joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ea89
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
and byte [ebp - 0x104], 0
push ebx
push esi
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edi, edi
cmp dword [0x101f274], edi
jne 0x100ec72
cmp dword [0x101f5bc], edi
je 0x100eacc
mov dword [0x101f274], 1
call fcn.0100ea42
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [ebp - 0x104]
push 0x1005334
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 6
push 0x8000000
call fcn.0100e994
cmp dword [0x101f9b0], edi
lea eax, [ebp - 0x104]
je 0x100eb17
push 0x1005318
jmp 0x100eb1c
push 0x1005300
push eax
call ebx
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
push 6
mov esi, 0x800000
push esi
call fcn.0100e994
mov eax, dword [0x101f6e8]
cmp eax, edi
je 0x100ebdf
push 7
pop ecx
and byte [ebp - 0x304], 0
mov esi, 0x10052e0
lea edi, [ebp - 0x204]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 4], eax
push 0x38
xor eax, eax
pop ecx
lea edi, [ebp - 0x1e5]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x303]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edi, edi
inc edi
test byte [ebp - 4], 1
je 0x100ebae
push edi
lea eax, [ebp - 0x304]
push 0x10052d8
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x204]
push eax
call esi
shr dword [ebp - 4], 1
inc edi
cmp edi, 0x20
jbe 0x100eb86
push 0x1003da4
lea eax, [ebp - 0x204]
push eax
call esi
lea eax, [ebp - 0x204]
push eax
push 6
push 0x800000
call fcn.0100e994
mov esi, 0x800000
xor edi, edi
cmp dword [0x101f5ac], edi
lea eax, [ebp - 0x104]
je 0x100ec03
cmp dword [0x101f58c], edi
je 0x100ebfc
push 0x1005290
jmp 0x100ec17
push 0x1005248
jmp 0x100ec17
cmp dword [0x101f58c], edi
je 0x100ec12
push 0x1005200
jmp 0x100ec17
push 0x10051b8
push eax
call ebx
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
push 6
push 0x8000000
call fcn.0100e994
test byte [0x101f6e8], 8
je 0x100eca8
cmp dword [0x101c0a0], edi
lea eax, [ebp - 0x104]
je 0x100ec5c
cmp dword [0x101f6ec], edi
je 0x100ec55
push 0x1005178
jmp 0x100ec61
push 0x1005148
jmp 0x100ec61
push 0x100510c
push eax
call ebx
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
push 6
push esi
jmp 0x100eca3
cmp dword [0x101f9b0], edi
lea eax, [ebp - 0x104]
je 0x100ec87
push 0x1005318
jmp 0x100ec8c
push 0x1005300
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
push 6
push 0x800000
call fcn.0100e994
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100f929
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
push 0x3f
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.WS2_32.dll_inet_ntoa]
xor eax, eax
mov al, byte [ebx]
xor esi, esi
and eax, 0xf
shl eax, 2
mov si, ax
lea eax, [esi + 8]
cmp dword [ebp + 0xc], eax
jge 0x100f99d
mov eax, dword [ebp + 0x10]
push dword [eax + 4]
call edi
push eax
lea eax, [ebp - 0x100]
push 0x1006454
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x100]
push eax
push 1
push 0x8000000
call fcn.0100e994
add esi, ebx
mov al, byte [esi]
test al, al
je 0x100f9bd
movzx eax, al
push eax
push 0x100643c
push 1
call fcn.0100c07e
add esp, 0xc
jmp 0x100fa46
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp word [esi + 4], ax
je 0x100f9d9
push 0x1006424
push 1
call fcn.0100c07e
pop ecx
pop ecx
jmp 0x100fa46
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [esi + 8]
push eax
movzx eax, word [esi + 6]
inc eax
push eax
mov eax, dword [ebp + 0x10]
push dword [eax + 4]
call edi
push eax
push dword [ebp + 0xc]
push 0x10063f4
push 1
call fcn.0100c07e
add esp, 0x18
call ebx
sub eax, dword [esi + 8]
push eax
movzx eax, word [esi + 6]
inc eax
push eax
mov eax, dword [ebp + 0x10]
push dword [eax + 4]
call edi
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x100]
push 0x10063c4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x100]
push eax
push 1
push 0x8000000
call fcn.0100e994
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1010060
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
and byte [ebp - 0x110], 0
push ebx
push esi
push edi
push 0x3f
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push esi
xor ebx, ebx
push esi
inc ebx
push 5
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], ebx
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
je 0x10100ad
push 4
pop esi
push 0x1006744
jmp 0x10101c5
xor eax, eax
mov ecx, 0xc8
lea edi, [ebp - 0x430]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x320
call sub.MPR.dll_WNetEnumResourceA
test eax, eax
je 0x10100eb
push 4
pop esi
push 0x100672c
jmp 0x10101c5
mov dword [ebp - 8], esi
mov esi, 0x100670c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call sub.MPR.dll_WNetEnumResourceA
test eax, eax
jne 0x10101a9
cmp dword [ebp - 0x41c], eax
je 0x101013a
push 2
push 0x1006708
push dword [ebp - 0x41c]
call fcn.01013e60
add esp, 0xc
test eax, eax
jne 0x101013a
add dword [ebp - 0x41c], 2
mov edi, dword [ebp - 0x41c]
push edi
push esi
push ebx
call fcn.0100c07e
push edi
lea eax, [ebp - 0x110]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
push ebx
push 0x8000000
call fcn.0100e994
push edi
call fcn.0100fae5
test eax, eax
jne 0x10101be
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jb 0x10100f3
xor esi, esi
cmp dword [ebp - 4], 0
je 0x1010193
push dword [ebp - 4]
call sub.MPR.dll_WNetCloseEnum
push esi
push 0x10066f4
push ebx
call fcn.0100c07e
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
cmp eax, 0x103
jne 0x10100de
xor eax, eax
cmp eax, dword [ebp - 8]
sbb esi, esi
inc esi
jmp 0x1010185
mov esi, eax
push 0x10065c0
push ebx
push 0x4000000
call fcn.0100e994
jmp 0x1010185

Function at 0x1010fdd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 0x1006d94
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x101102b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1006d88
push dword [ebp - 4]
mov dword [ebp - 0xc], 2
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, word [ebp - 8]
leave
ret
Function at 0x101112d
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
xor ebx, ebx
push 0x1011106
push esi
push esi
inc ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
jne 0x101117f
cmp dword [0x101c09c], esi
jne 0x101123e
push esi
push str.Suspender
push 0x1006f00
push dword [0x1020334]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x101123e
push 0x3a98
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
je 0x10111ef
mov ecx, 0x80
cmp eax, ecx
je 0x10111cc
mov ecx, 0x102
cmp eax, ecx
jne 0x1011237
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x1011237
cmp dword [0x101c09c], esi
jne 0x1011237
push esi
push str.Suspender
push 0x1006ed4
jmp 0x10111e1
cmp dword [0x101c09c], esi
mov ebx, ecx
jne 0x1011237
push esi
push str.Suspender
push 0x1006eb8
push dword [0x1020334]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1011237
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x1011213
cmp dword [0x101c09c], esi
jne 0x1011237
push esi
push str.Suspender
push 0x1006e94
jmp 0x10111e1
mov eax, dword [ebp + 8]
dec eax
je 0x1011235
sub eax, 0x102
jne 0x1011237
cmp dword [0x101c09c], esi
jne 0x1011237
push esi
push str.Suspender
push 0x1006e70
jmp 0x10111e1
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x10116c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push 0x3f
pop ecx
xor ebx, ebx
push ebx
mov byte [ebp - 0x110], bl
xor eax, eax
mov esi, 0x8000000
push esi
push 3
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
push ebx
push 1
stosw word es:[edi], ax
push closesocket
push dword [ebp + 8]
mov dword [ebp - 4], ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x101175a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x10117d8
cmp eax, 0x21
je 0x10117d8
cmp eax, 5
je 0x10117d8
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x110]
push 0x100722c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
push 6
push 0x800000
call fcn.0100e994
jmp 0x10117d8
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x101177b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x101177b
xor eax, eax
jmp 0x1011788
mov eax, 0x200
cmp dword [ebp - 0x10], eax
ja 0x1011788
mov eax, dword [ebp - 0x10]
push ebx
lea ecx, [ebp - 8]
push ecx
push eax
push 0x101fac0
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10117a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x110]
push dword [ebp - 8]
push 0x1007204
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
push 6
push esi
call fcn.0100e994
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10117e2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
mov esi, 0x1007254
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor ebx, ebx
push 0x7f
mov byte [ebp - 0x220], bl
xor eax, eax
pop ecx
lea edi, [ebp - 0x21f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
stosb byte es:[edi], al
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.01013d10
pop ecx
xor esi, esi
mov edi, 0x200
call fcn.01013d20
cdq
mov ecx, 0x100
idiv ecx
inc esi
cmp esi, edi
mov byte [ebp + esi - 0x221], dl
jl 0x1011827
mov dword [ebp - 4], ebx
mov al, byte [ebp - 4]
push ebx
push 0x8000000
push 2
push ebx
add al, 0x30
push 2
mov byte [ebp - 0x19], al
push 0x40000000
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x101189a
push ebx
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x220]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x101189a
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jl 0x1011843
jmp 0x10118a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1012022
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and byte [ebp - 0x100], 0
mov edx, eax
push 0x3f
xor eax, eax
cmp edx, 0xffffffff
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop edi
jne 0x101205c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x101209c
test dl, 0x10
je 0x1012094
push edx
lea eax, [ebp - 0x100]
push 0x1007538
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x100]
push eax
push 6
push 0x8000000
call fcn.0100e994
push dword [ebp + 8]
call fcn.01011d4d
jmp 0x101209c
push dword [ebp + 8]
call fcn.010116c0
leave
ret 4

Function at 0x10120a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push 0x3f
pop ecx
push dword [ebp + 8]
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x114], bl
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push 0x1007564
push eax
mov dword [ebp - 4], ebx
call esi
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 6
mov edi, 0x800000
push edi
call fcn.0100e994
push ebx
push 0x8000000
push 3
push ebx
push 1
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x101215c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x10121b2
cmp eax, 0x21
je 0x10121b2
cmp eax, 5
je 0x10121b2
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push 0x100722c
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
push 6
push edi
call fcn.0100e994
jmp 0x10121b2
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jne 0x101217f
call esi
test eax, eax
je 0x101217f
xor eax, eax
jmp 0x101218c
mov eax, 0x200
cmp dword [ebp - 0x10], eax
ja 0x101218c
mov eax, dword [ebp - 0x10]
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0x101fcc0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10121a9
call esi
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10123c1
Capabilities:
Check if file exists
Create thread
Get file attributes
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
xor esi, esi
inc ebx
cmp eax, 0xffffffff
mov dword [ebp - 4], esi
jne 0x10123eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x10124c2
test al, 0x10
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
je 0x10123fe
push 0x10121bc
jmp 0x1012403
push fcn.010120a0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
jne 0x1012435
cmp dword [0x101c09c], esi
jne 0x1012435
push esi
push str.Suspender
push 0x1007594
push dword [0x1020334]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10124c2
push 0x7530
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
jne 0x1012489
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
mov eax, dword [0x101c09c]
jne 0x101246a
cmp eax, esi
jne 0x101246a
push esi
push str.Suspender
push 0x1006e94
jmp 0x10124af
mov ebx, dword [ebp + 8]
cmp ebx, 0x103
jne 0x10124bb
xor ebx, ebx
inc ebx
cmp eax, esi
jne 0x10124bb
push esi
push str.Suspender
push 0x1006e70
jmp 0x10124af
cmp eax, 0x102
jne 0x10124bb
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x10124bb
cmp dword [0x101c09c], esi
jne 0x10124bb
push esi
push str.Suspender
push 0x1007578
push dword [0x1020334]
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x10124cb
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push esi
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
cmp edx, 1
stosb byte es:[edi], al
jl 0x1012634
cmp edx, 0x20
jg 0x1012634
lea eax, [edx - 1]
cmp eax, 0x1f
ja case.default.0x101250d
jmp dword [eax*4 + 0x101263a]
xor esi, esi
inc esi
jmp 0x1012634
push 2
jmp 0x1012532
push 4
jmp 0x1012532
push 8
jmp 0x1012532
push 0x10
jmp 0x1012532
push 0x20
jmp 0x1012532
push 0x40
pop esi
jmp 0x1012634
mov esi, 0x80
jmp 0x1012634
mov esi, 0x100
jmp 0x1012634
mov esi, 0x200
jmp 0x1012634
mov esi, 0x400
jmp 0x1012634
mov esi, 0x800
jmp 0x1012634
mov esi, 0x1000
jmp 0x1012634
mov esi, 0x2000
jmp 0x1012634
mov esi, 0x4000
jmp 0x1012634
mov esi, 0x8000
jmp 0x1012634
mov esi, 0x10000
jmp 0x1012634
mov esi, 0x20000
jmp 0x1012634
mov esi, 0x40000
jmp 0x1012634
mov esi, 0x80000
jmp 0x1012634
mov esi, 0x100000
jmp 0x1012634
mov esi, 0x200000
jmp 0x1012634
mov esi, 0x400000
jmp 0x1012634
mov esi, 0x800000
jmp 0x1012634
mov esi, 0x1000000
jmp 0x1012634
mov esi, 0x2000000
jmp 0x1012634
mov esi, 0x4000000
jmp 0x1012634
mov esi, 0x8000000
jmp 0x1012634
mov esi, 0x10000000
jmp 0x1012634
mov esi, 0x20000000
jmp 0x1012634
mov esi, 0x40000000
jmp 0x1012634
mov esi, closesocket
jmp 0x1012634
lea eax, [ebp - 0x100]
push 0x10075f0
push eax
xor esi, esi
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
lea eax, [ebp - 0x100]
push eax
push 1
push 0x8000000
call fcn.0100e994
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x1012e80
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push dword [ebp + 0x10]
mov edi, eax
movzx eax, word [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
cmp ebx, esi
je 0x1012f7d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x1012f7d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0x1012f7d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1012f0c
call fcn.0100bf99
push eax
push dword [ebp + 8]
push 0x10079e0
jmp 0x1012f8f
push esi
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1012f34
call fcn.0100bf99
push eax
push 0x10079c0
push esi
call fcn.0100bef0
add esp, 0xc
cmp dword [ebp - 4], edi
je 0x1012f44
push edi
push dword [ebp - 4]
push 0x100798c
jmp 0x1012f4f
push dword [ebp + 8]
push dword [ebp - 4]
push 0x100796c
push esi
call fcn.0100bef0
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1012f78
call fcn.0100bf99
push eax
push ebx
push 0x1007948
push esi
call fcn.0100bef0
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1012f9a
call fcn.0100bf99
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1007918
push esi
call fcn.0100bef0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1012fb1
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
or dword [ebp - 4], 0xffffffff
push ebx
push edi
xor ebx, ebx
xor eax, eax
mov byte [ebp - 0x414], bl
mov ecx, 0xff
lea edi, [ebp - 0x413]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
push eax
push 1
push 8
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1013030
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x101307b
lea eax, [ebp - 4]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x101307b
lea eax, [ebp - 0x14]
push eax
push 0x400
lea eax, [ebp - 0x414]
push eax
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x101305a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x101307b
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x101307f
xor eax, eax
jmp 0x10130bc
xor edi, edi
cmp dword [ebp - 0x414], ebx
push esi
jbe 0x10130b0
lea esi, [ebp - 0x410]
push dword [esi]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10130ad
inc edi
add esi, 8
cmp edi, dword [ebp - 0x414]
jb 0x1013090
jmp 0x10130b0
xor ebx, ebx
inc ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebx
pop esi
pop edi
pop ebx
leave
ret
Function at 0x10130fd
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
and byte [ebp - 0x104], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 0x3f
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
push 0xa
push dword [ebp + 0x10]
stosw word es:[edi], ax
push dword [ebp + 8]
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x10131e9
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10131e9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x10131e9
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
push ebx
push 0x1007a08
push 6
call fcn.0100c07e
add esp, 0x10
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10131e9
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x1003a24
lea eax, [ebp - 0x104]
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call esi
push 0x1001
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov esi, eax
cmp esi, 0xffffffff
je 0x10131e9
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc