joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001bc46
Capabilities:
Create process on windows

Disassembly:
push 0x64
mov eax, 0x1007b6a1
call fcn.10063ebe
xor ebx, ebx
push ebx
push 0x1008a578
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebx
je 0x1001bcd8
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1001bcd8
push 0x2001f
push 0x1008a5c4
push reloc.WS2_32.dll_bind
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.1000445a
test eax, eax
jne 0x1001bcad
lea eax, [ebp - 0x1c]
push eax
push 0x1008a5f4
lea eax, [ebp - 0x18]
push eax
call fcn.1000441f
lea esi, [ebp - 0x18]
call fcn.1000448d
cmp dword [ebp - 0x1c], ebx
jbe 0x1001bcc8
push 0x40010
push 0x1008a608
push 0x1008a630
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esi, [ebp - 0x18]
call fcn.1000448d
xor al, al
call fcn.10063f96
ret
mov eax, dword [0x100aa3bc]
mov edi, 0x100aa3bc
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
mov eax, dword [0x100aa3e8]
mov dword [ebp - 0x14], eax
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x1c]
call fcn.100028e3
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1000292d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
mov eax, dword [0x100aa3bc]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
push str._OCPRD124RunOpenCandyDLL_16
mov byte [ebp - 4], 1
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push 0x1008a890
call fcn.100027be
push 0x44
pop esi
push esi
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.1005c860
add esp, 0x1c
xor eax, eax
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x2c]
push ecx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebp - 0x70]
push ecx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x14]
push ebx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x44], 1
mov eax, dword [eax - 0xc]
push ebx
push eax
lea esi, [ebp - 0x14]
call fcn.100028e3
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne byte [ebp - 0xd]
call fcn.1000292d
cmp byte [ebp - 0xd], bl
jne 0x1001bdc2
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.100029ea
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.100029ea
mov al, bl
jmp 0x1001bcd2
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x28]
call esi
mov bl, 1
jmp 0x1001bda5
Function at 0x1001cc39
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
call fcn.1001bfc7
test al, al
jne 0x1001cc50
push 4
pop eax
jmp 0x1001cc6f
xor eax, eax
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x4a
push dword [ebx + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xd
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebx
leave
ret
Function at 0x1001d5b3
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007c4f6
mov eax, dword fs:[0]
push eax
mov eax, 0x114c
call fcn.10061440
mov eax, dword [0x100a82b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.10016053
mov al, byte [eax + 0x141]
xor ebx, ebx
cmp al, bl
jne 0x1001d7dc
push 0x208
lea eax, [ebp - 0x530]
push eax
push dword [0x100aa3e8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, pe_nt_image_headers32
push edi
lea eax, [ebp - 0xf48]
push eax
push edi
lea eax, [ebp - 0x1148]
push eax
push edi
lea eax, [ebp - 0xb40]
push eax
push 3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.1005c075
xor eax, eax
mov word [ebp - 0x220], ax
add esp, 0x24
lea eax, [ebp - 0x18]
push eax
lea esi, [edi + 4]
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.1005ab1d
add esp, 0xc
lea eax, [ebp - 0xb40]
push eax
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.1005ab1d
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x940]
push esi
push eax
call fcn.1005ab9a
add esp, 0xc
push str.OCSetupHlp.nsh
lea eax, [ebp - 0x940]
push esi
push eax
call fcn.1005ab1d
lea eax, [ebp - 0x940]
add esp, 0xc
push eax
call fcn.100076fd
pop ecx
test al, al
jne 0x1001d7dc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xd48]
push esi
push eax
call fcn.1005ab9a
add esp, 0xc
push str.OCAPIUnitTest.exe
lea eax, [ebp - 0xd48]
push esi
push eax
call fcn.1005ab1d
lea eax, [ebp - 0xd48]
add esp, 0xc
push eax
call fcn.100076fd
pop ecx
test al, al
jne 0x1001d7dc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x738]
push esi
push eax
call fcn.1005ab9a
add esp, 0xc
push str.OpenCandy_Why_Is_This_Here.txt
lea eax, [ebp - 0x738]
push esi
push eax
call fcn.1005ab1d
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x530]
push edi
push eax
call fcn.1002a5ca
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
lea esi, [ebp - 0x1158]
call fcn.10026f71
push ebx
mov edi, eax
mov dword [ebp - 4], ebx
call fcn.1002bb0d
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1158], ebx
je 0x1001d775
push dword [ebp - 0x1158]
call fcn.1005a1d0
pop ecx
lea eax, [ebp - 0x328]
push eax
lea esi, [ebp - 0x1150]
call fcn.10026f71
xor ecx, ecx
inc ecx
push ecx
mov edi, eax
mov dword [ebp - 4], ecx
call fcn.1002bb0d
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1150], ebx
je 0x1001d7ad
push dword [ebp - 0x1150]
call fcn.1005a1d0
pop ecx
call fcn.10025a29
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push ebx
lea eax, [ebp - 0x738]
push eax
call esi
push 4
push ebx
lea eax, [ebp - 0x530]
push eax
call esi
push 4
push ebx
lea eax, [ebp - 0xb40]
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10059ccb
leave
ret
Function at 0x1001dc35
Capabilities:
Create process on windows

Disassembly:
push 0x78
mov eax, 0x1007b650
call fcn.10063ebe
mov ebx, dword [ebp + 8]
call fcn.1001bfc7
test al, al
je 0x1001ddd8
mov eax, dword [0x100aa3bc]
mov edi, 0x100aa3bc
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x100aa3e8]
mov dword [ebp - 0x20], eax
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x18]
call fcn.100028e3
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1000292d
mov eax, dword [0x100aa3bc]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push ebx
push str._OCPRD124RestartDllAsAdmin_16
mov byte [ebp - 4], 1
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push str.RunDll32.exe___s___s__d
call fcn.100027be
push 0x44
pop esi
push esi
lea eax, [ebp - 0x84]
push ebx
push eax
call fcn.1005c860
add esp, 0x1c
xor eax, eax
mov word [ebp - 0x54], ax
lea ecx, [ebp - 0x40]
push ecx
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebp - 0x84]
push ecx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x14]
push ebx
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x58], 1
mov eax, dword [eax - 0xc]
push ebx
push eax
lea esi, [ebp - 0x14]
call fcn.100028e3
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne byte [ebp - 0xd]
call fcn.1000292d
cmp byte [ebp - 0xd], bl
je 0x1001ddc2
mov eax, dword [0x100aa3bc]
mov esi, dword [ebp - 0x38]
mov ecx, 0x100aa3bc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
push esi
push 0x1008b200
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.100027be
mov edi, dword [ebp - 0x1c]
pop ecx
pop ecx
push 0xfde9
lea eax, [ebp - 0x20]
push eax
push ecx
add edi, 0xfffffff0
mov eax, edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], esp
mov esi, esp
call fcn.1000296d
add eax, 0x10
mov dword [esi], eax
call fcn.10006e80
mov esi, eax
mov eax, dword [ebp - 0x20]
add esp, 0xc
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 8]
push ebx
push 0x4a
push dword [eax + 8]
mov dword [ebp - 0x30], 0x22
mov dword [ebp - 0x28], esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, ebx
je 0x1001ddab
push esi
call fcn.1005a1d0
pop ecx
push dword [ebp - 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x3c]
call esi
mov eax, edi
call fcn.100029ea
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.100029ea
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.100029ea
call fcn.10063f96
ret 4
Function at 0x10025c28
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x23c
mov eax, 0x1007f0de
call fcn.10063f27
mov eax, dword [ebp + 8]
mov dword [ebp - 0x248], eax
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21c]
push eax
xor edi, edi
push edi
push edi
push 0x801a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
setge bl
test bl, bl
je 0x10025ead
push str.OpenCandy_
mov esi, 0x104
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.1005ab1d
add esp, 0xc
cmp byte [ebp + 0xc], 0
lea eax, [ebp - 0x21c]
je 0x10025c9a
push str.B8DCC36F_4F05_445F_B1EE_FD8FC38CBBDA
jmp 0x10025c9f
push str.16282F95_E0BC_4589_B27D_3A41D9261168
push esi
push eax
call fcn.1005ab1d
add esp, 0xc
mov dword [ebp - 0x220], edi
push 1
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 4], edi
call fcn.10008c89
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
je 0x10025e99
lea eax, [ebp - 0x220]
push eax
lea esi, [ebp - 0x22c]
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], edi
call fcn.10008c53
mov edi, dword [ebp - 0x22c]
lea eax, [edi + 1]
push eax
call fcn.10059bd9
pop ecx
mov esi, eax
push edi
push esi
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x238], esi
mov byte [esi], 0
call fcn.10008c16
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
cmp dword [ebp - 0x220], 0
je 0x10025d40
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x220], 0
test bl, bl
je 0x10025e7e
and dword [ebp - 0x22c], 0
and dword [ebp - 0x228], 0
mov byte [edi + esi], 0
push 1
lea edi, [ebp - 0x22c]
mov byte [ebp - 4], 1
call fcn.1000d8a9
test al, al
je 0x10025e6f
push esi
mov eax, edi
call fcn.1000e07b
test al, al
je 0x10025e6f
push ecx
mov eax, esp
mov dword [ebp - 0x230], esp
push eax
mov edi, str.OfferId
call fcn.100022a8
push ecx
mov eax, esp
mov dword [ebp - 0x244], esp
push eax
mov edi, str.Offer
mov byte [ebp - 4], 2
call fcn.100022a8
lea eax, [ebp - 0x22c]
push eax
lea ebx, [ebp - 0x224]
mov byte [ebp - 4], 1
call fcn.1000d910
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x224]
push dword [eax - 0xc]
mov esi, ebx
call fcn.100028e3
push eax
lea esi, [ebp - 0x240]
call fcn.1002700b
mov esi, ebx
mov byte [ebp - 4], 4
call fcn.1000292d
lea esi, [ebp - 0x234]
call fcn.10026f5a
push ecx
push ecx
lea eax, [ebp - 0x240]
mov esi, esp
mov dword [ebp - 0x244], esp
push eax
mov byte [ebp - 4], 5
call fcn.10026fc8
push 1
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x248]
call fcn.10022ffd
mov byte [ebp - 4], 4
cmp dword [ebp - 0x234], 0
je 0x10025e42
push dword [ebp - 0x234]
call fcn.1005a1d0
pop ecx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x240], 0
je 0x10025e5b
push dword [ebp - 0x240]
call fcn.1005a1d0
pop ecx
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
call fcn.100029ea
mov esi, dword [ebp - 0x238]
lea edi, [ebp - 0x22c]
mov byte [ebp - 4], 0
call fcn.1000d7af
push esi
call fcn.1005a1d0
pop ecx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
xor edi, edi
cmp dword [ebp - 0x220], edi
je 0x10025ead
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
call fcn.10063faa
ret 8
Function at 0x10025eb7
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100a82b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
setge byte [ebp - 0x20d]
cmp byte [ebp - 0x20d], bl
je 0x10025f60
push esi
push str.OpenCandy_
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.1005ab1d
add esp, 0xc
lea eax, [ebp - 0x20c]
cmp byte [ebp + 8], bl
je 0x10025f29
push str.B8DCC36F_4F05_445F_B1EE_FD8FC38CBBDA
jmp 0x10025f2e
push str.16282F95_E0BC_4589_B27D_3A41D9261168
push esi
push eax
call fcn.1005ab1d
lea eax, [ebp - 0x20c]
add esp, 0xc
push eax
call fcn.100076fd
pop ecx
pop esi
test al, al
je 0x10025f60
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne byte [ebp - 0x20d]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x20d]
xor ecx, ebp
pop ebx
call fcn.10059ccb
leave
ret 4
Function at 0x1002850e
Capabilities:
Create thread
Resume thread

Disassembly:
push 8
mov eax, 0x1007a3fa
call fcn.10063ebe
cmp byte [0x100aba30], 0
jne 0x10028528
call fcn.10028215
cmp byte [edi + 0x24], 0
je 0x10028540
mov esi, edi
call fcn.10028c06
push 0xffffffffffffffff
push dword [edi + 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp + 0x18]
xor ebx, ebx
cmp eax, ebx
je 0x1002854c
mov dword [edi + 0xc], eax
mov esi, 0x1000
cmp dword [edi + 0x28], esi
jae 0x10028571
mov eax, dword [edi + 0x60]
cmp eax, ebx
je 0x10028564
push eax
call fcn.1005a0d8
pop ecx
push esi
call fcn.1005a7d9
pop ecx
mov dword [edi + 0x60], eax
mov dword [edi + 0x28], esi
mov byte [edi + 0x24], 1
mov dword [edi + 0x2c], ebx
call fcn.1003f1bc
push 0x10028366
mov esi, eax
push 0x4e2b
push esi
call fcn.1003f1ee
add esp, 0xc
push edi
push 0x2711
push esi
call fcn.1003f1ee
add esp, 0xc
cmp dword [ebp + 0x10], ebx
je 0x100285b4
push dword [ebp + 0x10]
push 0x4e
push esi
call fcn.1003f1ee
add esp, 0xc
push 0x100282c5
push 0x4e58
push esi
call fcn.1003f1ee
add esp, 0xc
push edi
push 0x2749
push esi
call fcn.1003f1ee
add esp, 0xc
push ebx
push 0x2b
push esi
call fcn.1003f1ee
add esp, 0xc
push edi
push 0x272d
push esi
call fcn.1003f1ee
add esp, 0xc
push 0x100283f6
push 0x4e6f
push esi
call fcn.1003f1ee
add esp, 0xc
push 1
push 0x34
push esi
call fcn.1003f1ee
add esp, 0xc
push dword [ebp + 8]
mov ecx, 0x100aba78
call fcn.10029084
cmp eax, ebx
je 0x10028631
push eax
push 0x2714
push esi
call fcn.1003f1ee
add esp, 0xc
push dword [ebp + 8]
push 0x2712
push esi
call fcn.1003f1ee
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [edi + 0x20], eax
lea eax, [edi + 0x5c]
push eax
push 4
push edi
push 0x10028483
push ebx
push ebx
mov dword [edi + 0x74], esi
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
call fcn.1005b758
add esp, 0x18
push eax
mov dword [edi + 0x58], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [edi + 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 0x58]
mov byte [edi + 0x24], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [edi + 0x70]
neg ebx
sbb ebx, ebx
jne 0x1002870c
mov eax, dword [edi + 0x78]
cmp eax, 0xc8
jl 0x100286a2
cmp eax, 0x190
jl 0x1002870c
mov esi, dword [ebp + 0x14]
push 0x10097162
call fcn.10027362
push 0x1000
or ebx, 0xffffffff
call fcn.10059bd9
mov dword [ebp + 0x10], eax
pop ecx
lea eax, [ebp + 0x10]
push eax
mov eax, edi
call fcn.10028723
test al, al
je 0x100286e1
push dword [ebp + 0x10]
call fcn.10027443
push 0x100996d8
call fcn.10027443
lea ecx, [ebp - 0x14]
mov eax, edi
call fcn.10028468
and dword [ebp - 4], 0
push dword [eax]
mov esi, dword [ebp + 0x14]
call fcn.10027443
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x1002870c
push dword [ebp - 0x14]
call fcn.1005a1d0
pop ecx
push dword [edi + 0x74]
call fcn.1003f2a3
and dword [edi + 0x74], 0
pop ecx
mov eax, ebx
call fcn.10063f96
ret 0x14
Function at 0x10028cad
Capabilities:
Acquire debug privileges

Disassembly:
push edi
push str.SeCreateGlobalPrivilege
push esi
call fcn.10028c47
push str.SeBackupPrivilege
push esi
mov edi, eax
call fcn.10028c47
push str.SeCreatePagefilePrivilege
push esi
call fcn.10028c47
push str.SeCreateSymbolicLinkPrivilege
push esi
call fcn.10028c47
push str.SeDebugPrivilege
push esi
call fcn.10028c47
push str.SeImpersonatePrivilege
push esi
call fcn.10028c47
push str.SeIncreaseBasePriorityPrivilege
push esi
call fcn.10028c47
push str.SeIncreaseQuotaPrivilege
push esi
call fcn.10028c47
add esp, 0x40
push str.SeLoadDriverPrivilege
push esi
call fcn.10028c47
push str.SeManageVolumePrivilege
push esi
call fcn.10028c47
push str.SeProfileSingleProcessPrivilege
push esi
call fcn.10028c47
push str.SeRemoteShutdownPrivilege
push esi
call fcn.10028c47
push str.SeRestorePrivilege
push esi
call fcn.10028c47
push str.SeSecurityPrivilege
push esi
call fcn.10028c47
push str.SeSystemEnvironmentPrivilege
push esi
call fcn.10028c47
push str.SeSystemProfilePrivilege
push esi
call fcn.10028c47
add esp, 0x40
push str.SeSystemtimePrivilege
push esi
call fcn.10028c47
push str.SeTakeOwnershipPrivilege
push esi
call fcn.10028c47
add esp, 0x10
mov eax, edi
pop edi
ret
Function at 0x10029063
Capabilities:
Delete file

Disassembly:
push esi
mov esi, eax
cmp byte [esi], 1
jne 0x10029075
lea eax, [esi + 2]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0x20c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop esi
ret
Function at 0x1002a41b
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, eax
lea eax, [edi + 4]
push eax
mov dword [ebp - 8], eax
call fcn.10059bd9
pop ecx
xor ecx, ecx
mov esi, eax
mov dword [esi], 1
cmp dword [ebp + 0x10], ecx
je 0x1002a474
cmp edi, ecx
jbe 0x1002a474
push ebx
push 0x18
mov eax, edi
xor edx, edx
pop ebx
div ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
xor edx, edx
push 0x18
pop ebx
div ebx
mov al, byte [edx + 0x100a996c]
mov edx, dword [ebp + 0x10]
xor al, byte [ecx + edx]
inc ecx
inc dword [ebp - 4]
mov byte [esi + ecx + 3], al
cmp ecx, edi
jb 0x1002a451
pop ebx
push dword [ebp - 8]
push esi
push 3
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call fcn.1005a1d0
pop ecx
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop esi
leave
ret

Function at 0x1002a49b
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
or edi, 0xffffffff
mov esi, eax
cmp dword [ebp + 0x14], ebx
jne 0x1002a501
cmp esi, ebx
je 0x1002a501
mov eax, dword [esi]
add eax, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffffc
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1002a4e6
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
test eax, eax
je 0x1002a59e
xor ecx, ecx
cmp eax, 0xea
setne cl
dec ecx
dec ecx
mov eax, ecx
jmp 0x1002a59e
mov eax, dword [esi]
add eax, 4
mov dword [ebp - 4], eax
je 0x1002a514
push eax
call fcn.10059bd9
pop ecx
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002a57f
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
add edi, 0xfffffffc
xor ecx, ecx
mov dword [esi], edi
cmp eax, ecx
je 0x1002a544
mov edx, dword [ebx]
mov dword [eax], edx
cmp dword [ebp + 0x14], ecx
je 0x1002a57b
cmp edi, ecx
jbe 0x1002a57b
push 0x18
mov eax, edi
xor edx, edx
pop esi
div esi
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
push 0x18
pop esi
div esi
mov al, byte [edx + 0x100a996c]
xor al, byte [ebx + ecx + 4]
mov edx, dword [ebp + 0x14]
mov byte [ecx + edx], al
inc ecx
inc dword [ebp - 8]
cmp ecx, edi
jb 0x1002a559
xor edi, edi
jmp 0x1002a591
cmp eax, 0xea
jne 0x1002a591
mov eax, dword [ebp - 4]
add eax, 0xfffffffc
push 0xfffffffffffffffe
mov dword [esi], eax
pop edi
test ebx, ebx
je 0x1002a59c
push ebx
call fcn.1005a1d0
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002a979
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1074
call fcn.10061440
mov eax, dword [0x100a82b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1070]
call fcn.1003cfcc
push 0x10099de4
push ecx
call fcn.10062eee
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x1002a9c0
mov byte [0x100ab1b4], al
mov eax, 0x100ab1b4
jmp 0x1002aa80
push edi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1018]
push 1
push eax
call fcn.1005e4ee
add esp, 0x10
jmp 0x1002aa00
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1070]
call fcn.1003cff0
push edi
push esi
lea eax, [ebp - 0x1018]
push 1
push eax
call fcn.1005e4ee
add esp, 0x18
test eax, eax
jg 0x1002a9da
lea eax, [ebp - 0x14]
push eax
lea ebx, [ebp - 0x1070]
call fcn.1003d093
push edi
call fcn.1005ff6c
movzx eax, byte [ebp - 5]
push eax
movzx eax, byte [ebp - 6]
push eax
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
movzx eax, byte [ebp - 0xd]
push eax
movzx eax, byte [ebp - 0xe]
push eax
movzx eax, byte [ebp - 0xf]
push eax
movzx eax, byte [ebp - 0x10]
push eax
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
push str._02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x
push 0x21
mov esi, 0x100ab1b4
push esi
call fcn.10060aa9
add esp, 0x54
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10059ccb
leave
ret