joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41231e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c470]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040aa36
and dword [ebp - 0x14], 0
cmp dword [0x41e1d0], 0
mov dword [ebp - 0x18], eax
jne 0x4123d1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x412479
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x412479
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41e1d0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41e1d4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41e1d8], eax
call edi
push eax
call esi
mov dword [0x41e1e0], eax
test eax, eax
je 0x4123d1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41e1dc], eax
mov eax, dword [0x41e1dc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41242a
cmp dword [0x41e1e0], ecx
je 0x41242a
push eax
call esi
push dword [0x41e1e0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41242a
test ebx, ebx
je 0x41242a
call edi
test eax, eax
je 0x412421
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x412421
test byte [ebp - 8], 1
jne 0x41242a
or dword [ebp + 0x10], 0x200000
jmp 0x41245d
mov eax, dword [0x41e1d4]
cmp eax, dword [ebp - 0x18]
je 0x41245d
push eax
call esi
test eax, eax
je 0x41245d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41245d
mov eax, dword [0x41e1d8]
cmp eax, dword [ebp - 0x18]
je 0x41245d
push eax
call esi
test eax, eax
je 0x41245d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41e1d0]
call esi
test eax, eax
je 0x412479
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41247b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406048
leave
ret
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43ea0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x43ea08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43ea08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0x401b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor edx, edx
cmp edi, 4
jle 0x401b74
lea esi, [edi - 1]
mov ecx, dword [esp + 0x10]
shr esi, 2
mov eax, esi
push ebx
neg eax
lea edi, [edi + eax*4]
mov eax, dword [esp + 0x18]
mov ebx, dword [ecx]
mov ebp, dword [eax]
xor ebx, ebp
mov ebp, dword [eax + 4]
add eax, 4
add ecx, 4
or edx, ebx
add eax, 4
mov ebx, dword [ecx]
add ecx, 4
xor ebx, ebp
mov ebp, dword [eax]
or edx, ebx
mov ebx, dword [ecx]
xor ebx, ebp
mov ebp, dword [eax + 4]
add eax, 4
add ecx, 4
or edx, ebx
add eax, 4
mov ebx, dword [ecx]
add ecx, 4
xor ebx, ebp
or edx, ebx
dec esi
jne 0x401b34
pop ebx
jmp 0x401b7c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
test edi, edi
jle 0x401b93
mov esi, edi
mov edi, dword [ecx]
mov ebp, dword [eax]
xor edi, ebp
add eax, 4
or edx, edi
add ecx, 4
dec esi
jne 0x401b82
xor eax, eax
pop edi
test edx, edx
pop esi
pop ebp
setne al
ret
Function at 0x10030b8
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1049174], 0
je 0x1011e16
ret
push esi
push edi
call sym.spoolsv.exe_PrvRevertToPrinterSelf
push 0x1011df0
push 0
push 2
mov edi, eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x101c680
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1011e58
push edi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
je 0x101c6c9
push 0xffffffffffffffff
push dword [0x1049280]
call fcn.01011e71
pop edi
pop esi
jmp 0x10030c5
mov eax, dword [0x1049104]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x1049104
je 0x101c6b2
test byte [eax + 0x1c], 1
je 0x101c6b2
call esi
push eax
mov eax, dword [0x1049104]
push 0x101552c
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
push 0
call esi
push eax
push 0x101c6e0
call fcn.01032636
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x69
call fcn.01032745
jmp 0x1011e58

Function at 0x100370f
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1003768
push edi
mov edi, 0x1049318
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call fcn.01003772
lea eax, [esi + 0xc]
cmp dword [eax], 0
jne 0x101d206
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x1c]
pop edi
cmp eax, 0xffffffff
jne 0x101d211
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x101d21d
push dword [esi + 0x24]
call sym.spoolsv.exe_PrvDllFreeSplStr
push esi
call sym.spoolsv.exe_PrvDllFreeSplMem
pop esi
pop ebp
ret 4
push eax
call fcn.0101a48b
jmp 0x100373b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100374f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x101d234
push 4
push eax
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [esi + 0x20]
call sym.spoolsv.exe_PrvDllFreeSplMem
and dword [esi + 0x20], 0
jmp 0x100375a
Function at 0x100395c
Capabilities:
Get thread local storage value
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x1049138]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x101ca9f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.RPCRT4.dll_I_RpcBindingInqTransportType]
cmp eax, ebx
jne 0x100bfbc
cmp dword [ebp - 0x18], 4
jne 0x101cabb
lea eax, [ebp - 0x14]
push eax
push 1
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x101cacf
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 2
push 1
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x101cac3
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x100bfce
xor eax, eax
cmp dword [ebp - 0x1c], ebx
setne al
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jl 0x101cae7
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01003279
leave
ret
cmp eax, 0x6bd
jne 0x101caa6
xor esi, esi
jmp 0x1003a35
call fcn.0100ce3b
jmp 0x1003a21
xor eax, eax
jmp 0x1003990
cmp eax, ebx
jle 0x101cab4
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x1003a35
xor esi, esi
inc esi
jmp 0x1003a35
call fcn.0100ce3b
mov esi, eax
jmp 0x1003a2c
call fcn.0100ce3b
mov esi, eax
sub esi, 0x800703f0
neg esi
sbb esi, esi
and esi, eax
jmp 0x1003a35
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x1003a44
test byte [eax + 0x1c], 1
je 0x1003a44
push esi
push 0x1022620
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
jmp 0x1003a44
Function at 0x1003a8e
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebx], esi
cmp dword [ebp + 0xc], esi
je 0x100c4af
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01017f6e
test eax, eax
je 0x101f2a0
push esi
push esi
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyW]
mov edi, eax
cmp edi, esi
jne 0x1003af0
cmp dword [ebp + 0xc], 0x48
jae 0x101f2ad
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp edi, esi
jne 0x101f327
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1003b05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1003af9
push dword [ebp + 0xc]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov dword [ebx], eax
cmp eax, esi
jne 0x101f2c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1003af0
lea ecx, [ebp + 0xc]
push ecx
push eax
push esi
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov edi, eax
cmp edi, esi
jne 0x101f30e
push dword [ebp + 0xc]
push dword [ebx]
call fcn.01018c46
push eax
call fcn.01018e96
mov edi, eax
cmp edi, esi
je 0x101f317
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
test eax, eax
jne 0x101f30a
push 2
pop edi
cmp edi, esi
je 0x101f317
push dword [ebx]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov dword [ebx], esi
cmp edi, 2
jne 0x1003af0
xor edi, edi
jmp 0x1003af0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101f35e
test byte [eax + 0x1c], 1
je 0x101f35e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1049104]
push 0x1024200
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
xor eax, eax
jmp 0x1003b04
Function at 0x100d772
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
cmp byte [esi + 0x40], 0
je 0x101ff09
mov eax, dword [ebp + 8]
push edi
mov edi, 0x80070057
test eax, eax
je 0x100d802
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100d797
sub eax, edx
sar eax, 1
cmp eax, dword [esi + 0x10]
ja 0x100d802
push ebx
lea eax, [esi + 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.0100bb2c
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
xor edi, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
cmp dword [esi + 8], edi
jbe 0x100d843
and dword [ebp - 4], edi
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + eax]
test eax, eax
jne 0x100d80a
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
imul ecx, ecx, 0xc
add ecx, dword [esi + 0x14]
call fcn.0100d870
mov edi, eax
cmp edi, 1
je 0x100d843
lea ecx, [ebp - 0x14]
call fcn.0100bb00
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret 8
push eax
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1013d3a
mov ecx, dword [esi + 0x14]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
sub eax, dword [ecx + edx + 4]
cmp eax, dword [esi + 0xc]
ja 0x100d7df
cmp eax, dword [ebp - 8]
ja 0x100dc9d
add dword [ebp - 4], 0xc
inc edi
cmp edi, dword [esi + 8]
jb 0x100d7d2
mov ecx, dword [esi + 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
cmp ecx, dword [esi + 4]
jae 0x101ff10
imul ecx, ecx, 0xc
add ecx, dword [esi + 0x14]
call fcn.0100d870
mov edi, eax
test edi, edi
jl 0x100d7f9
inc dword [esi + 8]
jmp 0x100d7f9
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edi
jmp 0x100d839
call ebx
imul edi, edi, 0xc
mov ecx, dword [esi + 0x14]
mov dword [ecx + edi + 4], eax
xor edi, edi
jmp 0x100d7f9
xor eax, eax
jmp 0x100d805
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0xc
add ecx, dword [esi + 0x14]
call fcn.0100d870
mov edi, eax
jmp 0x100d7f9
Function at 0x100df32
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov ebx, ecx
call fcn.0100dfe9
mov esi, eax
cmp esi, 1
jne 0x100dfd1
call sym.spoolsv.exe_PrvRevertToPrinterSelf
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x38]
push eax
xor esi, esi
push edi
mov dword [ebp - 0x38], esi
call fcn.01012835
cmp eax, esi
je 0x1020149
lea ecx, [ebp - 0x20]
call fcn.0100cd8b
lea ecx, [ebp - 0x34]
call fcn.0100cd8b
push esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
mov ecx, ebx
call fcn.0100d3a3
mov esi, eax
test esi, esi
jne 0x10201bc
lea eax, [ebp - 0x20]
push eax
push edi
mov ecx, ebx
call fcn.01013c9e
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.0100cdfc
lea ecx, [ebp - 0x20]
call fcn.0100cdfc
push dword [ebp - 0x3c]
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
je 0x10201fe
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01003279
leave
ret 4
cmp dword [ebp - 0x38], esi
je 0x10201b2
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x38]
mov dword [ebp - 8], esi
call fcn.0103c988
push dword [ebp - 0x38]
mov ebx, eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp ebx, esi
jne 0x10201b2
push 0x24
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, esi
je 0x1020182
push edi
mov ecx, eax
call fcn.0100d97a
mov esi, eax
test esi, esi
je 0x102018b
mov eax, dword [esi + 0x20]
jmp 0x1020190
mov eax, 0x8007000e
test eax, eax
jl 0x10201a6
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
push esi
call fcn.0100d362
test eax, eax
jl 0x10201a6
xor esi, esi
test esi, esi
je 0x10201b2
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov esi, 0x80004005
jmp 0x100dfc1
and eax, 0xffff
cmp eax, 0x2af9
jne 0x100dfb1
lea ecx, [ebp - 0xc]
call fcn.0100bb6c
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.010404cb
mov esi, eax
test esi, esi
jne 0x10201f1
push edi
push dword [ebp - 8]
mov ecx, ebx
call fcn.01040bfd
mov esi, eax
lea ecx, [ebp - 0xc]
call fcn.0100bbb6
jmp 0x100dfb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100e2fb
Capabilities:
Get token privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call sym.spoolsv.exe_PrvWaitForSpoolerInitialization
mov esi, dword [ebp + 8]
push dword [esi]
call fcn.01011c15
test eax, eax
jne 0x100e367
push edi
lea edi, [esi + 4]
push edi
push ebx
call fcn.01010fde
test eax, eax
je 0x100e336
push 1
push edi
call fcn.0101122d
push ebx
push ebx
push ebx
push ebx
push 3
call sym.spoolsv.exe_PrvRouterBroadcastMessage
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0xc
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
pop edi
test eax, eax
je 0x100e367
push esi
push dword [ebp - 4]
push 1
push 1
call fcn.0100bd29
mov eax, dword [esi]
cmp eax, ebx
jne 0x101ed33
lea eax, [esi + 4]
push eax
call fcn.0100ec1d
push esi
call sym.spoolsv.exe_PrvDllFreeSplMem
pop esi
pop ebx
leave
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100e371

Function at 0x100e4ee
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push 0x84c
mov dword [ebp - 4], ebx
call sym.spoolsv.exe_PrvDllAllocSplMem
mov esi, eax
cmp esi, ebx
je 0x101ed3f
push edi
push 0x2001f
call sym.spoolsv.exe_PrvSplGetClientUserHandle
lea edi, [esi + 4]
mov dword [edi], eax
push esi
cmp eax, ebx
je 0x101ed4d
push 1
push 0xe
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x101ed46
pop edi
cmp esi, ebx
je 0x100e575
cmp dword [0x1049174], ebx
jne 0x101a90a
lea eax, [ebp - 8]
push eax
push ebx
push esi
push fcn.0100e2fb
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x101ed59
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
push esi
call fcn.0100e2fb
jmp 0x100e575
xor eax, eax
jmp 0x100e578
push edi
call fcn.0100ec1d
push esi
call sym.spoolsv.exe_PrvDllFreeSplMem
xor esi, esi
jmp 0x100e542
push dword [esi]
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 4]
push eax
call fcn.0100ec1d
push esi
call sym.spoolsv.exe_PrvDllFreeSplMem
jmp 0x100e575

Function at 0x100ecc1
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push esi
lea eax, [ebp - 8]
push eax
push 2
push 0
push 0x100ed28
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x100ed06
push 2
mov word [ebp - 4], ax
lea eax, [ebp - 4]
push eax
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov esi, eax
cmp dword [ebp - 8], 0
je 0x100ed15
push dword [ebp - 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 4
Function at 0x100f3a6
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], eax
xor eax, eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 4]
push ecx
push dword [esi + 4]
mov dword [esi + 8], eax
push eax
push dword [esi]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
push eax
call fcn.01003589
mov dword [esi + 0x10], eax
pop esi
leave
ret
Function at 0x100f4cd
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x41c], ecx
test eax, eax
je 0x100f65a
push edi
push 0x100f684
push 0x100f67c
mov edi, 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.0100f6f5
lea eax, [ebp - 0x414]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100f52d
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x41c], 0
jne 0x101ecc4
push dword [ebx]
mov edx, edi
push 0x100f698
push 0x100f66c
sub edx, eax
lea ecx, [ebp + eax*2 - 0x414]
push edx
push ecx
mov dword [ebp - 0x41c], ecx
call fcn.0100f6f5
add esp, 0x14
inc dword [ebx]
call sym.spoolsv.exe_PrvRevertToPrinterSelf
push dword [ebp - 0x41c]
mov ebx, eax
call fcn.0100ecc1
test ebx, ebx
je 0x100f58d
push ebx
call sym.spoolsv.exe_PrvImpersonatePrinterClient
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100f596
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push dword [ebp - 0x418]
push dword [esi + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
cmp dword [esi + 0x14], 0
mov ebx, 0x100e57c
je 0x100f5f1
lea eax, [esi + 0x436]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
mov dword [esi + 0x18], eax
jne 0x1013b65
xor eax, eax
cmp dword [esi + 0x1c], eax
je 0x100f6b0
cmp word [esi + 0x434], ax
jne 0x100f60e
cmp dword [ebp + 0x10], eax
jne 0x100f6b0
push 0x100f6a0
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.010105ee
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
pop edi
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100f62a
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push dword [ebp - 0x418]
push dword [esi + 0xc]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01003279
leave
ret 0x14
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
lea eax, [esi + 0x24]
push ebx
push edi
push eax
call fcn.0100f6f5
xor ecx, ecx
inc ecx
lea eax, [esi + 0x434]
add esp, 0x14
cmp word [eax], 0
mov dword [esi + 0x1c], ecx
jne 0x100f60e
cmp dword [ebp + 0x10], 0
je 0x100f60e
jmp 0x101ecf9
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
lea eax, [esi + 0x436]
push ebx
push edi
push eax
call fcn.0100f6f5
add esp, 0x14
and dword [esi + 0x14], 0
jmp 0x100f5f1
push dword [ebp - 0x41c]
mov ecx, edi
sub ecx, eax
lea ebx, [ebp + eax*2 - 0x414]
push ecx
push ebx
call fcn.0100bc94
push 0x2c
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x100f58d
xor ecx, ecx
mov word [eax], cx
jmp 0x100f58d
mov word [eax], cx
jmp 0x100f60e
Function at 0x10125ad
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp + 0xc], esi
push dword [ecx + 0xc]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov edx, dword [ebp + 0xc]
test eax, eax
jne 0x10125e7
cmp edx, esi
jne 0x10203f6
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jne 0x1012e48
mov ecx, dword [ebp + 0x1c]
pop esi
test ecx, ecx
jne 0x10203fe
test eax, eax
jg 0x1014fa1
pop ebp
ret 0x18
mov esi, dword [ebp + 0x10]
mov dword [ecx], esi
jmp 0x10125f2
and eax, 0xffff
or eax, 0x80070000
jmp 0x1012606
push 0x57
pop eax
jmp 0x10125e7
mov dword [ecx], edx
jmp 0x10125fe

Function at 0x101260f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
cmp dword [0x1049124], esi
jne 0x101590a
mov eax, dword [0x1049124]
pop esi
leave
ret
lea eax, [ebp - 8]
push eax
push 1
push esi
push 0x10159a8
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1012626
push ebx
push edi
mov edi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 4]
push eax
push 0x1049124
push esi
push esi
push 0x101597c
push dword [ebp - 8]
mov dword [0x1049124], esi
mov dword [ebp - 4], ebx
call edi
mov dword [ebp - 0xc], eax
cmp eax, esi
jne 0x101c9bb
cmp dword [0x1049124], esi
jne 0x101c9c6
push dword [ebp - 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
pop edi
pop ebx
jmp 0x1012626
mov dword [0x1049124], esi
jmp 0x101595d
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.010433f6
test eax, eax
je 0x101c9df
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], esi
jne 0x1015969
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push 0x101ca28
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call edi
cmp eax, esi
jne 0x1015969
cmp dword [ebp - 0x10], esi
jne 0x1015969
cmp dword [ebp - 0x14], esi
je 0x1015969
mov dword [0x1049124], esi
jmp 0x1015969