joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004883
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
push dword [esi + 0x1c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0x80041008
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x1004a38
mov eax, dword [esi + 0x1c]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x1004a1e
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x1004a13
add eax, 2
push edi
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 8], edi
jne 0x1004909
mov dword [ebp - 4], 0x80041006
jmp 0x1004a12
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebp - 8]
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10049ee
and dword [ebp - 4], 0
cmp word [edi], 0xfeff
jne 0x100495f
push edi
lea ecx, [esi + 0x18]
call fcn.01003f3f
jmp 0x10049df
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004964
sub eax, edx
lea esi, [eax + 1]
lea eax, [esi + esi]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
test edi, edi
pop ecx
jne 0x1004989
mov dword [ebp - 4], 0x80041006
jmp 0x10049cd
push esi
push edi
push esi
push dword [ebp - 8]
push 1
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10049c1
call ebx
push eax
push dword [ebp - 8]
push 0x10018ac
push 2
call fcn.01006885
push edi
mov dword [ebp - 4], 0x80041001
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x14
jmp 0x10049cd
mov ecx, dword [ebp - 0x10]
push edi
add ecx, 0x18
call fcn.01003f3f
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
cmp dword [ebp - 4], 0
pop ecx
jl 0x1004a11
mov esi, dword [ebp - 0x10]
push dword [ebp + 8]
mov ecx, esi
call fcn.010045b5
mov dword [ebp - 4], eax
jmp 0x1004a11
mov esi, dword [esi + 0x1c]
call ebx
push eax
push esi
push 0x100188c
push 2
call fcn.01006885
push edi
mov dword [ebp - 4], 0x80041001
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x14
pop ebx
pop edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1004a38
mov esi, dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x100186c
push 2
call fcn.01006885
add esp, 0x10
mov eax, dword [ebp - 4]
pop esi
leave
ret 4
Function at 0x1004e30
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10018e8
call fcn.0100505c
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1004e6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004e6d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1004e85
cmp eax, 0x20b
je 0x1004e72
mov dword [ebp - 0x1c], ebx
jmp 0x1004e99
cmp dword [ecx + 0x84], 0xe
jbe 0x1004e6d
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1004e93
cmp dword [ecx + 0x74], 0xe
jbe 0x1004e6d
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100c018], 0xffffffff
or dword [0x100c01c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100a16c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100a168]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100c014], eax
call fcn.010051ca
cmp dword [0x100a080], ebx
jne 0x1004ef4
push fcn.010051ca
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010051b3
push 0x100a02c
push 0x100a028
call sub.msvcrt.dll__initterm
mov eax, dword [0x100a164]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100a160]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x100a024
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x1004f8a
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1004f5e
cmp al, 0x22
jne 0x1004f50
cmp byte [esi], 0x22
jne 0x1004f67
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1004f71
cmp al, 0x20
jbe 0x1004f63
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x54], 1
je 0x1004f95
movzx eax, word [ebp - 0x50]
jmp 0x1004f98
cmp byte [esi], 0x20
jbe 0x1004f67
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1004f8a
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1004fb5
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1004fea
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01005097
ret
Function at 0x10056c8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push esi
push 0x1002018
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi], eax
jne 0x10056e5
mov eax, 0x8004100c
pop esi
ret
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, 0x1001ff8
push ebx
push eax
call edi
test eax, eax
mov dword [esi + 4], eax
je 0x1005749
push 0x1001fd8
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0xc], eax
je 0x1005749
push 0x1001fb8
push dword [esi]
call edi
test eax, eax
mov dword [esi + 8], eax
je 0x1005749
push ebx
push dword [esi]
call edi
test eax, eax
mov dword [esi + 4], eax
je 0x1005749
push 0x1001fa4
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x10], eax
je 0x1005749
push 0x1001f90
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x1005750
mov eax, 0x8004100c
jmp 0x100576a
push 0x1001f74
push dword [esi]
call edi
mov dword [esi + 0x18], eax
neg eax
sbb eax, eax
and eax, 0x7ffbeff4
add eax, 0x8004100c
pop edi
pop ebx
pop esi
ret

Function at 0x100638c
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1007fb6
call fcn.01005108
sub esp, 0x14
push ebx
push esi
push edi
push 0xf003f
mov ebx, ecx
push 0x100234c
lea ecx, [ebp - 0x20]
call fcn.01006d08
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x10023a8
lea ecx, [ebp - 0x20]
call fcn.01006e3b
cmp eax, 1
je 0x1006424
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jg 0x1006424
push dword [ebp - 0x10]
mov esi, 0x105
push esi
lea edi, [ebx + 0xc]
push edi
call fcn.01005f35
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebx + eax*2 + 0xa], 0x5c
je 0x1006419
push 0x10018e0
push esi
push edi
call fcn.01006331
push edi
push 0x10023a8
lea ecx, [ebp - 0x20]
call fcn.01006df3
push dword [ebp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x1006469
push dword [ebp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov esi, 0x105
push esi
lea edi, [ebx + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x100644f
push 0x10023a0
push esi
push edi
call fcn.01005f35
jmp 0x1006469
push 0x1002388
push esi
push edi
call fcn.01006331
push edi
push 0x10023a8
lea ecx, [ebp - 0x20]
call fcn.01006df3
push dword [0x100a0e0]
push edi
call fcn.01006fa1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.01006d3b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1006696
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1007ff4
call fcn.01005108
sub esp, 0x90
mov eax, dword [0x100a078]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x60], eax
xor edi, edi
mov dword [ebp - 4], edi
cmp byte [ebp + 8], 0x50
jb 0x10066d1
mov byte [ebp + 8], 0
movsx eax, byte [ebp + 8]
push dword [eax*4 + 0x100a090]
mov ecx, esi
call fcn.01006495
mov dword [ebp - 0x68], eax
cmp eax, 0xffffffff
je 0x1006865
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push dword [esi + 0x1e2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x1006721
mov dword [ebp - 0x7c], edi
xor esi, esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x74]
call fcn.01006009
mov eax, esi
jmp 0x1006867
mov eax, dword [esi + 0x1e2c]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 2
push edi
call dword [sym.imp.msvcrt.dll_time]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.msvcrt.dll_localtime]
pop ecx
pop ecx
mov dword [ebp - 0x90], eax
cmp eax, edi
je 0x1006789
push eax
call dword [sym.imp.msvcrt.dll_asctime]
pop ecx
mov dword [ebp - 0x88], eax
push eax
push 0x40
lea eax, [ebp - 0x54]
push eax
call fcn.01006184
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x54]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100677a
sub eax, ecx
mov byte [ebp + eax - 0x55], dl
jmp 0x100679c
push 0x10023e0
push 0x40
lea eax, [ebp - 0x54]
push eax
call fcn.01006184
mov dword [ebp - 0x80], eax
lea ebx, [esi + 0x216]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x10023d4
mov edi, 0x800
push edi
push ebx
call fcn.010062d5
add esp, 0x14
mov eax, ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10067c6
sub eax, ecx
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x60]
push dword [ecx]
push dword [ebp - 0x6c]
sub edi, eax
push edi
lea eax, [esi + eax + 0x216]
push eax
call fcn.010062b3
and dword [ebp - 0x58], 0
mov dword [ebp - 0x64], ebx
lea eax, [esi + 0xa16]
mov dword [ebp - 0x5c], eax
mov cl, byte [ebx]
test cl, cl
je 0x1006825
cmp cl, 0xa
jne 0x1006816
mov byte [eax], 0xd
inc eax
mov dword [ebp - 0x5c], eax
inc dword [ebp - 0x58]
mov byte [eax], cl
jmp 0x1006818
mov byte [eax], cl
inc ebx
mov dword [ebp - 0x64], ebx
inc eax
mov dword [ebp - 0x5c], eax
inc dword [ebp - 0x58]
jmp 0x10067fd
mov byte [eax], 0
push 0
lea eax, [ebp - 0x8c]
push eax
push dword [ebp - 0x58]
add esi, 0xa16
push esi
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
inc esi
mov dword [ebp - 0x94], esi
mov byte [ebp - 4], 1
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x100670e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.01004d18
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1006d63
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100a078]
and dword [ebp - 0x40], 0
and dword [ebp - 0x3c], 0
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
test eax, eax
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x44], 0x19
je 0x1006ddd
lea edx, [ebp - 0x44]
push edx
lea edx, [ebp - 0x38]
push edx
lea edx, [ebp - 0x40]
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x1006ddd
cmp dword [ebp - 0x40], 1
jne 0x1006ddd
push 0xa
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
cmp dword [ebp - 0x3c], 0
mov dword [edi], eax
je 0x1006ddd
lea eax, [ebp - 0x38]
cmp dword [ebp - 0x3c], eax
je 0x1006ddd
xor eax, eax
jmp 0x1006de0
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01004d18
leave
ret 8

Function at 0x1006df3
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, ecx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea ecx, [eax + eax + 2]
mov eax, dword [esi + 4]
test eax, eax
jne 0x1006e13
inc eax
jmp 0x1006e31
push ecx
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0xc], eax
mov eax, ecx
pop esi
pop ebp
ret 8
Function at 0x1006e3b
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [eax], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x1006e63
xor eax, eax
inc eax
jmp 0x1006f1d
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 8]
push ecx
push ebx
push dword [ebp + 8]
push eax
call edi
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x1006e89
xor eax, eax
inc eax
jmp 0x1006f1c
xor eax, eax
inc eax
cmp dword [ebp - 8], eax
je 0x1006e9b
cmp dword [ebp - 8], 2
jne 0x1006f1c
add dword [ebp - 4], 2
mov eax, dword [ebp - 4]
add eax, eax
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
je 0x1006e81
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [esi + 4]
call edi
test eax, eax
mov dword [esi + 0xc], eax
jne 0x1006ef5
cmp dword [ebp - 8], 2
jne 0x1006f15
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
lea eax, [ebp + 0xa]
push eax
push ebx
call edi
mov esi, eax
inc esi
lea eax, [esi + esi + 2]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
mov dword [ebp - 0xc], eax
jne 0x1006efe
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x1006e81
inc esi
push esi
push eax
push ebx
call edi
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x1006f1a
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1006f28
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x100a078]
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x1002460
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
push 0x1e
push eax
mov esi, ecx
call fcn.01006303
add esp, 0x10
cmp dword [esi + 4], 0
jne 0x1006f60
xor eax, eax
inc eax
jmp 0x1006f8e
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x40]
push eax
push 1
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0xc], eax
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01004d18
leave
ret 8
Function at 0x1006fa1
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes

Disassembly:
mov eax, 0x100800b
call fcn.01005108
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call esi
cmp ebx, 0xffffffff
mov edi, eax
je 0x1006fe9
test bl, 0x10
jne 0x100704d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1006fe6
call esi
or eax, 0x80070000
jmp 0x100704f
push 3
pop edi
cmp edi, 2
je 0x1006ff3
cmp edi, 3
jne 0x1007045
xor edi, edi
push edi
lea eax, [ebp - 0x10]
push eax
push 1
push dword [ebp + 0xc]
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x1006fdd
mov ebx, dword [ebp - 0x10]
mov dword [ebp + 0xc], ebx
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100703a
call esi
mov edi, eax
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x100704d
mov eax, edi
jmp 0x1006fdf
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x1007425
Capabilities:
Create service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x100a078]
push esi
push edi
push 0xf003f
xor esi, esi
push esi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
push 0x3ff
lea eax, [ebp - 0x804]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x804]
push eax
mov eax, dword [0x100bfe0]
push 1
neg eax
sbb eax, eax
add eax, 3
push eax
push 0x10
push 0xf01ff
push dword [0x100bfdc]
push dword [0x100bfd8]
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
pop edi
pop esi
jne 0x10074a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x10074a6
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
call fcn.01004d18
leave
ret
Function at 0x1007890
Capabilities:
Persist via com hijack
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x100a078]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
push 0x80
lea eax, [ebp - 0x310]
push eax
push dword [esi + 0xc]
call dword [sym.imp.ole32.dll_StringFromGUID2]
push 0x10025b8
lea eax, [ebp - 0x310]
push eax
push 0x100
lea eax, [ebp - 0x510]
push eax
call fcn.01007833
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x510]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
mov ebx, eax
add ebx, 0x64
lea eax, [ebx + ebx]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
push dword [esi + 0x14]
mov dword [ebp - 0x51c], eax
push 0x1002594
push ebx
push eax
call fcn.01006303
add esp, 0x14
push dword [ebp - 0x51c]
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x51c]
push 1
push 0
push 0
push dword [ebp - 0x514]
call ebx
cmp dword [ebp + 0xc], 0
mov eax, 0x1002578
jne 0x100795c
mov eax, 0x1002420
lea ecx, [ebp - 0x518]
push ecx
push eax
push dword [ebp - 0x514]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push 0x104
lea eax, [ebp - 0x210]
push eax
push dword [0x100bfcc]
mov word [ebp - 8], 0x30
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call edi
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push 0
push dword [ebp - 0x518]
call ebx
cmp dword [esi + 0x18], 0
je 0x10079cb
cmp dword [esi + 0x1c], 0
jne 0x10079c4
mov esi, 0x100256c
jmp 0x10079d0
mov esi, 0x1002560
jmp 0x10079d0
mov esi, 0x100254c
push esi
call edi
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push 0x1002400
push dword [ebp - 0x518]
call ebx
push dword [ebp - 0x514]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x518]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.01004d18
leave
ret 8
Function at 0x1007a16
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x308
mov eax, dword [0x100a078]
push ebx
push esi
push edi
push 0x80
lea ecx, [ebp - 0x104]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push dword [eax + 0xc]
call dword [sym.imp.ole32.dll_StringFromGUID2]
push 0x10025b8
lea eax, [ebp - 0x104]
push eax
push 0x100
lea eax, [ebp - 0x304]
push eax
call fcn.01007833
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x304]
push eax
mov edi, 0x80000002
push edi
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jne 0x1007aac
cmp dword [ebp + 0xc], 0
mov eax, 0x1002578
jne 0x1007a97
mov eax, 0x1002440
push eax
push dword [ebp - 0x308]
call ebx
push dword [ebp - 0x308]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x308]
push eax
push 0x10025e8
push edi
call esi
test eax, eax
jne 0x1007ada
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x308]
call ebx
push dword [ebp - 0x308]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.01004d18
leave
ret 8
Function at 0x1007af0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1008024
call fcn.01005108
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
test edi, edi
pop ecx
je 0x1007cef
push ebx
push esi
push edi
call fcn.01005f7e
xor ebx, ebx
cmp word [edi], bx
mov esi, edi
je 0x1007b4a
xor eax, eax
mov ax, word [esi]
push eax
call fcn.010071a0
mov word [esi], ax
inc esi
inc esi
cmp word [esi], bx
jne 0x1007b35
call fcn.0100713e
push 0x1002694
push edi
call fcn.01007275
test eax, eax
jne 0x1007cbb
push 0x100267c
push edi
call fcn.01007275
test eax, eax
jne 0x1007cbb
push 0x1002660
push edi
call fcn.01007275
test eax, eax
jne 0x1007c85
push 0x1002644
push edi
call fcn.01007275
test eax, eax
jne 0x1007c85
push 0x1002630
push edi
call fcn.01007275
test eax, eax
jne 0x1007bc3
cmp dword [0x100bfd4], ebx
jne 0x1007bc3
push 0x1002618
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
jmp 0x1007cef
call fcn.01007182
test eax, eax
jl 0x1007cef
mov esi, dword [0x100a0e8]
mov edi, 0x100a0e8
jmp 0x1007c25
push 0x14
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x1007bfb
push dword [esi + 0xc]
mov ecx, eax
call fcn.010075e3
jmp 0x1007bfd
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x1007cef
lea ecx, [esi + 0x1c]
push ecx
push 1
push 0x15
push eax
push dword [esi + 8]
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jl 0x1007cef
mov esi, dword [esi]
cmp esi, edi
jne 0x1007bdd
cmp dword [0x100bfd4], ebx
je 0x1007c38
call fcn.010073e4
jmp 0x1007c48
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x100a0f0], eax
call fcn.01007297
mov esi, dword [0x100a0e8]
jmp 0x1007c63
push dword [esi + 0x1c]
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
test eax, eax
jl 0x1007cef
mov esi, dword [esi]
cmp esi, edi
jne 0x1007c50
push 0x1007507
push 0x3e8
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.01007297
call fcn.0100714d
jmp 0x1007cef
call fcn.01007172
mov esi, dword [0x100a0e8]
mov edi, 0x100a0e8
jmp 0x1007ca8
push 1
lea eax, [esi - 4]
push eax
call fcn.01007a16
test eax, eax
jl 0x1007cef
mov esi, dword [esi]
cmp esi, edi
jne 0x1007c97
cmp dword [0x100bfd4], ebx
je 0x1007cef
call fcn.010074b5
jmp 0x1007cef
call fcn.01007162
mov esi, dword [0x100a0e8]
mov edi, 0x100a0e8
jmp 0x1007cde
push 1
lea eax, [esi - 4]
push eax
call fcn.01007890
test eax, eax
jl 0x1007cef
mov esi, dword [esi]
cmp esi, edi
jne 0x1007ccd
cmp dword [0x100bfd4], ebx
je 0x1007cef
call fcn.01007425
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret