joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006fbb6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1008c8f0]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x1008c6a0]
je 0x1006fbe3
inc eax
cmp eax, 0x12
jb 0x1006fbd4
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x1008c6a0]
jne 0x1006fd17
mov eax, dword [0x1008fa9c]
cmp eax, 1
je 0x1006fcf2
cmp eax, edx
jne 0x1006fc13
cmp dword [0x1008faa0], 1
je 0x1006fcf2
cmp ecx, 0xfc
je 0x1006fd17
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1006fc4c
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.10070440
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.10070330
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1006fc8e
lea eax, [ebp - 0x10c]
push eax
call fcn.10070330
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x10081928
push edi
call fcn.10068b10
add esp, 0x10
push edi
call fcn.10070330
push dword [esi + 0x1008c6a4]
mov ebx, eax
call fcn.10070330
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10068480
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.10070440
push edi
push ebx
call fcn.10070450
push 0x10081908
push ebx
call fcn.10070450
push dword [esi + 0x1008c6a4]
push ebx
call fcn.10070450
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.100736d2
add esp, 0x2c
jmp 0x1006fd17
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x1008c6a4]
push dword [esi]
call fcn.10070330
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.10070fd2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1007056f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1008c8f0]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x100705ea
push ebx
call fcn.10070538
test eax, eax
pop ecx
jne 0x100705bc
call fcn.10069760
mov dword [eax], 0xf
call fcn.10069757
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop ebx
call fcn.10070fd2
leave
ret
and byte [ebp + 0xb], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x100705fc
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x100705ac
inc eax
cmp eax, 0x104
ja 0x100705ac
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x10070634
cmp eax, dword [ebp + 0x10]
jg 0x10070617
mov eax, dword [ebp + 0x10]
push eax
call fcn.10067c37
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x10070649
call fcn.10069757
mov dword [eax], 0xc
jmp 0x100705ac
cmp eax, dword [ebp + 0x10]
jle 0x10070649
call fcn.10069757
mov dword [eax], 0x22
jmp 0x100705ac
lea eax, [ebp - 0x10c]
push eax
push ecx
call fcn.10070440
pop ecx
pop ecx
jmp 0x100705ae

Function at 0x10071160
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.10068480
mov eax, dword [0x1008c8f0]
xor eax, dword [ebp + 4]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.10070cb1
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x1007128a
push 2
push esi
push dword [ebp + 8]
call fcn.10070cb1
add esp, 0xc
cmp eax, ebx
je 0x1007128a
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x1007122d
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x100c]
push esi
push eax
call fcn.10070b70
push 0x8000
push dword [ebp + 8]
call fcn.10074031
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp edi, ebx
mov eax, ebx
jge 0x100711e6
mov eax, edi
push eax
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.1006b549
add esp, 0xc
cmp eax, 0xffffffff
je 0x10071206
sub edi, eax
test edi, edi
jg 0x100711de
jmp 0x1007121e
call fcn.10069760
cmp dword [eax], 5
jne 0x1007121b
call fcn.10069757
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.10074031
pop ecx
pop ecx
jmp 0x10071275
jge 0x10071275
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10070cb1
push dword [ebp + 8]
call fcn.1006b09b
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x10071275
call fcn.10069757
mov dword [eax], 0xd
call fcn.10069760
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.10070cb1
add esp, 0xc
mov eax, esi
pop edi
jmp 0x1007128c
mov eax, ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.10070fd2
leave
ret
Function at 0x100728fe
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.10068480
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10072993
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x1008faf8]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x10072993
cmp eax, 1
je 0x100729ab
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10072993
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x10072968
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x1007298f
xor eax, eax
inc eax
jmp 0x100729c7
cmp esi, ebx
jae 0x10072997
xor eax, eax
jmp 0x100729c7
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1008faf8]
jmp 0x100729ad
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100736d2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1008ff08], ebx
push esi
push edi
jne 0x10073752
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1007378d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10081f60
push edi
call esi
test eax, eax
mov dword [0x1008ff08], eax
je 0x1007378d
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x1008ff0c], eax
call esi
cmp dword [0x1008faf8], 2
mov dword [0x1008ff10], eax
jne 0x10073752
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x1008ff18], eax
je 0x10073752
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x1008ff14], eax
mov eax, dword [0x1008ff14]
test eax, eax
je 0x10073797
call eax
test eax, eax
je 0x1007377e
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1008ff18]
test eax, eax
je 0x1007377e
test byte [ebp - 8], 1
jne 0x10073797
cmp dword [0x1008fb04], 4
jb 0x10073791
or byte [ebp + 0x12], 0x20
jmp 0x100737b6
xor eax, eax
jmp 0x100737c6
or byte [ebp + 0x12], 4
jmp 0x100737b6
mov eax, dword [0x1008ff0c]
test eax, eax
je 0x100737b6
call eax
mov ebx, eax
test ebx, ebx
je 0x100737b6
mov eax, dword [0x1008ff10]
test eax, eax
je 0x100737b6
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1008ff08]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10073e12
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ebx
je 0x10073e7d
push 0x3d
push dword [ebp + 8]
call fcn.10074add
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], esi
je 0x10073e7d
cmp dword [ebp + 8], esi
je 0x10073e7d
xor eax, eax
cmp byte [esi + 1], al
sete al
mov dword [ebp - 4], eax
mov eax, dword [0x1008fb18]
cmp eax, dword [0x1008fb1c]
jne 0x10073e63
mov edi, eax
call fcn.10073db1
mov dword [0x1008fb18], eax
cmp eax, ebx
jne 0x10073ebc
cmp dword [ebp + 0xc], ebx
je 0x10073e85
cmp dword [0x1008fb20], ebx
je 0x10073e85
call fcn.1007102e
test eax, eax
je 0x10073ebc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x10073fc0
push 4
call fcn.10067c37
cmp eax, ebx
pop ecx
mov dword [0x1008fb18], eax
je 0x10073e7d
mov dword [eax], ebx
cmp dword [0x1008fb20], ebx
jne 0x10073ebc
push 4
call fcn.10067c37
cmp eax, ebx
pop ecx
mov dword [0x1008fb20], eax
je 0x10073e7d
mov dword [eax], ebx
mov ebx, dword [0x1008fb18]
mov edi, esi
mov esi, dword [ebp + 8]
sub edi, esi
push esi
call fcn.10073d64
mov edi, eax
test edi, edi
pop ecx
jl 0x10073f15
cmp dword [ebx], 0
je 0x10073f15
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.10067c4e
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x10073efd
mov eax, dword [ebp + 8]
mov dword [esi], eax
jmp 0x10073f4b
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x10073ef4
mov eax, edi
shl eax, 2
push eax
push ebx
call fcn.100685c1
test eax, eax
pop ecx
pop ecx
je 0x10073f4b
jmp 0x10073f46
cmp dword [ebp - 4], 0
jne 0x10073fb9
test edi, edi
jge 0x10073f25
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call fcn.100685c1
test eax, eax
pop ecx
pop ecx
je 0x10073e7d
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [0x1008fb18], eax
cmp dword [ebp + 0xc], 0
je 0x10073fa2
push dword [ebp + 8]
call fcn.10070330
inc eax
inc eax
push eax
call fcn.10067c37
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10073fa2
push dword [ebp + 8]
push esi
call fcn.10070440
mov eax, esi
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
and byte [eax], 0
mov ecx, dword [ebp - 4]
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x10073f9b
or dword [ebp - 8], 0xffffffff
push esi
call fcn.10067c4e
pop ecx
cmp dword [ebp - 4], 0
je 0x10073fb1
push dword [ebp + 8]
call fcn.10067c4e
pop ecx
mov eax, dword [ebp - 8]
jmp 0x10073e80
push esi
call fcn.10067c4e
pop ecx
xor eax, eax
jmp 0x10073e80
Function at 0x424085
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x424094
pop dword [ebp - 0x38]
mov eax, 0xcec92b60
sub eax, 0xce86eacc
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x51149
push 0
mov eax, 0x800d4215
sub eax, 0x7fc88f65
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0xd8b23ba8
sub ecx, 0xd8b1f134
xor edx, edx
add edx, eax
mov ebx, 0xbaed1a17
sub ebx, 0xbaa5bc17
add ebx, dword [ebp - 0x38]
mov edi, 0x41077762
add edi, 0xcc60ad58
sub dword [ebp - 0x10], edi
mov esi, dword [ebx]
mov dword [ebp - 0x18], 0x61e16ec6
xor esi, edi
sub dword [ebp - 0x2c], eax
mov dword [edx], esi
add dword [ebp - 0x1c], esi
add edx, 0xa015590e
add edx, 0x5feaa6f6
add ebx, 4
loop 0x4240f5
add eax, 0x11ca3
mov ebx, eax
add eax, 0x931ef552
sub eax, 0x931ef54d
mov ecx, 0x97f43c93
add ecx, 0x684bc36d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401bd7
pop dword [ebp - 0x1c]
mov eax, 0x401bd7
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xf3c7c497
add dword [ebp - 0x2c], 0x5a8a80b4
mov dword [ebp - 0x28], 0xe5053696
add dword [ebp - 0x28], 0x4d2e15af
mov dword [ebp - 0x24], 0x7966d9fb
sub dword [ebp - 0x24], 0x2d1a95cd
mov dword [ebp - 0x20], 0x96f08c9
sub dword [ebp - 0x20], 0x96f08c9
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x10644249
add eax, 0xefdc2e17
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xc96c7abc
sub dword [ebp - 0x2c], 0x54fa1166
mov dword [ebp - 0x28], 0x10ab65bc
sub dword [ebp - 0x28], 0xcf3f0447
mov dword [ebp - 0x24], 0x25bd50f4
add dword [ebp - 0x24], 0x3db21b78
mov dword [ebp - 0x20], 0xb3dcf7f7
sub dword [ebp - 0x20], 0xb3dcf7f7
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xf11b2973
add eax, 0xf25478d
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x39cdf
push 0
call eax
mov ecx, 0x436490e4
sub ecx, 0x43643bf9
xor edi, edi
add edi, eax
mov ebx, 0x42157dd2
add ebx, 0xbe2b822e
add ebx, dword [ebp - 0x1c]
mov esi, 0x29f1172
add esi, 0x27a5cca5
xor dword [ebp - 8], ebx
mov edx, dword [ebx]
add dword [ebp - 0xc], 0x63d5c518
sub edx, esi
xor dword [ebp - 0x14], 0xe60c9c32
mov dword [edi], edx
add dword [ebp - 0x14], 0xe1c8d8df
add edi, 4
add ebx, 0x492501df
add ebx, 0xb6dafe25
loop 0x401cf6
add eax, 0xa2b56f90
sub eax, 0xa2b42911
xor ebx, ebx
add ebx, eax
add eax, 0x3e41591b
add eax, 0xc1bea6ea
mov ecx, 0x2008b63f
add ecx, 0xe03749c1
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x6f33563e
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
ret 8

Function at 0x6f335668
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x6f34110c]
push ebx
push esi
push 0xf003f
push dword [ebp + 0x19c]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp + 0x190], eax
mov dword [ebp - 0x74], esi
call fcn.6f335609
cmp eax, esi
jne 0x6f3356f0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x6f3356b9
lea eax, [ebp - 0x70]
push eax
call fcn.6f335668
cmp eax, esi
jne 0x6f3356ef
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x74]
je 0x6f3356ac
call fcn.6f3355a4
push dword [ebp + 0x19c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6f3355a4
mov ecx, dword [ebp + 0x190]
mov eax, esi
pop esi
pop ebx
call fcn.6f339880
add ebp, 0x194
leave
ret 4
Function at 0x6f338ac3
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
xor edi, edi
cmp eax, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
je 0x6f338ae3
mov edi, dword [eax + 8]
cmp dword [ebp + 0xc], ebx
je 0x6f338afa
jl 0x6f338afa
mov esi, 0x80070057
push esi
push 0x307025e
jmp 0x6f338b95
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 2
push 0x6f331258
push edi
call fcn.6f33efb2
mov esi, eax
cmp esi, ebx
je 0x6f338b24
push esi
push 0x311025e
push edi
call fcn.6f33d289
jmp 0x6f338b9a
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x6f331e54
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
je 0x6f338b51
push esi
push 0x31d025e
jmp 0x6f338b95
cmp dword [ebp + 0xc], ebx
je 0x6f338b7b
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push ebx
push 0x6f331e38
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
je 0x6f338b9a
push esi
push 0x32c025e
jmp 0x6f338b95
push 0x6f331e38
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
cmp esi, ebx
je 0x6f338b9a
push esi
push 0x331025e
call fcn.6f33d25f
cmp dword [ebp - 4], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x6f338baa
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
je 0x6f338bb4
push dword [ebp - 8]
call edi
cmp dword [ebp - 0xc], ebx
je 0x6f338bc2
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x6f339880
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6f34110c]
jne 0x6f339889
ret
jmp 0x6f33988e
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x6f34110c]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x6f3422c8]
test eax, eax
je 0x6f3398b2
call eax
cmp dword [0x6f3422cc], 0
je 0x6f3398f9
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x6f3422cc]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.6f339880
add ebp, 0x2a8
leave
ret

Function at 0x6f33d916
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x6f33d942
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x6f33d8ec
call fcn.6f33c4ec
or dword [edx + 0xf], esi
inc eax
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
invalid
test ebp, esp
Function at 0x6f33ee3d
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.6f33ebad
test al, al
je 0x6f33ee97
push dword [ebp + 0xc]
call fcn.6f33ebad
test al, al
jne 0x6f33ee7d
mov esi, 0x80070057
push esi
push 0xf801a0
call fcn.6f33d25f
jmp 0x6f33ef51
mov ecx, edi
call fcn.6f33eaa1
mov esi, eax
cmp esi, ebx
je 0x6f33ee92
push esi
push 0xfc01a0
jmp 0x6f33ee73
mov edi, dword [edi + 4]
jmp 0x6f33eeb2
push dword [ebp + 8]
mov ecx, edi
call fcn.6f33eb39
mov esi, eax
cmp esi, ebx
je 0x6f33eeaf
push esi
push 0x10301a0
jmp 0x6f33ee73
mov edi, dword [edi + 8]
push dword [ebp + 0xc]
call fcn.6f33ebad
test al, al
jne 0x6f33eee6
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
je 0x6f33eee3
push esi
push 0x11201a0
push dword [ebp + 0xc]
jmp 0x6f33ef4c
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
cmp word [eax], bx
jne 0x6f33ef06
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
cmp esi, ebx
je 0x6f33ef51
push esi
push 0x11c01a0
jmp 0x6f33ef49
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.6f33d525
mov esi, eax
cmp esi, ebx
je 0x6f33ef29
push esi
push 0x12601a0
jmp 0x6f33ee73
push dword [ebp + 8]
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
je 0x6f33ef51
push esi
push 0x12f01a0
push dword [ebp + 0x10]
call fcn.6f33d289
cmp dword [ebp - 4], ebx
je 0x6f33ef5f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x6f33ef6d
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call fcn.6f33f8d1
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x6f33fa27
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
push edi
push 3
xor ebx, ebx
pop edi
mov dword [eax], ebx
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 0xc], edi
push edi
jmp 0x6f33fa68
call fcn.6f33f8fc
cmp eax, 0x80070002
mov dword [ebp - 8], eax
jne 0x6f33fa90
cmp dword [ebp - 0xc], edi
jne 0x6f33fac6
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 0xc], ebx
push ebx
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x6f33fa4b
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
jne 0x6f33fa99
mov dword [ebp - 8], 0x8007000e
jmp 0x6f33fabb
cmp eax, 0x800700ea
jne 0x6f33fac6
jmp 0x6f33fa74
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x6f33fab1
call fcn.6f33f8fc
mov dword [ebp - 8], eax
jmp 0x6f33fabb
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor edi, edi
mov dword [ebp - 8], ebx
cmp edi, ebx
je 0x6f33fac6
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4