joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001100
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
push esi
xor ecx, ecx
xor esi, esi
push edi
test ebx, ebx
jle 0x100011f8
mov edi, dword [ebp + 8]
nop word [eax + eax]
mov al, byte [esi + edi]
cmp al, 0x3d
jne 0x1000112d
inc ecx
cmp ecx, 2
jg 0x10001174
cmp al, 0x7f
ja 0x10001174
movzx eax, al
mov al, byte [eax + 0x100262d0]
cmp al, 0x7f
je 0x10001174
cmp al, 0x40
jae 0x10001146
test ecx, ecx
jne 0x10001174
inc esi
inc edx
cmp esi, ebx
jl 0x10001120
test edx, edx
je 0x100011f8
mov ecx, dword [ebp + 0x14]
lea eax, [edx + edx*2]
lea eax, [eax*2 + 7]
sar eax, 3
cmp dword [ecx], eax
jge 0x1000117e
pop edi
pop esi
mov dword [ecx], eax
mov eax, 0xfffffff0
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffee
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
xor ecx, ecx
xor ebx, ebx
mov dword [ebp + 0xc], ecx
mov edi, 3
test esi, esi
jle 0x100011f0
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx]
mov dl, byte [ecx + 0x100262d0]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub edi, ecx
movzx ecx, dl
mov edx, dword [ebp + 0xc]
and ecx, 0x3f
inc edx
or ebx, ecx
mov dword [ebp + 0xc], edx
cmp edx, 4
jne 0x100011e4
xor ecx, ecx
mov dword [ebp + 0xc], ecx
test edi, edi
jle 0x100011cf
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
inc eax
cmp edi, 1
jle 0x100011dc
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
inc eax
cmp edi, 2
jle 0x100011e4
mov byte [eax], bl
inc eax
mov ecx, dword [ebp + 8]
dec esi
inc ecx
mov dword [ebp + 8], ecx
test esi, esi
jg 0x10001194
mov ecx, dword [ebp + 0x14]
sub eax, dword [ebp + 0x10]
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10001f30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10024367
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x100360a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x98], 8
lea eax, [esi + 0x84]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x10001f7d
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
push eax
push edi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
jne 0x100020c6
xor eax, eax
mov dword [ebp - 0x814], 7
push eax
push 0x10026350
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
call fcn.100017c0
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.100119d0
push edi
lea eax, [ebp - 0x810]
push 0x1002639c
push eax
call fcn.100019e0
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [esi + 1], 0
mov ecx, esi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x10002015
call fcn.10001da0
mov esi, eax
jmp 0x1000201c
call fcn.10001f00
mov esi, eax
lea eax, [ebp - 0x828]
cmp eax, esi
je 0x10002069
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x10002044
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.100018c0
xor eax, eax
mov dword [ebp - 0x814], 7
push esi
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], eax
mov word [ebp - 0x828], ax
call fcn.100012e0
mov eax, dword [ebp - 0x82c]
cmp eax, 8
jb 0x10002087
inc eax
lea ecx, [ebp - 0x840]
push eax
push dword [ebp - 0x840]
call fcn.100018c0
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.100143f0
mov esi, eax
add esp, 4
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x100020c4
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.100018c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f677
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100020f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100243b2
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x100360a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], 0
call fcn.100119d0
lea eax, [edi + 0x84]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10002173
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x100021b9
mov eax, dword [esi]
jmp 0x100021bb
mov eax, esi
xor ecx, ecx
mov word [eax], cx
cmp word [ebp - 0x810], cx
je 0x100021e1
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100021d2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.100017c0
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x834], 1
jb 0x1000220b
mov eax, dword [esi]
jmp 0x1000220d
mov eax, esi
mov ecx, ebx
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10002236
test dx, dx
je 0x10002232
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10002236
add eax, 4
add ecx, 4
test dx, dx
jne 0x10002210
xor eax, eax
jmp 0x1000223b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100022a2
cmp byte [edi + 1], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x10002277
call fcn.10001da0
push eax
mov ecx, esi
call fcn.10001260
mov ecx, dword [ebp - 0x814]
cmp ecx, 8
jb 0x100022a2
inc ecx
push ecx
jmp 0x10002291
call fcn.10001f00
push eax
mov ecx, esi
call fcn.10001260
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x100022a2
inc eax
push eax
push dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
call fcn.100018c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f677
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10007430
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, esi
lea ecx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x10007440
sub edi, ecx
mov edx, 2
sar edi, 1
xor ecx, ecx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000f6bd
add esp, 4
mov ebx, eax
sub eax, esi
nop
movzx ecx, word [esi]
lea esi, [esi + 2]
mov word [eax + esi - 2], cx
test cx, cx
jne 0x10007470
xor esi, esi
mov dword [ebp + 8], 1
test edi, edi
js 0x100074c9
nop dword [eax]
cmp word [ebx + esi*2], 0x5c
jne 0x100074bd
xor eax, eax
push ebx
mov word [ebx + esi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100074b4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100074da
mov eax, 0x5c
mov word [ebx + esi*2], ax
inc esi
cmp esi, edi
jle 0x10007490
mov dword [ebp + 8], 1
push ebx
call fcn.1000f6c6
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push ebx
mov dword [ebp + 8], 0
call fcn.1000f6c6
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10007500
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100360a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push 0x1a
push eax
push 0
call fcn.10007c70
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007540
sub ecx, edx
sar ecx, 1
je 0x10007622
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10007560
mov eax, dword [0x100263a4]
push esi
mov dword [edi], eax
mov esi, ebx
mov cx, word [ebx]
add ebx, 2
test cx, cx
jne 0x10007576
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10007590
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
pop esi
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x100075b4
mov dword [edi], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
test eax, eax
jne 0x100075e3
lea eax, [ebp - 0x20c]
push eax
call fcn.10007430
add esp, 4
cmp word [ebp - 0x20c], 0
jne 0x100075f1
xor ecx, ecx
jmp 0x1000760f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007600
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.100017c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000f677
mov esp, ebp
pop ebp
ret
Function at 0x100077c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100360a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x10036eb0]
test al, al
jne 0x10007863
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100119d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000785e
lea eax, [ebp - 0x20c]
push eax
call fcn.1001690f
lea eax, [ebp - 0x20c]
push str.config_systemprofile
push eax
call fcn.10012a99
add esp, 0xc
test eax, eax
jne 0x10007849
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.10012a99
add esp, 8
test eax, eax
je 0x1000785e
mov al, 1
mov byte [0x10036eb0], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f677
mov esp, ebp
pop ebp
ret
mov al, byte [0x10036eb0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f677
mov esp, ebp
pop ebp
ret
Function at 0x10007c70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor bl, bl
call fcn.100077c0
test al, al
je 0x10007cd1
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call fcn.10007710
add esp, 4
test al, al
je 0x10007cd1
push dword [ebp + 0xc]
push 1
push dword [ebp - 4]
push dword [ebp + 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x10007cd1
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
movzx ecx, bl
mov eax, 1
cmovne ecx, eax
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007db0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10024980
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x100360a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov edi, dword [ebp + 0xc]
push 0x44
push 0
push eax
call fcn.100119d0
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0x44
xor eax, eax
mov dword [ebp - 0x14], 7
add esp, 0xc
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x50], xmm0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 1
test edi, edi
je 0x10007ebd
cmp word [edi], ax
jne 0x10007e41
xor ecx, ecx
jmp 0x10007e55
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007e46
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x40]
call fcn.100017c0
cmp dword [ebp - 0x30], 0
je 0x10007ebd
push 1
push 0x100268f4
lea ecx, [ebp - 0x28]
call fcn.100017c0
cmp word [esi], 0
jne 0x10007e7e
xor ecx, ecx
jmp 0x10007e92
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007e83
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.100048a0
push 2
push 0x100268f8
lea ecx, [ebp - 0x28]
call fcn.100048a0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001590
jmp 0x10007ee9
cmp word [esi], 0
jne 0x10007ec7
xor ecx, ecx
jmp 0x10007edf
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007ed0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.100017c0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.CreateRunProcess__s_
call fcn.10013130
add esp, 8
lea ecx, [ebp - 0x50]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10007f35
xor esi, esi
jmp 0x10007f65
cmp byte [ebp + 0x10], 0
je 0x10007f50
mov eax, dword [ebp + 0x14]
or ecx, 0xffffffff
test eax, eax
cmovg ecx, eax
push ecx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
mov esi, 1
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x10007f7a
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.100018c0
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp ecx, 8
jb 0x10007fa3
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.100018c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f677
mov esp, ebp
pop ebp
ret
Function at 0x10007fc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2068
call fcn.1000f690
mov eax, dword [0x100360a8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x100081ce
push 0x2000
lea eax, [ebp - 0x2004]
mov dword [ebp - 0x2010], 0
push 0
push eax
mov dword [ebp - 0x2008], 0
call fcn.100119d0
push edi
push esi
lea eax, [ebp - 0x2004]
push str.__s___s
push eax
call fcn.100019e0
push str.EXPLORER.EXE
call fcn.100083e0
add esp, 0x20
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000818b
lea eax, [ebp - 0x2010]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000818b
lea eax, [ebp - 0x2008]
push eax
push 1
push 1
push 0
push 0xf01ff
push dword [ebp - 0x2010]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1000818b
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100080d8
push str.WTSGetActiveConsoleSessionId
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100080d1
call eax
push 4
mov dword [ebp - 0x2014], eax
lea eax, [ebp - 0x2014]
push eax
push 0xc
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x1000818b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
lea eax, [ebp - 0x2068]
push 0
push eax
call fcn.100119d0
add esp, 0xc
mov dword [ebp - 0x2068], 0x44
mov eax, 5
mov dword [ebp - 0x2060], str.WinSta0Default
mov word [ebp - 0x2038], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x203c], 1
push 0
push dword [ebp - 0x2008]
movups xmmword [ebp - 0x2024], xmm0
push eax
mov dword [ebp - 0x200c], 0
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x1000818b
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2068]
push eax
push 0
push dword [ebp - 0x200c]
lea eax, [ebp - 0x2004]
push 0x430
push 0
push 0
push 0
push eax
push 0
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1000818b
mov eax, dword [ebp - 0x200c]
test eax, eax
je 0x1000818b
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
mov eax, dword [ebp - 0x2008]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100081a3
cmp eax, 0xffffffff
je 0x100081a3
push eax
call esi
mov eax, dword [ebp - 0x2010]
test eax, eax
je 0x100081b5
cmp eax, 0xffffffff
je 0x100081b5
push eax
call esi
test edi, edi
jne 0x100081bc
push edi
call esi
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f677
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
push esi
call fcn.10007db0
mov ecx, dword [ebp - 4]
add esp, 0x10
test eax, eax
setne al
xor ecx, ebp
pop edi
pop esi
call fcn.1000f677
mov esp, ebp
pop ebp
ret
Function at 0x100083e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10024a10
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x100360a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000854b
push eax
lea ecx, [ebp - 0x40]
call fcn.10001a10
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.10009fb0
push 0x22c
lea eax, [ebp - 0x26c]
push 0
push eax
call fcn.100119d0
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x10008532
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1000852b
nop dword [eax + eax]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
je 0x100084b5
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100084a6
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.100017c0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.10009fb0
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x14]
cmp esi, 8
mov ebx, dword [ebp - 0x28]
push ecx
push dword [ebp - 0x18]
cmovae eax, ebx
push eax
call fcn.100014c0
add esp, 0x14
test eax, eax
je 0x10008567
mov byte [ebp - 4], 0
cmp esi, 8
jb 0x10008516
lea eax, [esi + 1]
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.100018c0
lea eax, [ebp - 0x26c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10008480
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x10008549
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.100018c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f677
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x28]
call fcn.10001220
jmp 0x10008534
Function at 0x100086a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10024a50
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x100360a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x26c]
push 0x22c
xor ebx, ebx
push ebx
push eax
call fcn.100119d0
xor eax, eax
mov dword [ebp - 0x2c], 7
add esp, 0xc
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
cmp word [esi], ax
jne 0x10008701
xor ecx, ecx
jmp 0x10008715
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008706
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.100017c0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.10009fb0
add esp, 4
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x270], eax
cmp eax, 0xffffffff
jne 0x1000874d
xor ebx, ebx
jmp 0x10008841
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10008835
nop dword [eax]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
je 0x100087a5
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008796
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.100017c0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.10009fb0
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0x40]
mov ebx, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
add esp, 4
mov esi, edi
cmp dword [ebp - 0x2c], 8
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
cmovae edx, dword [ebp - 0x28]
cmp ebx, edi
cmovb esi, ebx
test esi, esi
jne 0x10008874
xor eax, eax
test eax, eax
jne 0x10008800
cmp ebx, edi
jb 0x10008800
jbe 0x1000889b
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x10008819
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.100018c0
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x270]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10008770
xor ebx, ebx
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x10008856
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.100018c0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f677
mov esp, ebp
pop ebp
ret
mov ax, word [edx]
cmp ax, word [ecx]
jne 0x1000888a
add edx, 2
add ecx, 2
sub esi, 1
jmp 0x100087ea
movzx eax, word [edx]
cmp ax, word [ecx]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x100087f2
lea ecx, [ebp - 0x28]
mov ebx, 1
call fcn.10001220
jmp 0x10008835
Function at 0x100093b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push SysStringLen
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
call esi
test eax, eax
jne 0x100094e2
lea eax, [ebp - 8]
push eax
push 0xf013f
push 0
push str.SoftWare
push dword [ebp - 4]
call esi
test eax, eax
je 0x1000941d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0xc]
push 0
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
je 0x10009457
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x10009490
push dword [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 4]
call esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x18]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100094a0
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xc]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 4]
call esi
pop esi
mov esp, ebp
pop ebp
ret