joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1018a1b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [0x101a5e88], 0x16d1
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x101a5e8c], 0x2239
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x101a5e88]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
jmp 0x1018a257
mov dword [0x101a5e88], 0x207d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1018a2e2
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1018a310
mov dword [0x101a5e88], 0x25e8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1018a1fa
jmp 0x1018a217
mov dword [0x101a5e88], 0xfffffb97
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1018a2c0
jmp 0x1018a217
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffe2d
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
je 0x1018a296
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, dword [ebp - 0x28]
mov edx, eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x2c], eax
jl 0x1018a257
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [0x101a5e88], ecx
mov dword [0x101a5e8c], 0x1644
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x1018a23c
jmp 0x1018a217
mov dword [0x101a5e8c], 0x1f37
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1018a221
jmp 0x1018a217
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1018a217
mov eax, 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
jne 0x1018a217
mov eax, dword [ebp - 0x20]
add esp, 0x28
pop esi
pop ebp
ret

Function at 0x1018a5f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.1018a5f0]
mov dword [0x101a5e88], 0x1eab
mov dword [ebp - 4], eax
jmp 0x1018a624
mov eax, dword [ebp - 8]
add esp, 8
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x1018a60b
jmp 0x1018a631
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
je 0x1018a613
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [ebp - 4], eax
jmp 0x1018a624
Function at 0x453604
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x4536b9
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x45369a
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x453675
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x4536af
add edx, dword [esp + 0x14]
jmp 0x4536b3
add edx, dword [esp + 0x24]
test esi, esi
jne 0x453653
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x267c44c2
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3b1d2dbd
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x590326c8
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, str._LE
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x4c1f18dd
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10001750
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1048
call fcn.1000b940
mov byte [ebp - 0x218], 0
mov byte [ebp - 0x110], 0
mov byte [ebp - 0x10e], 0
mov byte [ebp - 0x658], 0
mov byte [ebp - 0x780], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x670], 0
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x65c], 0
mov dword [ebp - 8], 0x1000d1ac
mov dword [ebp - 4], 0x1000d1a8
mov dword [ebp - 0x54c], str.Save
mov dword [ebp - 0x21c], 0x1000d19c
push str._b:ys__cq
lea ecx, [ebp - 0x548]
call fcn.10002a50
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xb7
je 0x10001856
cmp dword [ebp - 0x244], 5
jne 0x1000185a
mov al, 1
jmp 0x1000185c
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x100019b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000d4e0
push 0x1000b974
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x1048
call fcn.1000b940
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x230], 0
mov byte [ebp - 0x128], 0
mov byte [ebp - 0x126], 0
mov byte [ebp - 0x668], 0
mov byte [ebp - 0x790], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x670], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x684], 0
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x20], 0x1000d1ac
mov dword [ebp - 0x1c], 0x1000d1a8
mov dword [ebp - 0x55c], str.Save
mov dword [ebp - 0x234], 0x1000d19c
mov dword [ebp - 4], 0
call fcn.10001750
movzx eax, al
test eax, eax
je 0x10001abc
mov dword [ebp - 4], 0xffffffff
jmp 0x10001b9b
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10001ad5
push 1
call fcn.10001860
jmp 0x10001b7a
mov dword [ebp - 0x794], 0
push 0
push 0x1000e01c
lea ecx, [ebp - 0x558]
call fcn.10002a50
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0x794], 0
je 0x10001b73
push 0
mov ecx, dword [ebp - 0x794]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x798], eax
cmp dword [ebp - 0x798], 0
je 0x10001b6a
mov edx, dword [ebp - 0x798]
push edx
mov eax, dword [0x1000e600]
push eax
push 0x10001bb0
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x1000e5fc], eax
mov ecx, dword [0x1000e5fc]
push ecx
push 0
push 0x111
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001b71
push 0
call fcn.10001860
jmp 0x10001b7a
push 0
call fcn.10001860
mov dword [ebp - 4], 0xffffffff
jmp 0x10001b93
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001e40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1048
call fcn.1000b940
mov byte [ebp - 0x218], 0
mov byte [ebp - 0x110], 0
mov byte [ebp - 0x10e], 0
mov byte [ebp - 0x658], 0
mov byte [ebp - 0x780], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x670], 0
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x65c], 0
mov dword [ebp - 8], 0x1000d1ac
mov dword [ebp - 4], 0x1000d1a8
mov dword [ebp - 0x54c], str.Save
mov dword [ebp - 0x21c], 0x1000d19c
push str._b:ys__cq
lea ecx, [ebp - 0x548]
call fcn.10002a50
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xb7
je 0x10001f46
cmp dword [ebp - 0x244], 5
jne 0x10001f65
cmp dword [0x1000e5f8], 0
je 0x10001f65
mov ecx, dword [0x1000e5f8]
call fcn.100055a0
mov ecx, dword [0x1000e5f8]
call fcn.10005e20
mov esp, ebp
pop ebp
ret
Function at 0x100025a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1068
call fcn.1000b940
mov byte [ebp - 0x218], 0
mov byte [ebp - 0x110], 0
mov byte [ebp - 0x10e], 0
mov byte [ebp - 0x658], 0
mov byte [ebp - 0x7a0], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x684], 0
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x694], 0
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x67c], 0
mov dword [ebp - 8], 0x1000d1ac
mov dword [ebp - 4], 0x1000d1a8
mov dword [ebp - 0x54c], str.Save
mov dword [ebp - 0x21c], 0x1000d19c
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str._n5305.1
lea ecx, [ebp - 0x548]
call fcn.10002a50
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x244], eax
push 0x16
push 0x3f5
push str._d__d
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov dword [ebp - 0x688], 0
push 0
lea ecx, [ebp - 0x688]
push ecx
lea edx, [ebp - 0x678]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x678]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10002060
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100047e0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp + 8]
add eax, 0x4dc
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x10c], 0x2e
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x10b], 0x65
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x10a], 0x78
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x109], 0x65
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x4dc
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x10004888
mov dword [ebp - 0x10c], 0xe
cmp dword [ebp - 0x10c], 0
jne 0x100048ab
push 0
lea edx, [ebp - 0x108]
push edx
mov ecx, dword [ebp - 0x110]
call fcn.10006190
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov esp, ebp
pop ebp
ret 4

Function at 0x10004e90
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x40c]
movzx ecx, byte [eax + 8]
test ecx, ecx
je 0x10004ede
push 4
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
neg eax
sbb eax, eax
and eax, 0xfffffff8
add eax, 8
mov dword [ebp - 4], eax
jmp 0x10004f1d
push 0x400
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.WinInit.Ini
lea edx, [ebp - 0x408]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x1000d224
push str.Rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x10004f30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x57c
mov dword [ebp - 0x57c], ecx
mov eax, dword [ebp - 0x57c]
movzx ecx, byte [eax + 0x1c]
test ecx, ecx
je 0x10004f61
lea edx, [ebp - 0x470]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x10004f73
push 0x400
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x578]
push ecx
mov ecx, dword [ebp - 0x57c]
call fcn.10004df0
push 0x1000d238
lea edx, [ebp - 0x470]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x578]
push eax
lea ecx, [ebp - 0x470]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x470]
push edx
mov eax, dword [ebp - 0x57c]
mov ecx, dword [eax + 0x18e4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10004fe1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp edx, 0xa
jl 0x10004f7a
lea ecx, [ebp - 0x470]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x57c]
call fcn.10004d40
movzx eax, al
test eax, eax
jne 0x10005005
mov eax, 5
jmp 0x10005021
lea ecx, [ebp - 0x470]
push ecx
mov edx, dword [ebp - 0x57c]
add edx, 0x18e8
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10005030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13c4
call fcn.1000b940
mov dword [ebp - 0x13c4], ecx
mov dword [ebp - 4], 0x104
push 0x1000e09c
mov ecx, dword [ebp - 0x13c4]
add ecx, 0x128
call fcn.10002a50
mov dword [ebp - 0xaec], eax
mov dword [ebp - 0x120], 0x80000002
cmp dword [ebp - 0xaec], 0
je 0x1000508d
mov eax, dword [ebp - 0xaec]
push eax
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1000e340
mov ecx, dword [ebp - 0x13c4]
add ecx, 0x128
call fcn.10002a50
mov dword [ebp - 0x13c0], eax
mov dword [ebp - 0x13bc], 1
mov dword [ebp - 0x13b8], 0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x13bc]
push ecx
mov edx, dword [ebp - 0x13c0]
push edx
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov dword [ebp - 0x13b8], eax
xor edx, edx
cmp dword [ebp - 0x13b8], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x1000510a
xor al, al
jmp 0x1000518a
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0x110]
push edx
call fcn.1000a9e0
add esp, 8
mov dword [ebp - 0x114], eax
push 0x1000e34c
mov ecx, dword [ebp - 0x13c4]
add ecx, 0x128
call fcn.10002a50
push eax
mov eax, dword [ebp - 0x114]
push eax
push str._d_s
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.1000a9e0
add esp, 8
cmp eax, 0xc4b3293
jne 0x10005188
mov al, 1
jmp 0x1000518a
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10005190
Capabilities:
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x120c
call fcn.1000b940
mov dword [ebp - 0x120c], ecx
mov ecx, dword [ebp - 0x120c]
call fcn.10005e40
mov ecx, dword [ebp - 0x120c]
call fcn.10005030
movzx eax, al
test eax, eax
jne 0x100051ea
lea ecx, [ebp - 9]
call fcn.100081f0
movzx ecx, al
test ecx, ecx
je 0x100051ea
push 1
push 1
push 0x22
push 1
mov ecx, dword [ebp - 0x120c]
call fcn.10006360
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 0x120c]
mov byte [edx + 0xb], 1
mov byte [ebp - 1], 0
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x120c]
call fcn.100072c0
movzx eax, al
test eax, eax
je 0x1000521a
mov dword [ebp - 8], 2
jmp 0x10005233
mov ecx, dword [ebp - 0x120c]
call fcn.10003160
movzx ecx, al
test ecx, ecx
jne 0x10005233
mov dword [ebp - 8], 0x20
cmp dword [ebp - 8], 0
jne 0x1000526d
mov edx, dword [ebp - 0x120c]
movzx eax, byte [edx + 0x430]
test eax, eax
jne 0x1000526d
xor ecx, ecx
mov word [ebp - 0x20], cx
xor edx, edx
mov dword [ebp - 0x1e], edx
mov dword [ebp - 0x1a], edx
mov dword [ebp - 0x16], edx
mov word [ebp - 0x12], dx
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 8], 0x21
cmp dword [ebp - 8], 0
je 0x1000527d
cmp dword [ebp - 8], 0x21
jne 0x10005320
mov eax, dword [ebp - 0x120c]
mov ecx, dword [eax + 0x124]
mov dword [ebp - 0x940], ecx
push 0x1000e334
mov ecx, dword [ebp - 0x120c]
add ecx, 0x128
call fcn.10002a50
mov dword [ebp - 0x93c], eax
mov edx, dword [ebp - 0x120c]
add edx, 0x20
mov dword [ebp - 0x938], edx
mov dword [ebp - 0x930], 0
mov dword [ebp - 0x934], 4
mov eax, dword [ebp - 0x934]
push eax
lea ecx, [ebp - 0x940]
push ecx
push 4
mov edx, dword [ebp - 0x93c]
push edx
mov eax, dword [ebp - 0x938]
push eax
mov ecx, dword [ebp - 0x938]
mov edx, dword [ecx + 0x100]
push edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0x930], eax
mov eax, dword [ebp - 0x120c]
mov ecx, dword [eax + 0x18e4]
push ecx
mov ecx, dword [ebp - 0x120c]
call fcn.10004f30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000532c
cmp dword [ebp - 8], 0x21
jne 0x1000533a
mov ecx, dword [ebp - 0x120c]
call fcn.100055a0
mov dword [ebp - 8], eax
movzx edx, byte [ebp - 1]
test edx, edx
je 0x10005349
mov dword [ebp - 8], 0x1d
push 1
push 1
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x120c]
call fcn.10006360
mov ecx, dword [ebp - 0x120c]
mov byte [ecx + 0xb], 0
mov edx, dword [ebp - 0x120c]
mov eax, dword [edx + 0x19ec]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x10005385
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x120c]
mov edx, dword [ecx + 0x19ec]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x100053a4
cmp dword [ebp - 8], 0x21
jne 0x100053df
push 0x1000e358
mov ecx, dword [ebp - 0x120c]
add ecx, 0x128
call fcn.10002a50
push eax
mov eax, dword [ebp - 0x120c]
add eax, 0x20
push eax
mov ecx, dword [ebp - 0x120c]
call fcn.10006990
mov eax, dword [ebp - 0x120c]
add eax, 0x18e8
jmp 0x100053e1
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10006190
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x950
mov dword [ebp - 0x948], ecx
cmp dword [ebp + 0xc], 0
je 0x100061b0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x94c], eax
jmp 0x100061ba
mov dword [ebp - 0x94c], str._NULL_
push 0x10
lea ecx, [ebp - 0x14]
push ecx
call fcn.1000ac30
add esp, 8
push 0x44
lea edx, [ebp - 0x60]
push edx
call fcn.1000ac30
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x60], 0x44
mov eax, dword [ebp - 0x948]
movzx ecx, byte [eax + 8]
test ecx, ecx
je 0x10006309
mov edx, dword [ebp - 0x948]
movzx eax, byte [edx + 0xb]
test eax, eax
jne 0x10006309
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x10006307
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], 0
push 0
push 0x1000e01c
mov ecx, dword [ebp - 0x948]
add ecx, 0x128
call fcn.10002a50
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x100062f3
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 0x68]
push ecx
push 1
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x7c], eax
lea edx, [ebp - 0x78]
push edx
push 0x2000000
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100062ec
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x100062e4
mov dword [ebp - 0x18], 0xf
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100062f3
mov dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x10006339
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10006339
mov dword [ebp - 0x18], 0x11
cmp dword [ebp + 0xc], 0
je 0x1000634a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x950], eax
jmp 0x10006354
mov dword [ebp - 0x950], str._NULL_
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8