joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009a91
Capabilities:
Enumerate network shares

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x101d774]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor ebx, ebx
push eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb0], ebx
call fcn.01009125
mov esi, eax
cmp esi, ebx
je 0x1009c7c
push edi
mov edi, 0x906
cmp esi, edi
jne 0x1009afe
push ebx
push dword [ebp - 0xac]
push ebx
call sub.NETAPI32.dll_NetShareDelSticky
mov esi, eax
cmp esi, ebx
jne 0x1009af4
push dword [ebp - 0xac]
push 0x1233
jmp 0x1009c76
cmp esi, edi
je 0x1009b04
push esi
call fcn.0101004c
push esi
call fcn.0101004c
push ebx
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xac]
push ebx
call sub.NETAPI32.dll_I_NetPathType
cmp eax, ebx
je 0x1009b22
push eax
call fcn.0101004c
cmp dword [ebp - 0xc0], 0x2006
jne 0x1009b36
mov dword [ebp - 0xb8], ebx
jmp 0x1009b5f
test byte [ebp - 0xbf], 0x40
jne 0x1009b42
push edi
jmp 0x1009b5a
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0xac]
push ebx
call sub.NETAPI32.dll_NetShareCheck
cmp eax, ebx
je 0x1009b5f
push eax
call fcn.0101004c
cmp dword [ebp - 0xb8], ebx
mov dword [ebp - 0xbc], ebx
je 0x1009b79
push 0x57
call fcn.0101004c
jmp 0x1009c61
push ebx
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xc4]
push eax
push 2
push ebx
call sub.NETAPI32.dll_NetShareEnum
cmp eax, ebx
je 0x1009ba3
push eax
call fcn.0101004c
mov esi, dword [ebp - 0xc4]
xor edi, edi
cmp dword [ebp - 0xb4], ebx
jbe 0x1009c21
push dword [ebp - 0xac]
push dword [esi + 0x18]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1009c15
push dword [esi]
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xbc], 1
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
call fcn.0100e823
lea eax, [ebp - 0xa8]
push eax
call fcn.01009125
cmp eax, ebx
je 0x1009c15
inc dword [ebp - 0xb0]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xa8]
push eax
push 0xe8d
call fcn.0101000f
inc edi
add esi, 0x20
cmp edi, dword [ebp - 0xb4]
jb 0x1009bb3
push dword [ebp - 0xc4]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 0xb0]
cmp eax, ebx
je 0x1009c59
cmp eax, dword [ebp - 0xb4]
jne 0x1009c46
push dword [ebp - 0xc8]
jmp 0x1009c66
push 0xdb0
call fcn.0100ffd2
push 1
call fcn.0100fb27
jmp 0x1009c6b
cmp dword [ebp - 0xbc], ebx
jne 0x1009c6b
push 0xe87
call fcn.0101004c
push dword [ebp - 0xac]
push 0x122a
call fcn.0101000f
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0100f4dc
leave
ret 4
Function at 0x100b419
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1020240]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
je 0x100b484
mov ecx, 0x1020240
mov edi, ecx
mov esi, ecx
push str._SETSNTP
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
cmp eax, dword [edi]
pop ecx
pop ecx
je 0x100b463
inc dword [ebp - 0xc]
add esi, 4
mov eax, dword [esi]
test eax, eax
mov edi, esi
jne 0x100b441
jmp 0x100b484
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax*4 + 0x1020240]
test ebx, ebx
je 0x100b484
push 0x3a
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x100b484
inc ebx
inc ebx
cmp dword [ebp + 8], 0
je 0x100b523
lea eax, [ebp - 8]
push eax
push 0x80000002
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
je 0x100b4aa
push eax
call fcn.0101004c
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 2
push 0
push 0x1001be0
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x100b4dd
cmp dword [ebp - 8], edi
je 0x100b4d7
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0101004c
cmp ebx, edi
je 0x100b52a
cmp word [ebx], di
je 0x100b52a
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push edi
push 0x1001bc8
push dword [ebp - 4]
call esi
mov edi, eax
test edi, edi
jne 0x100b55f
push 8
push 0x1001bc0
push 1
push eax
push 0x1001bb4
push dword [ebp - 4]
call esi
jmp 0x100b55d
mov eax, 0x80000002
jmp 0x100b4ad
push 0x1001bc8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
cmp edi, 2
jne 0x100b541
xor edi, edi
test edi, edi
jne 0x100b55f
push 0xc
push 0x1001ba8
push 1
push edi
push 0x1001bb4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp dword [ebp - 4], 0
je 0x100b56e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x100b57d
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x100b587
push edi
call fcn.0101004c
call fcn.0100ffba
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100b598
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x18], edi
je 0x100b6f7
lea eax, [ebp - 0x10]
push eax
push 0x80000002
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
cmp eax, edi
je 0x100b5d9
push eax
call fcn.0101004c
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 4]
push ecx
push 1
push edi
push 0x1001be0
push eax
call esi
cmp eax, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 0x1001bc8
jne 0x100b696
lea ecx, [ebp - 8]
mov eax, 0x400
push ecx
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp + 8], 1
call fcn.010158a8
test eax, eax
je 0x100b631
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xe
call fcn.0101004c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp + 8]
push eax
push 0
push ebx
push dword [ebp - 4]
call edi
cmp eax, 0xea
mov dword [ebp - 0x14], eax
jne 0x100b687
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
call sub.NETAPI32.dll_NetApiBufferReallocate
test eax, eax
je 0x100b671
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xe
call fcn.0101004c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp + 8]
push eax
push 0
push ebx
push dword [ebp - 4]
call edi
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
je 0x100b6db
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x1001c50
push 0x80000002
call esi
test eax, eax
jne 0x100b708
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp + 8]
push eax
push 0
push ebx
push dword [ebp - 4]
call edi
mov esi, eax
test esi, esi
jne 0x100b6ce
mov dword [ebp - 0x18], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100b708
cmp dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov dword [0x1020840], eax
push 1
je 0x100b701
push 0xf61
call fcn.0100fff0
jmp 0x100b712
mov eax, 0x80000002
jmp 0x100b5dc
push 0xf5f
jmp 0x100b6f0
push 0xf60
call fcn.0100ffd2
cmp dword [ebp - 8], 0
pop edi
pop esi
pop ebx
je 0x100b723
push dword [ebp - 8]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0x10], 0
je 0x100b732
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0100ffba
leave
ret 4
Function at 0x100b740
Capabilities:
Get domain controller name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1020240]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x100b7a8
push esi
mov ecx, 0x1020240
push edi
mov edi, ecx
mov esi, ecx
push str._RTSDOMAIN
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
cmp eax, dword [edi]
pop ecx
pop ecx
je 0x100b782
add esi, 4
mov eax, dword [esi]
inc ebx
test eax, eax
mov edi, esi
jne 0x100b762
jmp 0x100b7a6
mov ebx, dword [ebx*4 + 0x1020240]
test ebx, ebx
mov dword [ebp - 4], ebx
je 0x100b7a6
push 0x3a
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x100b7a6
add dword [ebp - 4], 2
pop edi
pop esi
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push 0x20
push eax
lea eax, [ebp - 8]
push eax
push 0x64
push 0
call fcn.01010749
test eax, eax
pop ebx
jne 0x100b800
cmp dword [ebp - 0xc], eax
je 0x100b802
cmp dword [ebp + 0x10], eax
je 0x100b7d7
cmp dword [ebp - 0xc], 1
jbe 0x100b802
add dword [ebp - 8], 4
push 0x1001ac0
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [ebp - 8]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
push dword [ebp - 8]
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x100b83b
xor eax, eax
lea ecx, [ebp + 0x10]
push ecx
xor ecx, ecx
cmp dword [ebp + 0x10], eax
setne cl
add ecx, 0x800
push ecx
push eax
push eax
push dword [ebp - 4]
push eax
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
je 0x100b82b
mov ax, 0xf48
jmp 0x100b83e
mov eax, dword [ebp + 0x10]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
xor ax, ax
leave
ret 0xc

Function at 0x100b847
Capabilities:
Get domain controller name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1020240]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0x100b8b1
mov ecx, eax
mov eax, 0x1020240
push edi
mov edi, eax
mov esi, eax
push 0x101d8a4
push ecx
call dword [sym.imp.msvcrt.dll_wcsstr]
cmp eax, dword [edi]
pop ecx
pop ecx
je 0x100b88f
inc dword [ebp - 4]
add esi, 4
mov ecx, dword [esi]
test ecx, ecx
mov edi, esi
jne 0x100b86d
jmp 0x100b8b0
mov eax, dword [ebp - 4]
mov ebx, dword [eax*4 + 0x1020240]
test ebx, ebx
je 0x100b8b0
push 0x3a
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x100b8b0
inc ebx
inc ebx
pop edi
lea eax, [ebp - 8]
push eax
push 0x20
xor eax, eax
push eax
push eax
push ebx
push eax
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x100b8d3
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x100b90a
test ebx, ebx
jne 0x100b8f8
mov esi, dword [ebp + 8]
push esi
push 0xa
call fcn.01010581
test eax, eax
je 0x100b8ec
push eax
call fcn.0101004c
mov eax, dword [esi]
mov eax, dword [eax + 8]
mov dword [0x1020840], eax
jmp 0x100b8fe
mov dword [0x1020840], ebx
push 1
push 0xf49
call fcn.0100fefc
pop esi
xor ax, ax
pop ebx
leave
ret 4
Function at 0x100c1df
Capabilities:
Delete user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101d774]
push esi
mov esi, dword [ebp + 8]
push 1
push 0
push 0
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100e833
test eax, eax
je 0x100c217
push eax
call fcn.0101004c
lea eax, [ebp - 0x214]
push eax
push 2
push esi
lea eax, [ebp - 0x210]
push eax
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
jne 0x100c259
mov eax, dword [ebp - 0x214]
test byte [eax + 0x19], 0x38
je 0x100c24e
push eax
call sub.NETAPI32.dll_NetApiBufferFree
push esi
push 0xeab
call fcn.0100ff1c
push dword [ebp - 0x214]
call sub.NETAPI32.dll_NetApiBufferFree
push esi
lea eax, [ebp - 0x210]
push eax
call sub.NETAPI32.dll_NetUserDel
mov esi, eax
test esi, esi
je 0x100c288
cmp esi, 0x35
jne 0x100c282
lea eax, [ebp - 0x210]
push eax
push 0xe81
call fcn.0100ff1c
push esi
call fcn.0101004c
call fcn.0100ffba
mov ecx, dword [ebp - 4]
pop esi
call fcn.0100f4dc
leave
ret 4
Function at 0x100c8e0
Capabilities:
List user accounts

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x101d774]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x430]
push eax
xor edi, edi
push 0xa
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x434], edi
call fcn.01010581
test eax, eax
je 0x100c927
mov dword [ebp - 0x42c], 1
mov word [ebp - 0x41c], di
jmp 0x100c949
mov eax, dword [ebp - 0x430]
push dword [eax]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push dword [ebp - 0x430]
call sub.NETAPI32.dll_NetApiBufferFree
push edi
push edi
push edi
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100e833
cmp eax, edi
je 0x100c967
push eax
call fcn.0101004c
push edi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x424]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push eax
push 0x300
push edi
lea eax, [ebp - 0x210]
push eax
call sub.NETAPI32.dll_NetUserEnum
cmp eax, 0xea
jne 0x100c9a4
mov dword [ebp - 0x434], 1
jmp 0x100c9ae
cmp eax, edi
je 0x100c9ae
push eax
call fcn.0101004c
cmp dword [ebp - 0x424], edi
jne 0x100c9bb
call fcn.01010035
push 0x100c29f
push 4
push dword [ebp - 0x424]
push dword [ebp - 0x428]
call dword [sym.imp.msvcrt.dll_qsort]
add esp, 0x10
call fcn.0100ffa6
cmp word [ebp - 0x210], di
je 0x100ca02
lea eax, [ebp - 0x210]
push 0x10014d0
push eax
call dword [sym.imp.msvcrt.dll_wcsspn]
pop ecx
pop ecx
lea eax, [ebp + eax*2 - 0x210]
jmp 0x100ca08
lea eax, [ebp - 0x41c]
push esi
push eax
push 0x111c
call fcn.0101000f
call fcn.0100ff43
cmp dword [ebp - 0x424], edi
mov esi, dword [ebp - 0x428]
mov dword [ebp - 0x420], edi
jbe 0x100ca97
push ebx
xor ebx, ebx
inc ebx
push 0x24
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcsrchr]
test eax, eax
pop ecx
pop ecx
je 0x100ca57
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 1
pop ecx
jne 0x100ca57
dec dword [ebp - 0x420]
dec ebx
jmp 0x100ca81
push 0
push dword [esi]
push 0x19
call fcn.0100fc80
push eax
push 0x100150c
call fcn.0100fc41
pop ecx
pop ecx
push 3
xor edx, edx
mov eax, ebx
pop ecx
div ecx
test edx, edx
jne 0x100ca81
call fcn.0100ffa6
inc edi
inc dword [ebp - 0x420]
inc ebx
add esi, 4
cmp edi, dword [ebp - 0x424]
jb 0x100ca31
xor edi, edi
pop ebx
push dword [ebp - 0x428]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 0x420]
push 3
xor edx, edx
pop ecx
div ecx
pop esi
test edx, edx
je 0x100cab9
call fcn.0100ffa6
cmp dword [ebp - 0x42c], edi
je 0x100cad4
push 0xdb0
call fcn.0100ffd2
push 1
call fcn.0100fb27
jmp 0x100cae8
cmp dword [ebp - 0x434], edi
je 0x100cae3
push 0xdb9
jmp 0x100cac6
call fcn.0100ffba
mov ecx, dword [ebp - 4]
pop edi
call fcn.0100f4dc
leave
ret
Function at 0x100e833
Capabilities:
Get domain controller name
Get domain information
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp word [ebp + 0xc], 0x104
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
jae 0x100e856
mov eax, 0x84b
jmp 0x100e9d5
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
cmp edi, ebx
mov word [eax], bx
je 0x100e877
cmp dword [ebp + 0x14], 0x10
jae 0x100e874
mov eax, 0x84b
jmp 0x100e9d4
mov word [edi], bx
cmp dword [0x1020240], ebx
push esi
je 0x100e8a7
mov eax, 0x1020240
mov esi, eax
push dword [eax]
push 0x101d8a4
call fcn.01011d9c
test eax, eax
jl 0x100e89e
mov dword [ebp - 0xc], 1
add esi, 4
cmp dword [esi], ebx
mov eax, esi
jne 0x100e887
lea eax, [ebp - 4]
push eax
push 1
push ebx
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
cmp eax, ebx
je 0x100e8bd
push eax
call fcn.0101004c
cmp edi, ebx
mov esi, dword [sym.imp.msvcrt.dll_wcscpy]
je 0x100e8d2
mov eax, dword [ebp - 4]
push dword [eax + 8]
push edi
call esi
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
cmp ecx, 4
je 0x100e9bd
cmp ecx, 5
je 0x100e9bd
cmp dword [ebp - 0xc], ebx
jne 0x100e922
mov edi, 0x10015f8
push edi
push dword [ebp + 8]
call esi
cmp dword [ebp + 0x10], ebx
pop ecx
pop ecx
je 0x100e9c9
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x100e9c9
push edi
push dword [ebp + 0x10]
jmp 0x100e9c5
cmp dword [0x1021624], ebx
jne 0x100e94d
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
jne 0x100e936
mov eax, dword [eax + 8]
jmp 0x100e938
mov eax, ecx
push eax
push 0xe6d
call fcn.0101000f
mov dword [0x1021624], 1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x1000
add eax, 0x20
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
cmp eax, ebx
je 0x100e975
push eax
call fcn.0101004c
push dword [ebp - 4]
call sub.NETAPI32.dll_DsRoleFreeMemory
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, ebx
jne 0x100e98e
mov eax, dword [ebp + 8]
mov word [eax], bx
jmp 0x100e9d1
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
movzx ecx, word [ebp + 0xc]
cmp eax, ecx
jbe 0x100e9a5
mov ebx, 0x84b
jmp 0x100e9b1
mov eax, dword [ebp - 8]
push dword [eax]
push dword [ebp + 8]
call esi
pop ecx
pop ecx
push dword [ebp - 8]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, ebx
jmp 0x100e9d3
push 0x10015f8
push dword [ebp + 8]
call esi
pop ecx
pop ecx
push dword [ebp - 4]
call sub.NETAPI32.dll_DsRoleFreeMemory
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 0x14
Function at 0x100edbf
Capabilities:
Enumerate services
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x101d774]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov esi, 0xfa0
push esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
call fcn.01012513
test eax, eax
je 0x100edf7
push 8
call fcn.0101004c
mov eax, dword [0x1021628]
cmp eax, ebx
jne 0x100ee16
push 0x80000000
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [0x1021628], eax
je 0x100ee3a
push 0xc
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x10], edi
je 0x100ee3a
lea eax, [ebp - 0x34]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x100ee44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100eeb8
cmp dword [ebp - 0x30], 1
jne 0x100ee5c
push dword [ebp + 8]
mov edi, 0xdc1
call fcn.0100ea96
mov dword [ebp - 0x14], eax
jmp 0x100eeb8
test byte [ebp - 0x2c], 1
jne 0x100ee69
mov edi, 0x88f
jmp 0x100eeb8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
push 1
push edi
call esi
test eax, eax
jne 0x100ef11
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov edi, eax
cmp edi, 0xea
jne 0x100eeb6
push dword [ebp - 8]
call fcn.0101253f
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 8]
push eax
push edi
call fcn.01012513
test eax, eax
je 0x100eef2
push 8
pop edi
xor ebx, ebx
cmp dword [ebp - 8], ebx
je 0x100eec5
push dword [ebp - 8]
call fcn.0101253f
cmp dword [ebp - 0x10], ebx
je 0x100eed3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, ebx
je 0x100ef99
cmp dword [ebp - 0x14], ebx
je 0x100ef93
push dword [ebp - 0x14]
push edi
call fcn.0100ff1c
jmp 0x100ef99
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 8]
push 1
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x100ef0f
call ebx
mov edi, eax
jmp 0x100eeb6
xor ebx, ebx
cmp dword [ebp - 0xc], ebx
je 0x100ef8c
push dword [ebp + 8]
call fcn.0100ea96
push eax
push 0xdca
call fcn.0101000f
xor esi, esi
cmp dword [ebp - 0xc], ebx
jbe 0x100ef53
xor edi, edi
mov eax, dword [ebp - 8]
push dword [edi + eax + 4]
push 0x10014ac
call fcn.0100fc41
pop ecx
pop ecx
call fcn.0100ffa6
inc esi
add edi, 0x24
cmp esi, dword [ebp - 0xc]
jb 0x100ef32
call fcn.0100ffa6
push ebx
push 0x14a6
call fcn.01010064
test eax, eax
jne 0x100ef6e
push 2
call fcn.0100fb27
xor edi, edi
cmp dword [ebp - 0xc], ebx
jbe 0x100ef8c
xor esi, esi
mov eax, dword [ebp - 8]
push ebx
push dword [esi + eax]
call fcn.0100afa1
inc edi
add esi, 0x24
cmp edi, dword [ebp - 0xc]
jb 0x100ef77
xor edi, edi
jmp 0x100eeb8
push edi
call fcn.0101004c
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100f4dc
leave
ret 4
Function at 0x100f5f4
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x10020f8
call fcn.0100f7d0
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x100f62f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100f62f
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100f647
cmp eax, 0x20b
je 0x100f634
mov dword [ebp - 0x1c], edi
jmp 0x100f65b
cmp dword [ecx + 0x84], 0xe
jbe 0x100f62f
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x100f655
cmp dword [ecx + 0x74], 0xe
jbe 0x100f62f
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1024da0], 0xffffffff
or dword [0x1024da4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1021654]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1021650]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1024da8], eax
call fcn.0100f7c6
cmp dword [0x101d778], edi
jne 0x100f6b6
push fcn.0100f7c6
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100f7af
push 0x101c010
push 0x101c00c
call sub.msvcrt.dll__initterm
mov eax, dword [0x102164c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1021648]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x101c008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01004ecd
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x100f72d
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100f762
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100f80b
ret
Function at 0x1010749
Capabilities:
List domain servers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push ebx
push dword [ebp + 0x1c]
lea eax, [ebp + 0x18]
push dword [ebp + 0x18]
push eax
push esi
push 0xffffffffffffffff
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.NETAPI32.dll_NetServerEnum
cmp eax, ebx
mov dword [ebp + 0x1c], eax
je 0x1010781
cmp eax, 0xea
jne 0x10107d5
cmp dword [ebp + 0xc], 0x64
mov edi, dword [edi]
jne 0x10107b0
cmp dword [esi], ebx
jbe 0x10107d5
lea eax, [edi + 4]
mov dword [ebp + 0xc], eax
push 4
push dword [ebp + 0xc]
push edi
call dword [sym.imp.msvcrt.dll_memmove]
add dword [ebp + 0xc], 8
add esp, 0xc
inc ebx
add edi, 4
cmp ebx, dword [esi]
jb 0x1010793
jmp 0x10107d5
cmp dword [esi], ebx
jbe 0x10107d5
lea eax, [edi + 4]
mov dword [ebp + 0xc], eax
push 0x14
push dword [ebp + 0xc]
push edi
call dword [sym.imp.msvcrt.dll_memmove]
add dword [ebp + 0xc], 0x18
add esp, 0xc
inc ebx
add edi, 0x14
cmp ebx, dword [esi]
jb 0x10107ba
mov eax, dword [ebp + 0x1c]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18