joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101f52d
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x1027018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x220], eax
xor eax, eax
push 0x20e
mov word [ebp - 0x214], ax
xor ebx, ebx
lea eax, [ebp - 0x212]
push ebx
push eax
mov dword [ebp - 0x21c], esi
call sub.msvcrt.dll_memset
push 0x40
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], ebx
call sub.msvcrt.dll_memset
mov dword [ebp - 0x230], ebx
xor eax, eax
lea edi, [ebp - 0x22c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x18
mov ecx, esi
stosd dword es:[edi], eax
call fcn.0101d394
test eax, eax
jne 0x101f5bb
mov esi, 0x8007000e
jmp 0x101f6f8
cmp dword [esi + 0x1c], 6
jge 0x101f5cb
mov esi, 0x8007139f
jmp 0x101f6f8
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x101f6f3
cmp dword [ebp - 0x218], ebx
je 0x101f6f3
cmp dword [ebp - 0x220], ebx
je 0x101f6f3
mov eax, dword [esi + 0x24]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x101f617
cmp dx, bx
je 0x101f613
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x101f617
add ecx, 4
add eax, 4
cmp dx, bx
jne 0x101f5f1
xor eax, eax
jmp 0x101f61c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x101f62a
mov esi, 0x80070005
jmp 0x101f6f8
push ebx
push dword [ebp - 0x218]
mov ecx, esi
call fcn.0101d48a
mov esi, eax
cmp esi, ebx
jl 0x101f6f8
lea eax, [ebp - 0x214]
push eax
mov edi, 0x108
push edi
push dword [ebp - 0x218]
call fcn.0102364e
mov esi, eax
cmp esi, ebx
jl 0x101f6f8
cmp dword [ebp + 0x14], ebx
je 0x101f682
push dword [0x1027010]
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.0101d01b
mov esi, eax
cmp esi, ebx
jl 0x101f6f8
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x274]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x214]
push eax
push ebx
mov dword [ebp - 0x274], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x101f6ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x101f6c6
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x101f6f8
push dword [ebp - 0x220]
mov edi, dword [ebp - 0x21c]
lea eax, [ebp - 0x230]
push eax
mov ecx, edi
call fcn.0101d504
mov esi, eax
cmp esi, ebx
jl 0x101f6f8
mov dword [edi + 0x1c], 8
jmp 0x101f6f8
mov esi, 0x80070057
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x22c], ebx
je 0x101f70e
push dword [ebp - 0x22c]
call edi
cmp dword [ebp - 0x230], ebx
je 0x101f71e
push dword [ebp - 0x230]
call edi
mov ecx, dword [ebp - 0x21c]
call fcn.0101d3ad
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102302f
leave
ret 0x14
Function at 0x101fcae
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x14
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x8007000e
call fcn.0101cbdf
mov esi, eax
pop ecx
test esi, esi
je 0x101fd8f
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
call edi
mov dword [esi + 4], eax
test eax, eax
je 0x101fd87
push dword [ebp + 0xc]
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x101fd7e
mov eax, dword [ebp - 8]
push 0
push 0
push esi
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
push 0x101fc61
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x14]
push 0
push 0
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x101fd5e
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x101fd4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101fd45
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x101fd55
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x101fd75
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101fd72
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
push dword [esi + 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esi + 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call fcn.0101cbfd
pop ecx
pop edi
mov eax, dword [ebp - 4]
pop esi
leave
ret 0x10

Function at 0x1020a93
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push edi
push 0x20000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1020b30
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
cmp dword [ebp + 0xc], edi
je 0x1020acb
push 0x1001978
jmp 0x1020ad0
push 0x1001970
call sub.ADVAPI32.dll_ConvertStringSidToSidW
cmp eax, edi
je 0x1020b11
lea eax, [ebp + 0xc]
push eax
push ebx
mov dword [ebp + 0xc], edi
call fcn.01023881
mov esi, eax
cmp esi, edi
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
jl 0x1020b0a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp + 0xc]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call edi
push dword [ebp + 8]
call edi
jmp 0x1020b27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1020b25
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1020b46
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1020b44
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10213af
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1027018]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x10c], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1021451
push edi
cmp dword [esi + 8], 0
jne 0x1021449
mov edi, dword [esi]
test edi, edi
je 0x1021449
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
push edi
push ebx
call fcn.0102123d
test eax, eax
je 0x102143f
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x102143f
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1021449
mov dword [ebp - 0x10c], 1
mov esi, dword [esi + 4]
test esi, esi
jne 0x10213d8
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10c]
pop esi
xor ecx, ebp
pop ebx
call fcn.0102302f
leave
ret 8
Function at 0x102146c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x1027018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x103
xor edi, edi
lea eax, [ebp - 0x107]
push edi
push eax
mov byte [ebp - 0x108], 0
call sub.msvcrt.dll_memset
add esp, 0xc
cmp ebx, edi
je 0x1021646
cmp byte [ebx], 0
je 0x1021646
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1021646
push esi
push ebx
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01020dac
mov edi, eax
test edi, edi
jl 0x1021645
push 0x1001990
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub esi, eax
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01020f83
mov edi, eax
test edi, edi
jl 0x1021645
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24c], eax
cmp eax, 0xffffffff
jne 0x1021549
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102167c
and eax, 0xffff
or eax, 0x80070000
jmp 0x102167c
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x100198c
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10215ee
push 0x1001988
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10215ee
lea eax, [ebp - 0x21c]
push eax
push ebx
push 0x1001980
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.01020fdc
mov edi, eax
add esp, 0x14
test edi, edi
jl 0x1021630
test byte [ebp - 0x248], 0x10
lea eax, [ebp - 0x108]
je 0x10215d5
push 0x90
push eax
call esi
lea eax, [ebp - 0x108]
push eax
call fcn.0102146c
mov edi, eax
test edi, edi
jl 0x1021630
jmp 0x10215ee
push 0x80
push eax
call esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x102161a
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x102154f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x12
je 0x1021658
call esi
jmp 0x1021620
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102162e
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp dword [ebp - 0x24c], 0xffffffff
je 0x1021645
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.0102302f
leave
ret 4
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 0x24c], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1021645
call esi
test eax, eax
jg 0x1021624
mov edi, eax
jmp 0x1021645
Function at 0x10217af
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x1027018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
inc ebx
cmp dword [0x1027274], 0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xd4], 0x80004005
je 0x10217ee
push 0x1027278
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp ebx, 0x1f4
jg 0x1021829
push ebx
push 0x10019a0
push edi
push 0x1001994
push dword [ebp + 0x10]
push esi
call fcn.01020fdc
add esp, 0x18
inc ebx
mov dword [ebp - 0xd4], eax
test eax, eax
jl 0x10218d5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10217ee
xor eax, eax
cmp dword [ebp - 0xd4], eax
jl 0x10218d5
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.01020b54
mov dword [ebp - 0xd4], eax
test eax, eax
jl 0x10218d5
lea eax, [ebp - 0xe8]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
test eax, eax
jne 0x10218ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10218a7
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xdc], 0
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x10218c4
push dword [ebp - 0xdc]
call esi
cmp dword [ebp - 0xd8], 0
je 0x10218d5
push dword [ebp - 0xd8]
call esi
cmp dword [0x1027274], 0
pop edi
pop esi
pop ebx
je 0x10218ec
push 0x1027278
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xd4]
xor ecx, ebp
call fcn.0102302f
leave
ret 0xc
Function at 0x102196e
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1027018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push ebx
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], 1
call fcn.010208c6
mov dword [ebp - 0x420], eax
cmp eax, ebx
jne 0x10219b8
mov eax, 0x80004005
jmp 0x1021a8c
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
push 0xffffffffffffffff
push edi
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1021a3b
cmp dword [ebp - 0x418], 0x1f4
jg 0x1021a51
push dword [ebp - 0x420]
lea eax, [ebp - 0x414]
push dword [ebp - 0x418]
push eax
push 0x10019a4
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0101f430
add esp, 0x18
inc dword [ebp - 0x418]
test eax, eax
jl 0x1021a27
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10219d7
push 1
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1021a58
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1021a8b
and eax, 0xffff
or eax, 0x80070000
jmp 0x1021a8b
mov eax, 0x80004005
jmp 0x1021a8b
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.01020a33
mov edi, eax
test edi, edi
jl 0x1021a89
mov esi, dword [ebp - 0x41c]
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0102302f
leave
ret 0xc

Function at 0x10220e0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 0x1021fdf
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x1022159
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x1022150
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x102214d
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1022170
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x102216d
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 0xc
Function at 0x1022549
Capabilities:
Create thread

Disassembly:
push section..data
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1022594
push edi
push 4
call fcn.0101cbdf
pop ecx
mov edi, eax
push edi
call fcn.0101cec9
test eax, eax
je 0x102258e
push 0
push 0
push edi
push 0x1022519
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x102258e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1022593
call fcn.0101ceec
pop edi
mov eax, dword [section..data]
ret

Function at 0x10228b3
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x1027018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea esi, [ebp + 8]
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp + 0x18]
lea edi, [ebp - 0x74]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x7c]
push eax
mov ebx, 0xf003f
push ebx
push 0
movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x10015c4
mov edi, 0x80000000
push edi
call esi
mov dword [ebp - 0x78], eax
test eax, eax
jne 0x102292e
push 0x27
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x80]
push eax
push ebx
push 0
push 0x1001afc
push edi
call esi
mov esi, eax
test esi, esi
jne 0x102296b
push 0x27
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x80]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x78]
test eax, eax
jne 0x1022978
test esi, esi
jne 0x102298c
jmp 0x102299c
test esi, esi
jne 0x102298c
test eax, eax
jle 0x102299c
and eax, 0xffff
or eax, 0x80070000
jmp 0x102299c
jle 0x102299a
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102302f
leave
ret 0x20
Function at 0x1023020
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1025aa0
call fcn.01023050
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x10277bc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1022ddb
cmp eax, esi
jne 0x1022dce
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1022dde
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1022db5
xor esi, esi
inc esi
mov eax, dword [0x10277b8]
cmp eax, esi
jne 0x1022df1
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1022e20
mov eax, dword [0x10277b8]
test eax, eax
jne 0x1022e1a
mov dword [0x10277b8], esi
push 0x1001344
push 0x1001338
call fcn.01022d17
pop ecx
pop ecx
test eax, eax
je 0x1022e20
jmp 0x1022f44
mov dword [0x1027304], esi
mov eax, dword [0x10277b8]
cmp eax, esi
jne 0x1022e44
push 0x1001334
push 0x1001320
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10277b8], 2
cmp dword [ebp - 0x20], ebx
jne 0x1022e51
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10277c8], ebx
je 0x1022e72
push 0x10277c8
call fcn.01023279
pop ecx
test eax, eax
je 0x1022e72
push ebx
push 2
push ebx
call dword [0x10277c8]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1022f44
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1022edc
cmp cx, bx
je 0x1022e97
cmp dword [ebp - 0x1c], ebx
jne 0x1022edc
movzx ecx, word [eax]
cmp cx, bx
je 0x1022eac
cmp cx, 0x20
ja 0x1022eac
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1022e97
test byte [ebp - 0x40], 1
je 0x1022eb8
movzx ecx, word [ebp - 0x3c]
jmp 0x1022ebb
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1027300], eax
cmp dword [0x10272f4], ebx
jne 0x1022f21
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1022eed
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x1022e81
cmp dword [0x1027304], ebx
jne 0x1022f2f
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1027300]
jmp 0x1022f50
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01023095
ret
call fcn.010233c6
jmp 0x1022d78

Function at 0x1023a05
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
call fcn.01023881
test eax, eax
jl 0x1023a38
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop esi
leave
ret 8
Function at 0x1023e4f
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x1025b28
call fcn.01023050
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov edx, dword [ebp - 0x30]
cmp word [edx], ax
jne 0x1023eb7
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x1023eb7
mov ecx, dword [eax + 0xd8]
lea esi, [ecx + edx]
cmp dword [ebp + 0xc], esi
jb 0x1023eb7
mov eax, dword [eax + 0xdc]
add eax, ecx
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x1023eb7
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1023ec0
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.01023095
ret 8
Function at 0x1024001
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, eax
push edi
mov ebx, 0x10000
cmp esi, 0x7ff80000
jbe 0x1024026
lea eax, [esi - 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x1024029
mov dword [ebp - 4], ebx
cmp esi, 0x80000000
jae 0x102403c
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 8], eax
jmp 0x1024043
mov dword [ebp - 8], 0xfff80000
mov eax, dword [0x1027670]
mov ecx, dword [0x102766c]
test eax, eax
jne 0x102405d
test ecx, ecx
je 0x1024072
mov eax, ecx
mov dword [0x1027670], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x1024072
cmp edx, dword [ebp - 4]
jb 0x1024072
cmp edx, dword [ebp - 8]
jbe 0x1024143
mov eax, ecx
test ecx, ecx
jmp 0x1024096
test eax, eax
je 0x1024091
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x1024091
cmp ecx, dword [ebp - 4]
jb 0x1024091
cmp ecx, dword [ebp - 8]
jbe 0x1024143
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x1027670], eax
jne 0x1024078
mov eax, esi
and eax, 0xffff
sub esi, eax
mov edi, esi
cmp esi, dword [ebp - 4]
jbe 0x10241d4
lea eax, [edi - 0x60000000]
cmp eax, 0x20000000
ja 0x10240c3
mov edi, 0x5fff0000
push 0x1c
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10241d4
cmp dword [ebp - 0x30], ebx
jne 0x10240e2
cmp dword [ebp - 0x34], ebx
jae 0x10240f5
mov edi, dword [ebp - 0x3c]
add edi, 0xffff0000
cmp edi, dword [ebp - 4]
ja 0x10240b1
jmp 0x10241d4
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1027670], eax
test eax, eax
je 0x10241d4
mov ecx, dword [0x102766c]
xor edx, edx
mov dword [eax + 4], ecx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov dword [0x102766c], eax
lea ecx, [eax + 0xffe0]
mov esi, 0x7fd
mov dword [ecx + 0x18], edx
mov edx, ecx
sub ecx, 0x20
dec esi
jne 0x1024135
mov dword [eax + 8], edx
mov edx, dword [eax + 8]
cmp edx, dword [ebp - 4]
jb 0x10241d9
cmp edx, dword [ebp - 8]
ja 0x10241d9
mov ecx, dword [edx + 0x18]
mov dword [eax + 8], ecx
push 8
mov eax, 0xcccccccc
pop ecx
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, edx
jmp 0x10241db
lea eax, [esi - 0x60000000]
cmp eax, 0x20000000
ja 0x1024180
mov esi, 0x80010000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10241d9
cmp dword [ebp - 0x14], ebx
jne 0x10241cb
cmp dword [ebp - 0x18], ebx
jb 0x10241cb
movzx ecx, si
test ecx, ecx
je 0x10241af
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x18], eax
add dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1027670], eax
test eax, eax
jne 0x1024111
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
lea esi, [eax + ecx]
cmp esi, dword [ebp - 8]
jb 0x102416e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret