joyce8/EMBER2024-capa huggingface dataset:
Function at 0x99fce0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xb0
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push esi
push edi
call fcn.00968930
test eax, eax
je 0x99fe1f
push 0x9c
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea edx, [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x14], 0x9c
call fcn.0094c480
test eax, eax
je 0x99fe1f
call fcn.009682c0
lea ecx, [esp + 0x10]
push ecx
push str.WScLastUBR
mov ecx, str.SoftwareMicroWorld
mov edx, 0x80000002
mov esi, eax
mov dword [esp + 0x18], 0
call fcn.0094c0d0
cmp dword [esp + 0x10], esi
je 0x99fe1f
mov eax, esi
mov esi, str.WScLastUBR
mov ebx, str.SoftwareMicroWorld
mov ecx, 0x80000002
call fcn.0094be90
push str.AVRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c180
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp al, 1
je 0x99fdb9
call esi
cmp eax, 2
jne 0x99fdb9
push str.AVRegisteredWithWsc
call fcn.00989f40
cmp eax, 1
jne 0x99fdb9
push 0
call edi
push str.ASRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c180
cmp al, 1
je 0x99fdeb
call esi
cmp eax, 2
jne 0x99fdeb
push str.ASRegisteredWithWsc
call fcn.00989f40
cmp eax, 1
jne 0x99fdeb
push 0
call edi
xor edi, edi
mov ecx, str.econceal
call fcn.009620b0
mov ecx, str.econservice
mov esi, eax
call fcn.009620b0
test esi, esi
jne 0x99fe0b
test eax, eax
je 0x99fe1f
mov esi, str.FirewallRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0095f910
mov ecx, dword [esp + 0xb8]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0xb0
ret
Function at 0x9a24b0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x4fc
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x4f4], eax
push ebx
push ebp
push esi
push edi
push 0x104
lea eax, [esp + 0x14]
push 0xb52b90
push eax
call fcn.00a7b9de
mov eax, 0xb52b90
add esp, 0xc
lea edx, [eax + 1]
xor ebx, ebx
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x9a24f0
sub eax, edx
cmp eax, 0x104
jb 0x9a2507
mov byte [esp + 0x113], bl
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esp + 0x10], bl
je 0x9a2535
lea eax, [esp + 0x10]
inc eax
cmp byte [eax], bl
jne 0x9a2517
lea ecx, [esp + 0x10]
sub eax, ecx
je 0x9a2535
cmp byte [esp + eax + 0xf], 0x5c
je 0x9a2535
push 0xaa1564
mov edx, ecx
push edx
call ebp
lea eax, [esp + 0x10]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x9a2540
sub eax, edx
cmp eax, 0x104
jge 0x9a2568
mov edx, str.ipcsrvr.dll
mov cl, byte [edx]
cmp cl, bl
je 0x9a2568
mov byte [esp + eax + 0x10], cl
inc eax
inc edx
cmp eax, 0x104
jl 0x9a2555
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [esp + eax + 0x10], bl
lea eax, [esp + 0x10]
push eax
call edi
mov dword [0xbdb3ac], eax
cmp eax, ebx
je 0x9a265c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MS_InitializeIPCLayerEx
push eax
call esi
mov edx, dword [0xbdb3ac]
push str.MS_WaitOnClientRequestEx
push edx
mov dword [0xbdb3c8], eax
call esi
push 0x104
mov dword [0xbdb3cc], eax
lea eax, [esp + 0x14]
push 0xb52b90
push eax
call fcn.00a7b9de
mov eax, 0xb52b90
add esp, 0xc
lea edx, [eax + 1]
jmp 0x9a25d0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x9a25d0
sub eax, edx
cmp eax, 0x104
jb 0x9a25e7
mov byte [esp + 0x113], bl
cmp byte [esp + 0x10], bl
je 0x9a260f
lea eax, [esp + 0x10]
inc eax
cmp byte [eax], bl
jne 0x9a25f1
lea ecx, [esp + 0x10]
sub eax, ecx
je 0x9a260f
cmp byte [esp + eax + 0xf], 0x5c
je 0x9a260f
push 0xaa1564
mov edx, ecx
push edx
call ebp
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x9a2616
sub eax, edx
cmp eax, 0x104
jge 0x9a2643
mov edx, str.msvint.dll
jmp 0x9a2630
mov cl, byte [edx]
cmp cl, bl
je 0x9a2643
mov byte [esp + eax + 0x10], cl
inc eax
inc edx
cmp eax, 0x104
jl 0x9a2630
mov byte [esp + eax + 0x10], bl
lea eax, [esp + 0x10]
push eax
call edi
mov dword [0xbdb3b0], eax
cmp eax, ebx
jne 0x9a26a6
call fcn.009a2700
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x3e7
mov edi, eax
lea esi, [esp + 0x11c]
call fcn.00960a40
add esp, 4
mov ecx, esi
push ebx
push ecx
call fcn.009a18a0
lea edx, [esp + 0x18]
push edx
mov eax, esi
push str.ERROR____Unable_to_Load_Library__s._Reason_above
push eax
call fcn.00a78f30
add esp, 0x14
mov ecx, esi
push ebx
push ecx
call fcn.009a18a0
add esp, 8
xor eax, eax
jmp 0x9a26dd
push str.ServerDispatchFunction
push eax
call esi
mov edx, dword [0xbdb3b0]
push str.MSV_Uninitialize
push edx
mov dword [str._b1m_V1m__1m], eax
call esi
mov dword [0xbdb3c4], eax
mov eax, dword [0xbdb3b0]
push str.MSV_Initialize
push eax
call esi
mov dword [0xbdb3c0], eax
mov eax, 1
mov ecx, dword [esp + 0x504]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x4fc
ret
Function at 0x9a2750
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x3f8
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x3f0], eax
push ebx
push esi
push edi
push 0x3e7
lea eax, [esp + 0x15]
push 0
push eax
mov esi, 1
mov byte [esp + 0x1c], 0
call fcn.00a7ffb0
add esp, 0xc
mov ecx, str.IPCSRVR_STARTED
call fcn.0097ddd0
mov ebx, eax
test ebx, ebx
jne 0x9a27e8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x9a27ce
call esi
push 0x3e7
mov edi, eax
lea esi, [esp + 0x14]
call fcn.00960a40
add esp, 4
mov ecx, esi
push ebx
push ecx
call fcn.009a18a0
push ebx
push str.ERROR____Unable_to_Open_Event__IPCSRVR_STARTED_._Reason_above
call fcn.009a18a0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3f0]
xor ecx, esp
call fcn.00a78f21
add esp, 0x3f8
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x9a2827
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x3e7
mov edi, eax
lea esi, [esp + 0x14]
call fcn.00960a40
add esp, 4
mov edx, esi
push 0
push edx
call fcn.009a18a0
push 0
push str.ERROR____Unable_to_Set_Event__IPCSRVR_STARTED_._Reason_above
call fcn.009a18a0
add esp, 0x10
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x3fc]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x3f8
ret

Function at 0x9a2b40
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xfffffffffffffffe
push 0xb0dd50
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov edi, edx
mov ax, word [0xaf3298]
mov word [ebp - 0x1c], ax
mov cl, byte [0xaf329a]
mov byte [ebp - 0x1a], cl
xor ebx, ebx
mov byte [ebp], bl
push 0x207
push ebx
lea edx, [ebp + 1]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 4], ebx
mov al, byte [esi]
cmp al, 0x21
jne 0x9a2bbe
mov al, byte [esi + 1]
mov byte [ebp - 0x1c], al
push 0x208
lea ecx, [ebp]
push ecx
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x9a2c19
cmp byte [esi], 0x21
jne 0x9a2bec
add esi, 3
push esi
lea eax, [ebp]
push eax
push str.__s_s
jmp 0x9a2bf9
add esi, 2
push esi
lea ecx, [ebp]
push ecx
push 0xac9b30
push edi
call fcn.00a78f30
add esp, 0x10
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x9a2c22
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00a78f21
add ebp, 0x20c
mov esp, ebp
pop ebp
ret
Function at 0x9a3040
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x310]
sub esp, 0x310
push 0xfffffffffffffffe
push 0xb13250
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x30c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov edi, edx
xor ebx, ebx
mov byte [ebp + 0x208], bl
push 0x103
push ebx
lea eax, [ebp + 0x209]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
call fcn.00968110
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x9a310d
push 0x104
lea ecx, [ebp + 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp + 0x208]
call fcn.00960910
lea eax, [ebp + 0x208]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x9a30e0
mov edx, dword [str.rundll32.exe]
mov dword [eax], edx
mov ecx, dword [0xacaebc]
mov dword [eax + 4], ecx
mov edx, dword [0xacaec0]
mov dword [eax + 8], edx
mov cl, byte [0xacaec4]
mov byte [eax + 0xc], cl
jmp 0x9a313c
mov edx, dword [str.rundll32.exe]
mov dword [ebp + 0x208], edx
mov eax, dword [0xacaebc]
mov dword [ebp + 0x20c], eax
mov ecx, dword [0xacaec0]
mov dword [ebp + 0x210], ecx
mov dl, byte [0xacaec4]
mov byte [ebp + 0x214], dl
cmp esi, ebx
je 0x9a31fa
cmp byte [esi], bl
je 0x9a31fa
mov ecx, esi
call fcn.00959b80
test eax, eax
jne 0x9a3173
cmp edi, ebx
je 0x9a3217
push esi
push str._s_file_not_present
push edi
call fcn.00a78f30
add esp, 0xc
jmp 0x9a3217
push esi
lea eax, [ebp + 0x208]
push eax
push str._s_setupapi.dll_InstallHinfSection_DefaultUninstall_128__s
lea ecx, [ebp]
push ecx
call fcn.00a78f30
add esp, 0x10
cmp dword [ebp - 0x24], ebx
je 0x9a31a1
lea edx, [ebp - 0x1c]
push edx
call fcn.009681c0
add esp, 4
mov esi, eax
jmp 0x9a31a4
mov esi, dword [ebp - 0x20]
push ebx
push 1
lea eax, [ebp]
push eax
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
call fcn.0095dfe0
add esp, 0xc
cmp esi, ebx
je 0x9a31ca
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00968240
add esp, 4
mov ebx, str.mwfsmfltr
call fcn.009605b0
test eax, eax
je 0x9a31ec
test edi, edi
je 0x9a3217
push str.Failed_to_uninstall_mwfsmfltr
push edi
call fcn.00a78f30
add esp, 8
jmp 0x9a3217
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x9a3220
cmp edi, ebx
je 0x9a3217
push str.Invalid_parameter
push edi
call fcn.00a78f30
add esp, 8
jmp 0x9a3217
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x30c]
xor ecx, ebp
call fcn.00a78f21
add ebp, 0x310
mov esp, ebp
pop ebp
ret
Function at 0x9a9d60
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x98
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x94], eax
test esi, esi
je 0x9a9d7b
mov byte [esi], 0
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x9a9de4
mov dword [esp + 4], 4
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test esi, esi
je 0x9a9dcf
push 0x5c
push esi
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x9a9dcf
mov byte [eax], 0
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00a78f21
add esp, 0x98
ret
cmp dword [esp + 4], 5
jb 0x9a9dad
push str.GetSystemWindowsDirectoryA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x9a9dad
push 0x104
push esi
call eax
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00a78f21
add esp, 0x98
ret
Function at 0x9ae330
Capabilities:
Check if file exists

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push 0x2e
push edi
call fcn.00a7a2c0
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x9ae446
lea eax, [esp + 0x10]
push eax
push str.DomainStripCheckB
mov ecx, str.SoftwareMicroWorld
mov edx, 0x80000002
mov dword [esp + 0x18], 2
call fcn.0094c0d0
test al, al
jne 0x9ae3bf
mov eax, dword [esp + 0x10]
mov esi, str.DomainStripCheckB
mov ebx, str.SoftwareMicroWorld
mov ecx, 0x80000002
call fcn.0094be90
push str.DomainStripCheck
mov ecx, ebx
mov edx, 0x80000002
call fcn.0094c180
cmp al, 1
je 0x9ae3bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x9ae3bf
push str.DomainStripCheck
call fcn.00989f40
cmp eax, 1
jne 0x9ae3bf
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x10]
cmp eax, 2
je 0x9ae3ea
test eax, eax
je 0x9ae446
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x9ae3d1
sub eax, edx
inc eax
push eax
call fcn.00a7a155
mov esi, eax
add esp, 4
test esi, esi
jne 0x9ae3fa
mov byte [ebp], 0
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, esi
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x9ae400
mov byte [ebp], cl
mov ecx, edi
call fcn.0087bb50
test eax, eax
je 0x9ae42d
push esi
call fcn.00a78fec
add esp, 4
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, edi
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x9ae433
push esi
call fcn.00a78fec
add esp, 4
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x9ae450
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xfffffffffffffffe
push 0xb0e0c8
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, str.netapi32.dll
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x11c], bl
push 0x103
push ebx
lea eax, [ebp - 0x11b]
push eax
call fcn.00a7ffb0
mov byte [ebp], bl
push 0x103
push ebx
lea ecx, [ebp + 1]
push ecx
call fcn.00a7ffb0
push 0x5c
push esi
call fcn.00a7a2c0
add esp, 0x20
test eax, eax
jne 0x9ae570
push 0x104
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp - 0x11c], bl
je 0x9ae570
lea ecx, [ebp - 0x11c]
lea edx, [ebp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x9ae501
cmp byte [ebp], bl
je 0x9ae534
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebx
je 0x9ae534
cmp byte [ebp + eax - 1], 0x5c
je 0x9ae534
push 0xaa1564
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x9ae538
sub eax, edx
lea edi, [ebp]
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x9ae545
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], 0xfffffffe
jmp 0x9ae596
push str.netapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], 0xfffffffe
jmp 0x9ae596
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.00a78f21
add ebp, 0x108
mov esp, ebp
pop ebp
ret
Function at 0x9aeb10
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push esi
lea eax, [esp + 8]
push eax
xor ebx, ebx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServicesLanmanServerParameters
push 0x80000002
mov dword [esp + 0x1c], ebx
xor esi, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x9aec3e
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
cmp esi, ebx
je 0x9aeb64
push esi
call fcn.00a7dc99
add esp, 4
add eax, 0x400
jmp 0x9aeb69
mov eax, 0x400
push eax
push esi
call fcn.00a7b398
mov esi, eax
push esi
call fcn.00a7dc99
push eax
push ebx
push esi
call fcn.00a7ffb0
push esi
call fcn.00a7dc99
mov edx, dword [esp + 0x2c]
add esp, 0x1c
lea ecx, [esp + 0x14]
push ecx
push esi
push ebx
push ebx
push str.NullSessionShares
sub eax, 3
push edx
mov dword [esp + 0x2c], eax
call ebp
mov edi, eax
cmp edi, ebx
je 0x9aebb2
cmp edi, 0xea
je 0x9aeb50
mov eax, dword [esp + 0x14]
mov byte [eax + esi], bl
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov byte [ecx + esi + 1], bl
mov edx, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
mov byte [edx + esi + 2], bl
call fcn.009ae960
add esp, 4
cmp eax, 1
jne 0x9aebf8
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push ecx
push esi
push 7
push ebx
push str.NullSessionShares
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x9aec0f
push eax
call ebp
xor eax, eax
mov dword [esp + 0x10], eax
cmp esi, ebx
je 0x9aec22
push esi
call fcn.00a78fec
mov eax, dword [esp + 0x14]
add esp, 4
xor esi, esi
cmp eax, ebx
je 0x9aec2d
push eax
call ebp
mov dword [esp + 0x10], ebx
cmp esi, ebx
je 0x9aec3a
push esi
call fcn.00a78fec
add esp, 4
mov eax, edi
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x9aec50
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push edi
lea eax, [esp + 8]
push eax
xor ebx, ebx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServicesLanmanServerParameters
push 0x80000002
mov dword [esp + 0x1c], ebx
xor edi, edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x9aed7e
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
cmp edi, ebx
je 0x9aeca4
push edi
call fcn.00a7dc99
add esp, 4
add eax, 0x400
jmp 0x9aeca9
mov eax, 0x400
push eax
push edi
call fcn.00a7b398
mov edi, eax
push edi
call fcn.00a7dc99
push eax
push ebx
push edi
call fcn.00a7ffb0
push edi
call fcn.00a7dc99
mov edx, dword [esp + 0x2c]
add esp, 0x1c
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
push ebx
push str.NullSessionShares
sub eax, 3
push edx
mov dword [esp + 0x2c], eax
call ebp
mov esi, eax
cmp esi, ebx
je 0x9aecf2
cmp esi, 0xea
je 0x9aec90
mov eax, dword [esp + 0x14]
mov byte [eax + edi], bl
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov byte [ecx + edi + 1], bl
mov edx, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
mov byte [edx + edi + 2], bl
call fcn.009ae870
add esp, 4
cmp eax, 1
jne 0x9aed38
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push ecx
push edi
push 7
push ebx
push str.NullSessionShares
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x9aed4f
push eax
call ebp
xor eax, eax
mov dword [esp + 0x10], eax
cmp edi, ebx
je 0x9aed62
push edi
call fcn.00a78fec
mov eax, dword [esp + 0x14]
add esp, 4
xor edi, edi
cmp eax, ebx
je 0x9aed6d
push eax
call ebp
mov dword [esp + 0x10], ebx
cmp edi, ebx
je 0x9aed7a
push edi
call fcn.00a78fec
add esp, 4
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0xc
ret
Function at 0x9b28c0
Capabilities:
Check os version
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb14750
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], 0
mov edi, 1
mov dword [ebp - 0x1c], edi
test esi, esi
je 0x9b290d
mov byte [esi], 0
cmp dword [0xc07e48], 0
jne 0x9b299f
mov ecx, str.Ws2_32.dll
call fcn.0094c620
mov dword [0xc07e48], eax
test eax, eax
jne 0x9b2954
mov edx, 0xaf6120
mov ecx, esi
call fcn.009b2a80
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0xc07e50], 0x94
push 0xc07e50
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp byte [0xb55918], 0
je 0x9b299f
cmp byte [0xbdc028], 0
jne 0x9b299f
push 0xb55918
push 0x104
push 0xbdc028
push 0xab3780
push 0xab91c4
push str.Prompt
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [0xbdba0c], 0
jne 0x9b29cc
push 0xaf6144
mov eax, dword [0xc07e48]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0xbdba0c], eax
test eax, eax
jne 0x9b29cc
mov edx, 0xaf614c
jmp 0x9b2932
cmp dword [0xc07e60], 2
jne 0x9b2939
mov eax, dword [0xc07e54]
cmp eax, 5
jne 0x9b2a1c
cmp dword [0xc07e58], 0
jne 0x9b2a00
push ebx
push esi
call fcn.009b2340
mov edi, eax
add esp, 8
mov dword [ebp - 0x1c], edi
jmp 0x9b2939
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
mov edx, dword [ebp + 8]
mov ecx, esi
call 0x9b1350
mov edi, eax
add esp, 8
mov dword [ebp - 0x1c], edi
jmp 0x9b2939
cmp eax, 6
jb 0x9b2939
mov edx, dword [ebp + 0xc]
push edx
push ebx
mov edx, dword [ebp + 8]
mov ecx, esi
call 0x9b0700
mov edi, eax
add esp, 8
mov dword [ebp - 0x1c], edi
jmp 0x9b2939
Function at 0x9ba3c0
Capabilities:
Get common file path

Disassembly:
cmp byte [str.C:WINDOWS_system32wininit.exe], 0
jne 0x9ba434
push 0x104
push str.C:WINDOWS_system32
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
jmp 0x9ba3e0
mov cl, byte [eax + str.C:WINDOWS_system32]
mov byte [eax + str.C:WINDOWS_system32wininit.exe], cl
inc eax
test cl, cl
jne 0x9ba3e0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [str.C:WINDOWS_system32wininit.exe], cl
je 0x9ba427
mov eax, str.C:WINDOWS_system32wininit.exe
inc eax
cmp byte [eax], 0
jne 0x9ba405
sub eax, str.C:WINDOWS_system32wininit.exe
je 0x9ba427
cmp byte [eax + 0xc0849f], 0x5c
je 0x9ba427
push 0xaa1564
push str.C:WINDOWS_system32wininit.exe
call esi
push str.wininit.exe
push str.C:WINDOWS_system32wininit.exe
call esi
pop esi
mov eax, dword [esp + 4]
push str.C:WINDOWS_system32wininit.exe
push eax
call fcn.00a88f66
add esp, 8
neg eax
sbb eax, eax
inc eax
ret
Function at 0x9c8d20
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 0x11c
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x118], eax
cmp dword [0xbdd0c8], 0
push ebx
push ebp
push esi
push edi
mov esi, ecx
jne 0x9c8e60
lea eax, [esp + 0x18]
push eax
push str.SyncTime
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [esp + 0x20], 2
call fcn.0094c0d0
mov eax, dword [esp + 0x18]
cmp eax, 2
je 0x9c8d7a
cmp eax, 3
jne 0x9c8e60
push esi
lea ecx, [esp + 0x20]
push str._JOB__Syncing_Time__u_
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [esp + 0x24]
push edx
push 0xb54ce8
call fcn.008808e0
lea eax, [esp + 0x2c]
push eax
push 0
push 0x9e4f40
call fcn.00a791b2
add esp, 0x1c
cmp eax, 0xffffffff
je 0x9c8e37
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
mov edi, eax
call ebx
mov dword [0xbdd0c8], 1
call esi
sub eax, edi
cmp eax, 0x1388
jae 0x9c8e60
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x9c8df0
push 1
mov ecx, str.MyTimeSyncHand
call fcn.00962f00
mov dword [esp + 0x14], eax
test eax, eax
je 0x9c8e60
call ebp
cmp eax, 0xb7
jne 0x9c8e2b
lea ecx, [esp + 0x14]
push ecx
call fcn.00985290
push 0xc8
call ebx
call esi
sub eax, edi
cmp eax, 0x1388
jb 0x9c8df0
jmp 0x9c8e60
lea edx, [esp + 0x14]
push edx
call fcn.00985290
jmp 0x9c8e60
push esi
lea eax, [esp + 0x20]
push str._JOB__Error_creating_thread_for_synctime____u_
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea ecx, [esp + 0x24]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x11c
ret