joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008de0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005ef8d
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x10074118]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push edi
mov eax, dword [0x10074118]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
cmp esi, ebx
je 0x10008e81
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10008e81
push esi
call fcn.10008dbc
pop ecx
test al, al
je 0x10008e4d
mov al, 1
jmp 0x10008e83
lea edi, [esp + 0x3c]
call fcn.1002cac7
mov dword [esp + 0xa0], ebx
cmp dword [esp + 0x54], 0x10
mov edx, dword [esp + 0x40]
jae 0x10008e6c
lea edx, [esp + 0x40]
call fcn.100278fa
test eax, eax
jne 0x10008ea7
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.10004d1a
xor al, al
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.100408d9
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x54], 0x10
mov eax, dword [esp + 0x40]
jae 0x10008eb6
lea eax, [esp + 0x40]
push 0x32e3
push eax
push str.https:___s:_d_globalSmallFile
lea esi, [esp + 0x80]
call fcn.10028de6
add esp, 0xc
push ebx
push ebx
lea eax, [esp + 0x2c]
call fcn.10031e83
sub esp, 0x18
mov byte [esp + 0xb8], 4
mov esi, esp
mov dword [esp + 0x30], esp
push str.processico
call fcn.10030ec1
lea eax, [esp + 0x3c]
push eax
mov edx, str.type
mov byte [esp + 0xbc], 5
call fcn.100321b8
mov edi, eax
mov byte [esp + 0xb8], 4
call fcn.100311c7
sub esp, 0x18
mov esi, esp
mov dword [esp + 0x30], esp
push dword [esp + 0x38]
call fcn.10030ec1
lea eax, [esp + 0x3c]
push eax
mov edx, str.name
mov byte [esp + 0xbc], 6
call fcn.100321b8
mov edi, eax
mov byte [esp + 0xb8], 4
call fcn.100311c7
sub esp, 0x18
mov esi, esp
mov dword [esp + 0x30], esp
push ebx
call fcn.10030e63
lea eax, [esp + 0x3c]
push eax
mov edx, str.clean
mov byte [esp + 0xbc], 7
call fcn.100321b8
mov edi, eax
mov byte [esp + 0xb8], 4
call fcn.100311c7
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x5c]
call fcn.1003264a
mov byte [esp + 0xa0], 8
cmp dword [esp + 0x70], 0x10
mov ecx, dword [esp + 0x5c]
jae 0x10008fae
lea ecx, [esp + 0x5c]
cmp dword [esp + 0x8c], 0x10
mov eax, dword [esp + 0x78]
jae 0x10008fc0
lea eax, [esp + 0x78]
push ebx
push ebx
push ebx
push ebx
push ecx
push str.desc
push dword [esp + 0x34]
push str.file
push eax
call fcn.1002b6b6
push ebx
test eax, eax
push 1
lea ecx, [esp + 0x60]
setne byte [esp + 0x1f]
call fcn.10004d1a
lea esi, [esp + 0x24]
mov byte [esp + 0xa0], 1
call fcn.10031144
push ebx
push 1
lea ecx, [esp + 0x7c]
call fcn.10004d1a
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.10004d1a
mov al, byte [esp + 0x17]
jmp 0x10008e83
Function at 0x1000901e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x1005ef31
call fcn.100425c1
test edi, edi
je 0x10009046
push edi
push str.default
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10009046
xor eax, eax
inc eax
jmp 0x100090e9
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push str.Softwareprojonepodlp_smpcacheprocicons_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1000907c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
call fcn.10028ee7
jmp 0x1000907e
xor eax, eax
test eax, eax
jne 0x1000903e
push edi
lea ecx, [ebp - 0x50]
call fcn.1000485d
and dword [ebp - 4], 0
push 0x100638d4
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1000a19e
add esp, 0xc
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 0x10
jb 0x100090b0
mov eax, dword [eax + 4]
jmp 0x100090b3
add eax, 4
push eax
call fcn.10008dbc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
mov bl, al
call fcn.10004d1a
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.10004d1a
test bl, bl
je 0x100090e7
push edi
call fcn.100086f3
jmp 0x1000903e
xor eax, eax
call fcn.10042699
ret
Function at 0x10009284
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x10074118]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x158], 0
push ebx
push esi
push edi
mov dword [ebp - 0x144], eax
xor eax, eax
lea edi, [ebp - 0x154]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x158]
mov esi, ecx
push eax
push esi
mov byte [ebp - 0x13d], 0
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
jne 0x100092d8
xor al, al
jmp 0x10009426
lea eax, [ebp - 0x198]
push eax
push 0x18
push dword [ebp - 0x148]
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x118
xor edi, edi
lea eax, [ebp - 0x138]
push edi
push eax
call fcn.10046720
add esp, 0xc
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x13c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp word [ebp - 0x186], 0x20
jne 0x100093c1
cmp dword [ebp - 0x138], 5
je 0x100093c1
push dword [ebp - 0x148]
call fcn.1000867f
mov edi, eax
pop ecx
mov esi, edi
call fcn.100085e8
mov ebx, eax
call fcn.100085c8
and dword [ebp - 0x168], 0
and dword [ebp - 0x164], 0
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], ebx
call fcn.10008608
lea ecx, [ebp - 0x180]
push ecx
push eax
push 1
lea eax, [ebp - 0x168]
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipBitmapLockBits
test eax, eax
je 0x10009391
mov dword [edi + 8], eax
push 0x10
call sub.gdiplus.dll_GdipAlloc
test eax, eax
je 0x100093bd
push dword [ebp - 0x170]
mov esi, eax
push dword [ebp - 0x178]
push dword [ebp - 0x17c]
push dword [ebp - 0x180]
call fcn.10008648
jmp 0x100093c8
xor eax, eax
jmp 0x100093c8
push esi
call fcn.100086b7
pop ecx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call fcn.100091fa
pop ecx
test al, al
je 0x100093f2
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x144]
call fcn.100085a8
test eax, eax
jne 0x100093f2
mov byte [ebp - 0x13d], 1
test esi, esi
je 0x100093fe
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
test edi, edi
je 0x1000940a
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
push dword [ebp - 0x148]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0x14c]
call esi
mov al, byte [ebp - 0x13d]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100408d9
leave
ret
Function at 0x10009435
Capabilities:
Check if file exists
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x10074118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x2c4], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
test eax, eax
je 0x10009474
push esi
call fcn.10026bfe
cmp edx, ebx
ja 0x1000946d
cmp eax, ebx
jbe 0x10009474
mov al, 1
jmp 0x1000950d
push 0x2b0
lea eax, [ebp - 0x2bc]
push ebx
push eax
mov dword [ebp - 0x2c0], ebx
call fcn.10046720
add esp, 0xc
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2c0]
push eax
push ebx
push dword [ebp - 0x2c4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 0x2c8]
push eax
push 0x100605ac
push 2
mov dword [ebp - 0x2c8], ebx
call dword [sym.imp.SHELL32.dll_SHGetImageList]
test eax, eax
jne 0x1000950b
mov eax, dword [ebp - 0x2c8]
lea edx, [ebp - 0x2c4]
push edx
push 1
push dword [ebp - 0x2bc]
mov dword [ebp - 0x2c4], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov ecx, dword [ebp - 0x2c4]
cmp ecx, ebx
je 0x1000950b
push esi
call fcn.10009284
pop ecx
push dword [ebp - 0x2c4]
mov bl, al
call dword [sym.imp.USER32.dll_DestroyIcon]
mov al, bl
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100408d9
leave
ret

Function at 0x10009858
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call sub.gdiplus.dll_GdiplusStartup
push esi
push esi
push esi
push 0x100096e6
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100783a4]
cmp eax, esi
jne 0x100098c0
push str.B30715A7
call fcn.1002af1c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100783a4], eax
cmp eax, esi
je 0x100098c8
push esi
push 0x1000951a
call eax
pop esi
leave
ret
Function at 0x1000a3cb
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x112c
call fcn.10051950
mov eax, dword [0x10074118]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
push str.SoftwareSASGeneration
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10028e40
call fcn.1002d512
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push str.Local::ProcessMonitor
push 0x3c
push str.._rcmgr.cpp
push str._s._d:_s
mov dword [0x100777e4], eax
lea eax, [ebp - 0x1008]
push 0x800
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x1008]
push eax
push str.assists.exe
mov ebx, 0x1000a4db
push ebx
call fcn.1002b626
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push 0x118
lea eax, [ebp - 0x1124]
push 0
push eax
mov dword [ebp - 0x1128], 0x11c
call fcn.10046720
add esp, 0xc
lea eax, [ebp - 0x1128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1124], 5
jbe 0x1000a4cc
cmp dword [ebp - 0x1124], 6
jne 0x1000a495
cmp dword [ebp - 0x1120], 0
je 0x1000a4cc
push str.Local::ProcessMonitor
push 0x42
push str.._rcmgr.cpp
push str._s._d:_s
lea eax, [ebp - 0x1008]
push 0x800
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x1008]
push eax
push str.assisths.exe
push ebx
call fcn.1002b626
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100408d9
leave
ret
Function at 0x1000a6ee
Capabilities:
Delete registry value

Disassembly:
push 0xdc
mov eax, 0x1005dbfd
call fcn.100425c1
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x54]
mov dword [ebp - 0x18], esi
call fcn.10031e83
xor ebx, ebx
push 3
pop edi
inc ebx
mov dword [ebp - 4], edi
cmp dword [ebp + 0xc], esi
je 0x1000a75e
push dword [ebp + 0xc]
lea ecx, [ebp - 0x3c]
call fcn.1000485d
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 4
push eax
mov dword [ebp - 0x18], ebx
call fcn.1002dc11
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
mov dword [ebp - 4], 5
push eax
mov dword [ebp - 0x18], edi
call fcn.1002dc75
test al, al
je 0x1000a75e
cmp byte [ebp - 0x4c], 7
mov byte [ebp - 0x11], 0
je 0x1000a761
mov byte [ebp - 0x11], bl
test byte [ebp - 0x18], 2
je 0x1000a776
and dword [ebp - 0x18], 0xfffffffd
lea eax, [ebp - 0xe8]
call fcn.100304dc
mov dword [ebp - 4], edi
test byte [ebp - 0x18], bl
je 0x1000a78c
and dword [ebp - 0x18], 0xfffffffe
push esi
push ebx
lea ecx, [ebp - 0x3c]
call fcn.10004d1a
cmp byte [ebp - 0x11], 0
je 0x1000a7b8
push esi
push esi
lea eax, [ebp - 0x3c]
call fcn.10031e83
push eax
push str.invalid_json
mov byte [ebp - 4], 8
push 0xb
push dword [ebp + 8]
call fcn.1002b926
add esp, 0x10
jmp 0x1000a878
lea eax, [ebp - 0x54]
mov esi, str.mode
push eax
mov edx, esi
call fcn.100321b8
cmp byte [eax + 8], 4
jne 0x1000a7fd
lea eax, [ebp - 0x54]
push eax
mov edx, esi
call fcn.100321b8
push eax
lea ecx, [ebp - 0x3c]
call fcn.10031332
mov byte [ebp - 4], 9
or dword [ebp - 0x18], 8
push 0x10063c48
call fcn.100060d3
pop ecx
mov byte [ebp - 0x11], 0
test al, al
jne 0x1000a800
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], edi
xor esi, esi
test byte [ebp - 0x18], 8
je 0x1000a819
and dword [ebp - 0x18], 0xfffffff7
push esi
push ebx
lea ecx, [ebp - 0x3c]
call fcn.10004d1a
cmp byte [ebp - 0x11], 0
je 0x1000a831
push esi
push esi
lea eax, [ebp - 0x3c]
call fcn.10031e83
push eax
mov byte [ebp - 4], 0xc
push esi
jmp 0x1000a86c
mov ebx, 0x10063c4c
push ebx
mov edi, str.Softwareprojonepodlp_smpcache_
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.1000a638
push 2
push ebx
push edi
push esi
call fcn.10028ead
xor edx, edx
push edx
mov esi, eax
push edx
lea eax, [ebp - 0x3c]
call fcn.10031e83
push eax
mov byte [ebp - 4], 0xf
push edx
push esi
push dword [ebp + 8]
call fcn.1002b926
add esp, 0x10
or dword [ebp - 0x18], 4
lea esi, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.10031144
lea esi, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10031144
mov eax, dword [ebp + 8]
call fcn.10042699
ret
Function at 0x1000cff3
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push 0x270
mov eax, 0x10059e4e
call fcn.1004262a
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x244], esi
call fcn.100098f4
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x230]
push eax
xor edi, edi
inc edi
push edi
mov dword [ebp - 4], esi
push esi
push esi
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], esi
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x1000d1c0
mov dword [ebp - 0x23c], esi
cmp dword [ebp - 0x234], esi
jbe 0x1000d1b5
mov dword [ebp - 0x238], esi
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x238]
lea esi, [ecx + eax]
cmp dword [esi + 4], 4
jbe 0x1000d196
xor eax, eax
mov ebx, 0xfe
push ebx
push eax
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x10e]
push eax
call fcn.10046720
add esp, 0xc
xor eax, eax
push ebx
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov dword [ebp - 0x248], 0x80
call fcn.10046720
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x24c], 0x80
push dword [esi + 0xc]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x1000d196
lea eax, [ebp - 0x110]
push eax
lea esi, [ebp - 0x22c]
call fcn.100048dd
lea eax, [ebp - 0x258]
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.1000ddad
mov esi, eax
lea eax, [ebp - 0x268]
lea ecx, [ebp - 0x22c]
call fcn.1000ddcd
mov ebx, eax
lea eax, [ebp - 0x270]
lea ecx, [ebp - 0x22c]
call fcn.1000ddad
push dword [esi + 4]
push dword [esi]
push dword [ebx + 4]
push dword [ebx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x260]
push eax
call fcn.1000dfe6
add esp, 0x1c
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x240]
lea ebx, [ebp - 0x27c]
call fcn.10009952
push 0
push edi
lea esi, [ebp - 0x22c]
mov byte [ebp - 4], 0
call fcn.10004e12
inc dword [ebp - 0x23c]
mov eax, dword [ebp - 0x23c]
add dword [ebp - 0x238], 0x10
cmp eax, dword [ebp - 0x234]
jb 0x1000d06a
push dword [ebp - 0x230]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x240]
call fcn.100426ad
ret
Function at 0x1000d694
Capabilities:
Add user account
Add user account to group
Delete user account
Get user security identifier

Disassembly:
push 0xe78
mov eax, 0x1005a5c2
call fcn.1004262a
mov eax, dword [ebp + 8]
mov dword [ebp - 0xe38], eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0xe84]
push eax
mov dword [ebp - 0xe34], ecx
call fcn.1003a533
xor ebx, ebx
push eax
lea ecx, [ebp - 0xe30]
mov dword [ebp - 4], ebx
call fcn.10001206
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0xe84]
mov byte [ebp - 4], 2
call fcn.10004d1a
xor eax, eax
mov esi, 0xfe
push esi
mov word [ebp - 0x114], ax
lea eax, [ebp - 0x112]
push ebx
push eax
call fcn.10046720
xor eax, eax
push esi
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.10046720
add esp, 0x18
lea edi, [esi - 0x7e]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push edi
push dword [ebp - 0xe38]
lea eax, [ebp - 0x114]
push eax
call esi
cmp dword [ebp - 0xe18], 8
mov eax, dword [ebp - 0xe2c]
jae 0x1000d74c
lea eax, [ebp - 0xe2c]
push edi
push eax
lea eax, [ebp - 0x214]
push eax
call esi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0xe64]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0xe68], eax
lea eax, [ebp - 0x214]
push ebx
mov dword [ebp - 0xe64], eax
lea eax, [ebp - 0xe68]
xor esi, esi
push eax
inc esi
push esi
push ebx
mov dword [ebp - 0xe5c], esi
mov dword [ebp - 0xe50], 0x201
call sub.NETAPI32.dll_NetUserAdd
test eax, eax
jne 0x1000d89f
push 0x3ff
lea eax, [ebp - 0x613]
push ebx
push eax
mov byte [ebp - 0x614], bl
call fcn.10046720
xor eax, eax
push 0x7fe
mov word [ebp - 0xe14], ax
lea eax, [ebp - 0xe12]
push ebx
mov edi, 0x400
push eax
mov dword [ebp - 0xe40], edi
call fcn.10046720
add esp, 0x18
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0xe44]
push eax
lea eax, [ebp - 0xe14]
push eax
lea eax, [ebp - 0xe40]
push eax
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0xe38]
mov dword [ebp - 0xe44], edi
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x1000d880
lea eax, [ebp - 0x614]
mov dword [ebp - 0xe3c], eax
mov eax, str.Administrators
cmp dword [ebp + 0x10], ebx
jne 0x1000d83c
mov eax, str.Users
push esi
lea ecx, [ebp - 0xe3c]
push ecx
push ebx
push eax
push ebx
call sub.NETAPI32.dll_NetLocalGroupAddMembers
test eax, eax
jne 0x1000d879
push 0x10063e7c
push dword [ebp - 0xe34]
call fcn.10004deb
mov edi, esi
push ebx
push esi
lea esi, [ebp - 0xe30]
call fcn.10004e12
mov eax, edi
call fcn.100426ad
ret 0xc
push 0x10063e8c
jmp 0x1000d885
push 0x10063ea0
push dword [ebp - 0xe34]
call fcn.10004deb
lea eax, [ebp - 0x114]
push eax
push ebx
call sub.NETAPI32.dll_NetUserDel
jmp 0x1000d8af
push 0x10063eb4
push dword [ebp - 0xe34]
call fcn.10004deb
xor edi, edi
jmp 0x1000d862
Function at 0x1000e497
Capabilities:
Create directory

Disassembly:
push 0x20
mov eax, 0x100594ed
call fcn.100425c1
mov eax, dword [ebp + 8]
lea ebx, [eax + 4]
mov dword [eax], vtable.CAutoRunMgr.0
xor esi, esi
xor eax, eax
mov dword [ebx + 0x18], 7
mov dword [ebx + 0x14], esi
mov dword [ebp - 0x10], ebx
mov word [ebx + 4], ax
mov edi, str.cache_autorunico
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.1002cd36
push 0xffffffffffffffff
push ebx
xor ebx, ebx
mov byte [ebp - 4], 1
call fcn.10004d65
push esi
push 1
lea esi, [ebp - 0x2c]
call fcn.10004e12
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x18], 8
jb 0x1000e4fb
mov eax, dword [eax + 4]
jmp 0x1000e4fe
add eax, 4
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [ebp + 8]
call fcn.10042699
ret 4
Function at 0x1000f294
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
call fcn.100098f4
push esi
push esi
push dword [ebp + 8]
push 0x1000f2dd
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 4], eax
pop esi
je 0x1000f2ce
cmp eax, 0xffffffff
je 0x1000f2ce
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
call fcn.100011b0
mov eax, dword [ebp + 8]
leave
ret 4

Function at 0x1000f859
Capabilities:
Check if file exists
Delete file
Get file attributes
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x10074118]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x18], 8
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x2c4], eax
lea esi, [ebx + 4]
jb 0x1000f884
mov eax, dword [esi]
jmp 0x1000f886
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000f921
cmp dword [ebx + 0x18], 8
jb 0x1000f8a0
mov edi, dword [esi]
jmp 0x1000f8a2
mov edi, esi
call fcn.10026adc
cmp dword [ebx + 0x18], 8
jb 0x1000f8af
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
push 0x2b0
lea eax, [ebp - 0x2bc]
push esi
push eax
mov dword [ebp - 0x2c0], esi
call fcn.10046720
mov eax, dword [ebp - 0x2c4]
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x1000f8e4
mov eax, dword [eax + 4]
jmp 0x1000f8e7
add eax, 4
push 0x100
push 0x2b4
lea ecx, [ebp - 0x2c0]
push ecx
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [ebp - 0x2c0]
cmp ecx, esi
jne 0x1000f90e
xor eax, eax
jmp 0x1000f924
mov edx, ebx
call fcn.10026316
push dword [ebp - 0x2c0]
call dword [sym.imp.USER32.dll_DestroyIcon]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100408d9
leave
ret 4
Function at 0x1001454c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x10074118]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push 0x11c
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.10046720
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x74], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push str.RtlGetNtVersionNumbers
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100145ca
and dword [ebp - 0x78], 0
and dword [ebp - 0x80], 0
and dword [ebp - 0x7c], 0
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x78]
push ecx
call eax
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x100145ca
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp + 0xa8]
xor eax, eax
cmp dword [ebp - 0x70], 0xa
sete al
xor ecx, ebp
call fcn.100408d9
add ebp, 0xac
leave
ret

Function at 0x100145e8
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x10074118]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0x11c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.10046720
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
mov ecx, dword [ebp + 0x9c]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.100408d9
add ebp, 0xa0
leave
ret

Function at 0x100150e9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10074118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x10015107
mov eax, dword [eax + 4]
jmp 0x1001510a
add eax, 4
cmp dword [ecx + 0x3c], 8
jb 0x10015115
mov ecx, dword [ecx + 0x28]
jmp 0x10015118
add ecx, 0x28
push eax
push ecx
push str._ls_hs.png
lea ecx, [ebp - 0x20]
call fcn.10028d88
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp dword [ebp - 8], 8
jae 0x10015136
lea eax, [ebp - 0x1c]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push 0
push 1
lea esi, [ebp - 0x20]
mov edi, ecx
call fcn.10004e12
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.100408d9
leave
ret 4