joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41aba0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b5a4
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44e014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x34
call fcn.0041c880
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
push dword [ebp + 0x10]
call fcn.00417f30
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00417f30
mov dword [esi + 0x30], 0x4069c0
mov dword [ebp + 0x10], esi
lea ebx, [edi + 4]
mov dword [ebp - 4], 2
push ebx
push 0
push esi
push 0x41c060
push 0
push 0
call fcn.00422942
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x41ac3c
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 6
mov dword [ebx], 0
call fcn.0041d98d
int3

Function at 0x42dc9f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042db15

Function at 0x44dcec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x44dcfb
pop dword [ebp - 0x24]
mov eax, 0x73e0fa41
sub eax, 0x739c1d46
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x1c19e4fb
add dword [ebp - 0x34], 0x32386050
mov dword [ebp - 0x30], 0x1b203c1f
sub dword [ebp - 0x30], 0xe8ecefda
mov dword [ebp - 0x2c], 0xb7e5a5ab
add dword [ebp - 0x2c], 0x94669e83
mov dword [ebp - 0x28], 0x9555e9ad
sub dword [ebp - 0x28], 0x9555e9ad
lea eax, [ebp - 0x34]
push eax
mov eax, 0x19ae113
sub eax, 0x15530af
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x98a5f3d6
sub dword [ebp - 0x34], 0x24338a80
mov dword [ebp - 0x30], 0x2deaa1ae
add dword [ebp - 0x30], 0x1381bfc7
mov dword [ebp - 0x2c], 0xe3a40365
sub dword [ebp - 0x2c], 0x803496f9
mov dword [ebp - 0x28], 0xdc24a004
add dword [ebp - 0x28], 0x23db5ffc
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x4fadaf70
add eax, 0xb0980110
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x4b8d4
push 0
call eax
mov ecx, 0x4116
mov edi, eax
mov esi, 0x643944f8
sub esi, 0x63f1e4f8
add esi, dword [ebp - 0x24]
mov ebx, 0x27ed969
mov edx, dword [esi]
xor dword [ebp - 8], edi
add edx, ebx
add dword [ebp - 8], 0x389fc2bb
mov dword [edi], edx
add edi, 4
add esi, 4
loop 0x44de11
add eax, 0xf72b
xor ebx, ebx
add ebx, eax
add eax, 0x8d3ac4cc
add eax, 0x72c53b39
mov ecx, 0x7bd8089c
sub ecx, 0x7b98089c
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10007f30
Capabilities:
Create process on windows

Disassembly:
push 0x34
mov eax, 0x1004b085
call fcn.100494ce
mov edi, ecx
mov esi, dword [edi + 0x5c]
cmp esi, dword [edi + 0x60]
je 0x10007fae
xor ebx, ebx
lea ecx, [ebp - 0x28]
call fcn.1000a1e0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0
je 0x10007f9a
push esi
mov edx, 0x10057484
lea ecx, [ebp - 0x40]
call fcn.1000c51f
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x28]
push 5
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
push ebx
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
call fcn.10002403
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10002403
add esi, 0x18
cmp esi, dword [edi + 0x60]
jne 0x10007f48
call fcn.10049478
ret
Function at 0x1000811a
Capabilities:
Create process on windows

Disassembly:
push 0x94
mov eax, 0x1004b14d
call fcn.100494ce
mov esi, ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xa0]
call fcn.1000a1e0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0xa0]
call fcn.10019b60
push str.HaoZipCD.exe
lea ecx, [ebp - 0x40]
call fcn.100022ea
mov byte [ebp - 4], 2
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x88]
call fcn.1001cb20
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.10002403
push 0x1005749c
lea ecx, [ebp - 0x70]
call fcn.100022ea
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x5c]
cmp dword [eax + 0x10], ebx
je 0x1000824f
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x40]
mov edx, dword [esi + 0x5c]
call fcn.1001cd20
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x28]
push eax
call fcn.10002229
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x40]
call fcn.10002403
lea ecx, [ebp - 0x28]
call fcn.10018110
test al, al
jne 0x1000822c
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 8
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.10002229
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x40]
call fcn.10002403
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x70]
push eax
call fcn.10002a58
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.10002403
mov esi, str.__ext
push esi
call fcn.1003dd45
pop ecx
push eax
push esi
lea ecx, [ebp - 0x70]
call fcn.10002a58
cmp dword [ebp - 0x5c], 8
lea ecx, [ebp - 0x70]
push 1
cmovae ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x88]
cmp dword [ebp - 0x74], 8
push ebx
cmovae eax, dword [ebp - 0x88]
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.10002403
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x88]
call fcn.10002403
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xa0]
call fcn.10002403
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.10002403
call fcn.10049478
ret
Function at 0x10009cb4
Capabilities:
Create process on windows

Disassembly:
push 0xdc
mov eax, 0x1004b519
call fcn.100494ce
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
je 0x10009edb
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], bl
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x58]
call fcn.1000204e
push ecx
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x40]
call fcn.1001d010
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa0]
mov dword [esp], 0x10057548
call fcn.100022ea
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
push ecx
mov edx, eax
lea ecx, [ebp - 0x88]
call fcn.1000250a
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
push eax
call fcn.10002229
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
call fcn.10002403
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa0]
call fcn.10002403
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 5
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0xac]
call fcn.1000a985
pop ecx
test al, al
je 0x10009ea9
cmp dword [ebp - 0x18], ebx
je 0x10009ea9
push str..FROM_HAOZIPEXT_2.
lea ecx, [ebp - 0x88]
call fcn.100022ea
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
push ecx
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.1000250a
pop ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x40]
push eax
call fcn.10002229
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa0]
call fcn.10002403
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x88]
call fcn.10002403
lea ecx, [ebp - 0x70]
call fcn.1000a1e0
mov byte [ebp - 4], 8
cmp dword [ebp - 0x60], ebx
je 0x10009e9d
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
push 7
cmovae eax, dword [ebp - 0x70]
lea edi, [ebp - 0xc8]
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
mov dword [ebp - 0xd4], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xe8], 0x3c
mov dword [ebp - 0xe4], 0x440
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], str.Open
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xe8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x10009e9d
cmp dword [ebp - 0xb0], ebx
je 0x10009e9d
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esi
call fcn.1003446e
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x70]
call fcn.10002403
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.10002403
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xac]
call fcn.1001c180
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
call fcn.10002403
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.1000c2a6
call fcn.10049478
ret 0xc
Function at 0x1000a2b3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x23c
mov eax, 0x1004b6a2
call fcn.100494ce
mov esi, ecx
mov dword [ebp - 0x244], esi
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x248], esi
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREHaoZip
push 0x80000002
mov dword [ebp - 0x238], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000a31a
xor eax, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x238], 1
jmp 0x1000a488
push 0x20a
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.10038450
add esp, 0xc
mov dword [ebp - 0x240], 0x208
lea eax, [ebp - 0x240]
xor edi, edi
inc edi
mov dword [ebp - 0x244], edi
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x244]
push eax
push ebx
push str.Path
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x23c]
test eax, eax
je 0x1000a396
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0x10], ebx
xor eax, eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x238], edi
jmp 0x1000a488
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x240]
cmp eax, 0x104
ja 0x1000a3c2
add eax, eax
cmp eax, 0x20a
jae 0x1000a490
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
jmp 0x1000a3c8
xor eax, eax
mov word [ebp - 0x14], ax
xor eax, eax
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
mov dword [ebp - 4], edi
lea eax, [ebp - 0x21c]
push eax
call fcn.1003dd45
pop ecx
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.1000242e
mov edi, str.SMDB
push edi
call fcn.1003dd45
pop ecx
push eax
push edi
lea ecx, [ebp - 0x234]
call fcn.10002a58
mov edi, str.HaoZip.exe
push edi
call fcn.1003dd45
pop ecx
push eax
push edi
lea ecx, [ebp - 0x234]
call fcn.10002a58
lea ecx, [ebp - 0x234]
call fcn.10019910
test al, al
je 0x1000a461
lea eax, [ebp - 0x234]
mov ecx, esi
push eax
call fcn.1000228a
jmp 0x1000a470
xor eax, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 0x238], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x234]
call fcn.10002403
mov eax, esi
call fcn.10049478
ret
call fcn.1003673c
int3
Function at 0x1000dff4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x42c
mov eax, 0x1004c044
call fcn.1004953c
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
xor ebx, ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
push 0x60
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x1000e071
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x1000e071
call fcn.1000d6dd
mov edi, eax
jmp 0x1000e188
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x1000e094
call fcn.1000d6dd
jmp 0x1000e17b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000e08a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x420], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x1000e0c7
mov edi, 0x8007000e
jmp 0x1000e17d
push 2
pop ecx
mov byte [ebp - 4], cl
mul ecx
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], edx
cmp edx, ebx
ja 0x1000e1b2
cmp eax, 0xffffffff
ja 0x1000e1b2
cmp eax, 0x400
jbe 0x1000e101
push eax
lea ecx, [ebp - 0x418]
call fcn.10010277
jmp 0x1000e10d
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x1000e131
cmp dword [ebp - 0x418], 0
je 0x1000e0bd
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x41c]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000e08a
xor edx, edx
mov eax, dword [ebp - 0x418]
mov word [eax + ecx*2], dx
push dword [ebp + 0x14]
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.1000ec55
mov edi, eax
test esi, esi
je 0x1000e188
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], bl
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000e1a4
lea ecx, [ebp - 0x418]
call fcn.1001026e
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.10049489
ret 0x10
push 0x80070216
call fcn.1000d686
int3
Function at 0x1001030f
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x1004c326
call fcn.1004949a
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor ebx, ebx
test eax, eax
js 0x100103d1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push 2
push edi
mov esi, 0x80000002
lea ecx, [ebp - 0x18]
push esi
call fcn.1000db3a
test eax, eax
je 0x10010397
sub esp, 0x14
lea ecx, [ebp - 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionShell_Extensions
push esi
call fcn.1000dade
test eax, eax
jne 0x1001036e
lea ecx, [ebp - 0x18]
call fcn.1000dac4
sub esp, 0x14
lea ecx, [ebp - 0x18]
push edi
push esi
call fcn.1000dade
test eax, eax
jne 0x10010387
lea ecx, [ebp - 0x18]
call fcn.1000dac4
push 2
push edi
push esi
lea ecx, [ebp - 0x18]
call fcn.1000db3a
test eax, eax
jne 0x100103c5
mov esi, str.HaoZip_Shell_Extension
push esi
call fcn.1003dd45
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.5FED836A_C96C_4d88_A91E_F63F07726585
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x18]
call fcn.1000dac4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000dac4
push ecx
push ecx
call fcn.1000fce2
mov esi, eax
test esi, esi
jne 0x10010407
push ebx
push ebx
push 0x65
mov edi, 0x100670c8
pop edx
mov ecx, edi
call fcn.1000f624
push ebx
push ebx
push 0x66
pop edx
mov ecx, edi
call fcn.1000f624
push ebx
push ebx
push 0x67
pop edx
mov ecx, edi
call fcn.1000f624
mov eax, esi
call fcn.10049463
ret

Function at 0x1001040f
Capabilities:
Delete registry value

Disassembly:
push 0xc
mov eax, 0x1004c326
call fcn.1004949a
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x1001046d
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x18]
push 2
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push 0x80000002
call fcn.1000db3a
test eax, eax
jne 0x10010459
push str.5FED836A_C96C_4d88_A91E_F63F07726585
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x18]
call fcn.1000dac4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000dac4
push ecx
push ecx
call fcn.1000fd76
call fcn.10049463
ret
Function at 0x10016986
Capabilities:
Create process on windows

Disassembly:
push 0xa4
mov eax, 0x1004d4e2
call fcn.100494ce
mov byte [ebp - 0x59], cl
mov esi, dword [ebp + 0x38]
mov edi, dword [ebp + 0x3c]
mov dword [ebp - 4], 1
test dl, dl
je 0x100169cf
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call fcn.1001804c
mov ecx, eax
call fcn.100180e3
test al, al
jne 0x100169cf
xor ebx, ebx
mov byte [ebp - 0x59], bl
jmp 0x10016b30
push 0x44
xor ebx, ebx
lea eax, [ebp - 0xb0]
push ebx
push eax
call fcn.10038450
push 0x10
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.10038450
add esp, 0x18
mov dword [ebp - 0xb0], 0x44
mov dword [ebp - 0x84], 0x80
cmp dword [ebp + 0x30], ebx
je 0x10016a44
cmp dword [ebp + 0x34], 8
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
cmp word [eax], 0x20
je 0x10016a44
lea eax, [ebp + 0x20]
mov edx, 0x10059100
push eax
lea ecx, [ebp - 0x40]
call fcn.1000c51f
pop ecx
push eax
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 2
call fcn.10002229
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.100021f5
lea eax, [ebp + 8]
mov edx, 0x10059104
push eax
lea ecx, [ebp - 0x40]
call fcn.1000c51f
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
mov edx, eax
mov dword [esp], 0x10059104
call fcn.10017062
pop ecx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 5
call fcn.100021f5
lea eax, [ebp + 0x20]
push eax
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x28]
call fcn.100170a8
pop ecx
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xb0]
push ecx
push ebx
push ebx
push 0x4000020
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10016abc
mov byte [ebp - 0x59], bl
jmp 0x10016b18
test esi, esi
je 0x10016ac5
mov eax, dword [ebp - 0x64]
mov dword [esi], eax
cmp byte [ebp - 0x59], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6c]
je 0x10016af9
test eax, eax
je 0x10016af9
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x10016aef
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x6c]
call esi
mov eax, ebx
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x68], 0
je 0x10016b0a
push dword [ebp - 0x68]
call esi
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x68], ebx
test eax, eax
je 0x10016b14
push eax
call esi
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x59], 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.100021f5
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.100021f5
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.100021f5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.100021f5
mov al, byte [ebp - 0x59]
call fcn.10049478
ret
Function at 0x10017941
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1006500c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.10038450
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1001799d
cmp dword [ebp - 0x114], 5
ja 0x10017999
jne 0x1001799d
cmp dword [ebp - 0x110], 0
jbe 0x1001799d
mov al, 1
jmp 0x1001799f
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036316
leave
ret

Function at 0x100179ab
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1006500c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.10038450
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100179fc
cmp dword [ebp - 0x114], 5
jb 0x100179fc
mov al, 1
jmp 0x100179fe
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036316
leave
ret

Function at 0x10017a0a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1006500c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.10038450
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10017a52
xor al, al
jmp 0x10017a5d
cmp dword [ebp - 0x114], 6
sbb al, al
inc al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036316
leave
ret

Function at 0x10017bb6
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1006500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
and dword [esi], 0
cmp dword [0x10067128], 0
jne 0x10017c31
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.10038450
add esp, 0xc
mov dword [ebp - 0x214], 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x210]
push eax
call fcn.1003dd45
pop ecx
push eax
lea eax, [ebp - 0x210]
mov ecx, 0x10067118
push eax
call fcn.1000242e
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10036316
leave
ret
Function at 0x10017cb0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1006500c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100670bc]
mov dword [ebp - 0x218], ecx
test eax, eax
jle 0x10017cdf
inc eax
mov dword [0x100670bc], eax
mov al, 1
jmp 0x10017dcb
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x214]
push ebx
push esi
push edi
push eax
xor bl, bl
call fcn.10017c74
test al, al
je 0x10017db5
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10017db5
push str.ImpersonateLoggedOnUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp - 0x214]
push esi
call eax
test eax, eax
je 0x10017dac
mov ebx, dword [ebp - 0x218]
inc dword [0x100670bc]
cmp dword [ebx], 0
je 0x10017d46
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], esi
xor esi, esi
mov bl, 1
cmp dword [0x10067110], esi
jne 0x10017dac
push 0x20a
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.10038450
add esp, 0xc
mov dword [ebp - 0x218], 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x210]
push eax
call fcn.1003dd45
pop ecx
push eax
lea eax, [ebp - 0x210]
mov ecx, 0x10067100
push eax
call fcn.1000242e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10017dbb
mov esi, dword [ebp - 0x214]
test esi, esi
je 0x10017dc6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036316
leave
ret