joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008cb3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100142ca
call fcn.10013680
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x88]
call fcn.10008374
mov edx, dword [ebp + 8]
xor edi, edi
mov eax, edx
mov dword [ebp - 4], edi
dec eax
mov dword [esi], 0x100152a8
je 0x10008cff
sub eax, 3
je 0x10008cff
sub eax, 4
je 0x10008cff
push 8
pop ecx
sub eax, ecx
je 0x10008cff
sub eax, 0x10
je 0x10008cff
mov dword [esi + 0x70], ecx
jmp 0x10008d02
mov dword [esi + 0x70], edx
mov ecx, esi
call fcn.10009442
test al, al
jne 0x10008d23
call dword [0x1001bec4]
push eax
mov dword [esi + 0x10c], eax
call dword [0x1001bec8]
mov dword [esi + 0x44], eax
mov dword [esi + 0x10], 0xcc0020
mov byte [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x14], eax
mov eax, 0x3e8
xor edx, edx
div ecx
mov ebx, dword [0x1001bed0]
push edi
mov dword [esi + 8], ecx
mov dword [esi + 0x18], eax
mov al, byte [ebp + 0xc]
mov byte [esi + 0xc], al
call ebx
push 1
mov dword [esi + 0x28], eax
call ebx
push 0x20
mov dword [esi + 0x2c], eax
pop eax
mov ebx, dword [0x1001be60]
cdq
idiv dword [esi + 0x70]
push dword [esi + 0x44]
mov dword [esi + 0x30], edi
mov byte [esi + 0x24], al
call ebx
push dword [esi + 0x44]
mov dword [esi + 0x4c], eax
call ebx
push edi
mov dword [esi + 0x80], eax
call ebx
push edi
mov dword [esi + 0x48], eax
call ebx
push 1
lea ebx, [esi + 0x5c]
push dword [esi + 0x28]
mov ecx, esi
mov dword [esi + 0x50], eax
mov dword [ebx], edi
push dword [esi + 0x70]
mov dword [esi + 0x60], edi
call fcn.100091df
push dword [esi + 0x2c]
mov ecx, esi
mov dword [esi + 0x64], eax
push dword [esi + 0x28]
push dword [esi + 0x70]
call fcn.100091df
push 1
mov ecx, esi
push dword [esi + 0x28]
mov dword [esi + 0x68], eax
push dword [esi + 0x70]
call fcn.100091df
push edi
push edi
push ebx
mov ebx, dword [0x1001be70]
push edi
mov dword [esi + 0x6c], eax
push dword [esi + 0x64]
push dword [esi + 0x44]
call ebx
mov dword [esi + 0x54], eax
push edi
lea eax, [esi + 0x60]
push edi
push eax
push edi
push dword [esi + 0x68]
push dword [esi + 0x44]
call ebx
mov dword [esi + 0x58], eax
push edi
lea eax, [esi + 0x78]
push edi
push eax
push edi
push dword [esi + 0x68]
push dword [esi + 0x44]
call ebx
push dword [esi + 0x58]
mov ebx, dword [0x1001be6c]
mov dword [esi + 0x84], eax
push dword [esi + 0x4c]
call ebx
push dword [esi + 0x54]
push dword [esi + 0x48]
call ebx
push dword [esi + 0x84]
push dword [esi + 0x80]
call ebx
push dword [esi + 0x2c]
lea eax, [esi + 0x34]
push dword [esi + 0x28]
push edi
push edi
push eax
call dword [0x1001becc]
mov eax, dword [esi + 0x68]
mov eax, dword [eax + 0x14]
shl eax, 1
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x68]
xor edx, edx
pop ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0xc]
div dword [esi + 0x2c]
mov dword [esi + 0x20], edi
pop edi
mov dword [esi + 0x74], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x10008f39
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
mov esi, ecx
je 0x1000907f
cmp dword [esi + 0x1c], 0
je 0x1000907f
call fcn.10009442
and dword [esi + 0x20], 0
lea edi, [esi + 4]
push 1
push edi
mov ecx, esi
call fcn.100092d6
lea eax, [ebp - 0xc]
push eax
call dword [0x1001bebc]
lea eax, [ebp - 0xc]
push 8
push eax
mov ecx, esi
call fcn.100092d6
lea ecx, [esi + 0x88]
call fcn.10009088
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
mov ecx, esi
call fcn.100092d6
cmp byte [edi], 2
jne 0x10008fe3
mov eax, dword [esi + 0x68]
mov ecx, esi
push dword [eax + 8]
push dword [eax + 4]
push dword [esi + 0x44]
push dword [esi + 0x80]
call fcn.1000947b
mov eax, dword [esi + 0x68]
mov ecx, esi
push dword [eax + 0x14]
mov eax, dword [esi + 0x20]
add eax, dword [esi + 0x1c]
push eax
push dword [esi + 0x60]
push dword [esi + 0x78]
call fcn.100094c7
add eax, dword [esi + 0x20]
mov dword [ebx], eax
jmp 0x1000907a
mov eax, dword [ebp - 8]
lea edi, [eax - 0x13]
test edi, edi
jge 0x10008fef
xor edi, edi
cmp eax, dword [0x1001cbb4]
je 0x10009008
push edi
mov ecx, esi
call fcn.100090de
test al, al
je 0x10009008
add edi, 0x13
jmp 0x1000900b
mov edi, dword [esi + 0x30]
cmp edi, dword [esi + 0x2c]
jge 0x10009021
push edi
mov ecx, esi
call fcn.100090de
test al, al
je 0x10009003
add edi, 0x13
jmp 0x10009003
mov eax, dword [ebp - 8]
push 0x13
mov dword [0x1001cbb4], eax
mov eax, dword [esi + 0x30]
add eax, 3
pop ecx
cdq
idiv ecx
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x30], edx
mov dword [ebx], eax
lea ebx, [esi + 0x14]
call edi
sub eax, dword [ebx]
cmp eax, dword [esi + 0x18]
jae 0x10009059
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10009046
push str.InterlockedExchange
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
call edi
push eax
push ebx
call dword [ebp - 4]
mov eax, dword [esi + 0x1c]
jmp 0x10009081
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100096aa
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x1001bdd4]
test eax, eax
je 0x10009706
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push 0
call dword [0x1001bdd8]
push 0
push 0
lea eax, [ebp - 0x14]
push 0x10
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [0x1001bd80]
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
inc eax
leave
ret
Function at 0x10009708
Capabilities:
Acquire debug privileges
Print debug messages

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
call fcn.100096aa
mov ebp, str.SeDebugPrivilege
push 1
push ebp
call fcn.1000a0f4
pop ecx
pop ecx
push 0xf003f
push 0
push 0
call dword [0x1001be10]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, eax
test ebx, ebx
jne 0x1000974c
push str.OpenSCManager_Error_n
call esi
push dword [esp + 0x22c]
lea eax, [esp + 0x38]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [esp + 0x38]
pop ecx
push eax
call esi
lea eax, [esp + 0x34]
push 0xf01ff
push eax
push ebx
call dword [0x1001be14]
mov edi, eax
test edi, edi
jne 0x10009784
push str.OpenService_error__n
call esi
lea eax, [esp + 0x18]
push eax
push edi
call dword [0x1001be18]
test eax, eax
jne 0x1000979b
push str.QueryServiceStatus_error__n
call esi
push ebx
call dword [0x1001bdc8]
mov dword [esp + 0x10], eax
xor eax, eax
cmp dword [esp + 0x10], eax
jne 0x100097c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41f
je 0x100097c2
push str.LockServiceDatabase_
call esi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push edi
call dword [0x1001bdcc]
test eax, eax
jne 0x100097e3
push str.ChangeServiceConfig_error__n
jmp 0x100097e8
push 0x10019dd8
call esi
push dword [esp + 0x10]
call dword [0x1001bdd0]
push edi
mov edi, dword [0x1001be24]
call edi
push ebx
call edi
push 0
push ebp
call fcn.1000a0f4
pop ecx
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x14]
call fcn.1000964c
push 0x10019dcc
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 8
Function at 0x1000982f
Capabilities:
Acquire debug privileges
Print debug messages

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
call fcn.100096aa
mov ebp, str.SeDebugPrivilege
push 1
push ebp
call fcn.1000a0f4
pop ecx
pop ecx
push 0xf003f
push 0
push 0
call dword [0x1001be10]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, eax
test ebx, ebx
jne 0x10009873
push str.OpenSCManager_Error_n
call esi
push dword [esp + 0x22c]
lea eax, [esp + 0x38]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [esp + 0x38]
pop ecx
push eax
call esi
lea eax, [esp + 0x34]
push 0xf01ff
push eax
push ebx
call dword [0x1001be14]
mov edi, eax
test edi, edi
jne 0x100098ab
push str.OpenService_error__n
call esi
lea eax, [esp + 0x18]
push eax
push edi
call dword [0x1001be18]
test eax, eax
jne 0x100098c2
push str.QueryServiceStatus_error__n
call esi
push ebx
call dword [0x1001bdc8]
mov dword [esp + 0x10], eax
xor eax, eax
cmp dword [esp + 0x10], eax
jne 0x100098eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41f
je 0x100098e9
push str.LockServiceDatabase_
call esi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push edi
call dword [0x1001bdcc]
test eax, eax
jne 0x1000990a
push str.ChangeServiceConfig_error__n
jmp 0x1000990f
push 0x10019e80
call esi
push dword [esp + 0x10]
call dword [0x1001bdd0]
push edi
mov edi, dword [0x1001be24]
call edi
push ebx
call edi
push 0
push ebp
call fcn.1000a0f4
pop ecx
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x14]
call fcn.1000964c
push 0x10019dcc
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 8
Function at 0x10009956
Capabilities:
Acquire debug privileges
Print debug messages

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
call fcn.100096aa
mov ebp, str.SeDebugPrivilege
push 1
push ebp
call fcn.1000a0f4
pop ecx
pop ecx
push 0xf003f
push 0
push 0
call dword [0x1001be10]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, eax
test ebx, ebx
jne 0x1000999a
push str.OpenSCManager_Error_n
call esi
push dword [esp + 0x22c]
lea eax, [esp + 0x38]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [esp + 0x38]
pop ecx
push eax
call esi
lea eax, [esp + 0x34]
push 0xf01ff
push eax
push ebx
call dword [0x1001be14]
mov edi, eax
test edi, edi
jne 0x100099d2
push str.OpenService_error__n
call esi
lea eax, [esp + 0x18]
push eax
push edi
call dword [0x1001be18]
test eax, eax
jne 0x100099e9
push str.QueryServiceStatus_error__n
call esi
push ebx
call dword [0x1001bdc8]
mov dword [esp + 0x10], eax
xor eax, eax
cmp dword [esp + 0x10], eax
jne 0x10009a12
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41f
je 0x10009a10
push str.LockServiceDatabase_
call esi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push edi
call dword [0x1001bdcc]
test eax, eax
jne 0x10009a31
push str.ChangeServiceConfig_error__n
jmp 0x10009a36
push 0x10019dd8
call esi
push dword [esp + 0x10]
call dword [0x1001bdd0]
push edi
mov edi, dword [0x1001be24]
call edi
push ebx
call edi
push 0
push ebp
call fcn.1000a0f4
pop ecx
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x14]
call fcn.1000964c
push 0x10019dcc
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 8
Function at 0x10009a7d
Capabilities:
Acquire debug privileges
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.100096aa
mov ebx, str.SeDebugPrivilege
push 1
push ebx
call fcn.1000a0f4
pop ecx
pop ecx
push 0xf003f
push 0
push 0
call dword [0x1001be10]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10009ac3
push str.OpenSCManager_Error_n
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x218]
pop ecx
push eax
call esi
lea eax, [ebp - 0x218]
push 0xf01ff
push eax
push dword [ebp - 4]
call dword [0x1001be14]
mov edi, eax
test edi, edi
jne 0x10009aff
push str.OpenService_error__n
call esi
lea eax, [ebp - 0x24]
push eax
push edi
call dword [0x1001be18]
test eax, eax
jne 0x10009b15
push str.QueryServiceStatus_error__n
call esi
cmp dword [ebp - 0x20], 1
je 0x10009b33
lea eax, [ebp - 0x24]
push eax
push 1
push edi
call dword [0x1001be1c]
test eax, eax
jne 0x10009b33
push 0x10019eb8
call esi
push edi
call dword [0x1001be20]
test eax, eax
jne 0x10009b45
push 0x10019ea8
jmp 0x10009b4a
push 0x10019e98
call esi
push edi
mov edi, dword [0x1001be24]
call edi
push dword [ebp - 4]
call edi
push 0
push ebx
call fcn.1000a0f4
pop ecx
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 8]
call fcn.1000964c
push 0x10019dcc
call esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10009b82
Capabilities:
Acquire debug privileges
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.100096aa
mov ebx, str.SeDebugPrivilege
push 1
push ebx
call fcn.1000a0f4
pop ecx
pop ecx
push 0xf003f
push 0
push 0
call dword [0x1001be10]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10009bc8
push str.OpenSCManager_Error_n
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x218]
pop ecx
push eax
call esi
lea eax, [ebp - 0x218]
push 0xf01ff
push eax
push dword [ebp - 4]
call dword [0x1001be14]
mov edi, eax
test edi, edi
jne 0x10009c04
push str.OpenService_error__n
call esi
lea eax, [ebp - 0x24]
push eax
push edi
call dword [0x1001be18]
test eax, eax
jne 0x10009c1a
push str.QueryServiceStatus_error__n
call esi
cmp dword [ebp - 0x20], 1
je 0x10009c3f
lea eax, [ebp - 0x24]
push eax
push 1
push edi
call dword [0x1001be1c]
test eax, eax
jne 0x10009c38
push 0x10019eb8
jmp 0x10009c44
push 0x10019ed8
jmp 0x10009c44
push 0x10019ec8
call esi
push edi
mov edi, dword [0x1001be24]
call edi
push dword [ebp - 4]
call edi
push 0
push ebx
call fcn.1000a0f4
pop ecx
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 8]
call fcn.1000964c
push 0x10019dcc
call esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10009c7c
Capabilities:
Acquire debug privileges
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.100096aa
mov ebx, str.SeDebugPrivilege
push 1
push ebx
call fcn.1000a0f4
pop ecx
pop ecx
push 0xf003f
push 0
push 0
call dword [0x1001be10]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10009cc2
push str.OpenSCManager_Error_n
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x218]
pop ecx
push eax
call esi
lea eax, [ebp - 0x218]
push 0xf01ff
push eax
push dword [ebp - 4]
call dword [0x1001be14]
mov edi, eax
test edi, edi
jne 0x10009cfe
push str.OpenService_error__n
call esi
lea eax, [ebp - 0x24]
push eax
push edi
call dword [0x1001be18]
test eax, eax
jne 0x10009d14
push str.QueryServiceStatus_error__n
call esi
cmp dword [ebp - 0x20], 1
jne 0x10009d37
push 0
push 0
push edi
call dword [0x1001bddc]
test eax, eax
jne 0x10009d30
push 0x10019f08
jmp 0x10009d3c
push 0x10019ef8
jmp 0x10009d3c
push 0x10019ee8
call esi
push edi
mov edi, dword [0x1001be24]
call edi
push dword [ebp - 4]
call edi
push 0
push ebx
call fcn.1000a0f4
pop ecx
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 8]
call fcn.1000964c
push 0x10019dcc
call esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1000a7fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.1000a6ca
pop ecx
xor edx, edx
test eax, eax
pop ecx
jle 0x1000a831
mov ecx, dword [ebp - 4]
add byte [ecx + edx], 0x7a
add ecx, edx
mov ecx, dword [ebp - 4]
xor byte [ecx + edx], 0x19
add ecx, edx
inc edx
cmp edx, eax
jl 0x1000a81a
mov eax, dword [ebp - 4]
leave
ret
Function at 0x1000ac10
Capabilities:
Print debug messages

Disassembly:
push ebx
push ebp
push esi
push edi
push str.lstrcatA
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.360tray.exe
mov edi, eax
call fcn.1000c283
xor ebp, ebp
pop ecx
test eax, eax
mov esi, 0x1001c35c
mov ebx, 0x100191b8
je 0x1000ac6f
push 0x1001a150
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 4
push ebp
push str.360tray.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x1001a144
push esi
call edi
push ebx
push esi
call edi
push str.avp.exe
call fcn.1000c283
test eax, eax
pop ecx
je 0x1000ac9a
push 4
push ebp
push str.avp.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x1001a134
push esi
call edi
push ebx
push esi
call edi
push str.KvMonXP.exe
call fcn.1000c283
test eax, eax
pop ecx
je 0x1000acc5
push 4
push ebp
push str.KvMonXP.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x1001a120
push esi
call edi
push ebx
push esi
call edi
push str.RavMonD.exe
call fcn.1000c283
test eax, eax
pop ecx
je 0x1000acf0
push 4
push ebp
push str.RavMonD.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x1001a10c
push esi
call edi
push ebx
push esi
call edi
push str.360sd.exe
call fcn.1000c283
test eax, eax
pop ecx
je 0x1000ad1b
push 4
push ebp
push str.360sd.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.360
push esi
call edi
push ebx
push esi
call edi
push str.Mcshield.exe
call fcn.1000c283
test eax, eax
pop ecx
je 0x1000ad46
push 4
push ebp
push str.Mcshield.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x1001a0e0
push esi
call edi
push ebx
push esi
call edi
push str.egui.exe
call fcn.1000c283
test eax, eax
pop ecx
je 0x1000ad71
push 4
push ebp
push str.egui.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.NOD32
push esi
call edi
push ebx
push esi
call edi
push str.kxetray.exe
call fcn.1000c283
test eax, eax
pop ecx
je 0x1000ad9c
push 4
push ebp
push str.kxetray.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x1001a0b8
push esi
call edi
push ebx
push esi
call edi
push str.knsdtray.exe
call fcn.1000c283
test eax, eax
pop ecx
je 0x1000adc7
push 4
push ebp
push str.knsdtray.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x1001a0a0
push esi
call edi
push ebx
push esi
call edi
push str.TMBMSRV.exe
call fcn.1000c283
test eax, eax
pop ecx
je 0x1000adf2
push 4
push ebp
push str.TMBMSRV.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x1001a08c
push esi
call edi
push ebx
push esi
call edi
push str.avcenter.exe
call fcn.1000c283
test eax, eax
pop ecx
je 0x1000ae1d
push 4
push ebp
push str.avcenter.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.avira
push esi
call edi
push ebx
push esi
call edi
push str.ashDisp.exe
call fcn.1000c283
test eax, eax
pop ecx
je 0x1000ae48
push 4
push ebp
push str.ashDisp.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.avast
push esi
call edi
push ebx
push esi
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1000ae4f
Capabilities:
Check os version
Get disk information
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
and byte [ebp - 0x112], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
lea eax, [ebp - 0x1fc]
mov edi, 0x9c
push eax
mov byte [ebp - 0x200], 0x66
mov dword [ebp - 0x1fc], edi
call esi
lea eax, [ebp - 0x39c]
push 0x100
push eax
push dword [ebp + 8]
call fcn.1000ab22
push 0x10
lea eax, [ebp - 0x30]
pop ebx
push ebx
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 0xa8]
call dword [0x1001bfd8]
lea eax, [ebp - 0x2c]
push 4
push eax
lea eax, [ebp - 0x148]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x39c]
push 0x32
push eax
lea eax, [ebp - 0x144]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x18
call fcn.1000aaa0
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x29c]
push eax
mov dword [ebp - 0x29c], edi
call esi
cmp dword [ebp - 0x298], 5
jne 0x1000af40
cmp dword [ebp - 0x294], 0
jne 0x1000af40
push str.lstrcpyA
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x15c]
push 0x100198f4
push ecx
call eax
jmp 0x1000af65
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x80]
lea eax, [ebp - 0x15c]
push 0x10019d38
push eax
call dword [0x1001bf30]
add esp, 0xc
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
push 0x14
pop ecx
call fcn.10013700
xor ebx, ebx
xor esi, esi
xor edi, edi
and dword [ebp - 4], ebx
mov dword [ebp - 0x10c], eax
mov al, byte [ebp - 4]
and byte [ebp - 0x11], 0
add al, 0x42
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x12], 0x5c
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x1000afe4
lea eax, [ebp - 0x20]
push 0
push eax
lea eax, [ebp - 0x14]
push 0
push eax
call dword [0x1001ccc8]
test eax, eax
je 0x1000afe4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add edi, eax
push 0x14
adc ebx, ecx
pop ecx
mov eax, edi
mov edx, ebx
call fcn.10013700
mov esi, eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jl 0x1000af93
and dword [ebp - 4], 0
mov dword [ebp - 8], esi
fild qword [ebp - 8]
call sub.MSVCRT.dll__ftol
mov dword [ebp - 0x108], eax
call fcn.1000aaed
mov byte [ebp - 0x112], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x110], eax
call fcn.1000ac10
push eax
lea eax, [ebp - 0xe4]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x104]
push 0x20
push eax
push dword [ebp + 8]
call fcn.1000aba2
mov ecx, dword [ebp + 0xc]
add esp, 0x14
lea eax, [ebp - 0x200]
push 0x16c
push eax
call fcn.10002223
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b7fa
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0xc
push esi
push 1
mov dword [esp + 8], ecx
push str.SeDebugPrivilege
call fcn.1000bb1f
xor esi, esi
pop ecx
cmp dword [esp + 0x1c], esi
pop ecx
jbe 0x1000b877
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, str.KERNEL32.dll
push str.TerminateProcess
push ebp
call ebx
push eax
call edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push dword [esi + eax]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
mov dword [esp + 0x20], eax
call dword [esp + 0x1c]
push str.CloseHandle
push ebp
call ebx
push eax
call edi
push dword [esp + 0x18]
call eax
add esi, 4
cmp esi, dword [esp + 0x24]
jb 0x1000b82c
pop edi
pop ebp
pop ebx
push 0
push str.SeDebugPrivilege
call fcn.1000bb1f
pop ecx
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 4]
call fcn.1000b61e
mov ecx, dword [esp + 4]
call fcn.1000b678
pop esi
add esp, 0xc
ret 8