joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101d0b6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101d0d7
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x101d14c
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
jne 0x101d0f2
cmp dword [ebp + 0xc], esi
je 0x101d0f2
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x101d14c
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
call edi
cmp eax, esi
mov dword [ebp - 8], eax
je 0x101d149
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push dword [ebp - 8]
push ebx
call edi
test eax, eax
je 0x101d149
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, dword [ebp + 0xc]
jbe 0x101d131
mov dword [ebp - 4], eax
jmp 0x101d149
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call fcn.01018b5b
cmp eax, esi
mov dword [ebp - 4], eax
je 0x101d149
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x101d3e2
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x1003554
push 0x1003524
call fcn.0101b028
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x101d404
pop ebp
jmp eax
pop ebp
jmp fcn.0101d0b6
Function at 0x101d40f
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, 0x1003524
je 0x101d44e
push 0x1003584
push ebx
call fcn.0101b028
push eax
call edi
test eax, eax
je 0x101d44e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
jmp 0x101d4a6
xor esi, esi
cmp dword [ebp + 8], esi
je 0x101d48a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp - 4], esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.01018b35
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp - 4]
push 0x1003570
push ebx
call fcn.0101b028
push eax
call edi
test eax, eax
je 0x101d4aa
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
jmp 0x101d522
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x101d520
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x101d518
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x101d518
mov eax, dword [ebp - 8]
mul dword [ebp - 0xc]
push edx
mov ebx, eax
push ebx
push 0
push dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
call fcn.01044e90
push dword [ebp - 0xc]
mov dword [esi], eax
push ebx
push 0
push dword [ebp - 0x18]
mov dword [esi + 4], edx
call fcn.01044e90
mov dword [edi], eax
mov eax, dword [ebp + 0x14]
test eax, eax
mov dword [edi + 4], edx
je 0x101d513
mov ecx, dword [esi]
mov dword [eax], ecx
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
xor eax, eax
inc eax
jmp 0x101d522
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x101d6e6
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101d720
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x101d7e6
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
cmp dword [ebp + 8], edi
je 0x101d75a
push dword [ebp + 8]
call ebx
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov esi, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 8]
push esi
call fcn.01018b35
mov edi, eax
neg edi
sbb edi, edi
and edi, esi
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x101d792
push dword [ebp + 0xc]
call ebx
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 8], esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01018b35
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp + 8]
xor eax, eax
cmp dword [ebp + 0x24], eax
je 0x101d7c8
push dword [ebp + 0x24]
call ebx
lea ebx, [eax + eax + 2]
lea eax, [ebx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 8], esp
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x24]
push dword [ebp + 8]
call fcn.01018b35
neg eax
sbb eax, eax
and eax, dword [ebp + 8]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x28

Function at 0x101d8bf
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101d8da
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x101d917
xor eax, eax
cmp dword [ebp + 8], eax
je 0x101d910
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.01018b35
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 4
Function at 0x101da4d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101da6e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x101dae3
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
jne 0x101da89
cmp dword [ebp + 0xc], esi
je 0x101da89
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x101dae3
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push esi
call edi
cmp eax, esi
mov dword [ebp - 8], eax
je 0x101dae0
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push dword [ebp - 8]
push ebx
call edi
test eax, eax
je 0x101dae0
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, dword [ebp + 0xc]
jbe 0x101dac8
mov dword [ebp - 4], eax
jmp 0x101dae0
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call fcn.01018b5b
cmp eax, esi
mov dword [ebp - 4], eax
je 0x101dae0
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x101dc0c
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101dc2e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x101dc97
xor esi, esi
cmp dword [ebp + 8], esi
je 0x101dc66
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.01018b35
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
mov edi, dword [ebp + 0x10]
mov eax, edi
shl eax, 2
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov esi, eax
test esi, esi
je 0x101dc95
push esi
push edi
push ebx
push dword [ebp + 0xc]
call fcn.01018b5b
mov eax, esi
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x101dca6
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101dcc1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x101dd01
cmp dword [ebp + 8], 0
jne 0x101dccb
xor eax, eax
jmp 0x101dd01
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.01018b35
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 4
Function at 0x101dd0f
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101dd2a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x101dd6a
cmp dword [ebp + 8], 0
jne 0x101dd34
xor eax, eax
jmp 0x101dd6a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.01018b35
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 4

Function at 0x101dd78
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101dda7
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x101de9b
cmp dword [ebp + 0xc], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x101ddb9
and dword [ebp - 4], 0
jmp 0x101dde7
push dword [ebp + 0xc]
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0xc]
push ebx
call fcn.01018b35
neg eax
sbb eax, eax
and eax, ebx
mov dword [ebp - 4], eax
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x101de1b
push dword [ebp + 0x10]
call esi
lea ebx, [eax + eax + 2]
lea eax, [ebx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x10]
push edi
call fcn.01018b35
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, edi
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x101de53
push dword [ebp + 0x14]
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 0xc], esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.01018b35
mov edi, eax
neg edi
sbb edi, edi
and edi, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp + 0x18], eax
je 0x101de89
push dword [ebp + 0x18]
call esi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 0xc], esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call fcn.01018b35
neg eax
sbb eax, eax
and eax, dword [ebp + 0xc]
push dword [ebp + 0x1c]
push eax
push edi
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x101ea79
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x58], edi
jne 0x101eaef
cmp dword [esi + 0x5c], edi
jne 0x101eaef
mov eax, dword [esi + 0x28]
cmp eax, 1
je 0x101eac7
jle 0x101eaef
cmp eax, 4
jle 0x101eaa3
cmp eax, 6
jne 0x101eaef
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x101eab9
push edi
push dword [esi + 0x14]
push eax
call fcn.0102dea0
mov dword [esi + 0x58], eax
jmp 0x101eaec
push 0x1003bf8
push 2
call fcn.0102ae4b
jmp 0x101eaef
lea eax, [ebp - 4]
push eax
push dword [esi + 0x18]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x101eaef
mov edx, dword [ebp - 4]
push ebx
xor ecx, ecx
xor ebx, ebx
or ecx, eax
or edx, ebx
mov dword [esi + 0x58], ecx
pop ebx
mov dword [esi + 0x5c], edx
cmp dword [esi + 0x4c], edi
jne 0x101eb1d
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x101eb1d
push eax
call fcn.010257cb
test eax, eax
jne 0x101eb1d
push dword [esi + 0x1c]
call fcn.010257cb
test eax, eax
jne 0x101eb1d
push 0x1003bb0
push 5
call fcn.0102ae4b
cmp dword [ebp + 8], edi
je 0x101eb2a
mov eax, dword [esi + 0x58]
mov edx, dword [esi + 0x5c]
jmp 0x101eb36
mov eax, dword [esi + 0x68]
add eax, dword [esi + 0x58]
mov edx, dword [esi + 0x6c]
adc edx, dword [esi + 0x5c]
pop edi
pop esi
leave
ret 4
Function at 0x10215cb
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1048628]
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov esi, ecx
push eax
lea edi, [esi + 4]
push edi
call fcn.0102740a
test eax, eax
mov dword [ebp - 0x210], eax
jl 0x10216c6
mov ecx, esi
call fcn.01021527
cmp dword [esi + 0x74], 0
je 0x10216c6
push ebx
lea eax, [ebp - 0x20c]
push eax
mov ebx, 0x104
push ebx
call fcn.0101adb2
test eax, eax
je 0x10216c5
lea eax, [ebp - 0x20c]
push eax
call fcn.0102534f
push dword [edi]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0100f5a7
lea eax, [ebp - 0x20c]
push eax
call fcn.010257cb
test eax, eax
je 0x10216c5
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x20c]
push eax
call fcn.0101a677
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10216c5
lea eax, [ebp - 0x214]
push eax
push ebx
mov dword [ebp - 0x214], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x10216be
mov ecx, dword [ebp - 0x214]
xor edx, edx
or edx, eax
or ecx, edi
cmp edx, dword [esi + 0x60]
jne 0x10216be
cmp ecx, dword [esi + 0x64]
jne 0x10216be
lea eax, [ebp - 0x20c]
push eax
add esi, 0x1c
push esi
call fcn.0102740a
mov dword [ebp - 0x210], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
call fcn.01018732
leave
ret 4

Function at 0x10228d0
Capabilities:
Get common file path
Get file size

Disassembly:
mov ecx, dword [ecx + 0x60]
test ecx, ecx
jne 0x10228dd
mov eax, 0x80004005
ret
jmp fcn.0102190e
Function at 0x1024d35
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
push edi
mov ebx, ecx
mov esi, 0x8007000e
call fcn.010247cb
cmp eax, edi
je 0x1024d65
push dword [ebp + 8]
push 0x1004d28
push eax
call fcn.01027e96
mov dword [ebp - 4], eax
jmp 0x1024d68
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
jne 0x1024d85
cmp dword [ebp - 4], edi
je 0x1024d7b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004003
jmp 0x1024f3f
cmp dword [ebp - 4], edi
je 0x1024f3d
push dword [ebp + 8]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push edi
push edi
push dword [ebp - 4]
call fcn.0101c11a
cmp dword [ebp + 0xc], edi
mov eax, 0x1003660
jne 0x1024e8d
mov eax, 0x1003664
mov dword [ebp + 0xc], eax
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push edi
push 0x1004d20
push dword [ebp - 4]
push dword [ebx + 0x14]
call fcn.01026bba
cmp dword [ebp + 0x10], edi
mov eax, 0x1003660
jne 0x1024e99
mov eax, 0x1003664
mov dword [ebp + 0xc], eax
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push edi
push 0x1004d10
push dword [ebp - 4]
push dword [ebx + 0x14]
call fcn.01026bba
push dword [ebp + 8]
call fcn.010257cb
test eax, eax
je 0x1024f32
push 0x82
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
cmp ebx, edi
pop ecx
je 0x1024f32
push edi
push 0x8000080
push 3
push edi
push 3
push edi
push dword [ebp + 8]
mov dword [ebp + 0x10], edi
mov dword [ebp + 0xc], edi
call fcn.0101a677
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x1024ed8
lea ecx, [ebp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x1024ecf
cmp dword [ebp + 0xc], edi
push eax
jbe 0x1024ea5
push dword [ebp + 0xc]
push 0x1004d4c
push 0x41
push ebx
call fcn.0100f541
add esp, 0x14
jmp 0x1024eb5
mov dword [ebp + 0xc], 0x1003660
jmp 0x1024dc4
mov dword [ebp + 0xc], 0x1003660
jmp 0x1024df9
push 0x1004a14
push 0x41
push ebx
call fcn.0100f541
add esp, 0x10
push ebx
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push edi
push 0x1004d40
push dword [ebp - 4]
call fcn.0101c11a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.01025e0f
test eax, eax
jl 0x1024f2b
mov eax, dword [ebp + 0x10]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp + 0xc]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push 0x1003f20
push 0x41
push ebx
call fcn.0100f541
push ebx
call esi
add esp, 0x20
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push edi
push 0x1004d00
push dword [ebp - 4]
call fcn.0101c11a
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 4]
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x102579e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x10257c0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10257c0
test al, 0x10
jne 0x10257c0
xor eax, eax
inc eax
jmp 0x10257c2
xor eax, eax
pop ebp
ret 4

Function at 0x1025cc2
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1048628]
push ebx
xor ebx, ebx
push ebx
push 4
mov dword [ebp - 4], eax
call fcn.010259af
test eax, eax
je 0x1025ce9
xor eax, eax
inc eax
jmp 0x1025dd2
or dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x10]
push eax
push 0x20008
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1025dcf
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call edi
push dword [ebp - 0x14]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
cmp esi, ebx
pop ecx
je 0x1025dbf
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push esi
push 2
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x1025db8
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1025db8
cmp dword [esi], ebx
mov dword [ebp - 0x18], ebx
jbe 0x1025daf
lea edi, [esi + 4]
push dword [edi]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1025da8
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add edi, 8
cmp eax, dword [esi]
jb 0x1025d8a
jmp 0x1025daf
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0x10], ebx
pop edi
pop esi
je 0x1025dcf
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01018732
leave
ret
Function at 0x1027940
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
je 0x1027a26
cmp dword [ebp + 0xc], ebx
je 0x1027a26
push esi
lea eax, [ebp - 4]
push eax
push 3
push ebx
mov esi, 0x1001bf8
push esi
push 0x80000002
call fcn.0101c02d
cmp eax, ebx
je 0x1027992
lea eax, [ebp - 4]
push eax
push 3
push ebx
push esi
push 0x80000001
call fcn.0101c02d
mov esi, eax
cmp esi, ebx
jne 0x10279e6
push edi
push dword [ebp + 0xc]
push 0x100555c
push dword [ebp - 4]
call fcn.0102687c
mov edi, eax
cmp edi, ebx
je 0x10279d3
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push ebx
push edi
push dword [ebp - 4]
call fcn.0101c11a
push edi
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x10279d8
mov esi, 0x80004005
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
pop edi
je 0x1027a09
jle 0x10279f4
and esi, 0xffff
or esi, 0x80070000
push esi
push dword [ebp + 8]
push 0x1005518
push 2
call fcn.0102ae85
add esp, 0x10
jmp 0x1027a21
push 0x10054f8
push 5
call fcn.0102ae4b
or dword [0x104a400], 1
mov esi, 0xd2af9
mov eax, esi
pop esi
jmp 0x1027a2b
mov eax, 0x80004003
pop ebx
leave
ret 8
Function at 0x102833d
Capabilities:
Get common file path
Get file size
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1048628]
push esi
push edi
xor esi, esi
push esi
push 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], esi
call fcn.010259af
test eax, eax
je 0x10283e0
mov edi, 0x104
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x102842b
push 0x1005838
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.0100f56f
test eax, eax
jl 0x102842b
push esi
push 0x8000080
push 3
push esi
push esi
push 0x80000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x102842b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 0x10c], eax
jne 0x10283d7
mov dword [ebp - 0x10c], esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x102842b
lea eax, [ebp - 0x110]
push eax
push 1
push esi
push 0x1005804
push 0x80000002
mov dword [ebp - 0x110], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x102842b
lea eax, [ebp - 0x10c]
push eax
push esi
push esi
push esi
push 0x10057e8
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
call fcn.01018732
leave
ret

Function at 0x10284f3
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
push esi
push esi
push esi
push 4
call fcn.01028147
test eax, eax
jne 0x102851f
push 0x80040002
push 1
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
jmp 0x1028587
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1028587
lea eax, [ebp - 0x10]
push eax
push 0x10058d4
push esi
call fcn.0101daf2
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1028579
push 0x80040002
push 1
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
cmp dword [ebp - 4], esi
je 0x1028587
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret