joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2ef201
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push dword [esp + 0x38]
push dword [esp + 0x38]
push edx
push ecx
call fcn.002e6dc3
mov dword [esp + 0x30], 0xb07bf
lea edi, [esp + 0x34]
xor eax, eax
lea ebp, [ecx + 4]
mov ebx, dword [ebp]
add esp, 0x10
stosd dword es:[edi], eax
add ebp, 4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ecx]
xor ebx, eax
mov dword [esp + 0x14], 0x81dc8e
add dword [esp + 0x14], 0xffffd7f0
xor dword [esp + 0x14], 0x81b47f
mov dword [esp + 0x10], 0xcb9660
mov dword [esp + 0x18], eax
imul eax, dword [esp + 0x10], 0x63
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x4ebb2724
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add ecx, ebx
mov esi, dword [esp + 0x14]
dec eax
add esi, ebx
test eax, ecx
je 0x2ef293
mov eax, dword [esp + 0x10]
dec eax
not eax
and esi, eax
add esi, dword [esp + 0x10]
mov dword [esp + 0x10], 0x59bd5a
lea edx, [esi + esi]
xor dword [esp + 0x10], 0xf925609d
imul eax, dword [esp + 0x10], 0x25
push ecx
mov dword [esp + 0x14], eax
shl dword [esp + 0x14], 0xa
xor dword [esp + 0x14], 0x303e246a
mov dword [esp + 0x18], 0x44df6d
shr dword [esp + 0x18], 4
shr dword [esp + 0x18], 9
xor dword [esp + 0x18], 0x13f4c
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
call fcn.002e32c0
mov edi, eax
mov dword [esp + 0x18], edi
pop ecx
test edi, edi
je 0x2ef35c
shr esi, 2
xor eax, eax
lea ecx, [esi*4]
mov esi, edi
add ecx, ebp
mov edx, ecx
sub edx, ebp
add edx, 3
shr edx, 2
cmp ebp, ecx
cmova edx, eax
test edx, edx
je 0x2ef356
mov edi, dword [esp + 0x18]
xor ebx, ebx
mov ecx, dword [ebp]
lea ebp, [ebp + 4]
xor ecx, edi
movzx eax, cl
mov word [esi], ax
mov eax, ecx
shr eax, 8
lea esi, [esi + 8]
movzx eax, al
mov word [esi - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc ebx
mov word [esi - 4], ax
movzx eax, cl
mov word [esi - 2], ax
cmp ebx, edx
jb 0x2ef318
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
xor eax, eax
mov word [edi + ebx*2], ax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x2f4496
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x98
push ebx
mov ebx, dword [esp + 0xa4]
push ebp
push esi
push edi
push dword [esp + 0xb4]
mov edi, edx
push ebx
push dword [esp + 0xb4]
mov dword [esp + 0x24], edi
push edi
push ecx
call fcn.002e6dc3
mov dword [esp + 0x30], 0x5d27c
xor ebp, ebp
mov dword [esp + 0x34], ebp
add esp, 0x14
mov dword [esp + 0x24], ebp
mov esi, ebp
mov dword [esp + 0x10], 0x4b4c7a
shl dword [esp + 0x10], 2
or dword [esp + 0x10], 0x8e590156
imul eax, dword [esp + 0x10], 0x21
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x7f2371bf
mov eax, dword [esp + 0x10]
test edi, eax
je 0x2f4518
push 0x61
pop eax
mov word [esp + esi*2 + 0x28], ax
inc esi
inc eax
cmp ax, 0x7a
jbe 0x2f450b
mov dword [esp + 0x10], 0xa371ac
xor edx, edx
mov eax, dword [esp + 0x10]
push 0x5e
pop ecx
div ecx
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x1bd1d
mov eax, dword [esp + 0x10]
test edi, eax
je 0x2f454f
push 0x41
pop eax
mov word [esp + esi*2 + 0x28], ax
inc esi
inc eax
cmp ax, 0x5a
jbe 0x2f4542
mov dword [esp + 0x10], 0xa719d2
shr dword [esp + 0x10], 0x10
xor dword [esp + 0x10], 0xa3
mov eax, dword [esp + 0x10]
test edi, eax
je 0x2f457c
push 0x30
pop eax
mov word [esp + esi*2 + 0x28], ax
inc esi
inc eax
cmp ax, 0x39
jbe 0x2f456f
test ebx, ebx
je 0x2f45f1
mov edi, dword [esp + 0xb4]
mov dword [esp + 0x14], 0x6f03c8
xor edx, edx
or dword [esp + 0x14], 0xd40a41b0
xor dword [esp + 0x14], 0xd46ac1b0
mov dword [esp + 0x10], 0x3d64a0
mov eax, dword [esp + 0x10]
push 0x28
pop ecx
div ecx
mov dword [esp + 0x10], eax
add dword [esp + 0x10], 0xffff929f
xor dword [esp + 0x10], 0x26b2625b
xor dword [esp + 0x10], 0x26b4643a
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
call fcn.002ff7c2
xor edx, edx
div esi
mov ax, word [esp + edx*2 + 0x28]
mov word [edi + ebp*2], ax
inc ebp
cmp ebp, ebx
jb 0x2f4587
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], 0xdd4ae6
shr dword [esp + 0x10], 4
shr dword [esp + 0x10], 2
xor dword [esp + 0x10], 0x37523
mov eax, dword [esp + 0x10]
test edi, eax
je 0x2f4620
mov eax, dword [esp + 0xb4]
xor ecx, ecx
mov word [eax + ebx*2], cx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret
Function at 0x2f46ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x34
push ebx
push ebp
mov ebp, dword [esp + 0x44]
mov eax, ecx
push esi
push edi
push ebp
push dword [esp + 0x4c]
mov dword [esp + 0x24], eax
push edx
push eax
call fcn.002e6dc3
mov eax, dword [ebp + 0x3c]
xor esi, esi
mov dword [esp + 0x44], 0xb4c3d
add eax, ebp
mov dword [esp + 0x48], 0xfa4cc
add esp, 0x10
mov dword [esp + 0x3c], esi
mov ebx, esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x4c], 0xd57ebc
add dword [esp + 0x4c], 0xffff9d75
xor dword [esp + 0x4c], 0xd51c31
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov edi, dword [eax + ecx*8 + 0x78]
add edi, ebp
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add eax, ebp
mov dword [esp + 0x28], eax
add ecx, ebp
mov eax, dword [edi + 0x24]
add eax, ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
cmp dword [edi + 0x18], esi
jbe 0x2f484f
mov eax, dword [ecx + ebx*4]
mov dword [esp + 0x4c], 0x4e564f
add eax, ebp
add dword [esp + 0x4c], 0xffff0e9c
add dword [esp + 0x4c], 0xbf39
xor dword [esp + 0x4c], 0x151ee554
xor dword [esp + 0x4c], 0x155f51d9
mov dword [esp + 0x18], 0x4ca640
xor dword [esp + 0x18], 0x33910216
xor dword [esp + 0x18], 0x33d064ee
mov dword [esp + 0x14], 0xbedd0c
shr dword [esp + 0x14], 3
xor dword [esp + 0x14], 0x1938a8
mov dword [esp + 0x10], 0xe28260
or dword [esp + 0x10], 0x6500356a
xor dword [esp + 0x10], 0x65ee114e
push dword [esp + 0x10]
push dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x54]
push eax
call fcn.002f6dbf
xor eax, 0x13513119
add esp, 0xc
cmp eax, dword [esp + 0x1c]
je 0x2f481f
mov ecx, dword [esp + 0x20]
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x2f4779
jmp 0x2f484f
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
movzx eax, word [eax + ebx*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, edi
jb 0x2f484f
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov eax, dword [eax + ecx*8 + 0x7c]
add eax, edi
cmp esi, eax
jae 0x2f484f
mov ecx, esi
call fcn.002fde14
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x2fe003
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push dword [esp + 0x24]
mov edi, edx
push edi
push ecx
call fcn.002e6dc3
mov eax, dword [edi + 0x3c]
add esp, 0xc
mov dword [esp + 0x18], 0x5c14d
add eax, edi
mov dword [esp + 0x1c], 0x45f3e
mov dword [esp + 0x14], 0x2793c9
or dword [esp + 0x14], 0x3c5f2686
xor dword [esp + 0x14], 0x3c7fb7ce
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + ecx*8 + 0x78]
test edx, edx
je 0x2fe16c
cmp dword [eax + ecx*8 + 0x7c], 0
je 0x2fe16c
lea esi, [edx + edi]
jmp 0x2fe161
mov dword [esp + 0x14], 0x9aa8c2
lea ecx, [eax + edi]
shr dword [esp + 0x14], 1
or dword [esp + 0x14], 0x2a8bfbba
add dword [esp + 0x14], 0xa414
xor dword [esp + 0x14], 0x2ad51638
mov dword [esp + 0x10], 0x21fb33
add dword [esp + 0x10], 0xffffc7af
add dword [esp + 0x10], 0x80e1
add dword [esp + 0x10], 0xffff3e22
xor dword [esp + 0x10], 0x22e10a
push dword [esp + 0x10]
mov edx, dword [esp + 0x18]
call fcn.002ff844
mov edx, eax
mov dword [esp + 0x1c], edx
pop ecx
test edx, edx
je 0x2fe177
mov ebx, dword [esi]
mov ebp, dword [esi + 0x10]
add ebx, edi
add ebp, edi
jmp 0x2fe158
jns 0x2fe0e7
movzx ecx, ax
jmp 0x2fe0ec
lea ecx, [edi + 2]
add ecx, eax
mov dword [esp + 0x14], 0x99e24d
add dword [esp + 0x14], 0xffffc65d
add dword [esp + 0x14], 0xffffea4b
imul eax, dword [esp + 0x14], 0x5b
push edx
mov dword [esp + 0x18], eax
xor dword [esp + 0x18], 0x3699dfee
mov dword [esp + 0x14], 0xcec4a2
imul eax, dword [esp + 0x14], 0x2e
mov dword [esp + 0x14], eax
imul eax, dword [esp + 0x14], 0x67
mov dword [esp + 0x14], eax
xor dword [esp + 0x14], 0xf2d7fd6b
push dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
call fcn.002e8499
pop ecx
pop ecx
test eax, eax
je 0x2fe177
mov edx, dword [esp + 0x18]
add ebx, 4
mov dword [ebp], eax
add ebp, 4
mov eax, dword [ebx]
test eax, eax
jne 0x2fe0e0
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x2fe06a
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
xor eax, eax
jmp 0x2fe16f
Function at 0x2feda4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x301b98]
mov dword [ebp - 8], 0xf78fb
mov ecx, dword [eax + 0x34]
test ecx, ecx
je 0x2fee07
push esi
push edi
mov esi, dword [ecx + 0x34]
xor edx, edx
mov dword [ebp - 8], 0xd6dc4c
mov eax, dword [ebp - 8]
push 0x46
pop edi
div edi
mov edx, ecx
mov dword [ebp - 8], eax
xor dword [ebp - 8], 0xeba43
mov dword [ebp - 4], 0xdb3571
xor dword [ebp - 4], 0x1323c6ed
xor dword [ebp - 4], 0x13f02dea
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00300621
pop ecx
mov ecx, esi
test esi, esi
jne 0x2fedbe
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5f2b58
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f2b73
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b7d98]
pop edx
test eax, eax
je 0x5f2c45
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5f2c34
test dword [ebp - 0x2a8], 1
jne 0x5f2c34
and dword [ebp - 0x2a8], 0x100
jne 0x5f2c34
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3ac3]
pop edx
pop esi
test eax, eax
je 0x5f2bd7
jmp 0x5f2c34
cmp word [esi], 0x5a4d
jne 0x5f2c34
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5f2c34
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d389f]
pop edx
test eax, eax
je 0x5f2c34
lea eax, [ebp - 0x28c]
push eax
call fcn.005f2ab4
test eax, eax
jne 0x5f2c2d
jmp 0x5f2c34
mov eax, esi
jmp 0x5f2c45
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5f2b73
pop esi
leave
ret 4
Function at 0x10007b5b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x10001ed8
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x10007bb3
jg 0x10007b87
mov esi, eax
jmp 0x10007b90
movzx esi, ax
or esi, 0x80070000
mov eax, dword [0x10014024]
cmp eax, 0x10014024
je 0x10007c10
test byte [eax + 0x1c], 2
je 0x10007c10
cmp byte [eax + 0x19], 2
jb 0x10007c10
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x72
jmp 0x10007c05
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x400000
push eax
push 4
push esi
push 0x10001eb4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10007c10
jg 0x10007bdb
mov esi, eax
jmp 0x10007be4
movzx esi, ax
or esi, 0x80070000
mov eax, dword [0x10014024]
cmp eax, 0x10014024
je 0x10007c10
test byte [eax + 0x1c], 2
je 0x10007c10
cmp byte [eax + 0x19], 2
jb 0x10007c10
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x73
mov edx, 0x10002130
pop ecx
call fcn.10002ec1
cmp dword [ebp - 4], 0
je 0x10007c1f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100080c8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24
mov eax, 0x10012148
call fcn.10011ee2
mov dword [ebp - 0x24], edx
mov edi, ecx
mov eax, dword [0x10014024]
cmp eax, 0x10014024
je 0x10008105
test byte [eax + 0x1c], 1
je 0x10008105
cmp byte [eax + 0x19], 5
jb 0x10008105
push edx
push dword [eax + 0x14]
mov edx, 0x10002130
push dword [eax + 0x10]
push 0x7a
pop ecx
call fcn.10002ec1
xor esi, esi
mov ecx, edi
mov dword [ebp - 0x14], esi
call fcn.1000b050
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], esi
push eax
push 1
push esi
push 0x10001d18
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10008139
mov esi, 0x8000ffff
jmp 0x1000821f
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], esi
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push 0x10001d6c
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000812f
cmp dword [ebp - 0x1c], 1
jne 0x1000812f
mov dword [ebp - 4], esi
mov ecx, edi
mov ebx, dword [ebp - 0x18]
shr ebx, 1
inc ebx
push ebx
call fcn.1000b21b
push ebx
mov ecx, edi
mov dword [ebp - 0x20], eax
call fcn.1000b248
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push eax
push esi
push 0x10001d6c
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100081ad
jg 0x100081a2
mov esi, eax
jmp 0x1000821f
movzx esi, ax
or esi, 0x80070000
jmp 0x1000821f
mov dword [ebp - 4], 2
mov eax, dword [edi]
cmp dword [eax - 4], 1
jle 0x100081c6
push dword [eax - 0xc]
mov ecx, edi
call fcn.1000b0ae
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [edi]
shr eax, 1
mov word [ecx + eax*2], dx
mov ecx, dword [edi]
call fcn.1000b2ee
push eax
mov ecx, edi
call fcn.10003014
cmp dword [ebp - 0x24], 0
mov ebx, 0x10001d80
jne 0x100081f2
mov ebx, 0x10001d9c
mov ecx, ebx
call fcn.1000b2ee
push eax
push ebx
mov ecx, edi
call fcn.1000aaae
jmp 0x1000821f
cmp dword [ebp - 0x14], 0
je 0x1000822e
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.10011e47
ret
Function at 0x10008544
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push 0x14
mov eax, 0x1001218e
call fcn.10011eac
mov dword [ebp - 0x18], edx
mov ebx, ecx
mov eax, dword [0x10014024]
cmp eax, 0x10014024
je 0x10008583
test byte [eax + 0x1c], 1
je 0x10008583
cmp byte [eax + 0x19], 5
jb 0x10008583
push ebx
push dword [eax + 0x14]
mov edx, 0x10002130
mov ecx, 0x81
push dword [eax + 0x10]
call fcn.10002ec1
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ecx
push eax
push 0x10001e64
push 1
push ecx
push 0x10001e54
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jns 0x1000860d
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100085c3
mov edx, dword [ecx]
push ecx
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x100151d8]
call esi
mov ebx, dword [ebp - 0x18]
mov esi, dword [0x10014024]
cmp esi, 0x10014024
je 0x10008605
test byte [esi + 0x1c], 1
je 0x10008605
movzx eax, byte [esi + 0x19]
mov ecx, edi
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x10008605
push dword [ebx]
mov edx, 0x10002130
mov ecx, 0x82
push edi
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.10004314
mov eax, edi
call fcn.10011e5b
ret
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push eax
mov esi, dword [eax]
mov ecx, dword [esi + 0x20]
call dword [0x100151d8]
call dword [esi + 0x20]
mov edi, eax
test edi, edi
jns 0x10008640
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100085c3
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
jmp 0x100085b9
mov ebx, dword [ebp - 0x18]
xor eax, eax
or ecx, 0xffffffff
cmp cx, word [ebp - 0x1c]
mov dword [ebp - 4], ecx
sete al
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100085c6
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x100151d8]
call esi
jmp 0x100085c6
Function at 0x10008a6f
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push 0x18
mov eax, 0x100121e8
call fcn.10011eac
mov esi, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [0x10014024]
mov ebx, dword [ebp + 8]
cmp eax, 0x10014024
je 0x10008aa9
test byte [eax + 0x1c], 1
je 0x10008aa9
cmp byte [eax + 0x19], 5
jb 0x10008aa9
push ebx
push esi
push ecx
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003b17
xor edi, edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
call fcn.100082e7
test eax, eax
js 0x10008b55
cmp dword [ebp - 0x18], edi
je 0x10008b55
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edi
push eax
push 0x10001e64
push 1
push edi
push 0x10001e54
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jns 0x10008afd
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10008b55
mov edx, dword [ecx]
push ecx
mov esi, dword [edx + 8]
jmp 0x10008b4b
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
jne 0x10008b14
mov edi, 0x8007000e
jmp 0x10008b3a
mov eax, dword [ebp - 0x14]
neg ebx
sbb ebx, ebx
push ebx
mov esi, dword [eax]
push ecx
push dword [ebp - 0x1c]
mov ecx, dword [esi + 0x50]
push eax
call dword [0x100151d8]
call dword [esi + 0x50]
push dword [ebp - 0x20]
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10008b55
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x100151d8]
call esi
mov edx, dword [0x10014024]
cmp edx, 0x10014024
je 0x10008b92
test byte [edx + 0x1c], 1
je 0x10008b92
movzx eax, byte [edx + 0x19]
mov ecx, edi
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x10008b92
push edi
push dword [edx + 0x14]
mov ecx, 0x8d
push dword [edx + 0x10]
mov edx, 0x10002130
call fcn.10002ec1
mov eax, edi
call fcn.10011e5b
ret 4
Function at 0x10008b9c
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100141a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov eax, dword [0x10014024]
cmp eax, 0x10014024
je 0x10008be0
test byte [eax + 0x1c], 1
je 0x10008be0
cmp byte [eax + 0x19], 5
jb 0x10008be0
push dword [eax + 0x14]
mov edx, 0x10002130
mov ecx, 0x8e
push dword [eax + 0x10]
call fcn.10003014
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push 0x10001e64
push 1
push esi
push 0x10001e54
mov dword [ebp - 0xc], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x10008c55
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov dword [ebp - 8], esi
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x100151d8]
call esi
mov edi, eax
test edi, edi
js 0x10008c42
test byte [ebp - 8], 1
mov dword [ebx], 4
je 0x10008c36
mov dword [ebx], 1
jmp 0x10008c42
test byte [ebp - 8], 2
je 0x10008c42
mov dword [ebx], 2
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x100151d8]
call esi
mov edx, dword [0x10014024]
cmp edx, 0x10014024
je 0x10008c8a
test byte [edx + 0x1c], 1
je 0x10008c8a
movzx eax, byte [edx + 0x19]
mov ecx, edi
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x10008c8a
push dword [ebx]
push edi
push dword [edx + 0x14]
push dword [edx + 0x10]
call fcn.1000425c
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011470
mov esp, ebp
pop ebp
ret
Function at 0x10008c9d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100141a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [0x10014024]
cmp eax, 0x10014024
je 0x10008cd9
test byte [eax + 0x1c], 1
je 0x10008cd9
push dword [eax + 0x14]
mov edx, 0x10002130
mov ecx, 0x90
push dword [eax + 0x10]
call fcn.10002ea3
mov esi, 0x100015b4
lea edi, [ebp - 0x34]
lea ebx, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x100015a4
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x100015c4
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
and dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
push 0
push 0x8000
push ebx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, eax
test esi, esi
js 0x10008d4d
mov ecx, dword [ebp - 0x38]
xor edx, edx
push 1
push 0x80000002
push 0x10001bd8
inc edx
call fcn.10007892
push dword [ebp - 0x38]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
js 0x10008d4d
inc edi
add ebx, 0x10
cmp edi, 3
jb 0x10008d02
mov edi, dword [0x10014024]
cmp edi, 0x10014024
je 0x10008d8a
test byte [edi + 0x1c], 1
je 0x10008d8a
movzx eax, byte [edi + 0x19]
mov ecx, esi
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x10008d8a
push esi
push dword [edi + 0x14]
mov edx, 0x10002130
mov ecx, 0x91
push dword [edi + 0x10]
call fcn.10002ec1
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011470
mov esp, ebp
pop ebp
ret
Function at 0x100098b0
Capabilities:
Add user account to group
Delete user account from group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor edi, edi
push eax
push 0x10001bd8
mov bl, cl
mov esi, edi
call dword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSidToSidW]
test eax, eax
jne 0x100098f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x100098e4
push 0x57
pop esi
test esi, esi
jle 0x100098ef
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1000992a
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 1
push eax
push edi
push 0x10001dd0
push edi
test bl, bl
je 0x10009912
call dword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
jmp 0x10009918
call dword [sym.imp.NETAPI32.dll_NetLocalGroupDelMembers]
test eax, eax
je 0x10009921
mov esi, 0x80070005
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000ab5b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000abb7
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000aba9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x1000aba5
cmp esi, ecx
jae 0x1000aba9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x1000ab93
cmp esi, ecx
jb 0x1000abad
xor eax, eax
jmp 0x1000abb6
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1000ad45
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
test edx, edx
je 0x1000ad8a
mov ecx, edx
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000ad5d
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, 0x80004005
call fcn.100034cf
int3