joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001212a
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x10027950
call fcn.10015b1e
mov ebx, dword [ebp + 8]
xor edi, edi
cmp ebx, edi
jne 0x10012149
xor eax, eax
jmp 0x1001221e
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, edi
je 0x1001221c
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], 0x22c
call sub.kernel32.dll_Process32FirstW
jmp 0x100121f2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.100120e9
and dword [ebp - 4], 0
push ebx
lea ecx, [ebp - 0x244]
call fcn.100120e9
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.10011f97
lea ecx, [ebp - 0x244]
call fcn.10011f97
push dword [ebp - 0x240]
lea ecx, [ebp - 0x244]
call fcn.100250c4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
test eax, eax
je 0x100121fc
call fcn.10011b75
mov ecx, dword [ebp - 0x240]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.10011b75
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10012174
jmp 0x10012215
mov edi, dword [ebp - 0x234]
call fcn.10011b75
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.10011b75
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10015ba1
ret

Function at 0x10013c76
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10039078], 0
push esi
push edi
jne 0x10013bec
call fcn.10013b58
test eax, eax
je 0x10013c31
mov eax, dword [0x10039078]
cmp eax, 1
jne 0x10013c0d
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x10013c31
jmp 0x10013c73
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x10013c73
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10013c35
xor eax, eax
jmp 0x10013c73
mov eax, dword [esi]
push dword [0x10039078]
call edi
mov edi, eax
test edi, edi
je 0x10013c57
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x10013c73
lea edi, [esi + 0xff0]
push esi
push dword [0x10039078]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x10013c5d
mov eax, esi
pop edi
pop esi
ret
jmp 0x10013bd8

Function at 0x100155f6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10037a70]
jne 0x10015600
repz ret
jmp fcn.10017fba
Function at 0x100250c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100250d3
pop dword [ebp - 0x40]
mov eax, 0x5671a68f
sub eax, 0x466f55bc
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3f285
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x23c8626
sub ecx, 0x23c3c61
mov edi, eax
mov esi, 0x10042200
add esi, dword [ebp - 0x40]
mov ebx, 0x7035c2a9
sub ebx, 0x74083037
mov dword [ebp - 0x14], 0xfa2f0e54
mov edx, dword [esi]
xor dword [ebp - 0x3c], 0x3981a94c
add edx, ebx
xor dword [ebp - 0x18], ebx
mov dword [edi], edx
xor dword [ebp - 0x3c], ecx
add edi, 4
add esi, 4
loop 0x10025127
add eax, 0x119e7
mov ebx, eax
add eax, 0x3a4e52
add eax, 0xffc5b1b3
mov ecx, 0x8666e495
add ecx, 0x89991b6b
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x320256fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x3202570a
pop dword [ebp - 0x40]
mov eax, 0x53a2c8e8
add eax, 0xde5f8e22
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x5fc114ce
add dword [ebp - 0x50], 0xee91307d
mov dword [ebp - 0x4c], 0x1aa931da
add dword [ebp - 0x4c], 0x178a1a6b
mov dword [ebp - 0x48], 0x88899ef9
add dword [ebp - 0x48], 0xc3c2a535
mov dword [ebp - 0x44], 0x38b51aa9
sub dword [ebp - 0x44], 0x38b51aa9
lea eax, [ebp - 0x50]
push eax
mov eax, 0xfe3f05e9
sub eax, 0xcc39b569
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x3299bfe1
sub dword [ebp - 0x50], 0xbe27568b
mov dword [ebp - 0x4c], 0x41605aa9
add dword [ebp - 0x4c], 0xc06cc
mov dword [ebp - 0x48], 0x5e036520
sub dword [ebp - 0x48], 0xfa93f8b4
mov dword [ebp - 0x44], 0xf37a4ad4
add dword [ebp - 0x44], 0xc85b52c
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xb5679405
add eax, 0x7c9dbc73
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x46f64
push 0
call eax
mov ecx, 0x1b89d4bd
sub ecx, 0x1b898f7b
xor ebx, ebx
add ebx, eax
mov edi, 0x169cc6fb
add edi, 0x1b6b0f05
add edi, dword [ebp - 0x40]
mov edx, 0xc8e13f8f
xor dword [ebp - 0x38], 0xfdd2520d
mov esi, dword [edi]
xor dword [ebp - 4], 0xa068d303
add esi, edx
sub dword [ebp - 0x34], 0x51ee793e
mov dword [ebx], esi
add ebx, 0x70a5b284
sub ebx, 0x70a5b280
add edi, 0x8484f594
sub edi, 0x8484f590
loop 0x32025828
add eax, 0x8fd9ba88
sub eax, 0x8fd8b2ad
xor ebx, ebx
add ebx, eax
add eax, 0xf859984d
add eax, 0x7a667b8
mov ecx, 0x546d4e0b
add ecx, 0xdd92b1f5
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4039c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x290
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x28c], eax
xor eax, eax
push 0x7e
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.00403b40
xor edx, edx
push 0x1fe
push edx
lea eax, [esp + 0xa2]
push eax
mov word [esp + 0xa4], dx
call fcn.00403b40
push str.SYSTEMCurrentControlSetServicesUSBSTOREnum
lea ecx, [esp + 0xa8]
push 0x100
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call fcn.00403ec3
push str.Count
lea edx, [esp + 0x34]
push 0x40
push edx
call fcn.00403ec3
add esp, 0x30
lea eax, [esp + 4]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x98]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403a89
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 4]
push eax
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x28c]
mov eax, dword [esp]
xor ecx, esp
call fcn.00403b30
add esp, 0x290
ret

Function at 0x409d35
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040710b
and dword [ebp - 4], 0
cmp dword [0x41185c], 0
mov ebx, eax
jne 0x409de6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409e97
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409e97
push eax
call fcn.00407099
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41185c], eax
call esi
push eax
call fcn.00407099
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x411860], eax
call esi
push eax
call fcn.00407099
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x411864], eax
call esi
push eax
call fcn.00407099
pop ecx
mov dword [0x41186c], eax
test eax, eax
je 0x409de6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407099
pop ecx
mov dword [0x411868], eax
mov eax, dword [0x411868]
cmp eax, ebx
je 0x409e3e
cmp dword [0x41186c], ebx
je 0x409e3e
push eax
call fcn.00407114
push dword [0x41186c]
mov esi, eax
call fcn.00407114
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409e3e
test edi, edi
je 0x409e3e
call esi
test eax, eax
je 0x409e35
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409e35
test byte [ebp - 0xc], 1
jne 0x409e3e
or dword [ebp + 0x10], 0x200000
jmp 0x409e77
mov eax, dword [0x411860]
cmp eax, ebx
je 0x409e77
push eax
call fcn.00407114
pop ecx
test eax, eax
je 0x409e77
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409e77
mov eax, dword [0x411864]
cmp eax, ebx
je 0x409e77
push eax
call fcn.00407114
pop ecx
test eax, eax
je 0x409e77
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41185c]
call fcn.00407114
pop ecx
test eax, eax
je 0x409e97
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409e99
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4086ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4086d9
pop dword [ebp - 8]
mov eax, 0x4086d9
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x6ee488fc
add dword [ebp - 0x18], 0xdf6dbc4f
mov dword [ebp - 0x14], 0xce7ef015
add dword [ebp - 0x14], 0x63b45c30
mov dword [ebp - 0x10], 0x3fe28035
sub dword [ebp - 0x10], 0xf3963c07
mov dword [ebp - 0xc], 0xcbd17a7d
add dword [ebp - 0xc], 0x342e8583
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xde078315
sub dword [ebp - 0x18], 0x699519bf
mov dword [ebp - 0x14], 0x1434f3fa
add dword [ebp - 0x14], 0x2d376d7b
mov dword [ebp - 0x10], 0x17b05438
add dword [ebp - 0x10], 0x4bbf1834
mov dword [ebp - 0xc], 0x93a780b5
add dword [ebp - 0xc], 0x6c587f4b
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xfc4d91b2
sub eax, 0xfc0cc166
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x34279
push 0
call eax
mov ecx, 0x328a
xor edx, edx
add edx, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 8]
mov esi, 0x8aeb50c4
mov edi, dword [ebx]
add dword [ebp - 4], eax
sub edi, esi
mov dword [edx], edi
xor dword [ebp - 4], ecx
add edx, 0xd9e2a06
add edx, 0xf261d5fe
add ebx, 0x7b59e2fc
add ebx, 0x84a61d08
loop 0x4087e1
add eax, 0x21b525f1
sub eax, 0x21b468f6
mov ebx, eax
add eax, 0xaa3c19dc
sub eax, 0xaa3c19d7
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000a310
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b3c9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10080440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0
call fcn.10009880
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 1
call edi
push eax
call fcn.100470c5
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea esi, [eax*4]
call edi
mov edi, eax
xor edi, esi
shl edi, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, edi
mov ecx, eax
shr eax, 4
and ecx, 0xf
cmp ecx, 0xa
jae 0x1000a3a5
add ecx, 0x30
jmp 0x1000a3a8
add ecx, 0x37
mov byte [ebp - 0x20], cl
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x1000a3bd
add ecx, 0x30
jmp 0x1000a3c0
add ecx, 0x37
mov byte [ebp - 0x1f], cl
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x1000a3d5
add ecx, 0x30
jmp 0x1000a3d8
add ecx, 0x37
mov byte [ebp - 0x1e], cl
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x1000a3ed
add ecx, 0x30
jmp 0x1000a3f0
add ecx, 0x37
mov byte [ebp - 0x1d], cl
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x1000a405
add ecx, 0x30
jmp 0x1000a408
add ecx, 0x37
mov byte [ebp - 0x1c], cl
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x1000a41d
add ecx, 0x30
jmp 0x1000a420
add ecx, 0x37
mov byte [ebp - 0x1b], cl
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x1000a435
add ecx, 0x30
jmp 0x1000a438
add ecx, 0x37
mov byte [ebp - 0x1a], cl
cmp eax, 0xa
jae 0x1000a445
add eax, 0x30
jmp 0x1000a448
add eax, 0x37
mov byte [ebp - 0x19], al
mov ecx, ebx
lea eax, [ebp - 0x20]
mov byte [ebp - 0x18], 0
push eax
call fcn.10009c10
call fcn.100470a4
push eax
mov ecx, ebx
call fcn.10009d70
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002c484
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b5b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, ecx
pop ebp
ret

Function at 0x1000b600
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000b62b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000b62b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x1000b6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov edx, ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edx
mov dword [ebx], 0
nop dword [eax + eax]
cmp esi, dword [0x10079e40]
lea eax, [ebp + 0x10]
push 0
push eax
mov ecx, esi
mov dword [ebp + 0x10], 0
cmova ecx, dword [0x10079e40]
push ecx
push edi
push dword [edx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
add dword [ebx], ecx
test eax, eax
je 0x1000b707
test ecx, ecx
je 0x1000b6fc
mov edx, dword [ebp - 4]
add edi, ecx
sub esi, ecx
jne 0x1000b6c0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000b840
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10080440]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edi]
mov dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.100099b0
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.1002c484
mov esp, ebp
pop ebp
ret
Function at 0x1000c2a0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b5e8
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push esi
mov eax, dword [0x10080440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x1000c2e2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000c2e2
mov dword [esi], 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.10009820
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10008bd0
push 0x20
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.1000c280
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10009a80
push dword [ebp - 0x40]
call fcn.1002c47f
push dword [ebp - 0x4c]
call fcn.1002c47f
push dword [ebp - 0x18]
call fcn.1002c47f
add esp, 0x2c
mov dword [ebp - 0x90], 0x44
xor eax, eax
mov dword [ebp - 0x8c], 0
mov word [ebp - 0x5e], ax
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x88], 0
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x84], 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x64], 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1000c3a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1000c3b6
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x34]
mov dword [esi], eax
xor esi, esi
push dword [ebp - 0x24]
call fcn.1002c47f
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000c3e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b618
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push esi
mov eax, dword [0x10080440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [ebp + 0x14], 0
jne 0x1000c42e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000c2a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi]
test eax, eax
je 0x1000c445
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000c445
mov dword [esi], 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.10009820
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10008bd0
push dword [ebp - 0x18]
call fcn.1002c47f
push 0x38
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x60], 0x3c
push 0
push eax
call fcn.10044800
mov eax, dword [ebp - 0x24]
add esp, 0x18
mov dword [ebp - 0x50], eax
mov ecx, esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5c], 0x240
mov dword [ebp - 0x44], 1
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
call fcn.1000c570
test eax, eax
mov ecx, str.runas
lea eax, [ebp - 0x60]
cmovne ecx, dword [ebp - 0x54]
push eax
mov dword [ebp - 0x54], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1000c4cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1000c4d3
mov eax, dword [ebp - 0x28]
mov dword [esi], eax
xor esi, esi
push dword [ebp - 0x24]
call fcn.1002c47f
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1000c570
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x10080440]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.10044800
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jg 0x1000c5e2
cmp dword [ebp - 0x118], 2
jg 0x1000c5e2
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002c484
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1002c484
mov esp, ebp
pop ebp
ret

Function at 0x1000c6c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 4
cmp byte [esi], al
setne al
mov dword [ebp + 0xc], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0xc], 0
setne cl
mov byte [esi], cl
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d120
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b80b
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x10080440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x234], 7
push eax
push 0x1005f708
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
call fcn.10008730
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x1005f708
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.10008730
mov eax, dword [0x10082650]
mov byte [ebp - 4], 1
test eax, eax
jne 0x1000d1eb
push 0x138
call fcn.1002c435
add esp, 4
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1000d1e0
mov ecx, eax
call fcn.1001e6a0
jmp 0x1000d1e2
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x10082650], eax
mov ecx, eax
call fcn.1001e7c0
mov edx, eax
cmp word [edx], 0
jne 0x1000d1fe
xor ecx, ecx
jmp 0x1000d212
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000d203
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.10008730
push 0xc
push str.GDVCDbus.exe
lea ecx, [ebp - 0x230]
call fcn.1000d6b0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000d31e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10044800
push str.7c4585
lea eax, [ebp - 0x218]
push 0x1005fc9c
push eax
call fcn.1000db00
add esp, 0x18
lea ecx, [ebp - 0x248]
push 1
push 0x1005fca4
call fcn.10008730
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x248]
call fcn.1000d5a0
push 2
push 0x1005fca8
lea ecx, [ebp - 0x248]
call fcn.1000d6b0
cmp word [ebp - 0x218], 0
jne 0x1000d2c8
xor ecx, ecx
jmp 0x1000d2e0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000d2d1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.1000d6b0
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push 0
cmovae eax, dword [ebp - 0x248]
push 0x1388
push 1
push 0x1005f708
push eax
call fcn.1001a820
add esp, 0x14
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x1000d33c
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.10008830
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x220], 0
cmp eax, 8
jb 0x1000d377
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.10008830
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002c484
mov esp, ebp
pop ebp
ret