joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x45c06c]
test eax, eax
je 0x4291d3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x42914c
cmp dword [eax + 4], 0
mov edi, eax
je 0x42914c
add edi, 8
jmp 0x4291ce
mov eax, dword [0x45c06c]
test eax, eax
je 0x4291e2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4291cc
mov esi, eax
test eax, eax
jne 0x4291a2
movzx eax, byte [0x45ca98]
mov ecx, 0xc
call fcn.0040c250
test eax, eax
je 0x4291fd
mov dword [eax], 0x45c06c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45c06c]
test eax, eax
je 0x4291f1
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4291ce
test ecx, ecx
je 0x4291ce
lock dec dword [ecx]
jne 0x4291ce
call fcn.00429210
jmp 0x4291ce
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45c06c
call fcn.00446e40
jmp 0x429130
mov ecx, 0x45c06c
call fcn.00446e40
jmp 0x42915a
mov ecx, 0x45c06c
call fcn.00446e40
jmp 0x42919a
mov ecx, 4
mov edx, 0xc
call fcn.00446130
ud2
Function at 0x42fce0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.0041f6a0
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test edx, edx
je 0x42fd45
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.0042fc20
mov edi, dword [esp]
test edi, edi
je 0x42fd54
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42fd69
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x42fd61
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0
mov ecx, esp
call fcn.0041f850
mov dword [esi], 0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [esi], 0
je 0x42fd61
mov ecx, edi
mov edx, 2
call fcn.0040c280
jmp 0x42fd61
Function at 0x431f70
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.00437c60
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4378f0
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x1044]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.00438d80
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push 0x429b00
push eax
push 0x1000
push esi
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x4320c4
mov ebx, dword [sym.imp.kernel32.dll_SleepEx]
mov dword [ebp - 0x20], edi
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x431ffa
cmp dword [ebp - 0x2c], 0
jne 0x4320d5
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x4320d5
cmp esi, 0x1000
ja 0x432111
xor edi, edi
nop dword [eax]
mov eax, esi
sub eax, edi
jb 0x4320f7
xorps xmm0, xmm0
lea edx, [ebp - 0x30]
lea ecx, [ebp + edi - 0x1044]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], edx
push 0x429b00
lea edx, [ebp - 0x44]
push edx
push eax
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WriteFileEx]
test eax, eax
je 0x4320cc
nop dword [eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x432070
cmp dword [ebp - 0x2c], 0
jne 0x4320d2
add edi, dword [ebp - 0x28]
cmp edi, esi
jne 0x432030
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
push 0x429b00
lea eax, [ebp - 0x44]
push eax
push 0x1000
lea eax, [ebp - 0x1044]
push eax
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x431ffa
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x4320d5
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, edi
mov edx, esi
push 0x453158
call fcn.00446570
add esp, 4
jmp 0x43212c
mov dword [ebp - 0x10], 0
mov ecx, esi
mov edx, 0x1000
push 0x453158
call fcn.00446360
add esp, 4
ud2
Function at 0x432200
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, esp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], esp
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x44], 0x437910
lea eax, [esi + 0x40]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x40], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x432264
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov edx, esi
lea ecx, [esi + 8]
mov dword [esi + 0x20], 0x453268
mov dword [esi + 0x24], 1
mov dword [esi + 0x30], 0
mov byte [esi], 0
mov dword [esi + 4], eax
mov dword [esi + 0x48], 0
mov dword [esi + 8], edx
mov dword [esi + 0x28], ecx
lea ecx, [esi + 0x20]
mov edx, 0x453294
mov dword [esi + 0xc], fcn.004253e0
mov dword [esi + 0x2c], 1
call fcn.00446250
ud2
Function at 0x436430
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebp, dword [esp + 0x48]
mov ebx, edx
mov edx, dword [ebp + 4]
mov edi, dword [ebp + 8]
mov eax, edx
sub eax, edi
jb 0x4364e2
mov esi, ecx
mov ecx, dword [ebp]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
add ecx, edi
push 0
push 0
push eax
push ecx
push edx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x436490
push 0xffffffffffffffff
push ebx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, 0xc0000011
je 0x4364a8
cmp eax, 0x103
je 0x4364f3
test eax, eax
js 0x4364c3
mov ecx, dword [esp + 8]
add ecx, edi
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 0xc]
cmp eax, ecx
cmova ecx, eax
mov dword [ebp + 0xc], ecx
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
mov edi, eax
call fcn.0041ff80
cmp al, 0xb
je 0x4364b8
mov dword [esi], 0
mov dword [esi + 4], edi
jmp 0x4364bb
mov ecx, edi
push 0x451054
call fcn.00446280
add esp, 4
ud2
mov eax, esp
mov dword [esp + 0x1c], 0x452f20
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0041d2e0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0041d410
mov ecx, 7
int 0x29
ud2

Function at 0x436560
Capabilities:
Delete file

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push dword [esp + 0x28]
call fcn.0041f6a0
add esp, 4
mov ecx, dword [esp]
mov ebx, dword [esp + 4]
mov eax, dword [esp + 8]
test ecx, ecx
je 0x4365c4
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov edx, esp
push 1
call fcn.00426640
add esp, 4
mov edi, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
test edi, edi
je 0x4365c0
push edi
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x4365cb
mov byte [esi], 4
test ebx, ebx
jne 0x4365db
jmp 0x4365e7
mov eax, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], eax
jmp 0x4365e7
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x4365e7
mov ecx, edi
mov edx, 2
call fcn.0040c280
add esp, 0x18
pop esi
pop edi
pop ebx
ret

Function at 0x438389
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x4383c8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4383c8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4383c8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4383c8
cmp dword [ecx + 0x74], 0xe
jbe 0x4383c8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x43f5a3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x43f640
push ebx
push esi
call fcn.0043f56c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043f500
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43f5ed
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43f63f
push edi
push eax
call fcn.004401c0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43f60d
call fcn.0043e061
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43f63e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043f500
add esp, 0x20
test eax, eax
jne 0x43f62c
push edi
call fcn.0043e061
jmp 0x43f634
push ebx
call fcn.0043e061
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x44093d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x455ed0
push 0x455ec8
push str.FlsAlloc
push 0x1f
call fcn.004407fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x440971
push dword [ebp + 8]
mov ecx, esi
call dword [0x4481e4]
call esi
jmp 0x440977
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4409bb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x455ee0
push 0x455ed8
push str.FlsGetValue
push 0x21
call fcn.004407fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4409f2
push dword [ebp + 8]
mov ecx, esi
call dword [0x4481e4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x4409fa
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x455ee8
push 0x455ee0
push str.FlsSetValue
push 0x22
call fcn.004407fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x440a34
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4481e4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsSetValue]
Function at 0x445ea0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x445ecd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x445ecd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x446e40
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x446eb1
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x446eec
cmp dword [esp + 4], 0
je 0x446ed3
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x446f01
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x45ca4c]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x45ca4c], esi
jne 0x446e90
mov byte [0x45ca48], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x446ee3
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x446f44
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x446ed7
mov edi, dword [esp]
jmp 0x446ee3
mov edi, dword [esi]
jmp 0x446ee2
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00446f80
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x453588
mov dword [esp + 8], 0x453550
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x453da0
mov dword [esp + 0x14], 0
call fcn.00446250
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x453550
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x453da0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00446fc0
ud2
Function at 0x10001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x1001f2b8]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
push ebx
xor ebx, ebx
push edi
mov edi, dword [esp + 0x30]
cmp eax, 0xffffffff
je 0x1000102c
cmp dword [0x100201f4], 6
jb 0x10001035
test eax, eax
jne 0x10001035
push eax
call fcn.10015e20
add esp, 4
cmp eax, 0xffffffff
je 0x100010e6
push esi
push eax
call fcn.10011d10
mov esi, eax
add esp, 4
test esi, esi
je 0x10001064
push edi
push esi
call fcn.100115f0
add esp, 8
push esi
mov ebx, eax
call sub.NTDLL.dll_NtClose
test ebx, ebx
jne 0x100010d2
test edi, edi
je 0x100010d2
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0
push 0
push 1
push edi
mov dword [esp + 0x28], 0x690057
mov dword [esp + 0x2c], 0x53006e
mov dword [esp + 0x30], 0x610074
mov dword [esp + 0x34], 0x5c0030
mov dword [esp + 0x38], 0x650044
mov dword [esp + 0x3c], 0x610066
mov dword [esp + 0x40], 0x6c0075
mov dword [esp + 0x44], 0x74
call fcn.1000c950
add esp, 0x1c
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10008464
add esp, 0x24
ret
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10008464
add esp, 0x24
ret
mov ecx, dword [esp + 0x28]
pop edi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.10008464
add esp, 0x24
ret

Function at 0x10001100
Capabilities:
Impersonate user

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
push edi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
xor edi, edi
push edi
push 2
push ecx
push edx
push eax
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
mov esi, eax
test esi, esi
jne 0x10001139
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x52f
jne 0x1000114c
mov edi, 1
test esi, esi
je 0x1000114c
mov ecx, dword [esp + 8]
push ecx
call sub.NTDLL.dll_NtClose
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x1000362c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x10003673
cmp edx, 0x10
jl 0x1000365f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x1000364c
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x10003673
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x1000366b
and edx, 3
cmp edx, 3
jne 0x10003687
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x1000368c
cmp edx, 2
jne 0x10003698
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x1000369d
cmp edx, 1
jne 0x100036a3
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x10008464
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001f2b8]
jne 0x1000846e
repz ret
jmp fcn.100086f0

Function at 0x1000c25a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001f2b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100087f6
and dword [ebp - 0x14], 0
cmp dword [0x10022134], 0
mov dword [ebp - 0x18], eax
jne 0x1000c30d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000c3b5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000c3b5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10022134], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10022138], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1002213c], eax
call edi
push eax
call esi
mov dword [0x10022144], eax
test eax, eax
je 0x1000c30d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10022140], eax
mov eax, dword [0x10022140]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000c366
cmp dword [0x10022144], ecx
je 0x1000c366
push eax
call esi
push dword [0x10022144]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000c366
test ebx, ebx
je 0x1000c366
call edi
test eax, eax
je 0x1000c35d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000c35d
test byte [ebp - 8], 1
jne 0x1000c366
or dword [ebp + 0x10], 0x200000
jmp 0x1000c399
mov eax, dword [0x10022138]
cmp eax, dword [ebp - 0x18]
je 0x1000c399
push eax
call esi
test eax, eax
je 0x1000c399
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000c399
mov eax, dword [0x1002213c]
cmp eax, dword [ebp - 0x18]
je 0x1000c399
push eax
call esi
test eax, eax
je 0x1000c399
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10022134]
call esi
test eax, eax
je 0x1000c3b5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000c3b7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008464
leave
ret
Function at 0x1000c950
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Set environment variable
Terminate process

Disassembly:
sub esp, 0x98
mov eax, dword [0x1001f2b8]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xa8]
push ebx
mov ebx, dword [esp + 0xb4]
push ebp
mov ebp, dword [esp + 0xbc]
push esi
push edi
mov edi, dword [esp + 0xac]
push 0x44
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x28], eax
call sub.NTDLL.dll_RtlZeroMemory
push 0x10
lea edx, [esp + 0x14]
push edx
call sub.NTDLL.dll_RtlZeroMemory
mov esi, dword [esp + 0xb0]
mov dword [esp + 0x24], 0x44
test esi, esi
jne 0x1000c9bb
mov dword [esp + 0x50], 1
test ebp, ebp
je 0x1000c9c3
mov dword [esp + 0x2c], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor eax, eax
xor edx, edx
mov dword [esp + 0x68], 0x5f005f
mov dword [esp + 0x6c], 0x6f0063
mov dword [esp + 0x70], 0x70006d
mov dword [esp + 0x74], 0x740061
mov dword [esp + 0x78], 0x6c005f
mov dword [esp + 0x7c], 0x790061
mov dword [esp + 0x80], 0x720065
mov word [esp + 0x84], dx
mov dword [esp + 0x88], 0x750052
mov dword [esp + 0x8c], 0x41006e
mov dword [esp + 0x90], 0x490073
mov dword [esp + 0x94], 0x76006e
mov dword [esp + 0x98], 0x6b006f
mov dword [esp + 0x9c], 0x720065
mov word [esp + 0xa0], ax
cmp dword [0x1001fe50], eax
jne 0x1000ca71
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x6c]
push edx
call ebp
mov eax, dword [0x100200cc]
test eax, eax
je 0x1000ca9f
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push 0
neg esi
sbb esi, esi
and esi, 0x8000000
push esi
push 0
push 0
push 0
push edi
push 0
call eax
jmp 0x1000cac6
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push 0
neg esi
sbb esi, esi
and esi, 0x8000000
push esi
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [0x1001fe50], 0
mov esi, eax
jne 0x1000cada
push 0
lea edx, [esp + 0x6c]
push edx
call ebp
pop edi
test esi, esi
pop esi
pop ebp
pop ebx
je 0x1000cb68
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x1000cb3b
cmp eax, 0xffffffff
je 0x1000cafe
imul eax, eax, 0x3e8
jmp 0x1000cb01
or eax, 0xffffffff
push eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000cb26
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000cb3b
mov ecx, dword [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x1000cb3b
cmp dword [esp + 0xac], 0
je 0x1000cb3b
mov edx, dword [esp]
push 0
push edx
call sub.NTDLL.dll_NtTerminateProcess
mov eax, dword [esp + 4]
push eax
call sub.NTDLL.dll_NtClose
mov ecx, dword [esp]
push ecx
call sub.NTDLL.dll_NtClose
mov eax, 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.10008464
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
xor ecx, esp
xor eax, eax
call fcn.10008464
add esp, 0x98
ret
Function at 0x1000cb80
Capabilities:
Start service

Disassembly:
push ecx
push ebp
push edi
push 1
xor edi, edi
push str.ServicesActive
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
je 0x1000cc04
mov eax, dword [esp + 0x10]
push esi
push 0x10
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1000cbfc
push ebx
lea ebx, [edi + 2]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1000cbe8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x1000cbe8
push 0x7d0
call edi
dec ebx
jne 0x1000cbc0
jmp 0x1000cbf0
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [esp + 0x10]
pop ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, edi
pop edi
pop ebp
pop ecx
ret
Function at 0x1000d390
Capabilities:
Get token membership

Disassembly:
sub esp, 0x5c
mov eax, dword [0x1001f2b8]
xor eax, esp
mov dword [esp + 0x58], eax
push edi
lea eax, [esp + 8]
push eax
xor edi, edi
push 0xa
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edi
call fcn.10012270
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000d478
cmp dword [0x100201f4], 5
mov dword [esp + 4], edi
mov dword [esp + 0xc], edi
jbe 0x1000d418
mov eax, dword [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x20]
push edx
push 0x12
push eax
call esi
test eax, eax
je 0x1000d411
cmp dword [esp + 0x18], 3
jne 0x1000d411
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x10]
push edx
push 0x13
push eax
call esi
pop esi
cmp dword [esp + 4], edi
jne 0x1000d430
mov edx, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
cmp dword [esp + 4], edi
je 0x1000d46e
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edi
push 0x1a
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1000d464
mov ecx, dword [esp + 4]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov edx, dword [esp + 4]
push edx
call sub.NTDLL.dll_NtClose
mov eax, dword [esp + 8]
push eax
call sub.NTDLL.dll_NtClose
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
pop edi
xor ecx, esp
call fcn.10008464
add esp, 0x5c
ret