joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc91
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x41e6b8]
je 0x40ccac
inc edi
cmp edi, 0x17
jb 0x40cc9d
cmp edi, 0x17
jae 0x40ce2c
push ebp
push 3
call fcn.004152ca
cmp eax, 1
pop ecx
je 0x40cdf8
push 3
call fcn.004152ca
test eax, eax
pop ecx
jne 0x40cce0
cmp dword [0x41e160], 1
je 0x40cdf8
cmp ebx, 0xfc
je 0x40ce2b
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x41fb28
push ebp
call fcn.0040ac6e
add esp, 0xc
test eax, eax
je 0x40cd16
push esi
push esi
push esi
push esi
push esi
call fcn.00407226
add esp, 0x14
push 0x104
mov esi, 0x41fb41
push esi
push 0
mov byte [0x41fc45], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40cd5a
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040ac6e
add esp, 0xc
test eax, eax
je 0x40cd5a
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00407226
add esp, 0x14
push esi
call fcn.00407ea0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40cd9f
push esi
call fcn.00407ea0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x41fe3c
push 0x41a22c
sub ecx, eax
push ecx
push eax
call fcn.00411576
add esp, 0x14
test eax, eax
je 0x40cd9f
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00407226
add esp, 0x14
jmp 0x40cda1
xor esi, esi
push 0x41a228
push ebx
push ebp
call fcn.004114ba
add esp, 0xc
test eax, eax
je 0x40cdc1
push esi
push esi
push esi
push esi
push esi
call fcn.00407226
add esp, 0x14
push dword [edi*8 + 0x41e6bc]
push ebx
push ebp
call fcn.004114ba
add esp, 0xc
test eax, eax
je 0x40cde3
push esi
push esi
push esi
push esi
push esi
call fcn.00407226
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0041510d
add esp, 0xc
jmp 0x40ce2b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40ce2b
cmp ebp, 0xffffffff
je 0x40ce2b
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x41e6bc]
push dword [esi]
call fcn.00407ea0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x41510d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040dbe4
xor ebx, ebx
cmp dword [0x420008], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4151e3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4152c3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41b410
push edi
call esi
cmp eax, ebx
je 0x4152c3
push eax
call fcn.0040db76
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x420008], eax
call esi
push eax
call fcn.0040db76
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42000c], eax
call esi
push eax
call fcn.0040db76
mov dword [0x420010], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040a66c
test eax, eax
pop ecx
pop ecx
je 0x4151b1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00407226
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4151e3
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040db76
cmp eax, ebx
pop ecx
mov dword [0x420018], eax
je 0x4151e3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040db76
pop ecx
mov dword [0x420014], eax
mov eax, dword [0x420014]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x415268
cmp dword [0x420018], ecx
je 0x415268
push eax
call fcn.0040dbed
push dword [0x420018]
mov esi, eax
call fcn.0040dbed
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x415268
cmp edi, ebx
je 0x415268
call esi
cmp eax, ebx
je 0x415235
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x415235
test byte [ebp - 0x18], 1
jne 0x415268
lea eax, [ebp - 0x10]
push eax
call fcn.0040a6a3
test eax, eax
pop ecx
je 0x415250
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00407226
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x41525f
or dword [ebp + 0x10], 0x200000
jmp 0x4152a3
or dword [ebp + 0x10], 0x40000
jmp 0x4152a3
mov eax, dword [0x42000c]
cmp eax, dword [ebp - 8]
je 0x4152a3
push eax
call fcn.0040dbed
cmp eax, ebx
pop ecx
je 0x4152a3
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4152a3
mov eax, dword [0x420010]
cmp eax, dword [ebp - 8]
je 0x4152a3
push eax
call fcn.0040dbed
cmp eax, ebx
pop ecx
je 0x4152a3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x420008]
call fcn.0040dbed
cmp eax, ebx
pop ecx
je 0x4152c3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4152c5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x14d236e9
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..reloc
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2f785bca
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x40305a]
shl eax, 2
mov dword [0x40305e], eax
push edi
push ecx
xor eax, eax
mov edi, 0x403570
mov ecx, 0x403694
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
mov edx, dword fs:[4]
mov dword [0x40306e], edx
mov eax, dword [edx - 8]
mov dword [0x403066], eax
mov eax, dword [edx - 4]
mov dword [0x40306a], eax
sub edx, 4
mov dword [0x4035c8], edx
sub edx, 4
cmp edx, esp
jae 0x401054
mov esp, edx
push 0
call fcn.00401ade
pop ecx
push 0x40302c
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x403062], eax
push 0
jmp fcn.00401f30

Function at 0x401228
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
push 0x200
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
test eax, eax
jne 0x401259
mov eax, 0x4030b7
call fcn.004013e4
mov eax, 1
jmp 0x4012e3
push 0xf003f
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jne 0x40127e
mov eax, 0x4030cc
call fcn.004013e4
mov eax, 1
jmp 0x4012e3
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 1
push 2
push 0x10
push 0xf01ff
push 0x403088
push 0x403088
push ebx
call sub.ADVAPI32.dll_CreateServiceA
mov esi, eax
test esi, esi
je 0x4012cc
mov eax, 0x4030e8
call fcn.004013e4
push 0
push 0
push esi
call sub.ADVAPI32.dll_StartServiceA
push esi
call sub.ADVAPI32.dll_CloseServiceHandle
xor esi, esi
jmp 0x4012db
mov eax, 0x4030fd
call fcn.004013e4
mov esi, 1
push ebx
call sub.ADVAPI32.dll_CloseServiceHandle
mov eax, esi
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x4012ec
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, 0x403088
mov ebp, 0x403570
push 0xf003f
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
jne 0x401320
lea eax, [edi + 0x44]
call fcn.004013e4
mov eax, 1
jmp 0x4013df
push 0xf01ff
push edi
push esi
call sub.ADVAPI32.dll_OpenServiceA
mov ebx, eax
test ebx, ebx
je 0x4013c7
push ebp
push 1
push ebx
call sub.ADVAPI32.dll_ControlService
test eax, eax
je 0x40139b
lea eax, [edi + 0x8f]
call fcn.004013e4
push 0x64
call sub.KERNEL32.dll_Sleep
jmp 0x401372
cmp dword [ebp + 4], 3
jne 0x40137d
lea eax, [edi + 0x9e]
call fcn.004013e4
push 0x3e8
call sub.KERNEL32.dll_Sleep
push ebp
push ebx
call sub.ADVAPI32.dll_QueryServiceStatus
test eax, eax
jne 0x401357
cmp dword [ebp + 4], 1
jne 0x401390
lea eax, [edi + 0xa0]
call fcn.004013e4
jmp 0x40139b
lea eax, [edi + 0xb2]
call fcn.004013e4
push ebx
call sub.ADVAPI32.dll_DeleteService
test eax, eax
je 0x4013b2
lea eax, [edi + 0xc4]
call fcn.004013e4
jmp 0x4013bd
lea eax, [edi + 0xd7]
call fcn.004013e4
push ebx
call sub.ADVAPI32.dll_CloseServiceHandle
xor ebx, ebx
jmp 0x4013d7
lea eax, [edi + 0xee]
call fcn.004013e4
mov ebx, 1
push esi
call sub.ADVAPI32.dll_CloseServiceHandle
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4014ec
Capabilities:
Connect pipe
Create pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff7f0
mov ebp, 0x4031e4
mov edi, esp
mov dword [esp + 0x804], 0xc
lea esi, [esp + 4]
call fcn.00401a9c
mov dword [esp + 0x808], eax
xor eax, eax
mov dword [esp + 0x80c], eax
lea edx, [esp + 0x804]
push edx
push 0xea60
push 0x800
push 0x800
push 1
push 4
push 3
push 0x40325c
call sub.KERNEL32.dll_CreateNamedPipeA
push dword [esp + 0x808]
mov ebx, eax
call sub.KERNEL32.dll_LocalFree
cmp ebx, 0xffffffff
jne 0x401562
xor eax, eax
jmp 0x401634
push 0
push 0
push 4
call fcn.004011c1
push 0
push ebx
call sub.KERNEL32.dll_ConnectNamedPipe
test eax, eax
je 0x40160b
cmp dword [ebp], 0xffffffff
je 0x40160b
xor edx, edx
mov dword [ebp], edx
push 0
push edi
push 0x7ff
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x4015d3
mov ecx, dword [edi]
mov byte [esi + ecx], 0
push esi
push esi
call fcn.004017a7
mov dword [edi], eax
cmp dword [edi], 0
je 0x4015c1
push 0
push edi
push dword [edi]
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x4015fa
push 0
push edi
push 2
push 0x40326c
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x4015fa
call sub.KERNEL32.dll_GetLastError
push eax
push 0x40326e
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push edi
push esi
call fcn.00401ba0
pop ecx
inc eax
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_FlushFileBuffers
push ebx
call sub.KERNEL32.dll_DisconnectNamedPipe
jmp 0x40156d
push ebx
call sub.KERNEL32.dll_CloseHandle
cmp dword [0x4031e0], 0
je 0x401632
call dword [0x403594]
push dword [0x4031e0]
call sub.KERNEL32.dll_FreeLibrary
xor eax, eax
mov dword [0x4031e0], eax
xor eax, eax
add esp, 0x810
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40163f
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
add esp, 0xfffffdfc
mov dword [0x4031e4], 0xffffffff
push 0xea60
lea eax, [esp + 4]
push eax
push 0x1ff
lea edx, [esp + 0x10]
push edx
push 0
push 0x4031f9
push 0x40325c
call sub.KERNEL32.dll_CallNamedPipeA
add esp, 0x204
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x557235d5
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0xe3f6f11
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1001eb5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10013d0
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
test eax, eax
je 0x1001eed
xor eax, eax
inc eax
jmp 0x1001f23
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x10013b4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
je 0x1001f0e
xor esi, esi
inc esi
jmp 0x1001f18
xor eax, eax
cmp dword [ebp - 4], esi
sete al
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x1003324
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1005290]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x10033b9
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003342
sub eax, edx
sar eax, 1
mov ecx, 0x104
cmp eax, ecx
ja 0x10033b9
push esi
push ecx
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcscpy_s
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003373
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x20c]
dec eax
dec eax
movzx ecx, word [eax]
cmp cx, 0x5c
je 0x1003399
cmp cx, 0x2f
jne 0x10033a0
xor ecx, ecx
mov word [eax], cx
jmp 0x1003388
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x10033bb
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01003db3
leave
ret
Function at 0x10033cc
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0x1005290]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push dword [edi + 4]
mov dword [ebp - 0x768], eax
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_wcscpy_s
mov ecx, dword [edi + 4]
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x100340c
sub eax, edx
sar eax, 1
sub ebx, eax
mov eax, ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1003421
sub eax, ecx
sar eax, 1
push 0x1001c78
lea eax, [ebp + eax*2 - 0x20c]
push ebx
push eax
mov dword [ebp - 0x764], eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x760], eax
cmp eax, 0xffffffff
jne 0x100347c
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x1003607
mov ecx, 0x1001c74
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10034ad
test dx, dx
je 0x10034a9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10034ad
add eax, 4
add ecx, 4
test dx, dx
jne 0x1003487
xor eax, eax
jmp 0x10034b2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10035cd
mov ecx, 0x1001c6c
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10034eb
test dx, dx
je 0x10034e7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10034eb
add eax, 4
add ecx, 4
test dx, dx
jne 0x10034c5
xor eax, eax
jmp 0x10034f0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10035cd
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
push eax
push ebx
push dword [ebp - 0x764]
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [edi + 0xc]
add esp, 0x10
test eax, eax
je 0x1003531
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push 0x104
lea eax, [ebp - 0x730]
push eax
push dword [edi + 8]
call fcn.0100388b
test eax, eax
je 0x10035cd
cmp dword [edi + 0xc], 0
je 0x10035aa
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x30c]
push eax
lea edx, [ebp - 0x20c]
call fcn.01003251
test eax, eax
je 0x10035aa
test byte [ebp - 0x75c], 0x10
je 0x10035cd
lea esi, [ebp - 0x30c]
call fcn.01003324
test eax, eax
je 0x10035cd
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
mov eax, esi
push eax
mov eax, dword [ebp + 8]
call fcn.01003096
jmp 0x10035cd
lea esi, [ebp - 0x20c]
call fcn.01003324
test eax, eax
je 0x10035cd
mov eax, esi
push eax
mov eax, dword [ebp - 0x768]
call fcn.0100316f
mov esi, eax
test esi, esi
jne 0x10035ea
lea eax, [ebp - 0x75c]
push eax
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
test esi, esi
jne 0x100347c
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x1003605
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1003605
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01003db3
leave
ret 8
Function at 0x1003a8d
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1005290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
test eax, eax
jl 0x1003af0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
call dword [sym.imp.ntdll.dll_RtlFreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.01003db3
leave
ret

Function at 0x1003d99
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1004248
call fcn.01003f74
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10068ac
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1003bae
cmp eax, esi
jne 0x1003ba1
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1003bb1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003b88
xor esi, esi
inc esi
mov eax, dword [0x10068a8]
cmp eax, esi
jne 0x1003bc4
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1003bff
mov eax, dword [0x10068a8]
test eax, eax
jne 0x1003bf9
mov dword [0x10068a8], esi
push 0x1001164
push 0x1001158
call fcn.01003b05
pop ecx
pop ecx
test eax, eax
je 0x1003bff
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1003cc9
mov dword [0x100531c], esi
mov eax, dword [0x10068a8]
cmp eax, esi
jne 0x1003c23
push 0x1001154
push 0x100114c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10068a8], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1003c30
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10068b0], ebx
je 0x1003c51
push 0x10068b0
call fcn.01003ee9
pop ecx
test eax, eax
je 0x1003c51
push ebx
push 2
push ebx
call dword [0x10068b0]
push dword [0x1005304]
push dword [0x1005308]
push dword [0x1005300]
call fcn.01001f2b
add esp, 0xc
mov dword [0x1005318], eax
cmp dword [0x100530c], ebx
jne 0x1003caf
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x100531c], ebx
jne 0x1003cbd
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1005318]
call fcn.01003fb9
ret
call fcn.010040c1
jmp 0x1003b66
Function at 0x4040a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
xor eax, eax
push edi
mov ecx, 0x80070057
cmp dword [ebp + 8], ebx
jne 0x4040ba
mov eax, ecx
xor edx, edx
mov edi, 0x403214
cmp edx, edi
jne 0x4040c7
mov eax, ecx
cmp eax, ebx
jl 0x404151
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
je 0x404130
cmp eax, ebx
je 0x404102
jle 0x40413e
and eax, 0xffff
or eax, 0x80070000
jmp 0x40413e
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push edi
push dword [ebp - 4]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x404130
cmp eax, ebx
jne 0x4040f4
cmp dword [ebp + 8], esi
je 0x404135
xor esi, esi
inc esi
jmp 0x404140
xor eax, eax
cmp dword [ebp - 0xc], 1
setne al
mov esi, eax
cmp dword [ebp - 4], ebx
je 0x40414e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x404684
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
lea esi, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.004056be
mov dword [ebp - 4], eax
test eax, eax
je 0x4046fd
and dword [ebp - 4], ebx
push 0x4031cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
jne 0x4046e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4046db
cmp eax, 0x7e
je 0x4046db
test eax, eax
jg 0x4046cf
mov dword [ebp - 4], eax
jmp 0x404736
and eax, 0xffff
or eax, 0x80070000
jmp 0x4046ca
mov dword [ebp - 4], 0x80040641
jmp 0x404736
push 0x4031e4
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4046ff
mov dword [ebp - 4], 0x8000ffff
jmp 0x40472b
mov eax, ebx
mov esi, dword [ebp - 8]
mov dword [edi], ebx
xor ebx, ebx
and dword [ebp - 8], ebx
mov dword [edi + 8], eax
cmp dword [edi + 4], esi
je 0x404743
test esi, esi
je 0x40471b
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov eax, dword [edi + 4]
test eax, eax
je 0x404728
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi + 4], esi
test ebx, ebx
je 0x404736
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 8]
test eax, eax
je 0x404743
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret