joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10a5165
Capabilities:
Encode data using xor

Disassembly:
call fcn.010cff6b
imul ecx, dword [esi], 0x7388084
inc edx
loopne 0x10a4efd
add byte [eax], al
shr bl, 2
or eax, 0xcacde8e0
add al, byte [eax]
push ss
add byte [eax], al
mov al, byte [0x3041e848]
inc esp
call 0xd2651ef5
push cs
and al, ch
mov word [ebp + 0x2c], ds
add byte [ebx + 0x74], dl
pop ss
nop
mov byte [edx - 0x457b4fbf], bh
inc ecx
xor cl, dh
add dword [eax], eax
sub al, 0x77
pop ebp
sub al, 0
in eax, dx
mov eax, 0x4ad42026
inc ecx
adc al, dl
dec edx
inc ecx
inc eax
sbb dword [eax], eax
add byte [eax - 0x1717b273], al
cmp edx, eax
cli
invalid
call fcn.010f7890
ja 0x10a4f04
add byte [eax], dl
push esp
pop ecx
inc edx
mov al, byte [0xd005f900]
pop eax
pop ecx
inc edx
pushal
call fcn.01299031
cwde
sub al, dh
adc byte [ebx], dh
inc ecx
jo 0x10a4f2c
xor eax, dword [ecx + 0x40]
or al, byte [eax]
add byte [eax + 0x5ffc4d8b], dh
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01043035
call fcn.01200ea5
cwde
inc esi
inc edx
adc ah, ch
dec ebx
or al, dl
xchg esp, eax
inc esi
inc edx
xor byte [esi], dl
add byte [eax], al
loopne 0x10a4f34
stc
invalid
loope 0x10a4f8e
pop ds
add byte [eax], dh
adc eax, 0xa948001f
inc ecx
loopne 0x10a4f9d
test eax, 0x3d8041
add al, ah
call fcn.01042486
sub al, 0x4d
inc ecx
adc byte [edx], dl
lcall 0x2000, 0xea026
sub byte [ebp + 0x41], cl
sub al, 0xf1
scasd eax, dword es:[edi]
add al, byte [eax]
sar ch, 0x81
loopne 0x10a4f63
stc
jmp [ecx*2 - 0x65edefbf]
inc byte [eax - 0x30]
push ss
add byte [eax], al
push eax
and al, 0xbd
xor dl, byte [eax + 0xcc2c9]
call fcn.010d1973
inc eax
add byte [eax], al
rol byte [esi + eax*2 + 0x42], 1
mov al, byte [0xf0424640]
int3
inc edx
invalid
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.01042486
js 0x10a5143
inc edx
adc cl, ah
push es
or eax, 0x6dd0
insd dword es:[edi], dx
add byte [eax], al
mov al, byte [0xb0420674]
call fcn.0136ac47
add esp, esi
cmp esi, dword [eax + 0x6c]
mov bl, 0x40
shr byte [eax - 0x4d], 0x40
mov al, byte [0x117]
jmp 0x10a4e8c
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0105762e
call fcn.010d1973
insd dword es:[edi], dx
add byte [eax], al
xor byte [ecx + eax + 0x42], al
rol byte [eax + 1], 1
inc edx
mov al, 0xdb
inc ecx
or eax, 0xbd0fe8d0
adc eax, 0x416d6c00
and byte [esp + 0x6d680022], ah
inc ecx
push eax
pop ss
add dword [eax], eax
loopne 0x10a5132
invalid
Function at 0x10ab310
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [ecx + 0x48890448], cl
or byte [ecx + 0x48891448], cl
sbb byte [ecx + 0x48891c48], cl
and al, 0x89
dec eax
sub byte [ecx - 0x76a0d3b8], cl
dec eax
xor byte [ecx + 0x48893448], cl
cmp byte [esi - 0x3d], bl
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push edi
lea eax, [ebp - 0x10]
push eax
mov edi, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call fcn.010e7ec4
call fcn.01200ea5
test byte [esi + 0x3dd59041], ah
pop ds
add byte [eax + 0x2fc041a6], 0
add al, ah
call fcn.010cff6b
popal
stosd dword es:[edi], eax
add byte [eax], 0xb4
push ebp
inc ecx
xor byte [esi], cl
add byte [eax], al
sub ah, 0x82
and eax, 0x4c05e8b0
add al, byte [eax]
js 0x10ab2e9
add byte [eax - 0x40], 0x40
inc ecx
mov al, 0x21
add byte [eax], al
adc byte [edx - 0x178fd80b], ah
clc
add al, byte gs:[eax]
xlatb
add byte [eax], al
invalid
Function at 0x10afd2d
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x78
push esi
push edi
xor edi, edi
cmp dword [ebx + 8], edi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x30], edi
jne 0x10afdab
call fcn.01200ea5
push esp
jmp 0x10afdd5
cmp dword [ebx + 0x10], edi
je 0x10afd8c
cmp dword [ebx + 0xc], edi
jne 0x10afdba
cmp dword [ebx + 0x14], edi
jne 0x10afd8c
lea eax, [ebp - 8]
push eax
call fcn.010a3a91
mov esi, eax
cmp esi, edi
jl 0x10b04b7
call fcn.011f3f3c
cmp byte [ecx + eax*2 - 0x30], bl
xor al, 0x5c
sal byte [esp + ebx*2], 1
inc ecx
push eax
sal byte [ebx], cl
and eax, dword [eax + 0x7000003c]
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 8]
call fcn.0105756e
call fcn.010cff6b
mov al, byte [0xd4608343]
mov eax, dword [0x758041]
add al, ah
invalid
jge 0x10b051b
call fcn.011f3f3c
adc byte [ecx + eax*2 - 0x10], dl
or al, 0x54
inc ecx
xor dl, dl
nop
and eax, 0x24c0
loopne 0x10b04b5
aam 9
adc eax, 0x40df1c00
inc eax
fstp xword [eax]
cmp byte [eax], dh
sbb bh, bl
inc eax
push eax
iretd
call fcn.0136ac47
adc al, 0xb
cmp ah, byte [eax - 0x7fbf36c8]
xor al, 0xc9
inc eax
invalid
Function at 0x10b075d
Capabilities:
Authenticate hmac

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
jne 0x10b08e9
call fcn.01042486
in al, 0xee
inc ecx
push eax
in al, 0x8c
push cs
push eax
xor eax, dword [eax]
add byte [eax - 0x20], dl
out dx, al
inc ecx
push eax
mov ebx, 0x80070057
call fcn.010cff6b
push 0xb840825b
sub eax, 0x71041
add byte [eax + 0x51], dh
inc ecx
adc byte [edi], al
add byte [eax], al
jo 0x10b07f9
fsubr qword [eax]
push eax
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10b0852
call fcn.01042486
fcom dword [ecx + 0x42]
xor ah, ah
sbb dword [edi], eax
adc byte [eax], ah
add byte [eax], al
jo 0x10b07a1
push ecx
inc edx
add al, ch
rol byte [esi], 1
adc eax, 0x424c2000
adc byte [ecx + 0x1cf0082c], cl
dec esp
inc edx
push eax
cmp byte [eax], al
add byte [eax], ah
call fcn.01200ea5
adc al, 0x2b
inc edx
invalid
shr al, 1
xchg ecx, eax
jo 0x10b0802
add cl, bh
add byte [eax], al
pushal
mov esp, 0xa17040bf
fistp qword [edx]
mov al, byte [0xa040bfc0]
test byte [eax + 0x3c], 2
je 0x10b0852
call fcn.010f7890
cmc
add dword [eax], eax
pushal
xor byte [edx], al
inc edx
xor ch, bl
xor eax, 0x234c00d
add al, byte [edx + 0x30]
fnsave dword [0x234c00d]
inc edx
shr al, 1
cmp al, 0xf7
add dword [eax], eax
mov cl, 0xc6
and eax, 0x5c
jecxz 0x10b0877
xor byte [esi], bl
add al, al
mov eax, dword [0x53400f0d]
push 0x10076d8
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
call fcn.010d1973
add byte gs:[eax], al
xor byte [edx + ecx], dl
inc edx
push eax
adc byte [edx], cl
inc edx
mov al, byte [0x100cf130]
call fcn.010f7890
cmp eax, 0x34800000
inc edi
inc ecx
adc byte [esi], bh
out dx, al
nop
nop
cmp byte [edi + 0x41], al
mov al, 0xe8
mov ebx, 0x60001436
aam 0x40
pushal
pop esp
aam 0x40
invalid
jo 0x10b081f
dec ebp
hlt
dec edi
add byte [eax], al
invalid
call fcn.01042486
sbb byte [ecx + eax*2 + 0x30], 0x6b
xor byte [ebx], ah
jo 0x10b0890
add dword [eax], eax
inc eax
jl 0x10b0958
inc ecx
mov al, 0x39
jge 0x10b090d
je 0x10b077c
call fcn.010f7890
pop ss
add byte [eax], al
inc eax
mov byte [eax + 0x42], al
ror bl, 0x8f
or byte [eax + 0x6042408c], al
call fcn.010d1973
cld
add dword [eax], eax
loopne 0x10b08aa
rol dword [ecx + 0x10], 0x80
rol dword [ecx + 0x30], 0x36
mov ebx, 0x458db010
hlt
or eax, dword [eax + 0x150546e8]
add byte [eax - 0x4e6fbe85], bh
invalid
Function at 0x10b6ac2
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1426ed0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi + 4]
xor esi, esi
cmp ebx, esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x44], ebx
je 0x10b6dfa
call fcn.011f3f3c
shl dl, 1
inc eax
push eax
int3
call fcn.0137441f
inc eax
in al, 0x1e
mov al, byte [0x4041d7f8]
std
add dword [eax], eax
sal ah, 0xd7
inc ecx
inc eax
call fcn.010cff6b
push ecx
stosd dword es:[edi], eax
and dword [eax], 0xffffffac
aad 0x41
loopne 0x10b6e5f
add byte [eax], al
shr byte [esi], 0x8a
wrmsr
call fcn.011f3f3c
hlt
pushal
dec eax
add dword [eax], eax
add byte [ebx + edi], bl
inc ecx
nop
call fcn.0136ac47
mov ecx, 0x1c9028f3
sub al, byte [ecx + 0x50]
sbb byte [edx], ch
inc ecx
inc eax
sbb eax, dword [eax]
add byte [eax], al
call fcn.01042486
adc eax, 0x41715041
sub dh, byte [eax + 0x47]
add byte [eax], al
mov al, 0x60
adc eax, 0xb3e8e041
adc dword [eax + eax], edx
sbb eax, 0xe8f03339
cld
inc eax
mov al, byte [0x7040fcec]
pop ebp
add byte [eax], al
shr al, 0x13
mov al, byte [0xfb780014]
inc eax
jo 0x10b6f0b
push eax
xor esi, eax
je 0x10b6e97
inc eax
mov al, byte [0xa000001a]
call fcn.010f7890
xor al, byte [eax]
add al, dh
mov esp, 0x724040ad
sbb eax, 0xadc0c03c
inc eax
jo 0x10b6e45
dec ebp
invalid
mov cl, ch
adc eax, dword [eax]
mov ah, 0x27
inc edx
mov al, 0x6d
add byte [eax], al
invalid
Function at 0x10baa38
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1426ed0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push ecx
call fcn.01278dfd
mov al, byte [0x61500554]
add byte [eax], al
push eax
call fcn.01299031
dec eax
or bh, byte [ecx]
mov al, byte [0x40d520]
sbb al, 0xd5
inc eax
pushal
out dx, al
add byte [eax], al
rol byte [ebp - 0x17ba7640], 1
jl 0x10bae5a
call fcn.01200ea5
insb byte es:[edi], dx
jg 0x10baad8
rcl byte [edi + ebx*2 + 0x7f68e004]
inc esp
xor byte [edx], bh
add byte [eax], al
adc byte [ebx - 0x72ff1b9b], al
inc ebp
loopne 0x10baaf9
push 0
push 1
push 0
lea eax, [ebp - 0x14]
push eax
push edi
push esi
call fcn.01083bb5
call fcn.011f3f3c
nop
push ebp
inc ecx
pushal
mov word [ebp + 0x41], ss
add byte [eax - 0x7d], bh
and eax, 0xe20
loopne 0x10bab20
call fcn.0135ebf1
inc esp
add byte [eax], al
adc byte [edi - 0x171ff941], ch
movsb byte es:[edi], byte [esi]
scasd eax, dword es:[edi]
mov edi, 0xa4e8e006
jns 0x10baad9
jmp eax
add al, al
add al, 0x69
inc ecx
add byte [eax], al
imul eax, dword [ecx + 0x10], 0x502296ef
cmp eax, 0xc004d304
je 0x10badcf
test eax, eax
mov dword [ebp - 0x18], eax
jl 0x10bae5a
call fcn.01200ea5
adc al, 0
cmp byte [edx - 0x3f913fbf], dl
and byte [eax + 0x34], ah
xchg edx, eax
inc ecx
lock add byte es:[eax], al
mov al, 0xe8
xor al, 0x54
add dword [eax], eax
and bl, dl
and byte [eax], 0x94
imul eax, dword [ecx + 0x60], 0x600000e0
or eax, 0xe8f0228f
cmp bh, byte [ecx - 8]
invalid
add al, dl
hlt
nop
push ss
add byte [eax], al
inc eax
and al, 0xf
inc ecx
sub al, 0xc9
xchg ecx, eax
adc eax, dword [eax]
pop esp
or eax, dword [ecx]
pop eax
or eax, dword [ecx + 0x20]
je 0x10bad36
sub ah, byte [eax + 0x50000017]
mov dword [ebp - 0x1c], 1
jmp 0x10badcf
call fcn.0137441f
mov bl, ah
inc edx
loopne 0x10bad65
add dword [ecx], 0xffffffeb
add dword [eax], eax
or byte [eax - 0x17cfbe7d], 0xa7
retf 3
call fcn.010d1973
and dword [eax], eax
add al, dh
push 0x645040f0
invalid
Function at 0x10c4b9a
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x1426ed0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0xa0], 0
and word [ebp - 8], 0
push esi
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp + 0xc]
push 0x44
pop ecx
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x14]
push 0x2d
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xac], eax
pop eax
push 0x34
pop esi
push 0x30
pop edx
mov word [ebp - 0x50], 0x35
mov word [ebp - 0x4e], 0x37
mov word [ebp - 0x4c], 0x42
mov word [ebp - 0x4a], 0x39
mov word [ebp - 0x48], cx
mov word [ebp - 0x46], 0x32
mov word [ebp - 0x44], 0x35
mov word [ebp - 0x42], 0x37
mov word [ebp - 0x40], ax
mov word [ebp - 0x3e], si
mov word [ebp - 0x3c], 0x35
mov word [ebp - 0x3a], 0x36
mov word [ebp - 0x38], dx
mov word [ebp - 0x36], ax
mov word [ebp - 0x34], si
mov word [ebp - 0x32], 0x46
mov word [ebp - 0x30], cx
mov word [ebp - 0x2e], 0x42
mov word [ebp - 0x2c], ax
mov word [ebp - 0x2a], 0x39
mov word [ebp - 0x28], dx
mov word [ebp - 0x26], 0x43
mov word [ebp - 0x24], 0x36
mov word [ebp - 0x22], ax
mov word [ebp - 0x20], 0x42
mov word [ebp - 0x1e], 0x41
mov word [ebp - 0x1c], si
mov word [ebp - 0x1a], 0x33
mov word [ebp - 0x18], 0x46
mov word [ebp - 0x16], 0x36
mov word [ebp - 0x14], 0x43
mov word [ebp - 0x12], cx
mov word [ebp - 0x10], 0x46
mov word [ebp - 0xe], cx
mov word [ebp - 0xc], 0x45
mov word [ebp - 0xa], 0x45
mov word [ebp - 0x9c], 0x38
mov word [ebp - 0x9a], si
mov word [ebp - 0x98], 0x39
mov word [ebp - 0x96], dx
mov word [ebp - 0x94], 0x45
mov word [ebp - 0x92], 0x35
mov word [ebp - 0x90], 0x41
mov word [ebp - 0x8e], 0x35
mov word [ebp - 0x8c], ax
mov word [ebp - 0x8a], si
mov word [ebp - 0x88], cx
mov word [ebp - 0x86], 0x36
mov word [ebp - 0x84], dx
mov word [ebp - 0x82], ax
mov word [ebp - 0x80], si
mov word [ebp - 0x7e], 0x39
mov word [ebp - 0x7c], 0x43
mov word [ebp - 0x7a], 0x41
mov word [ebp - 0x78], ax
mov word [ebp - 0x76], 0x42
mov word [ebp - 0x74], 0x42
mov word [ebp - 0x72], 0x31
mov word [ebp - 0x70], dx
mov word [ebp - 0x6e], ax
mov word [ebp - 0x6c], 0x46
mov word [ebp - 0x6a], cx
mov eax, dword [ebp - 0xa4]
xor esi, esi
cmp eax, esi
mov word [ebp - 0x68], 0x33
mov word [ebp - 0x66], 0x45
mov word [ebp - 0x64], 0x41
mov word [ebp - 0x62], 0x45
mov word [ebp - 0x60], cx
mov word [ebp - 0x5e], 0x38
mov word [ebp - 0x5c], cx
mov word [ebp - 0x5a], 0x39
mov word [ebp - 0x58], dx
mov word [ebp - 0x56], 0x32
call fcn.01042486
inc eax
inc esp
inc edx
mov al, 0xe4
or byte [eax - 0x5fffff8e], al
cmp al, 0x44
inc edx
nop
call fcn.01042486
and al, 0x7f
inc ecx
add byte [eax], dh
cmpsb byte [esi], byte es:[edi]
and eax, esi
inc byte [ecx]
add al, dl
and byte [edi + 0x41], bh
shr al, 0xbf
salc
idiv edi
pushal
jl 0x10c4e0b
pushal
invalid
ret 0xe040
Function at 0x10c9562
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
sub al, byte [eax]
sbb eax, 0xb80043ce
js 0x10c9595
nop
xor byte [eax], al
add byte [eax + 0x704178b4], dh
jmp fcn.010c9323
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push 0x1009008
push dword [ebp + 8]
call fcn.010c8f85
call fcn.010cff6b
loope 0x10c954a
test byte [eax - 0xc], al
bound eax, qword [edx - 0x20]
pop eax
add byte [eax], al
pushal
mov eax, 0xe8d0054f
out dx, al
invalid

Function at 0x10cbd94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x1426ed0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
push esi
push edi
xor edi, edi
mov esi, ecx
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x90], edi
call fcn.01050eea
call fcn.011f3f3c
mov ebx, cs
inc ecx
push eax
mov bl, cl
inc ecx
mov al, byte [0xe00fe6a3]
jle 0x10cbe06
add byte [eax - 0x18], dl
das
adc dword [edx], 0x416d5400
nop
push eax
insd dword es:[edi], dx
inc ecx
push eax
dec edx
and dl, byte [eax]
xchg esi, eax
add byte [eax], al
invalid

Function at 0x10ce288
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push edi
push 5
pop eax
xor edi, edi
cmp dword [ebp + 0x18], eax
jbe 0x10ce29e
mov dword [ebp + 0x18], eax
xor eax, eax
cmp dword [ebp + 0x18], eax
jbe 0x10ce2b7
lea ecx, [ebp + 0x18]
add ecx, 4
mov edx, dword [ecx]
mov dword [ebp + eax*4 - 0x14], edx
inc eax
cmp eax, dword [ebp + 0x18]
jb 0x10ce2a8
push esi
push 0x1009460
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
jne 0x10ce2e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10ce2df
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x10ce322
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push 0
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x10ce31b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10ce319
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test edi, edi
pop esi
jge 0x10ce34c
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10ce34c
test byte [eax + 0x3c], 2
je 0x10ce34c
push edi
push 0x10094b8
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
mov eax, edi
pop edi
leave
ret
Function at 0x10cfeae
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1426ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x90
lea eax, [ebp - 0x94]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
xor edi, edi
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10cff0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
mov edi, eax
jmp 0x10cff30
cmp dword [ebp - 0x88], 2
jne 0x10cff2c
cmp dword [ebp - 0x94], 5
ja 0x10cff27
jne 0x10cff2c
cmp dword [ebp - 0x90], edi
jbe 0x10cff2c
xor eax, eax
inc eax
jmp 0x10cff2e
xor eax, eax
mov dword [esi], eax
test edi, edi
jge 0x10cff59
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10cff59
test byte [eax + 0x3c], 2
je 0x10cff59
push edi
push 0x10096ec
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01043035
leave
ret 4
Function at 0x10d1136
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call fcn.01053c22
cmp eax, edi
mov dword [ebp + 0xc], eax
jl 0x10d11ad
mov eax, dword [ebp - 4]
push esi
lea ecx, [ebp - 8]
push ecx
push edi
lea ecx, [ebp + 8]
push ecx
push edi
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
xor esi, esi
sub ecx, edi
je 0x10d1193
dec ecx
dec ecx
je 0x10d118f
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.01044c5f
test eax, eax
je 0x10d11a7
jmp 0x10d1196
xor esi, esi
jmp 0x10d1196
xor esi, esi
inc esi
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x10d11a7
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
cmp dword [ebp + 0xc], edi
pop esi
jge 0x10d11d4
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10d11d4
test byte [eax + 0x3c], 2
je 0x10d11d4
push dword [ebp + 0xc]
push 0x10096fc
push 0x2d
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 4]
call fcn.01045411
mov eax, dword [ebp + 0xc]
pop edi
leave
ret 0x14
Function at 0x10d3aea
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1426ed0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 4
push 1
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call esi
test eax, eax
jne 0x10d3b58
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
mov dword [ebp - 0x10], eax
jmp 0x10d3c0f
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 6
push 1
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
je 0x10d3b44
lea eax, [ebp - 0x20]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10d3b44
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push ecx
push 2
push eax
call fcn.010d37ec
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x10d3c14
push edi
mov edi, dword [ebp - 0x1c]
cmp dword [edi], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
jbe 0x10d3bff
lea esi, [edi + 4]
push dword [esi]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10d3bce
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x14], ebx
jmp 0x10d3be8
push dword [esi]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10d3be8
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], 1
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add esi, 8
cmp eax, dword [edi]
jb 0x10d3bb2
cmp dword [ebp - 0x14], ebx
jne 0x10d3c06
cmp dword [ebp - 0x28], ebx
jne 0x10d3c06
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
pop edi
cmp dword [ebp - 0x10], ebx
jge 0x10d3c3b
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10d3c3b
test byte [eax + 0x3c], 2
je 0x10d3c3b
push dword [ebp - 0x10]
push 0x10096ec
push 0x2f
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 0x18]
call fcn.01050e70
lea ecx, [ebp - 0x24]
call fcn.01050e70
lea ecx, [ebp - 0x1c]
call fcn.010cfe2a
lea ecx, [ebp - 0x20]
call fcn.010453e3
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.01043035
leave
ret 4
Function at 0x10d6c72
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
xor edx, edx
movzx esi, word [ecx + 6]
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x10d6cb1
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x10d6ca7
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x10d6cb3
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x10d6c97
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10eea7f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
not eax
jbe 0x10eeab8
push ebx
movzx ebx, byte [ecx]
dec dword [ebp + 0x10]
mov edx, eax
shr edx, 0x18
xor edx, ebx
and edx, 0xff
shl eax, 8
xor eax, dword [edx*4 + 0x10112e8]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x10eea93
pop ebx
not eax
pop ebp
ret 0xc