joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401220
Capabilities:
Create thread
Delete file
Get common file path
Terminate process

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x12c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
call fcn.004018d0
lea ecx, [esp + 0x12c]
push 0
push ecx
lea ecx, [esp + 0x18]
call fcn.004018e0
test eax, eax
jne 0x40129c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x12c]
push 0
push edx
lea ecx, [esp + 0x18]
call fcn.004018e0
test eax, eax
je 0x40127a
lea ecx, [esp + 0x10]
jmp section..htext

Function at 0x4014f0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40151e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, esi
pop esi
ret

Function at 0x401570
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
mov dword [esp], 0
push eax
push 0xf003f
push 0
push 0x4011c0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401662
mov ecx, dword [0x4011b0]
mov eax, dword [0x4011b8]
mov edx, dword [0x4011b4]
mov dword [esp + 0xc], ecx
mov cx, word [0x4011bc]
push edi
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1e]
mov dword [esp + 0x14], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0xc]
lea eax, [esp + 0x114]
push edx
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push 0
push edx
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401656
mov edx, dword [esp + 0x21c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov edx, dword [esp + 0xc]
push 1
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x214
ret
Function at 0x403523
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x3c]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x78]
push edx
call fcn.00403518
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x20]
push edx
call fcn.00403518
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x24]
push edx
call fcn.00403518
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.00403518
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x4035a5
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 0x18]
jae 0x403600
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4]
push eax
call fcn.00403518
add esp, 8
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.0040348c
add esp, 8
test eax, eax
jne 0x4035fe
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
xor eax, eax
mov ax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + eax*4]
push edx
call fcn.00403518
add esp, 8
jmp 0x403602
jmp 0x40359c
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x40394a
Capabilities:
Encode data using xor

Disassembly:
pop ebp
idiv byte [ebp + 0x6d]
mov esi, 0xaaf991c6
fnstenv [ecx]
sub ch, byte [esi]
aam 0x85
xor dword [ebp + 0x74], 0x239d7274
push 0xffffffffffffffd7
je 0x4039d0
popfd
and ebp, dword [edx - 0x29]
push ebx
inc edi
pop edi
adc byte [eax + ebp], dl
fiadd dword [edi - 0x42]
or al, 0x5b
sbb al, 0x10
xor al, 0xda
cmp eax, 0xfc16e688
imul ebp, dword [ebx + 0x6b], 0x1718e663
imul edx, esi, 0xffffffd6
salc
push es
call 0x2b6b64b2
add dh, cl
mov cl, 0x7b
imul edx, ebp, 0xffffffd5
aad 0xc5
and byte [edx + esi*8], dl
jae 0x40395c
invalid
les ebp, [esi - 0x3aae59f2]
fst dword [ebp - 0x74245170]
clc
dec esp
inc eax
dec edx
aaa
add esp, dword [edi + 0x24f0bcb7]
add word [edi + 0x1f], ax
mov al, 0xd5
outsb dx, byte [esi]
mov bl, 0xb2
add eax, 0x80808185
pushal
into
mov dword [ebp + 0x60f6931], ebx
cmp bl, dh
cmp byte [edx + 0x38], dl
xor eax, 0x15c98d69
mov eax, 0x7f2feba7
cld
cli
in eax, 0x4d
push edx
cmp byte [esi + ecx*8 - 0x560a4e4c], ah
cmp eax, 0x8793e449
adc eax, dword [ebx - 0x3a]
div byte [esi + 0x7f]
ljmp 0x1c1c
Function at 0x4100e5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x428044]
jne 0x4100ef
repz ret
jmp fcn.00411dd9

Function at 0x41ada1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041213b
and dword [ebp - 4], 0
cmp dword [0x429f30], 0
mov ebx, eax
jne 0x41ae52
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41af03
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41af03
push eax
call fcn.004120c9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x429f30], eax
call esi
push eax
call fcn.004120c9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x429f34], eax
call esi
push eax
call fcn.004120c9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x429f38], eax
call esi
push eax
call fcn.004120c9
pop ecx
mov dword [0x429f40], eax
test eax, eax
je 0x41ae52
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004120c9
pop ecx
mov dword [0x429f3c], eax
mov eax, dword [0x429f3c]
cmp eax, ebx
je 0x41aeaa
cmp dword [0x429f40], ebx
je 0x41aeaa
push eax
call fcn.00412144
push dword [0x429f40]
mov esi, eax
call fcn.00412144
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41aeaa
test edi, edi
je 0x41aeaa
call esi
test eax, eax
je 0x41aea1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41aea1
test byte [ebp - 0xc], 1
jne 0x41aeaa
or dword [ebp + 0x10], 0x200000
jmp 0x41aee3
mov eax, dword [0x429f34]
cmp eax, ebx
je 0x41aee3
push eax
call fcn.00412144
pop ecx
test eax, eax
je 0x41aee3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41aee3
mov eax, dword [0x429f38]
cmp eax, ebx
je 0x41aee3
push eax
call fcn.00412144
pop ecx
test eax, eax
je 0x41aee3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x429f30]
call fcn.00412144
pop ecx
test eax, eax
je 0x41af03
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41af05
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10042bc
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ntdll.dll_NtQuerySystemTime]
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlRandom]
xor edx, edx
mov ecx, 0xfe
div ecx
push 0xf0000000
push 1
push ebx
push ebx
lea eax, [ebp - 8]
push eax
inc dl
mov byte [ebp - 1], dl
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1004361
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push edi
add esi, esi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x100434a
xor eax, eax
cmp dword [ebp + 0xc], ebx
mov word [esi + edi], bx
jbe 0x1004353
cmp word [edi + eax*2], bx
jne 0x1004342
movzx cx, byte [ebp - 1]
mov word [edi + eax*2], cx
inc eax
cmp eax, dword [ebp + 0xc]
jb 0x1004333
jmp 0x1004353
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
jmp 0x100436a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret 8
Function at 0x100475f
Capabilities:
Get session user name
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x14]
push ebx
push edi
xor edi, edi
cmp eax, edi
mov ebx, eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp + 0x14], edi
jne 0x1004884
mov edx, dword [ebp + 8]
push esi
push 0x14
push edx
call fcn.01003f89
test eax, eax
je 0x1004855
mov eax, dword [edx + 0x2e8]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x10047af
mov dword [ebp - 4], eax
jmp 0x10047e9
lea eax, [ebp + 0x14]
push eax
mov dword [ebp + 0x14], edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
add eax, eax
push eax
call sub.NETAPI32.dll_NetApiBufferAllocate
mov ebx, eax
test ebx, ebx
jne 0x1004859
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
call edi
test eax, eax
jne 0x10047ed
call esi
mov ebx, eax
test ebx, ebx
jne 0x1004859
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0x18]
push edi
push 0x2900
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp eax, edi
mov dword [ebp + 0x14], eax
je 0x1004851
cmp dword [0x1012ca8], edi
mov edi, dword [ebp + 0xc]
je 0x1004827
push edi
push 0x2f04
call fcn.0100371a
pop ecx
pop ecx
push edi
call fcn.010043bd
test eax, eax
je 0x100483c
call fcn.010040da
mov ebx, eax
test ebx, ebx
jne 0x1004859
push 1
push 1
push dword [ebp + 8]
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
test eax, eax
jne 0x100486a
call esi
mov ebx, eax
test ebx, ebx
je 0x100486a
push 0x1f57
call fcn.0100371a
pop ecx
push ebx
call fcn.010037c9
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
pop esi
je 0x1004882
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, ebx
pop edi
pop ebx
leave
ret 0x14
Function at 0x100617f
Capabilities:
Delete user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1012854]
and dword [ebp - 0x20c], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [edi + 8]
cmp word [eax], 0x1e
jbe 0x10061b4
mov eax, 0x4bc
jmp 0x1006266
mov eax, dword [esi]
test eax, eax
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_swprintf]
je 0x10061fe
cmp word [eax], 0x5c
je 0x10061fe
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 6]
push eax
call sub.NETAPI32.dll_NetApiBufferAllocate
test eax, eax
mov dword [ebp - 0x210], eax
jne 0x100624f
push dword [esi]
push 0x1001484
push dword [ebp - 0x20c]
call ebx
add esp, 0xc
jmp 0x1006204
mov dword [ebp - 0x20c], eax
mov eax, dword [edi + 8]
push dword [eax + 4]
lea eax, [ebp - 0x208]
push 0x1001514
push eax
call ebx
add esp, 0xc
cmp dword [0x1012ca8], 0
je 0x1006237
lea eax, [ebp - 0x208]
push eax
push 0x2ef4
call fcn.0100371a
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x20c]
call sub.NETAPI32.dll_NetUserDel
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x20c]
cmp eax, dword [esi]
pop ebx
je 0x1006260
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0100c7ad
leave
ret 8
Function at 0x100647f
Capabilities:
Add user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1012854]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push edi
xor edi, edi
mov dword [ebp - 0x20c], edi
cmp word [eax], 0x1e
jbe 0x10064b9
mov eax, 0x4bc
jmp 0x10065c8
push dword [eax + 4]
lea eax, [ebp - 0x208]
push 0x1001514
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [0x1012ca8], edi
je 0x10064ec
lea eax, [ebp - 0x208]
push eax
push 0x2ef9
call fcn.0100371a
pop ecx
pop ecx
lea eax, [ebp - 0x208]
mov dword [ebp - 0x230], eax
mov eax, dword [esi]
cmp eax, edi
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], 0x801
mov dword [ebp - 0x214], edi
je 0x1006571
cmp word [eax], 0x5c
je 0x1006571
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 6]
push eax
call sub.NETAPI32.dll_NetApiBufferAllocate
cmp eax, edi
mov dword [ebp - 0x210], eax
jne 0x10065b2
push dword [esi]
push 0x1001484
push dword [ebp - 0x20c]
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
jmp 0x1006577
mov dword [ebp - 0x20c], eax
push edi
lea eax, [ebp - 0x230]
push eax
push 1
push dword [ebp - 0x20c]
call sub.NETAPI32.dll_NetUserAdd
cmp eax, 0x8b0
mov dword [ebp - 0x210], eax
jne 0x10065b2
push ebx
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x20c]
call fcn.010063c0
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x20c]
cmp eax, dword [esi]
je 0x10065c2
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100c7ad
leave
ret 0x10
Function at 0x1008cd5
Capabilities:
Get domain trust relationships

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
or dword [ebp - 0x14], 0xffffffff
or dword [ebp - 0x18], 0xffffffff
push ebx
xor ebx, ebx
xor edx, edx
push esi
mov esi, dword [ebp + 8]
inc edx
mov dword [eax], ebx
test byte [esi + 0x18], dl
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edx
je 0x1008d16
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [edi]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ebx
jmp 0x1008d2d
test byte [edi + 0x18], 1
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi]
mov dword [ebp - 0x10], ecx
jne 0x1008d2d
mov ecx, dword [edi + 8]
mov ecx, dword [ecx + 4]
mov dword [ebp + 8], ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push edx
push eax
call dword [sym.imp.NETAPI32.dll_DsEnumerateDomainTrustsW]
cmp eax, ebx
jne 0x1008e05
cmp dword [ebp - 8], ebx
mov dword [ebp + 0xc], ebx
jbe 0x1008db0
mov eax, dword [ebp - 4]
lea ecx, [ebx + eax]
mov eax, dword [ecx + 8]
test al, 8
je 0x1008d69
test al, 4
jne 0x1008da0
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x18], eax
jmp 0x1008da0
mov eax, dword [ecx]
test eax, eax
je 0x1008d7f
push dword [ebp + 8]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1008d9a
mov eax, dword [ebp - 4]
mov eax, dword [ebx + eax + 4]
test eax, eax
je 0x1008da0
push dword [ebp - 0x10]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1008da0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
add ebx, 0x2c
cmp eax, dword [ebp - 8]
jb 0x1008d50
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x1008dbd
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
je 0x1008e03
cmp dword [ebp - 0x18], eax
jne 0x1008de3
cmp dword [ebp - 0xc], ebx
je 0x1008dd9
or dword [esi + 0x18], 4
or dword [edi + 0x18], 2
jmp 0x1008dfa
or dword [edi + 0x18], 4
or dword [esi + 0x18], 2
jmp 0x1008dfa
cmp dword [ebp - 0xc], ebx
je 0x1008df2
or dword [esi + 0x18], 2
or dword [edi + 0x18], 4
jmp 0x1008dfa
or dword [edi + 0x18], 2
or dword [esi + 0x18], 4
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100ad85
Capabilities:
Get domain information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 2
push edi
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
mov esi, eax
test esi, esi
je 0x100adae
push esi
push edi
push 0x1fbe
jmp 0x100ae36
mov eax, dword [ebp - 4]
test byte [eax], 4
push eax
je 0x100adcc
call sub.NETAPI32.dll_DsRoleFreeMemory
push 0x1fbb
call fcn.0100371a
pop ecx
jmp 0x100ae6d
call sub.NETAPI32.dll_DsRoleFreeMemory
lea eax, [ebp + 8]
push eax
push 3
push edi
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
mov esi, eax
test esi, esi
jne 0x100ada2
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x100ae0a
xor eax, eax
cmp ecx, 1
setne al
add eax, 0x1fb9
push eax
call fcn.0100371a
pop ecx
push dword [ebp + 8]
call sub.NETAPI32.dll_DsRoleFreeMemory
jmp 0x100ae6d
push eax
call sub.NETAPI32.dll_DsRoleFreeMemory
push 0x80000000
push 0x1001438
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x100ae42
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
push 0x1fbd
call fcn.0100371a
add esp, 0xc
mov eax, esi
jmp 0x100ae76
push 4
push 0x10016d8
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
test edi, edi
je 0x100ae74
push 0x1fbc
call fcn.0100371a
pop ecx
push edi
call esi
mov eax, 0x2035
jmp 0x100ae76
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x100c8c5
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x1001728
call fcn.0100cad4
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x100c900
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100c900
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100c918
cmp eax, 0x20b
je 0x100c905
mov dword [ebp - 0x1c], edi
jmp 0x100c92c
cmp dword [ecx + 0x84], 0xe
jbe 0x100c900
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x100c926
cmp dword [ecx + 0x74], 0xe
jbe 0x100c900
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1012ce0], 0xffffffff
or dword [0x1012ce4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1012cc0]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1012cbc]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1012ce8], eax
call fcn.010b2000
cmp dword [0x1012860], edi
jne 0x100c987
push 0x100cacc
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100cab5
push 0x1012010
push 0x101200c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1012cb8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1012cb4]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x1012008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01003a5a
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x100c9fe
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100ca33
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100cb0f
ret
Function at 0x100cf52
Capabilities:
Enumerate services
Query service status
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push 0x2c
push dword [ebp + 8]
xor esi, esi
push dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, esi
mov dword [ebp - 0x14], eax
jne 0x100cf95
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x1001b38
call fcn.0100fb71
pop ecx
pop ecx
jmp 0x100d09c
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push esi
push esi
push 1
push eax
call edi
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x100d02f
call ebx
mov esi, eax
cmp esi, 0xea
jne 0x100d02b
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferAllocate
mov esi, eax
test esi, esi
jne 0x100d089
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
push 1
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x100cff7
call ebx
mov esi, eax
jmp 0x100d023
xor edi, edi
cmp dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
jbe 0x100d023
push dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
push dword [edi + eax]
call fcn.0100cf52
mov esi, eax
test esi, esi
jne 0x100d023
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add edi, 0x24
cmp eax, dword [ebp - 8]
jb 0x100d001
push dword [ebp - 0xc]
call sub.NETAPI32.dll_NetApiBufferFree
test esi, esi
jne 0x100d089
lea eax, [ebp - 0x30]
push eax
push 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x100d05d
call ebx
mov esi, eax
cmp esi, 0x426
jne 0x100d052
xor esi, esi
jmp 0x100d09a
push esi
push dword [ebp + 8]
push 0x1001b0c
jmp 0x100d092
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x100d076
call ebx
mov esi, eax
test esi, esi
jne 0x100d09a
cmp dword [ebp - 0x2c], 1
je 0x100d09a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100d05d
push esi
push dword [ebp + 8]
push 0x1001ad4
call fcn.0100fb71
add esp, 0xc
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret 8

Function at 0x100d63e
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 0xf003f
xor esi, esi
push esi
push 0x1001ce0
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d6b8
cmp dword [ebp + 8], esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x100d6a4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x20006
push 1
push esi
push esi
push 0x1001d38
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100d6b2
push dword [ebp - 8]
call edi
jmp 0x100d6b2
push 0x1001d38
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call edi
pop edi
pop esi
leave
ret 4