joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10f2590
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x101bd18
push esi
call fcn.010cbc10
xor ebx, ebx
test eax, eax
je 0x10f25d5
mov eax, dword [esi]
mov ecx, dword [eax + 0x3550]
mov dword [ecx + 0xe48], ebx
mov edx, dword [esi]
mov eax, dword [edx + 0x3550]
push ebx
push 0x101bd18
push esi
mov dword [eax + 0xe40], ebx
call fcn.010cbc90
push esi
call fcn.010cc4d0
mov ecx, dword [esi]
push 0x101bd14
push 0x1014dd4
push connect
push ecx
call fcn.010b37a0
test eax, eax
je 0x10f263a
mov eax, dword [esi]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101bd14
push 0x1014dd4
push connect
push eax
mov dword [ebp + 8], ebx
call fcn.010b3130
mov edi, dword [esi]
lea ecx, [ebp + 8]
push ecx
push ebx
push esi
push 0x104c300
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, ebx
je 0x10f263a
mov edx, dword [edi + 0x1c0]
push eax
call edx
cmp dword [esi + 0xa40], ebx
je 0x10f2667
mov eax, dword [esi]
push 0x101bd0c
push 0x1014dd4
push connect
push eax
call fcn.010b37a0
test eax, eax
je 0x10f2667
mov dword [esi + 0xa68], 1
mov ecx, dword [esi]
push ecx
call fcn.010ec8e0
mov eax, dword [esi]
push ebx
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0x101bd04
push 0x1014d6c
push connect
push eax
call fcn.010b33d0
cmp eax, ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_HeapFree]
je 0x10f26c5
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call ebx
test edi, edi
je 0x10f26c5
cmp dword [esi + 0xa40], 0
je 0x10f26c5
mov edx, dword [esi]
push 0
add edx, 0x1d654
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov eax, dword [esi]
mov ecx, dword [eax + 0x3550]
cmp dword [ecx + 0x194], 0
jne 0x10f271b
push 0
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0x101bcfc
push 0x1014d6c
push connect
push eax
call fcn.010b33d0
test eax, eax
je 0x10f271b
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call ebx
cmp edi, 0x16
jne 0x10f271b
push 1
add esi, 0xa6c
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10f2f70
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [esi + 0xa8], eax
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10f2e00
push 0
push 0
mov dword [esi + 0xa0], ecx
mov dword [esi + 0xa4], edx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0xb8], eax
pop esi
pop ebp
ret 0x10
Function at 0x10f3310
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
jne 0x10f332d
xor eax, eax
jmp 0x10f3340
mov eax, esi
cmp word [esi], bx
je 0x10f333c
add eax, 2
cmp word [eax], bx
jne 0x10f3334
sub eax, esi
sar eax, 1
push eax
push 0x5c
push esi
call fcn.0102a9b0
test eax, eax
je 0x10f34a0
sub eax, esi
push edi
sar eax, 1
push eax
push esi
call fcn.0102ab30
mov edi, eax
test edi, edi
je 0x10f3495
push 0x20a
lea eax, [ebp - 0x254]
push 0
push eax
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 8]
mov eax, dword [edx]
add esp, 0xc
push 0x3f
lea ecx, [ebp - 0x48]
push ecx
push eax
call fcn.010e72e0
lea ecx, [ebp - 0x48]
push ecx
push edi
push 0x1013514
lea edx, [ebp - 0x254]
push 0x103
push edx
call fcn.0102aaf0
mov ebx, dword [sym.imp.KERNEL32.DLL_MoveFileW]
add esp, 0x14
lea eax, [ebp - 0x254]
push eax
push esi
call ebx
test eax, eax
jne 0x10f33d3
mov edx, dword [ebp + 8]
mov eax, dword [edx]
lea ecx, [ebp - 0x254]
push ecx
push esi
push eax
call fcn.0108e130
push 0x20a
lea ecx, [ebp - 0x460]
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
lea edx, [ebp - 0x48]
push edx
call fcn.0107e160
lea eax, [ebp - 0x48]
push eax
push edi
push 0x1013514
lea ecx, [ebp - 0x460]
push 0x103
push ecx
call fcn.0102aaf0
add esp, 0x14
lea edx, [ebp - 0x460]
push edx
lea eax, [ebp - 0x254]
push eax
call ebx
test eax, eax
jne 0x10f343d
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x460]
push ecx
mov ecx, dword [eax]
lea edx, [ebp - 0x254]
push edx
push ecx
call fcn.0108e130
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea edx, [ebp - 0x460]
push edx
call ebx
test eax, eax
je 0x10f3457
mov dword [ebp - 4], 1
lea eax, [ebp - 0x254]
push eax
call ebx
test eax, eax
je 0x10f346b
mov dword [ebp - 4], 1
push esi
call ebx
test eax, eax
je 0x10f3479
mov dword [ebp - 4], 1
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10f4660
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax + 0x3550], 0
je 0x10f46be
push esi
add eax, 0x12970
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov esi, dword [edi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10e8dc0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10f46ae
mov ecx, dword [esi + 0x1c0]
push eax
call ecx
pop esi
xor eax, eax
pop edi
pop ebp
ret 4
mov edx, dword [edi]
add edx, 0x12970
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop esi
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x10f4d70
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x84
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push ebx
push edi
call fcn.010f4d10
mov esi, eax
test esi, esi
jne 0x10f4de4
cmp dword [edi + 0xa60], eax
je 0x10f4de4
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp - 0x84]
push edx
mov dword [ebp + 0x10], 0x3f
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x84]
push 0x1018ed0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x10f4de2
test bl, 6
je 0x10f4de2
push edi
call fcn.010f13f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10f5590
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x108
cmp eax, 0x800c
je 0x10f55b0
cmp eax, 0x8005
jne 0x10f5635
push 0x105
lea eax, [ebp - 0x108]
push 0
push eax
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 0xc]
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x108]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x10f5635
push 8
lea eax, [ebp - 0x108]
push 0x101c028
push eax
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x10f5635
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x2a0]
push edi
call eax
mov edi, eax
mov ecx, edi
sub ecx, dword [esi + 0x2d32c]
cmp ecx, 0x3a98
jbe 0x10f5633
lea edx, [ebp - 0x100]
push edx
push esi
call fcn.010f5520
mov dword [esi + 0x2d32c], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10f68e0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
lea eax, [esi + 0x2d34c]
push eax
mov dword [ebp - 4], 1
call ebx
mov eax, dword [esi + 8]
cmp dword [eax + 0x10a4], 0
jne 0x10f6b10
test dword [esi + 0x2c288], 0x200
jne 0x10f6b10
mov eax, dword [eax]
cmp dword [eax + 0x8264], 0
jne 0x10f6a6a
cmp dword [esi + 0x2d35c], 0
jne 0x10f6a6a
cmp dword [eax + 0x8254], 0
je 0x10f6969
mov eax, dword [ebp - 4]
push eax
mov edi, 0x226408
push edi
push esi
call fcn.010f6850
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push edi
push esi
call fcn.0106cd50
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffffc
add edi, 0x226408
cmp dword [esi + 0x2d358], 0
jne 0x10f6af5
mov eax, dword [esi + 0x2b664]
cmp eax, 0xb
je 0x10f6ae4
cmp dword [ebp + 0x1c], 0
je 0x10f69dc
cmp eax, 1
jbe 0x10f69dc
push 1
push 0x226408
push esi
call fcn.010f6850
push 1
lea ecx, [esi + 0x2e7a0]
push ecx
call ebx
push 1
lea eax, [esi + 0x2d358]
push eax
call ebx
mov edx, dword [esi + 8]
push 1
add edx, 0x1d5c
push edx
call ebx
jmp 0x10f6af5
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x82
lea ecx, [ebp - 0x88]
and eax, 0xffff
push 0
push ecx
mov dword [ebp + 0xc], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
add esp, 0xc
push 0x3f
lea edx, [ebp - 0x88]
push edx
push 0x1004
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
push 0x101c0a4
lea ecx, [ebp - 0x88]
push ecx
call fcn.0102a410
test eax, eax
je 0x10f6ae4
push 1
lea edx, [esi + 0x2e7a0]
push edx
call ebx
push 1
lea eax, [esi + 0x2d358]
push eax
call ebx
mov eax, dword [esi + 8]
push 1
add eax, 0x1d5c
push eax
call ebx
push 1
push 0x226408
push esi
call fcn.010f6850
jmp 0x10f6af5
push 1
lea ecx, [esi + 0x2e7a0]
push ecx
call ebx
push 0x226408
lea edx, [esi + 0x2d344]
push edx
call ebx
cmp eax, 0x226408
je 0x10f6ac5
mov eax, dword [esi + 8]
push 0x226408
add eax, 0x1d80
push eax
call ebx
push 0
push 0
push esi
call fcn.010f5c60
cmp dword [esi + 0x407c], 0
jne 0x10f6ac5
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
push 0
push 0
push 0
push 0
push 0x226408
push edx
call fcn.0108fd80
push edi
push esi
call fcn.0106cd50
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffffc
push 0
add edi, 0x226408
push edi
push esi
call fcn.010f6850
cmp edi, 0x226404
jne 0x10f6afc
cmp dword [esi + 0x2d354], 0
jne 0x10f6afc
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call fcn.010f6850
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push edi
push esi
call fcn.0106cd50
test eax, eax
je 0x10f6950
mov edi, 0x226404
jmp 0x10f6aec
Function at 0x10f6c20
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
mov edi, dword [ebp + 0xc]
push 2
push edi
call dword [sym.imp.USER32.dll_GetAncestor]
mov esi, eax
test esi, esi
je 0x10f6c44
cmp esi, 0xffffffff
jne 0x10f6c46
mov esi, edi
test esi, esi
je 0x10f6d11
cmp esi, 0xffffffff
je 0x10f6d11
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
test edi, edi
je 0x10f6d11
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
push ebx
push ecx
push edx
call fcn.0106cd50
mov ebx, eax
test ebx, ebx
jne 0x10f6cfe
push 0x20a
push eax
lea eax, [ebp - 0x210]
push eax
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 0xc]
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x210]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 4
push 0x101c0b0
lea eax, [ebp - 0x210]
push eax
call fcn.0102a440
test eax, eax
jne 0x10f6cc7
lea ebx, [eax + 1]
jmp 0x10f6cfe
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [edx]
cmp dword [eax + 0x81a4], 0x2710
jb 0x10f6cfe
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
test edi, edi
je 0x10f6cfe
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
push eax
push ecx
call fcn.0106cd50
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push 0
push esi
push edi
push ebx
push edx
push eax
call fcn.010f68e0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10f74f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10f2e00
push 0
push 0
mov dword [esi + 0xa8], 2
mov dword [esi + 0xa0], 0x1b58
mov dword [esi + 0xa4], 0x1388
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [esi]
push esi
add ecx, 0x240fc
push ecx
mov dword [esi + 0xb8], eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
pop esi
pop ebp
ret 4

Function at 0x10fa760
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push esi
mov esi, dword [edx]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x10f8d00
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10fa793
mov edx, dword [esi + 0x1c0]
push eax
call edx
pop esi
pop ebp
ret 4
Function at 0x10fc430
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax + 0x27828], 1
push edi
jne 0x10fc44d
push eax
call fcn.010a6090
jmp 0x10fc473
mov ecx, dword [ebp + 0xc]
mov ecx, dword [eax + ecx*4 + 0x26820]
mov edx, dword [ecx + 0x23c]
push 1
push 0
push 0
push 0
push edx
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
push edx
push ecx
push eax
call fcn.010a5e00
mov edi, dword [esi + 4]
lea edx, [ebp + 8]
push edx
push 0
push esi
push fcn.010e5cd0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10fc499
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x10fc570
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
push 0
add eax, 0x267fc
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi + 0xf0]
push 0
push edi
mov dword [ebp - 4], edi
call fcn.0109e950
lea ecx, [ebp - 8]
push ecx
push 0
push esi
push 0x10de020
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp + 8], eax
test eax, eax
je 0x10fc666
cmp eax, 0xffffffff
je 0x10fc666
push esi
call fcn.010dcd10
cmp dword [esi], 0
je 0x10fc5e1
mov edx, dword [esi + 0xc]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [eax + 0x267f8], 0
xor edi, edi
jmp 0x10fc600
mov eax, dword [esi]
cmp dword [eax + 0x267fc], 0
jne 0x10fc633
add dword [eax + 0x267f8], 3
mov ecx, dword [esi]
mov eax, dword [ecx + 0x267f4]
test eax, eax
je 0x10fc629
push 0
push 0
push eax
push esi
call fcn.01057a80
push 0x64
call ebx
inc edi
cmp edi, 0x21
jl 0x10fc600
mov edx, dword [esi]
cmp dword [edx + 0x267fc], 0
jne 0x10fc64f
mov edi, edi
push 0xa
call ebx
mov eax, dword [esi]
cmp dword [eax + 0x267fc], 0
je 0x10fc640
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [esi + 0xf0]
push ecx
call fcn.0109eac0
push 1
push edi
call fcn.0109e950
mov edx, dword [esi + 0xc]
push 0
push 0
push 0x408
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call fcn.010e5cd0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10fcde0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
push 6
push eax
call fcn.010d74f0
mov dword [esi + 0x2d438], eax
test al, 2
je 0x10fce40
push edi
push esi
push 0x10fccc0
push esi
call fcn.0106b830
push esi
push 0x10de350
push esi
call fcn.0106b830
mov ecx, dword [esi + 8]
mov edi, dword [ecx]
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x10de990
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10fce3f
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x10fcec0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x41
lea edi, [esi + 0x30914]
push 0
push edi
call sub.msvcrt.dll_memset
mov eax, dword [esi]
mov ecx, dword [eax]
add esp, 0xc
push ecx
call fcn.010289b0
mov edx, dword [esi]
mov ebx, dword [edx]
cmp dword [ebx + 0x14f74], 0
mov dword [ebp - 8], eax
jne 0x10fcf04
push ebx
call fcn.010e64a0
cmp dword [ebx + 0x14f78], 0
mov dword [ebp + 8], 0x101a944
jne 0x10fcf1b
mov dword [ebp + 8], 0x101a92c
mov ebx, dword [ebx + 0x3550]
test ebx, ebx
je 0x10fcf32
cmp dword [ebx + 0x13c], 0
je 0x10fcf32
add dword [ebp + 8], 3
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], eax
call dword [sym.imp.msvcrt.dll_localtime]
mov edx, dword [ebp + 8]
push eax
push edx
push 0x3f
push edi
call dword [sym.imp.msvcrt.dll_strftime]
push 0x82
lea eax, [ebp - 0x90]
push 0
push eax
call sub.msvcrt.dll_memset
push edi
push 0x101c0f4
lea ecx, [ebp - 0x90]
push 0x3f
push ecx
call fcn.0102aaf0
add esp, 0x30
lea edx, [ebp - 0x90]
push edx
call fcn.01077250
mov eax, dword [esi]
mov eax, dword [eax]
lea ecx, [ebp - 0x90]
push ecx
push 0x100b744
add eax, 0x3c22
push eax
call fcn.0107e5b0
mov dword [esi + 0x30904], eax
test eax, eax
je 0x10fcff5
mov edx, dword [esi]
push eax
mov eax, dword [edx]
push eax
call fcn.010b1fb0
mov ecx, dword [esi + 0x30904]
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esi + 0x30900], eax
test eax, eax
je 0x10fcff5
cmp eax, 0xffffffff
je 0x10fcff5
push 0
lea edx, [ebp - 0xc]
push edx
push 2
push 0x101c0f0
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov esi, dword [esi + 0x30900]
test esi, esi
je 0x10fd012
cmp esi, 0xffffffff
je 0x10fd012
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10fd470
Capabilities:
Enumerate gui resources
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.010fd3a0
mov eax, dword [esi]
mov ecx, dword [eax]
push 0
push ecx
call fcn.010c61f0
mov edx, dword [esi]
mov eax, dword [edx]
cmp dword [eax + 0x819c], 6
jb 0x10fd4b6
mov eax, dword [eax + 0x264]
test eax, eax
je 0x10fd4b6
cmp eax, fcn.01027120
je 0x10fd4b6
lea ecx, [esi + 0x30390]
push ecx
call eax
mov eax, dword [esi + 0x30390]
mov ecx, dword [esi + 0x30394]
mov edx, eax
or edx, ecx
jne 0x10fd4e0
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [eax + 0x13f30]
mov dword [esi + 0x30390], ecx
mov edx, dword [eax + 0x13f34]
jmp 0x10fd4f4
push 0
push 0x400
push ecx
push eax
call fcn.011788a0
mov dword [esi + 0x30390], eax
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x2f208]
mov edi, 0x3f
push ecx
mov dword [esi + 0x30394], edx
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edx, [ebp + 8]
push edx
lea eax, [esi + 0x2f28a]
push eax
push 3
mov dword [ebp + 8], edi
call sub.Secur32.dll_GetUserNameExW
mov ecx, dword [esi]
mov edx, dword [ecx]
push edx
call fcn.010b21f0
mov dword [esi + 0x2f30c], eax
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
call fcn.010b20f0
mov dword [esi + 0x2f310], eax
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [esi + 0x30334]
push edx
push ecx
call fcn.01028610
mov edx, dword [esi]
mov eax, dword [edx]
lea ecx, [eax + 0x8152]
push ecx
push eax
call fcn.010b69e0
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x43
call edi
mov edx, dword [esi]
neg eax
sbb eax, eax
neg eax
mov dword [esi + 0x30338], eax
mov eax, dword [edx]
mov ecx, dword [eax + 0x130]
call ecx
mov edx, dword [esi]
push 0x101c234
push 0x101c220
mov word [esi + 0x3033c], ax
mov eax, dword [edx]
push connect
push eax
call fcn.010b37a0
push esi
push 0x10786f0
mov dword [esi + 0x2f314], eax
call dword [sym.imp.USER32.dll_EnumWindows]
push 0
call edi
push 1
mov dword [esi + 0x30380], eax
call edi
push 0
mov dword [esi + 0x30384], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x10fd5f8
push 0xc
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edi
push 0
mov dword [esi + 0x30388], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esi]
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x8238]
xor edi, edi
neg eax
sbb eax, eax
and eax, 0x100
push eax
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0x101c20c
push 0x101c198
push connect
push ecx
call fcn.010b33d0
test eax, eax
je 0x10fd641
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov dword [esi + 0x3038c], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10fd9f0
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov eax, 0x1018168
lea ebx, [ebx]
add eax, 2
cmp word [eax], bx
jne 0x10fda10
mov ecx, dword [esi]
mov edx, dword [ecx]
push 2
sub eax, 0x1018168
sar eax, 1
push eax
push 0x1018168
push 0x1018168
push connect
lea eax, [ebp - 8]
push eax
push 0x10df6c0
push edx
call fcn.010e6f50
mov eax, dword [esi]
mov edx, dword [eax]
cmp dword [edx + 0x8238], ebx
je 0x10fda7b
push 0xa
push 0x1018168
call fcn.0102a730
push eax
push 0x1018168
push 0x1018168
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10df6c0
push edx
call fcn.010e6f50
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov eax, 0x1018168
add eax, 2
cmp word [eax], bx
jne 0x10fda86
push 2
sub eax, 0x1018168
sar eax, 1
push eax
mov eax, dword [esi]
mov ecx, dword [eax]
push 0x1018168
push 0x1018168
push connect
lea edx, [ebp - 8]
push edx
push 0x10df6c0
push ecx
call fcn.010e6f50
mov edx, dword [esi]
mov edx, dword [edx]
cmp dword [edx + 0x8238], ebx
je 0x10fdaf1
push 0xa
push 0x1018168
call fcn.0102a730
push eax
push 0x1018168
push 0x1018168
push connect
lea eax, [ebp - 8]
push eax
push 0x10df6c0
push edx
call fcn.010e6f50
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov eax, 0x101c268
lea esp, [esp]
add eax, 2
cmp word [eax], bx
jne 0x10fdb00
mov edx, dword [esi]
push 2
sub eax, 0x101c268
sar eax, 1
push eax
mov eax, dword [edx]
push 0x101c268
push 0x101c268
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10df6c0
push eax
call fcn.010e6f50
mov ecx, dword [esi]
mov edx, dword [ecx]
cmp dword [edx + 0x8238], ebx
je 0x10fdb6b
push 0xa
push 0x101c268
call fcn.0102a730
push eax
push 0x101c268
push 0x101c268
push connect
lea eax, [ebp - 8]
push eax
push 0x10df6c0
push edx
call fcn.010e6f50
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov eax, 0x101c268
add eax, 2
cmp word [eax], bx
jne 0x10fdb76
mov edx, dword [esi]
push 2
sub eax, 0x101c268
sar eax, 1
push eax
mov eax, dword [edx]
push 0x101c268
push 0x101c268
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10df6c0
push eax
call fcn.010e6f50
mov ecx, dword [esi]
mov edx, dword [ecx]
cmp dword [edx + 0x8238], ebx
je 0x10fdbe1
push 0xa
push 0x101c268
call fcn.0102a730
push eax
push 0x101c268
push 0x101c268
push connect
lea eax, [ebp - 8]
push eax
push 0x10df6c0
push edx
call fcn.010e6f50
mov dword [ebp - 4], 0x1018f14
mov dword [ebp - 8], esi
mov eax, 0x1012770
add eax, 2
cmp word [eax], bx
jne 0x10fdbf0
mov edx, dword [esi]
push 7
sub eax, 0x1012770
sar eax, 1
push eax
mov eax, dword [edx]
push 0x1012770
push 0x1012770
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10df6c0
push eax
call fcn.010e6f50
mov dword [ebp - 4], 0x1018f14
mov dword [ebp - 8], esi
mov eax, 0x1012770
add eax, 2
cmp word [eax], bx
jne 0x10fdc33
mov edx, dword [esi]
push 7
sub eax, 0x1012770
sar eax, 1
push eax
mov eax, dword [edx]
push 0x1012770
push 0x1012770
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10df6c0
push eax
call fcn.010e6f50
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4