joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e240
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov dword [ebp - 0x484], ecx
mov eax, dword [ebp - 0x484]
cmp dword [eax + 8], 0
je 0x1002e275
mov ecx, dword [ebp - 0x484]
mov eax, dword [ecx + 4]
jmp 0x1002e364
mov word [ebp - 0x480], 0
push 0x3fe
push 0
lea edx, [ebp - 0x47e]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov cx, word [ebp - 0x480]
mov word [ebp - 4], cx
mov ecx, 0xf
mov esi, str.C:WindowsSystem32_ntdll.dll
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xe
mov esi, str.C:WinNTSystem32_ntdll.dll
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
mov dx, word [ebp - 4]
mov word [ebp - 0x44], dx
mov ax, word [ebp - 4]
mov word [ebp - 0x7c], ax
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1002e31e
lea edx, [ebp - 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1002e31e
mov eax, dword [ebp - 0x484]
mov dword [eax + 8], 1
mov ecx, dword [ebp - 0x484]
mov dword [ecx + 4], 1
mov eax, 1
jmp 0x1002e364
call fcn.1002dd00
test eax, eax
je 0x1002e348
mov edx, dword [ebp - 0x484]
mov dword [edx + 8], 1
mov eax, dword [ebp - 0x484]
mov dword [eax + 4], 1
mov eax, 1
jmp 0x1002e364
mov ecx, dword [ebp - 0x484]
mov dword [ecx + 8], 1
mov edx, dword [ebp - 0x484]
mov dword [edx + 4], 0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret
Function at 0x1002eec0
Capabilities:
Unload driver

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
push str.RegistryMachineSystemCurrentControlSetServicesddmdrv
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea ecx, [ebp - 8]
push ecx
call sub.ntdll.dll_NtUnloadDriver
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x1002ef1f
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x14], eax
push 0xb0
push 0x10041a28
call fcn.1002e090
add esp, 8
push eax
push str._s:_Failed_to_NtUnloadDriver.
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
xor eax, eax
jmp 0x1002ef24
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1002ef30
Capabilities:
Install driver

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
push 0x100418b8
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0xa
call fcn.1002db10
add esp, 4
test eax, eax
jge 0x1002ef8b
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x14], eax
push 0x94
push 0x10041930
call fcn.1002e090
add esp, 8
push eax
push str._s:_Failed_to_EnablePrivilege_SE_LOAD_DRIVER_PRIVILEGE__in_LoadDrive.
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x1002efe7
lea edx, [ebp - 8]
push edx
call sub.ntdll.dll_NtLoadDriver
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xc000010e
jne 0x1002efa7
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jge 0x1002efe2
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x18], eax
push 0xa0
push 0x10041988
call fcn.1002e090
add esp, 8
push eax
push str._s:_Failed_to_NtLoadDriver.
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
xor eax, eax
jmp 0x1002efe7
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1002eff0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x1002f075
push 0x383
push 0x10042170
call fcn.1002e090
add esp, 8
push eax
push str.GetFileAttributesW_pFile__INVALID_FILE_ATTRIBUTES
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100026a0
add esp, 0xc
jmp 0x1002f119
lea edx, [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1002f0c9
push 0x385
push 0x100421b0
call fcn.1002e090
add esp, 8
push eax
push str.AllocateAndInitializeSid_SIDAuthWorld__1__SECURITY_WORLD_RID__0__0__0__0__0__0__0__pSIDEveryone_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100026a0
add esp, 0xc
jmp 0x1002f119
push 0
push 2
push 0x10000000
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.1002db70
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x14], eax
jne 0x1002f119
push 0x38c
push str..._sys.cpp
call fcn.1002e090
add esp, 8
push eax
push str.AddAceToObjectsSecurityDescriptor_pFile___SE_FILE_OBJECT____LPTSTR_pSIDEveryone___TRUSTEE_IS_SID___GENERIC_ALL___SET_ACCESS___NO_INHERITANCE_ERROR_SUCCESS
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100026a0
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret 4
Function at 0x1002f8a0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 4], 0
mov word [ebp - 0x220], 0
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x268]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x268], 0x44
mov eax, dword [ebp + 8]
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x22c], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x23c]
or eax, 0x101
mov dword [ebp - 0x23c], eax
mov cx, word [ebp - 0x238]
mov word [ebp - 0x238], cx
push str.cmd.exe__k
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.ntdll.dll_wcscpy]
add esp, 8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x268]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [ebp - 0x220]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002f98c
jmp 0x1002f9a5
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x1002f9a8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret 8
Function at 0x1002f9c0
Capabilities:
Read file on windows
Read pipe
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8001c
call fcn.10010670
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x8001c], ecx
mov dword [ebp - 0x80014], 0
mov dword [ebp - 0x80018], 0
mov dword [ebp - 0x80010], 0
mov dword [ebp - 0x8000c], 0
lea eax, [ebp - 0x8000c]
push eax
lea ecx, [ebp - 0x80010]
push ecx
lea edx, [ebp - 0x80014]
push edx
push 0x80000
lea eax, [ebp - 0x80008]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1002fadb
cmp dword [ebp - 0x80014], 0
je 0x1002fad7
push 0
lea edx, [ebp - 0x80014]
push edx
push 0x80000
lea eax, [ebp - 0x80008]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002fa71
cmp dword [ebp - 0x80014], 0
jne 0x1002fa73
jmp 0x1002faeb
mov edx, dword [ebp - 0x80014]
push edx
lea eax, [ebp - 0x80008]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x80014]
mov dword [edx], eax
mov ecx, dword [ebp - 0x8001c]
cmp dword [ecx], 0xffffffff
je 0x1002fad1
push 0
lea edx, [ebp - 0x80018]
push edx
mov eax, dword [ebp - 0x80014]
push eax
lea ecx, [ebp - 0x80008]
push ecx
mov edx, dword [ebp - 0x8001c]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002facf
jmp 0x1002faeb
jmp 0x1002fad5
xor eax, eax
jmp 0x1002faf0
jmp 0x1002fad9
jmp 0x1002faeb
jmp 0x1002fae6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002fa05
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1002fb00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x1002fb13
xor eax, eax
jmp 0x1002fb44
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1002fb3b
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jne 0x1002fb39
jmp 0x1002fb3f
jmp 0x1002fb3d
jmp 0x1002fb3f
jmp 0x1002fb13
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002fb50
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1002fb8a
xor eax, eax
jmp 0x1002fbcc
push 2
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x1002fbe0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1002fc1a
xor eax, eax
jmp 0x1002fc5c
push 2
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1002fd50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x20c], 0
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea eax, [ebp - 0x207]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0
push 0
push 0
mov ecx, dword [ebp - 0x218]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x200
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp - 0x218]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002fdd6
xor eax, eax
jmp 0x1002fed8
movzx ecx, byte [ebp - 0xa]
cmp ecx, 0x55
jne 0x1002fdeb
movzx edx, byte [ebp - 9]
cmp edx, 0xaa
je 0x1002fdf2
xor eax, eax
jmp 0x1002fed8
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x210], ecx
jmp 0x1002fe12
mov edx, dword [ebp - 0x210]
add edx, 1
mov dword [ebp - 0x210], edx
cmp dword [ebp - 0x210], 4
jge 0x1002fed6
mov eax, dword [ebp - 0x210]
shl eax, 4
lea ecx, [ebp + eax - 0x4a]
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x218]
mov eax, dword [edx + 0x10]
add eax, 1
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x214]
movzx eax, byte [edx + 4]
test eax, eax
je 0x1002fe8f
mov ecx, dword [ebp - 0x214]
movzx edx, byte [ecx + 4]
cmp edx, 0xf
je 0x1002fe8f
mov eax, dword [ebp - 0x214]
movzx ecx, byte [eax + 4]
cmp ecx, 5
je 0x1002fe8f
push 0x10
mov edx, dword [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, 1
jmp 0x1002fed8
mov ecx, dword [ebp - 0x214]
movzx edx, byte [ecx + 4]
cmp edx, 0xf
je 0x1002fead
mov eax, dword [ebp - 0x214]
movzx ecx, byte [eax + 4]
cmp ecx, 5
jne 0x1002fed1
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 8]
mov dword [edx + 0xc], ecx
jmp 0x1002fe03
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret 4

Function at 0x1002ff80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x1002ffba
mov eax, 1
jmp 0x1002ffbc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret
Function at 0x1002ffd0
Capabilities:
Create service
Get common file path
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x10042904
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], 0
cmp dword [ebp - 0x214], 0
je 0x1003001f
push 0x10042920
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x10030030
push 0
call dword [ebp - 0x218]
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003017e
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
movzx ecx, word [ebp + eax*2 - 0x212]
cmp ecx, 0x5c
je 0x100300d6
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
movzx eax, word [ebp + eax*2 - 0x212]
cmp eax, 0x2f
je 0x100300d6
push 0x10042940
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.ntdll.dll_wcscat]
add esp, 8
push 0x10042944
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ntdll.dll_wcscat]
add esp, 8
push 0xf01ff
push 0x10042970
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x1003015e
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0
push 2
push 1
push 0xf01ff
push 0x10042984
push 0x10042998
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x1003015e
push 0
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp dword [ebp - 0x21c], 0
je 0x10030174
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x218], 0
je 0x1003018f
push 1
call dword [ebp - 0x218]
cmp dword [ebp - 0x214], 0
je 0x100301a5
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret
Function at 0x10030940
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x10032b20
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x10032b5a
mov eax, 1
jmp 0x10032b5c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret

Function at 0x10032b70
Capabilities:
Create service
Get common file path
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 8], eax
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], 0
cmp dword [ebp - 0x214], 0
je 0x10032bbf
push str.Wow64EnableWow64FsRedirection
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x10032bd0
push 0
call dword [ebp - 0x218]
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10032d1e
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
movzx ecx, word [ebp + eax*2 - 0x212]
cmp ecx, 0x5c
je 0x10032c76
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
movzx eax, word [ebp + eax*2 - 0x212]
cmp eax, 0x2f
je 0x10032c76
push 0x10043b28
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.ntdll.dll_wcscat]
add esp, 8
push 0x10043b2c
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ntdll.dll_wcscat]
add esp, 8
push 0xf01ff
push 0x10043b58
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x10032cfe
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0
push 2
push 1
push 0xf01ff
push 0x10043b6c
push str.amwrtdrv
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x10032cfe
push 0
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp dword [ebp - 0x21c], 0
je 0x10032d14
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x218], 0
je 0x10032d2f
push 1
call dword [ebp - 0x218]
cmp dword [ebp - 0x214], 0
je 0x10032d45
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret
Function at 0x10033180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10032fd0
add esp, 0xc
test eax, eax
jne 0x100331d3
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0xc], eax
push 0xb2
push 0x10043c38
call fcn.10032d90
add esp, 8
push eax
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
xor eax, eax
jmp 0x1003322f
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0x200
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
call sub.ntdll.dll__allmul
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10033225
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 0x200
div ecx
test edx, edx
jne 0x10033225
mov dword [ebp - 0x10], 1
jmp 0x1003322c
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10035390
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x1000
mov dword [ebp - 0x18], 0
xor eax, eax
cmp dword [ebp + 8], 0xffffffff
setne al
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x100353f9
push 0x57
push 0x100437c0
call fcn.100352d0
add esp, 8
push eax
push str.h_INVALID_HANDLE_VALUE
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100026a0
add esp, 0xc
jmp 0x100354ea
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1000f6bd
add esp, 4
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x1003545a
push 0x5b
push str...helper.cpp
call fcn.100352d0
add esp, 8
push eax
push str.ReadFile_h__pBuff__Length__ReadLen__NULL_
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.100026a0
add esp, 0xc
jmp 0x100354ea
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
jmp 0x10035473
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jae 0x10035498
mov ecx, dword [ebp - 4]
mov dl, byte [ecx]
push edx
push 1
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
test eax, eax
jne 0x10035496
mov dword [ebp - 0x10], 1
jmp 0x10035498
jmp 0x1003546a
cmp dword [ebp - 0x18], 0
jbe 0x100354ca
cmp dword [ebp - 0x10], 0
jne 0x100354b8
mov eax, dword [ebp - 4]
push eax
push 0x10043824
call dword [sym.imp.MSVCR80.dll_printf]
add esp, 8
jmp 0x100354ca
mov ecx, dword [ebp - 4]
push ecx
push 0x10043828
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 8
push 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1003545a
cmp dword [ebp - 4], 0
je 0x10035509
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219