joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f1a5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x46f2bd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46f2bd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0048eb73
mov esi, eax
test esi, esi
je 0x46f2bd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x46f2bd
mov ecx, esi
call fcn.0046f130
cmp edi, eax
jge 0x46f2bd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x46f243
mov dword [esp + 0x34], 1
jmp 0x46f29e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x46f2bd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0046ce80
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x48f517
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48f54f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048d52b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048d503
jmp 0x48f55b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x490c09
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x490c4b
call fcn.0049692e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x490c4b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x490c42
xor eax, eax
jmp 0x490c53
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00490c59
pop edi
pop esi
pop ebx
ret 4
Function at 0x496e5e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x496e8c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x496eaa
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00496dc4
jmp 0x496eaa
mov eax, dword [esi + 0x14]
test eax, eax
je 0x496eaa
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00496dc4
test edi, edi
mov eax, edi
jne 0x496e94
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40507c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40508b
pop dword [ebp - 0x40]
mov eax, 0xa261ce19
sub eax, 0xa2217d8e
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x418c7
push 0
mov eax, 0xd088ce54
sub eax, 0xd0467c3c
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x5699
xor esi, esi
add esi, eax
mov edi, 0x435400
add edi, dword [ebp - 0x40]
mov ebx, 0x333d86bc
add ebx, 0xa5e253a8
add dword [ebp - 0x38], ebx
mov edx, dword [edi]
add dword [ebp - 0x34], edx
xor edx, ebx
xor dword [ebp - 0xc], 0x35558427
mov dword [esi], edx
sub dword [ebp - 0x10], edx
add esi, 4
add edi, 0x4d0651ce
add edi, 0xb2f9ae36
loop 0x4050e0
add eax, 0xc14ecea4
sub eax, 0xc14d816d
mov ebx, eax
add eax, 0x125c037d
add eax, 0xeda3fc88
mov ecx, 0x6d6e78c1
sub ecx, 0x6d2e78c1
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x403f59
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x403f68
pop dword [ebp - 0x30]
mov eax, 0x403f68
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x50171a7a
sub dword [ebp - 0x40], 0x1c4d52f
mov dword [ebp - 0x3c], 0x8d01a612
sub dword [ebp - 0x3c], 0x5ace59cd
mov dword [ebp - 0x38], 0xa5df5dcc
add dword [ebp - 0x38], 0xa66ce662
mov dword [ebp - 0x34], 0x7e43e92f
add dword [ebp - 0x34], 0x81bc16d1
lea eax, [ebp - 0x40]
push eax
mov eax, 0x8753679b
sub eax, 0x87129747
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x3957b3ce
sub dword [ebp - 0x40], 0xc4e54a78
mov dword [ebp - 0x3c], 0x7819c1ca
add dword [ebp - 0x3c], 0xc9529fab
mov dword [ebp - 0x38], 0xc25ff8da
sub dword [ebp - 0x38], 0x5ef08c6e
mov dword [ebp - 0x34], 0x62ff83b4
sub dword [ebp - 0x34], 0x62ff83b4
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xb48b14c2
sub eax, 0xb44a4476
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x397a8
push 0
call eax
mov ecx, 0x1378baf3
add ecx, 0xec878c95
mov edx, eax
mov edi, 0xf16e0632
add edi, 0xed3a9ce
add edi, dword [ebp - 0x30]
mov esi, 0xcb8287f
sub esi, 0x5525ddc6
mov ebx, dword [edi]
sub dword [ebp - 0x10], edx
xor ebx, esi
add dword [ebp - 0x14], 0x25a2fb2a
mov dword [edx], ebx
sub dword [ebp - 0xc], ebx
add edx, 0xd09a9b8f
add edx, 0x2f656475
add edi, 4
loop 0x404085
add eax, 0x3402ba2a
sub eax, 0x3401a937
xor ebx, ebx
add ebx, eax
add eax, 0xbb49e162
sub eax, 0xbb49e15d
mov ecx, 0xfe43af31
add ecx, 0x1fc50cf
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10009960
