joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403aa6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f060]
jne 0x403ab0
repz ret
jmp fcn.0040495e

Function at 0x408aec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405a77
and dword [ebp - 4], 0
cmp dword [0x41069c], 0
mov ebx, eax
jne 0x408b9d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c4e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c4e
push eax
call fcn.00405a05
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41069c], eax
call esi
push eax
call fcn.00405a05
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4106a0], eax
call esi
push eax
call fcn.00405a05
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4106a4], eax
call esi
push eax
call fcn.00405a05
pop ecx
mov dword [0x4106ac], eax
test eax, eax
je 0x408b9d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405a05
pop ecx
mov dword [0x4106a8], eax
mov eax, dword [0x4106a8]
cmp eax, ebx
je 0x408bf5
cmp dword [0x4106ac], ebx
je 0x408bf5
push eax
call fcn.00405a80
push dword [0x4106ac]
mov esi, eax
call fcn.00405a80
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408bf5
test edi, edi
je 0x408bf5
call esi
test eax, eax
je 0x408bec
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408bec
test byte [ebp - 0xc], 1
jne 0x408bf5
or dword [ebp + 0x10], 0x200000
jmp 0x408c2e
mov eax, dword [0x4106a0]
cmp eax, ebx
je 0x408c2e
push eax
call fcn.00405a80
pop ecx
test eax, eax
je 0x408c2e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c2e
mov eax, dword [0x4106a4]
cmp eax, ebx
je 0x408c2e
push eax
call fcn.00405a80
pop ecx
test eax, eax
je 0x408c2e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41069c]
call fcn.00405a80
pop ecx
test eax, eax
je 0x408c4e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c50
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40b2b7
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40b2b7
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40b2b7
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.004018e0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov ecx, dword [ebp + 0x14]
call fcn.00401920
push eax
call fcn.00403cf0
add esp, 0xc
mov al, 1
jmp 0x40b2b9
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x40db20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4152a1
mov eax, dword fs:[0]
push eax
sub esp, 0x4f8
mov eax, dword [0x41d048]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x454], esi
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [0x41d484]
add esp, 0xc
lea ecx, [ecx + 0x74]
call fcn.00410d15
test eax, eax
je 0x40dd0e
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40dd0e
lea eax, [ebp - 0x218]
push eax
push 0
push 0x4178e0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40dd0e
push 1
push 0x40
push 0x20
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x504]
call fcn.0040a660
mov ecx, dword [0x41d484]
mov dword [ebp - 4], 0
lea ecx, [ecx + 0x74]
call fcn.00410d91
mov edx, eax
mov dword [ebp - 0x428], 0
mov ecx, edx
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40dc10
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x438]
call fcn.00403200
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.004032d0
add esp, 8
cmp dword [ebp - 0x43c], 0x10
lea eax, [ebp - 0x450]
push 0
push dword [ebp - 0x440]
cmovae eax, dword [ebp - 0x450]
dec dword [ebp - 0x50373]
call dword [eax - 0x3a]
inc ebp
cld
add bh, bh
adc eax, sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const___long_long___int64__
lea ecx, [ebp - 0x500]
call fcn.0040e1f0
test eax, eax
jne 0x40dc96
push eax
mov eax, dword [ebp - 0x504]
lea ecx, [ebp - 0x504]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x450]
call fcn.00403100
mov edx, dword [ebp - 0x424]
cmp edx, 0x10
jb 0x40dce1
mov ecx, dword [ebp - 0x438]
inc edx
mov eax, ecx
mov byte [ebp - 4], 3
cmp edx, 0x1000
jb 0x40dcd7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40dcd7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00412a01
add esp, 8
lea ecx, [ebp - 0x504]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
mov dword [ebp - 4], 0xffffffff
call fcn.0040af50
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x218]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dd30
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00408510
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004129c0
mov esp, ebp
pop ebp
ret
Function at 0x10001ca0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1002de32
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x1003a1c0]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push edi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0x124]
mov dword fs:[0], eax
xor ebx, ebx
push 0x103
mov dword [esp + 0x130], ebx
lea eax, [esp + 0x21]
push ebx
mov dword [esp + 0x18], ebx
push eax
mov dword [esp + 0x24], esi
mov byte [esp + 0x28], bl
call fcn.10020580
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0xf01ff
mov dword [esp + 0x1c], 0x104
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
lea edi, [esi + 4]
lea eax, [esp + 0x1c]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [edi], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10001d50
sub eax, edx
push eax
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.10007110
mov dword [esp + 0x12c], ebx
mov eax, dword [esi + 0x14]
cmp eax, ebx
mov dword [esp + 0x10], 1
jbe 0x10001da6
lea ebx, [eax - 1]
cmp ebx, eax
jbe 0x10001d8a
call fcn.1001dd60
cmp dword [esi + 0x18], 0x10
jb 0x10001d92
mov edi, dword [edi]
cmp byte [edi + ebx], 0x5c
mov eax, esi
je 0x10001da8
push 1
push 0x10032dc0
call fcn.10007020
mov eax, esi
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1001e327
add esp, 0x124
ret
Function at 0x10001dd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1002fb28
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1003a1c0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
cmp byte [0x1003c274], 0
jne 0x10001e2a
push 3
push 0
call fcn.10014c20
push 3
push 0
call fcn.10014c20
add esp, 0x10
mov byte [0x1003c274], 1
lea esi, [esp + 0xc]
mov dword [esp + 8], 1
call fcn.10001ca0
push 0xb
push str.ShareAd.xml
mov eax, esi
mov dword [esp + 0x40], 0
call fcn.10007020
push 0xffffffffffffffff
push 0
mov eax, esi
push eax
lea ecx, [edi + 0xc4]
call fcn.10006680
mov ecx, dword [esp + 0x10]
mov esi, 0x10
cmp dword [esp + 0x24], esi
jae 0x10001e76
lea ecx, [esp + 0x10]
call fcn.10013510
test al, al
je 0x10001ec7
cmp dword [esp + 0x24], esi
mov edx, dword [esp + 0x10]
mov byte [edi + 0x210], 1
jae 0x10001e94
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.10001f40
test al, al
jne 0x10001ea7
mov dword [esp + 8], 2
cmp dword [0x1003b4e0], 0
jne 0x10001ee7
cmp dword [esp + 0x24], esi
jb 0x10001ec3
mov ecx, dword [esp + 0x10]
push ecx
call fcn.1001dad4
add esp, 4
xor eax, eax
jmp 0x10001f19
cmp dword [0x1003b4e0], 0
jne 0x10001ee7
cmp dword [esp + 0x24], esi
jb 0x10001ec3
mov edx, dword [esp + 0x10]
push edx
call fcn.1001dad4
add esp, 4
xor eax, eax
jmp 0x10001f19
push 0
push 0
push edi
push 0x10005810
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [esp + 0x24], esi
jb 0x10001f15
mov eax, dword [esp + 0x10]
push eax
call fcn.1001dad4
add esp, 4
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1001e327
mov esp, ebp
pop ebp
ret
Function at 0x100094d0
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1002fc3b
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x1003a1c0]
xor eax, esp
mov dword [esp + 0x1b4], eax
push esi
push edi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0x1c8]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x100095d2
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x2c]
push ecx
push 0x202
mov dword [0x1003c4ec], eax
call sub.WS2_32.dll_WSAStartup
lea ecx, [esp + 0x10]
call fcn.10013280
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x1d4], 0
call fcn.10012bd0
add esp, 4
mov ecx, str.EXPLORER.EXE
lea edi, [esp + 0x10]
call fcn.10009930
test al, al
je 0x10009593
cmp dword [0x1003c4e8], 0
jne 0x100095bc
push 0x60
call fcn.1001e422
add esp, 4
test eax, eax
je 0x1000958a
mov esi, eax
call fcn.1000cbf0
mov dword [0x1003c4e8], eax
jmp 0x100095bc
xor eax, eax
mov dword [0x1003c4e8], eax
jmp 0x100095bc
cmp dword [0x1003b4e0], 0
je 0x100095bc
push 0
push 0
push 0
push 0x10009470
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x100095bc
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [esp + 0x28], 0x10
jb 0x100095db
mov eax, dword [esp + 0x14]
push eax
call fcn.1001dad4
add esp, 4
jmp 0x100095db
test eax, eax
jne 0x100095db
call sym.MemDll.DLL_StopAd
mov eax, 1
mov ecx, dword [esp + 0x1c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1b4]
xor ecx, esp
call fcn.1001e327
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100096f0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x1002fbbb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
cmp dword [0x1003b518], 0
mov ecx, 0x1003b4e8
je 0x10009731
push 0xffffffffffffffff
push 0
push 0x1003b504
call fcn.10006680
jmp 0x10009736
call fcn.1000ffd0
cmp dword [0x1003b4fc], 0
jbe 0x1000974b
mov byte [0x1003c4f0], 0
jmp 0x100097e6
cmp dword [0x1003c4f4], 0
mov byte [0x1003c4f0], 1
jne 0x1000979c
push 0x40
call fcn.1001e422
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x1000977e
mov esi, eax
call fcn.10019420
jmp 0x10009780
xor eax, eax
mov dword [esp + 0x18], 0xffffffff
movzx ecx, word [0x1003c4b0]
push ecx
mov edi, eax
mov dword [0x1003c4f4], eax
call fcn.10019330
cmp dword [0x1003c4f8], 0
jne 0x100097e6
push 4
call fcn.1001e422
add esp, 4
test eax, eax
je 0x100097bd
mov dword [eax], 0
mov esi, eax
jmp 0x100097bf
xor esi, esi
cmp dword [esi], 0
mov dword [0x1003c4f8], esi
jne 0x100097e6
mov edx, dword [0x1003c4b4]
push 0
push 0
push edx
push 0x1000fdb0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi], eax
call fcn.10009b50
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x10009800
Capabilities:
Terminate thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.10009bc0
mov eax, dword [0x1003c4f8]
xor ebx, ebx
cmp eax, ebx
je 0x1000985f
mov ecx, dword [eax]
cmp ecx, ebx
mov edi, dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov ebp, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, eax
je 0x10009839
push ebx
push ecx
call edi
mov eax, dword [esi]
push eax
call ebp
mov eax, dword [0x1003c4f8]
mov dword [esi], ebx
cmp eax, ebx
mov esi, eax
je 0x10009859
mov eax, dword [eax]
cmp eax, ebx
je 0x10009850
push ebx
push eax
call edi
mov ecx, dword [esi]
push ecx
call ebp
mov dword [esi], ebx
push esi
call fcn.1001dad4
add esp, 4
mov dword [0x1003c4f8], ebx
mov eax, dword [0x1003c4f4]
cmp eax, ebx
je 0x100098ad
call fcn.10019620
mov eax, dword [0x1003c4f4]
cmp eax, ebx
mov esi, eax
je 0x100098a7
call fcn.10019620
mov byte [esi], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 8], ebx
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x10009895
push eax
call fcn.1001dad4
add esp, 4
push esi
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.1001dad4
add esp, 4
mov dword [0x1003c4f4], ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x100098e0
Capabilities:
Create thread

Disassembly:
cmp dword [0x1003c754], 0
mov byte [0x1003b4c4], 0
jne 0x10009926
mov eax, dword [esp + 4]
test eax, eax
je 0x1000990c
mov edx, 0x1003c508
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x10009900
push 0
push 0
push 0
push 0x100098c0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x1003c754], eax
xor eax, eax
ret 4
Function at 0x10009990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x1002f588
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x1003a1c0]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
xor ebx, ebx
xor ebp, ebp
jmp 0x100099d0
mov eax, 0xf
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x78], 2
call fcn.10010a90
mov eax, dword [0x1003c4ec]
lea ecx, [ebp + 0x6f]
movzx edx, cx
push 0xa
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x10009a6c
mov ecx, dword [0x1003c4ec]
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x10009a6c
mov edx, dword [0x1003c4ec]
push esi
push edx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
cmp eax, ebx
je 0x10009a6c
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.100108c0
movzx eax, byte [ebp + 0x1003c4fc]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
call fcn.10010540
add esp, 4
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x78], 0xffffffff
call fcn.10010a90
mov eax, dword [esp + 0x54]
cmp eax, ebx
je 0x10009aab
push eax
call fcn.1001dad4
add esp, 4
mov esi, 0x10
cmp dword [esp + 0x48], esi
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
jb 0x10009acf
mov edx, dword [esp + 0x34]
push edx
call fcn.1001dad4
add esp, 4
cmp dword [esp + 0x2c], esi
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
jb 0x10009af2
mov eax, dword [esp + 0x18]
push eax
call fcn.1001dad4
add esp, 4
add ebp, 1
cmp ebp, 0xa
jl 0x100099d0
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.1001e327
add esp, 0x64
ret

Function at 0x10009b50
Capabilities:
Create thread

Disassembly:
cmp dword [0x1003c718], 0
je 0x10009b5c
xor al, al
ret
call fcn.1000c440
test al, al
jne 0x10009bb1
call fcn.1000c510
test al, al
jne 0x10009bb1
cmp dword [0x1003c724], 0
jne 0x10009b8a
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [0x1003c724], eax
push 0
push 0
push 0x1003c718
push 0x10009e00
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x1003c718], eax
mov al, cl
ret
mov al, 1
ret
Function at 0x10009bc0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x1002f54c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.DLL_SetEvent]
mov edi, dword [sym.imp.KERNEL32.DLL_TerminateThread]
xor ebp, ebp
cmp dword [0x1003c718], ebp
je 0x10009c47
mov eax, dword [0x1003c724]
push eax
call esi
mov ecx, dword [0x1003c718]
push ebp
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x10009c22
mov edx, dword [0x1003c718]
push ebp
push edx
call edi
mov eax, dword [0x1003c718]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call ebx
mov ecx, dword [0x1003c724]
push ecx
call ebx
mov dword [0x1003c718], ebp
mov dword [0x1003c724], ebp
jmp 0x10009c4d
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [0x1003c720]
cmp eax, ebp
je 0x10009c9c
push eax
call esi
mov eax, dword [0x1003c71c]
cmp eax, ebp
je 0x10009c8d
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x10009c7f
mov edx, dword [0x1003c71c]
push ebp
push edx
call edi
mov eax, dword [0x1003c71c]
push eax
call ebx
mov dword [0x1003c71c], ebp
mov ecx, dword [0x1003c720]
push ecx
call ebx
mov dword [0x1003c720], ebp
xor edi, edi
mov dword [esp + 0x14], ebp
or ebx, 0xffffffff
test byte [0x1003c4a8], 1
jne 0x10009ccf
or dword [0x1003c4a8], 1
mov dword [esp + 0x20], ebp
call fcn.100017b0
push 0x1002ffe0
call fcn.1001e315
add esp, 4
mov dword [esp + 0x20], ebx
mov esi, dword [0x1003c27c]
cmp esi, ebp
je 0x10009de6
mov ecx, dword [0x1003c280]
sub ecx, esi
mov eax, 0x78787879
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x10009de6
test byte [0x1003c4a8], 1
jne 0x10009d32
mov eax, 1
or dword [0x1003c4a8], eax
mov dword [esp + 0x20], eax
call fcn.100017b0
push 0x1002ffe0
call fcn.1001e315
mov dword [esp + 0x24], ebx
mov esi, dword [0x1003c27c]
add esp, 4
cmp esi, ebp
je 0x10009d53
mov ecx, dword [0x1003c280]
sub ecx, esi
mov eax, 0x78787879
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x10009d5e
call fcn.1001dd60
mov esi, dword [0x1003c27c]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + edx + 0xf4]
add esi, edx
cmp ecx, ebp
je 0x10009d7c
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov dword [esi + 0xf4], ebp
mov eax, dword [esi + 0xf0]
cmp eax, ebp
je 0x10009d93
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov dword [esi + 0xf0], ebp
mov eax, dword [esi + 0xf8]
cmp eax, ebp
je 0x10009dd6
cmp dword [esi + 0xb4], 3
jne 0x10009dc3
push ebp
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x10009dc3
mov eax, dword [esi + 0xf8]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov ecx, dword [esi + 0xf8]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 0xf8], ebp
add edi, 1
add dword [esp + 0x14], 0x110
jmp 0x10009ca5
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x1000c440
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SOFTWAREEYOOCLIENTSTATUS
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call esi
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x1000c4ba
push edi
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push str.SuperLogin
push ecx
call ebp
mov edx, dword [esp + 0xc]
push edx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
je 0x1000c4fe
lea eax, [esp + 8]
push eax
push 0x20119
push 0
push str.SOFTWAREEYOOCLIENTSTATUS
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x1000c4fe
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.SuperLogin
push ecx
call ebp
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp + 0xc], eax
pop esi
setne al
pop ebp
add esp, 0x10
ret

Function at 0x1000c510
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SYSTEMControlSet001
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call esi
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x1000c58a
push edi
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push str.superadmin
push ecx
call ebp
mov edx, dword [esp + 0xc]
push edx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
je 0x1000c5ce
lea eax, [esp + 8]
push eax
push 0x20119
push 0
push str.SYSTEMControlSet001
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x1000c5ce
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.superadmin
push ecx
call ebp
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp + 0xc], eax
pop esi
setne al
pop ebp
add esp, 0x10
ret