword [ebp - 0x254], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10004920
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bcee
mov esp, ebp
pop ebp
ret
Function at 0x10003700
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004ab23
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x10061070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x100038d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xffff
movzx edx, ax
and edx, 0xff
movzx eax, dl
cmp eax, 6
jae 0x10003773
mov dword [ebp - 0x38], 1
jmp 0x1000377a
mov dword [ebp - 0x38], 0
mov cl, byte [ebp - 0x38]
mov byte [ebp - 0x2d], cl
movzx edx, byte [ebp - 0x2d]
test edx, edx
jne 0x100037cc
push 0x100076b0
mov eax, dword [ebp - 0x3c]
push eax
push 0x10059598
mov ecx, dword [ebp + 8]
push ecx
push str.Failed_to_WTSQueryUserToken__not_XP___Session_id_:
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.10003130
xor eax, eax
jmp 0x100038db
push 0x100076b0
mov edx, dword [ebp - 0x3c]
push edx
push 0x100595d4
mov eax, dword [ebp + 8]
push eax
push str.Failed_to_WTSQueryUserToken__XP___Session_id_:
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.10003130
push str.winlogon.exe
lea ecx, [ebp - 0x2c]
call fcn.10004bb0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2f]
call fcn.100045f0
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x68]
call fcn.10002500
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x54]
call fcn.10004740
mov byte [ebp - 4], 1
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x60]
push edx
call fcn.100032b0
add esp, 0xc
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
push ecx
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100034a0
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x1000388e
mov dword [ebp - 0x40], 1
jmp 0x10003895
mov dword [ebp - 0x40], 0
mov dl, byte [ebp - 0x40]
mov byte [ebp - 0x2e], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
call fcn.10004920
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.10004700
mov dword [ebp - 4], 0xffffffff
push fcn.10004b60
push 1
push 0x18
lea eax, [ebp - 0x2c]
push eax
call fcn.1002bf8c
movzx ecx, byte [ebp - 0x2e]
test ecx, ecx
je 0x100038d8
xor eax, eax
jmp 0x100038db
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bcee
mov esp, ebp
pop ebp
ret
Function at 0x100039a0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004ab94
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x10061070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x98], 0
lea eax, [ebp - 0x98]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100039f6
xor al, al
jmp 0x10003b53
push str.SeTcbPrivilege
lea ecx, [ebp - 0x8c]
call fcn.10004e70
mov dword [ebp - 4], 0
push str.SeLoadDriverPrivilege
lea ecx, [ebp - 0x74]
call fcn.10004e70
mov byte [ebp - 4], 1
push str.SeDebugPrivilege
lea ecx, [ebp - 0x5c]
call fcn.10004e70
mov byte [ebp - 4], 2
push str.SeBackupPrivilege
lea ecx, [ebp - 0x44]
call fcn.10004e70
mov byte [ebp - 4], 3
push str.SeRestorePrivilege
lea ecx, [ebp - 0x2c]
call fcn.10004e70
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x8e]
call fcn.100045f0
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x8c]
push edx
lea ecx, [ebp - 0xb8]
call fcn.10002500
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0xb0]
call fcn.100045b0
mov byte [ebp - 4], 6
push fcn.10004d30
push 5
push 0x18
lea eax, [ebp - 0x8c]
push eax
call fcn.1002bf8c
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x9c], ecx
lea edx, [ebp - 0x94]
push edx
mov ecx, dword [ebp - 0x9c]
call fcn.10004510
lea eax, [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0x9c]
call fcn.100044b0
jmp 0x10003ade
lea ecx, [ebp - 0x94]
call fcn.10004470
lea ecx, [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0x94]
call fcn.10004430
movzx edx, al
test edx, edx
je 0x10003b27
lea ecx, [ebp - 0x94]
call fcn.10004490
mov dword [ebp - 0xa4], eax
push 1
mov ecx, dword [ebp - 0xa4]
call fcn.10004c70
push eax
mov eax, dword [ebp - 0x98]
push eax
call fcn.10003900
add esp, 0xc
jmp 0x10003ad3
mov ecx, dword [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x8d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.10004570
mov al, byte [ebp - 0x8d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bcee
mov esp, ebp
pop ebp
ret
Function at 0x10003ff0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x10061070]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x808], ax
push 0x800
push 0
lea ecx, [ebp - 0x806]
push ecx
call fcn.1002ef20
add esp, 0xc
push 0x10059864
lea edx, [ebp - 0x808]
push edx
call fcn.100077a0
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x808]
push ecx
call fcn.100077c0
add esp, 8
push 0x10059868
lea edx, [ebp - 0x808]
push edx
call fcn.100077c0
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x100040d9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x80c], eax
mov ecx, dword [ebp - 0x80c]
add ecx, 2
mov dword [ebp - 0x820], ecx
mov edx, dword [ebp - 0x80c]
mov ax, word [edx]
mov word [ebp - 0x80e], ax
add dword [ebp - 0x80c], 2
cmp word [ebp - 0x80e], 0
jne 0x1000407b
mov ecx, dword [ebp - 0x80c]
sub ecx, dword [ebp - 0x820]
sar ecx, 1
mov dword [ebp - 0x824], ecx
je 0x100040d9
push 0x1005986c
lea edx, [ebp - 0x808]
push edx
call fcn.100077c0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x808]
push ecx
call fcn.100077c0
add esp, 8
push 0x400
lea edx, [ebp - 0x808]
push edx
call fcn.100011d0
add esp, 8
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x814]
shl eax, 1
mov dword [ebp - 0x814], eax
mov ecx, dword [ebp - 0x814]
push ecx
mov edx, 2
imul eax, edx, 0
lea ecx, [ebp + eax - 0x808]
push ecx
push 1
push 0x10059870
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x818], 0
jne 0x1000415b
push 0x100076b0
push str.Add_auto_run_registry.
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.10003130
jmp 0x10004184
push 0x100076b0
mov edx, dword [ebp - 0x818]
push edx
push str.Failed_to_add_auto_run__error_:
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.100077e0
mov ecx, eax
call fcn.10003130
cmp dword [ebp - 0x818], 0
jne 0x10004199
mov dword [ebp - 0x81c], 1
jmp 0x100041a3
mov dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x81c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcee
mov esp, ebp
pop ebp
ret 8
Function at 0x100041c0
Capabilities:
Create process on windows
Create process suspended
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x574
mov eax, dword [0x10061070]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.100039a0
mov byte [ebp - 0x104], 0
push 0xff
push 0
lea eax, [ebp - 0x103]
push eax
call fcn.1002ef20
add esp, 0xc
mov dword [ebp - 0x514], 0x100
lea ecx, [ebp - 0x514]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push str.SYSTEM
lea eax, [ebp - 0x104]
push eax
call fcn.1003b389
add esp, 8
test eax, eax
jne 0x1000425d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sym.SetupAssist.dll_int___stdcall_CreateProcessAsConsoleSession_wchar_t_const___wchar_t_const__
test eax, eax
je 0x10004246
mov eax, 1
jmp 0x10004416
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sym.SetupAssist.dll_int___stdcall_AddAutoRunOnce_wchar_t_const___wchar_t_const__
jmp 0x10004416
xor edx, edx
mov word [ebp - 0x508], dx
push 0x400
push 0
lea eax, [ebp - 0x506]
push eax
call fcn.1002ef20
add esp, 0xc
push 0x10059930
lea ecx, [ebp - 0x508]
push ecx
call fcn.10007840
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x508]
push eax
call fcn.10007860
add esp, 8
push 0x10059934
lea ecx, [ebp - 0x508]
push ecx
call fcn.10007860
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x10004333
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x50c], edx
mov eax, dword [ebp - 0x50c]
add eax, 2
mov dword [ebp - 0x518], eax
mov ecx, dword [ebp - 0x50c]
mov dx, word [ecx]
mov word [ebp - 0x50e], dx
add dword [ebp - 0x50c], 2
cmp word [ebp - 0x50e], 0
jne 0x100042d5
mov eax, dword [ebp - 0x50c]
sub eax, dword [ebp - 0x518]
sar eax, 1
mov dword [ebp - 0x51c], eax
je 0x10004333
push 0x10059938
lea ecx, [ebp - 0x508]
push ecx
call fcn.10007860
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x508]
push eax
call fcn.10007860
add esp, 8
push 0x44
push 0
lea ecx, [ebp - 0x574]
push ecx
call fcn.1002ef20
add esp, 0xc
mov dword [ebp - 0x574], 0x44
mov dword [ebp - 0x520], 0x20
lea edx, [ebp - 0x530]
push edx
lea eax, [ebp - 0x574]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x520]
push ecx
push 0
push 0
push 0
mov edx, 2
imul eax, edx, 0
lea ecx, [ebp + eax - 0x508]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100043ce
push 0x100076b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10059964
push 0x1005993c
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.10003130
xor eax, eax
jmp 0x10004416
mov edx, dword [ebp - 0x52c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x530]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100076b0
mov ecx, dword [ebp - 0x528]
push ecx
push str.Create_child_process__id_:
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.10003130
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcee
mov esp, ebp
pop ebp
ret 8
Function at 0x1000bb50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x10061070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
je 0x1000bb7c
jmp 0x1000bd1c
mov byte [ebp - 0x10c], 0
push 0x104
push 0
lea ecx, [ebp - 0x10b]
push ecx
call fcn.1002ef20
add esp, 0xc
lea edx, [ebp - 0x10c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
add ecx, 1
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x114]
mov al, byte [edx]
mov byte [ebp - 0x10d], al
add dword [ebp - 0x114], 1
cmp byte [ebp - 0x10d], 0
jne 0x1000bbc6
mov ecx, dword [ebp - 0x114]
sub ecx, dword [ebp - 0x128]
mov dword [ebp - 0x12c], ecx
je 0x1000bc97
lea edx, [ebp - 0x10c]
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0x118]
add eax, 1
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x118]
mov dl, byte [ecx]
mov byte [ebp - 0x10e], dl
add dword [ebp - 0x118], 1
cmp byte [ebp - 0x10e], 0
jne 0x1000bc17
mov eax, dword [ebp - 0x118]
sub eax, dword [ebp - 0x130]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
movsx edx, byte [ebp + ecx - 0x10d]
cmp edx, 0x5c
je 0x1000bc97
lea eax, [ebp - 0x10c]
add eax, 0xffffffff
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x10f], dl
add dword [ebp - 0x11c], 1
cmp byte [ebp - 0x10f], 0
jne 0x1000bc69
mov edi, dword [ebp - 0x11c]
mov ax, word [0x1005998c]
mov word [edi], ax
lea ecx, [ebp - 0x10c]
add ecx, 0xffffffff
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x120]
mov al, byte [edx + 1]
mov byte [ebp - 0x110], al
add dword [ebp - 0x120], 1
cmp byte [ebp - 0x110], 0
jne 0x1000bca6
mov edi, dword [ebp - 0x120]
mov ecx, 5
mov esi, str.EndpointInstaller2.log
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, 0x10062fb8
call fcn.1000b9b0
mov ecx, 0x10062fb8
call fcn.1000b970
push 1
mov ecx, 0x10062fb8
call fcn.1000b990
push 0x100076b0
push str.______________________________
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.10003130
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcee
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000df50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b258
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x10061070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x1000df90
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1000df9c
mov al, 1
jmp 0x1000e13f
mov dword [ebp - 0x48], 8
call fcn.10001740
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.10001740
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.10001710
add esp, 8
movzx eax, al
test eax, eax
je 0x1000dfdf
xor al, al
jmp 0x1000e13f
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.10004e00
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x28]
call fcn.1000de00
mov ecx, eax
call fcn.10004490
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.10005840
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000de00
mov ecx, eax
call fcn.10004490
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.1000e900
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x1000e05a
cmp dword [ebp - 0x38], 1
je 0x1000e061
cmp dword [ebp - 0x38], 3
je 0x1000e0fb
jmp 0x1000e113
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000de00
mov ecx, eax
call fcn.10004490
mov edx, dword [ebp - 0x44]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x1000e0c4
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000de00
mov ecx, eax
call fcn.10004490
push eax
call fcn.10035e48
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x1000e0c4
mov byte [ebp - 0x2d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004d30
mov al, byte [ebp - 0x2d]
jmp 0x1000e13f
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1000e0e7
mov byte [ebp - 0x2e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004d30
mov al, byte [ebp - 0x2e]
jmp 0x1000e13f
cmp dword [ebp - 0x34], 0
jne 0x1000e0f9
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.10005aa0
jmp 0x1000e12b
mov byte [ebp - 0x2f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004d30
mov al, byte [ebp - 0x2f]
jmp 0x1000e13f
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004d30
mov al, byte [ebp - 0x30]
jmp 0x1000e13f
jmp 0x1000dff2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bcee
mov esp, ebp
pop ebp
ret
Function at 0x1000f9c0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x10016a30
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.setEnvVar:
push 0x10062250
call fcn.10016700
add esp, 8
push eax
call fcn.10016700
add esp, 8
push eax
call fcn.10016700
add esp, 8
mov ecx, eax
call fcn.10004fc0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop ebp
ret 8
Function at 0x10010170
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10061070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x23
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.10004bb0
push str._skyguard_firstboot.dat
lea ecx, [ebp - 0x21c]
call fcn.10011f30
lea ecx, [ebp - 0x21c]
call fcn.10004b20
push eax
push str.123456789
push 0x10059b30
push str.FIRSTROOT
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 4
push 0
lea ecx, [ebp - 0x21c]
call fcn.10004b20
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 0x220], 1
lea ecx, [ebp - 0x21c]
call fcn.10004b60
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcee
mov esp, ebp
pop ebp
ret 4

Function at 0x10010220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b3eb
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x10061070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x830], 0
lea ecx, [ebp - 0x828]
call fcn.10012170
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x810], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x80e]
push ecx
call fcn.1002ef20
add esp, 0xc
mov dword [ebp - 0x82c], 0
lea edx, [ebp - 0x82c]
push edx
push 0
lea eax, [ebp - 0x834]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100102f4
cmp dword [ebp - 0x82c], 0
jbe 0x100102f4
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0x834]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0x828]
call fcn.10011f70
lea eax, [ebp - 0x828]
push eax
mov ecx, dword [ebp + 8]
call fcn.100120f0
mov ecx, dword [ebp - 0x830]
or ecx, 1
mov dword [ebp - 0x830], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x828]
call fcn.10004b60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bcee
mov esp, ebp
pop ebp
ret
Function at 0x100107f0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x5c], 0
push 0x40
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.1002ef20
add esp, 0xc
mov dword [ebp - 0x5c], 0x44
cmp dword [ebp + 0x20], 0
jne 0x10010827
mov dword [ebp - 0x30], 0x101
xor ecx, ecx
mov word [ebp - 0x2c], cx
mov dword [ebp - 0x18], 0
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp + 8]
call fcn.10004b20
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10010876
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10004b60
mov eax, dword [ebp - 4]
jmp 0x100108ae
cmp dword [ebp + 0x24], 1
jne 0x10010888
push 0xffffffffffffffff
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 1
lea ecx, [ebp + 8]
call fcn.10004b60
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x100108c0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b4b8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x10061070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10059cc0
lea ecx, [ebp - 0x28]
call fcn.10004bb0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x28]
call fcn.10004b20
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x10010989
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x30], ecx
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp - 0x30]
call fcn.10004510
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.100044b0
jmp 0x1001094c
lea ecx, [ebp - 0x2c]
call fcn.10004470
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10004430
movzx edx, al
test edx, edx
je 0x1001097f
lea ecx, [ebp - 0x2c]
call fcn.10004490
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
call fcn.10004b20
push eax
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
jmp 0x10010944
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004b60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bcee
mov esp, ebp
pop ebp
ret