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x11c], ecx
mov eax, dword [ebp - 0x11c]
cmp dword [eax + 0x88], 0xffffffff
jne 0x10009985
xor al, al
jmp 0x10009ad9
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], 0
jmp 0x100099b6
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x108]
jae 0x10009a31
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp + ecx*4 - 0x104]
cmp eax, dword [edx + 0x88]
jne 0x10009a2c
mov ecx, dword [ebp - 0x108]
sub ecx, 1
cmp dword [ebp - 0x118], ecx
jae 0x10009a1b
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp + eax*4 - 0x100]
mov dword [ebp + edx*4 - 0x104], ecx
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
jmp 0x100099df
mov eax, dword [ebp - 0x108]
sub eax, 1
mov dword [ebp - 0x108], eax
jmp 0x10009a31
jmp 0x100099a7
xor ecx, ecx
jne 0x1000999b
cmp dword [ebp - 0x108], 0x40
jae 0x10009a6a
mov edx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax + 0x88]
mov dword [ebp + edx*4 - 0x104], ecx
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
xor eax, eax
jne 0x10009a39
push 8
push 0
lea ecx, [ebp - 0x114]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x114]
push edx
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call sub.WS2_32.dll_select
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
je 0x10009ab2
cmp dword [ebp - 0x10c], 0
jne 0x10009ab6
xor al, al
jmp 0x10009ad9
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x11c]
mov eax, dword [edx + 0x88]
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x10009ad7
xor al, al
jmp 0x10009ad9
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10009b10
Capabilities:
Check for time delay via gettickcount
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x230], ecx
cmp dword [ebp + 8], 0
je 0x10009b35
cmp dword [ebp + 0xc], 0
jne 0x10009b3c
xor eax, eax
jmp 0x10009d3c
mov eax, dword [ebp - 0x230]
cmp dword [eax], 0
je 0x10009b8b
mov ecx, dword [ebp - 0x230]
add ecx, 0x108
push ecx
call sub.ntdll.dll_strlen
add esp, 4
cmp dword [ebp + 0xc], eax
jae 0x10009b68
xor eax, eax
jmp 0x10009d3c
mov edx, dword [ebp - 0x230]
add edx, 0x108
push edx
mov eax, dword [ebp + 8]
push eax
call sub.ntdll.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x10009d3c
call sym.Comn.dll_GetObjectSys
mov dword [ebp - 0x21c], eax
call sym.Comn.dll_GetObjectVol
mov dword [ebp - 4], eax
mov word [ebp - 0x218], 0
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x34]
call eax
test eax, eax
jne 0x10009c81
lea ecx, [ebp - 0x220]
push ecx
push 1
push 0
push str.SYSTEMSetup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x10009c0f
xor eax, eax
jmp 0x10009d3c
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x228], 0x104
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x230]
add eax, 4
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 0
push str.SystemPartition
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x10009c72
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10009d3c
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10009ca0
push 0x104
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x230]
add eax, 4
push eax
call dword [sym.imp.ntdll.dll_wcstombs]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
and ecx, 0x3e8
push ecx
push str.._systmp_d
mov edx, dword [ebp - 0x230]
add edx, 0x108
push edx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
mov eax, dword [ebp - 0x230]
add eax, 4
push eax
mov ecx, dword [ebp - 0x230]
add ecx, 0x10c
push ecx
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x10009cf5
xor eax, eax
jmp 0x10009d3c
mov edx, dword [ebp - 0x230]
mov dword [edx], 1
mov eax, dword [ebp - 0x230]
add eax, 0x108
push eax
call sub.ntdll.dll_strlen
add esp, 4
cmp dword [ebp + 0xc], eax
jae 0x10009d1e
xor eax, eax
jmp 0x10009d3c
mov ecx, dword [ebp - 0x230]
add ecx, 0x108
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.ntdll.dll_strcpy
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret 8
Function at 0x1000a5d0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10036f3b
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x104], ecx
mov ecx, dword [ebp - 0x104]
call fcn.1000a840
cmp dword [ebp + 8], 0
jne 0x1000a619
xor al, al
jmp 0x1000a7a9
lea ecx, [ebp - 0xfc]
call fcn.1000d7f0
mov dword [ebp - 4], 0
push 0x80
lea ecx, [ebp - 0xfc]
call fcn.1000d710
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0xfc]
call fcn.1000d880
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x6c], 0x80
mov ecx, dword [ebp - 0x104]
add ecx, 0x4c
push ecx
lea edx, [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x60]
push eax
lea ecx, [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x64]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jne 0x1000a6fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000a6fa
cmp dword [ebp - 0x70], 0x44
jbe 0x1000a6a9
push 0x80004005
call fcn.10009f10
cmp dword [ebp - 0x6c], 0x80
jbe 0x1000a6cf
mov edx, dword [ebp - 0x6c]
push edx
lea ecx, [ebp - 0xfc]
call fcn.1000d740
lea ecx, [ebp - 0xfc]
call fcn.1000d880
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x104]
add eax, 0x4c
push eax
lea ecx, [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x60]
push edx
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x64]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x1000a77f
mov ecx, dword [ebp - 0x104]
mov byte [ecx + 0x48], 1
mov edx, dword [ebp - 0x64]
push edx
mov ecx, dword [ebp - 0x104]
call fcn.1000a940
push eax
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1000a77f
mov ecx, dword [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x104]
add ecx, 0x54
call fcn.1000d620
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x104]
add ecx, 0x50
call fcn.1000d620
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x104]
add ecx, 0x5c
call fcn.1000d620
mov byte [ebp - 0xfd], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.1000d6f0
mov al, byte [ebp - 0xfd]
jmp 0x1000a7a9
mov ecx, dword [ebp - 0x104]
call fcn.1000a840
mov byte [ebp - 0xfe], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.1000d6f0
mov al, byte [ebp - 0xfe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
je 0x1000d375
cmp dword [ebp + 0xc], 0
jne 0x1000d37c
xor eax, eax
jmp 0x1000d4c6
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
je 0x1000d3c2
mov ecx, dword [ebp - 0x18]
add ecx, 0x108
push ecx
call sub.ntdll.dll_strlen
add esp, 4
cmp dword [ebp + 0xc], eax
jae 0x1000d3a2
xor eax, eax
jmp 0x1000d4c6
mov edx, dword [ebp - 0x18]
add edx, 0x108
push edx
mov eax, dword [ebp + 8]
push eax
call sub.ntdll.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x1000d4c6
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push str.SYSTEMSetup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000d3ea
xor eax, eax
jmp 0x1000d4c6
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0x104
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
add eax, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push str.SystemPartition
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000d432
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000d4c6
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
and edx, 0x3e8
push edx
push str.._systmp_d
mov eax, dword [ebp - 0x18]
add eax, 0x108
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x10c
push edx
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x1000d487
xor eax, eax
jmp 0x1000d4c6
mov eax, dword [ebp - 0x18]
mov dword [eax], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0x108
push ecx
call sub.ntdll.dll_strlen
add esp, 4
cmp dword [ebp + 0xc], eax
jae 0x1000d4ab
xor eax, eax
jmp 0x1000d4c6
mov edx, dword [ebp - 0x18]
add edx, 0x108
push edx
mov eax, dword [ebp + 8]
push eax
call sub.ntdll.dll_strcpy
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x1000f6c2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004c024]
jne 0x1000f6cc
repz ret
jmp fcn.1000fb4d
Function at 0x10010fc0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10011015
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x18], eax
push 0x631
push 0x1003a744
call fcn.10010f00
add esp, 8
push eax
push str._s:_OpenProcessToken_Failed.
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x10011179
lea edx, [ebp - 0x10]
push edx
push str.SeBackupPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001108c
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x1c], eax
push 0x63d
push 0x1003a798
call fcn.10010f00
add esp, 8
push eax
push 0x1003a7a8
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
xor eax, eax
jmp 0x10011179
lea eax, [ebp - 0x10]
push eax
push str.SeRestorePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10011100
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x20], eax
push 0x64a
push 0x1003a7f4
call fcn.10010f00
add esp, 8
push eax
push 0x1003a804
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
xor eax, eax
jmp 0x10011179
lea ecx, [ebp - 0x10]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10011174
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x24], eax
push 0x657
push 0x1003a84c
call fcn.10010f00
add esp, 8
push eax
push str._s:_AdjustTokenPrivileges_Failed.
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x10011179
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10011180
Capabilities:
Check if file exists
Get common file path
Get file attributes
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x100111e4
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x21c], eax
push 0x17
push 0x100392e4
call fcn.10010f00
add esp, 8
push eax
push str._s:_GetSystemDirectory_Failed.
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x21c]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x1001124b
mov byte [ebp - 0x218], 0
push 0x103
push 0
lea edx, [ebp - 0x217]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push str._s_bcdedit.exe
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10011233
xor eax, eax
jmp 0x1001124b
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.ntdll.dll_strcpy
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret
Function at 0x10017710
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1444
call fcn.10010670
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x1440], 0
push 0x103
push 0
lea eax, [ebp - 0x143f]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x11c]
push ecx
push 1
push 0
push 0x1003ac40
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1124], eax
cmp dword [ebp - 0x1124], 0
je 0x10017775
xor al, al
jmp 0x10017969
mov dword [ebp - 0x1334], 1
mov dword [ebp - 0x1128], 0x104
lea edx, [ebp - 0x1128]
push edx
lea eax, [ebp - 0x1440]
push eax
lea ecx, [ebp - 0x1334]
push ecx
push 0
push 0x1003ac50
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x1124], eax
cmp dword [ebp - 0x1124], 0
je 0x100177d5
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x10017969
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea edx, [ebp - 0x10f]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x118]
and eax, 0x3e8
push eax
push 0x1003ac60
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x1440]
push edx
lea eax, [ebp - 0x10c]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x1001784d
xor al, al
jmp 0x10017969
push 0x1003ac70
lea ecx, [ebp - 0x110]
push ecx
call sub.ntdll.dll_strcat
add esp, 8
mov byte [ebp - 0x1330], 0
push 0x1ff
push 0
lea edx, [ebp - 0x132f]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
lea eax, [ebp - 0x1330]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
mov dword [ebp - 0x112c], eax
cmp dword [ebp - 0x112c], 0
jne 0x100178ad
xor al, al
jmp 0x10017969
mov byte [ebp - 0x1120], 0
push 0xfff
push 0
lea edx, [ebp - 0x111f]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
push 0x1000
lea ecx, [ebp - 0x1120]
push ecx
lea edx, [ebp - 0x1330]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
mov dword [ebp - 0x112c], eax
cmp dword [ebp - 0x112c], 0
jne 0x10017907
xor al, al
jmp 0x10017969
mov dword [ebp - 0x1444], 0
jmp 0x10017922
mov eax, dword [ebp - 0x1444]
add eax, 1
mov dword [ebp - 0x1444], eax
mov ecx, dword [ebp - 0x1444]
cmp ecx, dword [ebp - 0x114]
jae 0x10017967
mov edx, dword [ebp - 0x1444]
movsx eax, byte [ebp + edx - 0x111f]
cmp eax, 0x3a
jne 0x10017965
mov ecx, dword [ebp - 0x1444]
movsx edx, byte [ebp + ecx - 0x111e]
cmp edx, 0x5c
jne 0x10017965
mov eax, dword [ebp - 0x1444]
mov al, byte [ebp + eax - 0x1120]
jmp 0x10017969
jmp 0x10017913
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret
Function at 0x100179e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x1003afcc
lea eax, [ebp - 0x110]
push eax
call fcn.10002700
add esp, 8
test eax, eax
je 0x10017a34
mov eax, 1
jmp 0x10017a36
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret