joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e001137
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x2e001146
pop dword [ebp - 0xc]
mov eax, 0x9341d39b
sub eax, 0x6541c255
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x5764ceb3
sub dword [ebp - 0x1c], 0x9128968
mov dword [ebp - 0x18], 0x90bdd5a7
sub dword [ebp - 0x18], 0x5e8a8962
mov dword [ebp - 0x14], 0xa09495cf
sub dword [ebp - 0x14], 0x544851a1
mov dword [ebp - 0x10], 0x4aa383a4
sub dword [ebp - 0x10], 0x4aa383a4
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x51ae099d
add dword [ebp - 0x1c], 0x22c45fb9
mov dword [ebp - 0x18], 0xf89d0d3e
sub dword [ebp - 0x18], 0xb730abc9
mov dword [ebp - 0x14], 0x32513bc3
sub dword [ebp - 0x14], 0xcee1cf57
mov dword [ebp - 0x10], 0xc2768b81
add dword [ebp - 0x10], 0x3d89747f
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xe6acf07
sub eax, 0xe0679e4b
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x42294
push 0
call eax
mov ecx, 0x31f9688
sub ecx, 0x31f4a45
mov ebx, eax
mov esi, 0x2e057e00
add esi, dword [ebp - 0xc]
mov edi, 0xa3c36658
add dword [ebp - 8], eax
mov edx, dword [esi]
sub dword [ebp - 4], 0xd59a7080
xor edx, edi
xor dword [ebp - 4], 0xcd6ac4ae
mov dword [ebx], edx
sub dword [ebp - 8], ebx
add ebx, 0xa554d1b0
add ebx, 0x5aab2e54
add esi, 0x7599cb69
sub esi, 0x7599cb65
loop 0x2e001257
add eax, 0xee1237fe
add eax, 0x11eeebe1
mov ebx, eax
add eax, 0xe28bb53f
sub eax, 0xe28bb53a
mov ecx, 0x79902e02
sub ecx, 0x4b902e02
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x2e01416e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e0306d8
call fcn.2e001511
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014eb5
test ax, ax
je 0x2e014216
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014216
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01420d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e001137
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014200
push esi
mov ecx, edi
call fcn.2e010e6c
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e001137
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e00155b
ret
Function at 0x2e014ca3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030759
call fcn.2e02e6de
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014da7
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e014b8d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010d8f
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014d65
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014d5c
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e001137
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014d4e
push esi
mov ecx, edi
call fcn.2e010e6c
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e001137
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014da7
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014d9e
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e001137
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e001137
pop ecx
pop ecx
mov al, bl
call fcn.2e02e6bc
ret 8

Function at 0x2e014de1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e03078d
call fcn.2e001511
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014e1b
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014e81
lea eax, [ebp - 0x14]
mov edi, 0x2e033941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014e78
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014e78
inc eax
push eax
call fcn.2e001137
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014e6a
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010e6c
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e001137
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e00155b
ret 8
Function at 0x2e01e565
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030a97
call fcn.2e02e6de
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e683
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e67a
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e001137
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e66d
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010e6c
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e001137
test al, al
jne 0x2e01e620
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e001137
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e623
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e65d
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e654
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e001137
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e001137
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e001137
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e6bc
ret
Function at 0x42b5d0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
test edi, edi
jle 0x42b5e3
call fcn.0042b570
xor byte [edx + esi], al
inc edx
cmp edx, edi
jl 0x42b5d6
cmp edi, 0x2d
jne 0x42b5fc
mov dword [0x2bdf6d8], 0xa62e7790
mov dword [0x2bdf6dc], 0xffffffff
ret

Function at 0x42b600
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x437004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x437dd0]
push esi
mov esi, dword [0x2bdd24c]
push edi
mov edi, dword [0x2bdf6cc]
call fcn.0042b5a0
cmp dword [0x2bdf6cc], 0x2f
jne 0x42b66d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0042b5d0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.004010d6
add esp, 0x24
ret
Function at 0x42b8e0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0x42b8f8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x42b939
mov dword [0x2bdf334], 0x8e46a6f0
cmp dword [0x2bdf6cc], 0x3dc
jne 0x42b937
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
jmp 0x42b8ef
mov dword [ebp - 0x10], 0
jmp 0x42b94b
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x42b9e6
cmp dword [0x2bdf6cc], 0xa5f
jne 0x42b96c
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [ebp - 0x10], 0x84620b
jne 0x42b991
mov eax, dword [0x438bf0]
mov dword [0x2bdf6cc], eax
mov ecx, dword [0x2bdf6cc]
add ecx, 0xa231
mov dword [0x2bdf6cc], ecx
cmp dword [0x2bdf6cc], 0x141
jne 0x42b9e1
xor edx, edx
mov word [ebp - 0x24], dx
xor eax, eax
mov word [ebp - 0x22], ax
xor ecx, ecx
mov word [ebp - 0x20], cx
xor edx, edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputA]
mov dword [0x43a1b8], 0xec58acac
mov dword [0x43a1bc], 0xffffffff
jmp 0x42b942
call fcn.0042b690
jmp dword [0x2bdd24c]
Function at 0x100024e3
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x454
mov eax, dword [0x1006a1fc]
xor eax, esp
mov dword [esp + 0x450], eax
push esi
mov esi, dword [esp + 0x45c]
push edi
mov edi, dword [esp + 0x464]
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
push 0
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0x58
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call esi
push 0x5a
push dword [esp + 0x1c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x1c], xmm0
call esi
movss xmm0, dword [esp + 0x14]
mulss xmm0, dword [0x10046d40]
push 1
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm0, dword [0x10046d58]
cvttss2si eax, xmm0
mov dword [esp + 0xc], eax
imul eax, dword [esp + 0x46c], 0xa
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
divss xmm0, dword [0x10046d58]
cvttss2si eax, xmm0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DPtoLP]
movd xmm0, dword [esp + 0xc]
cvtdq2pd xmm0, xmm0
push 0x400
andps xmm0, xmmword [0x10046d60]
divsd xmm0, qword [0x10046d50]
addsd xmm0, qword [0x10046d48]
cvttsd2si eax, xmm0
neg eax
mov dword [esp + 0x20], eax
xor eax, eax
cmp dword [esp + 0x470], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
setne byte [esp + 0x35]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x34], al
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], ax
mov eax, dword [esp + 0x474]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [esp + 0x30], eax
lea eax, [esp + 0x5c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [esp + 0x5c]
push 0x10044eac
push eax
call fcn.100233a0
test eax, eax
mov ecx, 0x10044eb4
lea eax, [esp + 0x44]
cmovne ecx, edi
push ecx
push 0x20
push eax
call fcn.10032391
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [esp + 0x10]
mov esi, eax
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [esp + 0x458]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1001df6b
add esp, 0x454
ret 0x14
Function at 0x10008eeb
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x454
mov eax, dword [0x1006a1fc]
xor eax, esp
mov dword [esp + 0x450], eax
push esi
mov esi, dword [esp + 0x45c]
push edi
mov edi, dword [esp + 0x464]
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
push 0
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0x58
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call esi
push 0x5a
push dword [esp + 0x1c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x1c], xmm0
call esi
movss xmm0, dword [esp + 0x14]
mulss xmm0, dword [0x10046d40]
push 1
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm0, dword [0x10046d58]
cvttss2si eax, xmm0
mov dword [esp + 0xc], eax
imul eax, dword [esp + 0x46c], 0xa
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
divss xmm0, dword [0x10046d58]
cvttss2si eax, xmm0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DPtoLP]
movd xmm0, dword [esp + 0xc]
cvtdq2pd xmm0, xmm0
push 0x400
andps xmm0, xmmword [0x10046d60]
divsd xmm0, qword [0x10046d50]
addsd xmm0, qword [0x10046d48]
cvttsd2si eax, xmm0
neg eax
mov dword [esp + 0x20], eax
xor eax, eax
cmp dword [esp + 0x470], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
setne byte [esp + 0x35]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x34], al
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], ax
mov eax, dword [esp + 0x474]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [esp + 0x30], eax
lea eax, [esp + 0x5c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [esp + 0x5c]
push 0x10046ddc
push eax
call fcn.100233a0
test eax, eax
mov ecx, 0x10046de4
lea eax, [esp + 0x44]
cmovne ecx, edi
push ecx
push 0x20
push eax
call fcn.10032391
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [esp + 0x10]
mov esi, eax
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [esp + 0x458]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1001df6b
add esp, 0x454
ret 0x14
Function at 0x1000cf1a
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x1006a1fc]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push ebx
push dword [edi]
call fcn.10032391
mov esi, eax
test esi, esi
jne 0x1000cfc9
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000cfa4
lea eax, [esp + 0x28]
push eax
call fcn.1000cf1a
mov esi, eax
test esi, esi
jne 0x1000cfc9
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x30]
mov dword [esp + 0x30], 0x100
call ebp
lea ecx, [esp + 0x14]
test eax, eax
je 0x1000cf7f
call fcn.10003fa0
push ebx
mov ecx, edi
call fcn.1000c8c8
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.10003fa0
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001df6b
add esp, 0x11c
ret 4
Function at 0x1000e480
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
mov eax, 0x114c
call fcn.1001e1d0
mov eax, dword [0x1006a1fc]
xor eax, esp
mov dword [esp + 0x1148], eax
push ebx
mov ebx, dword [esp + 0x1154]
lea eax, [esp + 0x14c]
push ebp
push esi
push edi
mov ebp, 0x800
xor esi, esi
push ebp
push esi
push eax
mov dword [esp + 0x1c], esi
call fcn.10020dd0
push ebp
lea eax, [esp + 0x968]
push esi
push eax
call fcn.10020dd0
push str.SOFTWAREMozillaMozilla_Firefox
lea eax, [esp + 0x174]
mov dword [esp + 0x30], ebp
push ebp
push eax
call fcn.10032391
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0x34]
add esp, 0x24
push eax
lea eax, [esp + 0x15c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x1000e532
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x95c]
push eax
push esi
push esi
push 0x1004a76c
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
test eax, eax
je 0x1000e54d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x1158]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001df6b
add esp, 0x114c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [esp + 0x958]
push eax
lea eax, [esp + 0x15c]
push str.SOFTWAREMozillaMozilla_Firefox_sMain
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x15c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x1000e532
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x800
push eax
push ebx
xor ebp, ebp
push ebp
push ebp
push 0x1004a7a8
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
test eax, eax
je 0x1000e5b7
call esi
jmp 0x1000e532
call esi
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000e5be
sub ecx, edx
cmp byte [ecx + ebx - 1], 0x5c
je 0x1000e5e2
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000e5d1
mov ax, word [0x1004a7bc]
mov word [edi], ax
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000e5e5
mov esi, str.extensions
lea eax, [esp + 0x18]
push eax
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x1000e619
push ebp
push ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000e62b
jmp 0x1000e532
push eax
call dword [sym.imp.kernel32.dll_FindClose]
test byte [esp + 0x18], 0x10
je 0x1000e532
xor eax, eax
inc eax
jmp 0x1000e534
Function at 0x1000e633
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x10c4]
mov eax, 0x1144
call fcn.1001e1d0
mov eax, dword [0x1006a1fc]
xor eax, ebp
mov dword [ebp + 0x10c0], eax
push esi
push edi
mov edi, dword [ebp + 0x10cc]
lea eax, [ebp - 0x80]
push 0x140
push 0
push eax
call fcn.10020dd0
push edi
lea eax, [ebp + 0xc0]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xc0]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000e753
lea eax, [ebp - 0x54]
push 0x1004a7ec
push eax
call fcn.10032391
pop ecx
pop ecx
test eax, eax
je 0x1000e71f
lea eax, [ebp - 0x54]
push 0x1004a7f0
push eax
call fcn.10032391
pop ecx
pop ecx
test eax, eax
je 0x1000e71f
lea eax, [ebp - 0x54]
push eax
push edi
lea eax, [ebp + 0x8c0]
push 0x1004a7f4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x80]
add esp, 0x10
and eax, 0xfffffffe
push eax
lea eax, [ebp + 0x8c0]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test byte [ebp - 0x80], 0x10
lea eax, [ebp + 0x8c0]
push eax
jne 0x1000e719
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x1000e71f
push eax
lea eax, [ebp + 0x8c0]
push eax
call fcn.1000b54d
pop ecx
jmp 0x1000e71e
call fcn.1000e633
pop ecx
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x1000e69c
push esi
call dword [sym.imp.kernel32.dll_FindClose]
push edi
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
mov esi, eax
test esi, esi
jne 0x1000e74f
push eax
push edi
call fcn.1000b54d
pop ecx
pop ecx
mov eax, esi
jmp 0x1000e756
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x10c0]
pop edi
xor ecx, ebp
pop esi
call fcn.1001df6b
add ebp, 0x10c4
leave
ret

Function at 0x100117ed
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, 0x8c
test esi, esi
lea edx, [esi + 0xc]
cmove edx, eax
push edx
mov eax, dword [edx]
call dword [eax + 0x18]
push 0x58
test esi, esi
lea eax, [esi - 0x28]
pop ecx
cmove eax, ecx
pop esi
cmp dword [eax], 0
je 0x1001181e
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 8
Function at 0x100153fb
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x974
mov eax, dword [0x1006a1fc]
xor eax, esp
mov dword [esp + 0x970], eax
push ebx
push ebp
xor ebp, ebp
mov ebx, 0x400
push esi
mov esi, dword [esp + 0x99c]
inc ebp
push edi
mov edi, dword [esp + 0x988]
test esi, esi
jne 0x10015452
push ebx
lea eax, [esp + 0x584]
push eax
push ebp
push edi
call fcn.1001a9f6
add esp, 0x10
test eax, eax
je 0x10015452
mov eax, str._s_ssvagent.exe
lea esi, [esp + 0x580]
jmp 0x10015467
test edi, edi
jne 0x100155b7
test esi, esi
je 0x100155b7
mov eax, str._s_bin_ssvagent.exe
push esi
push eax
lea eax, [esp + 0x188]
push ebx
push eax
call fcn.100082eb
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x194]
push eax
call fcn.10032391
add esp, 0x18
test eax, eax
jne 0x100155b7
cmp dword [esp + 0x98c], 0
mov ecx, str.__new
mov byte [esp + 0x7c], al
mov ebx, 0x104
mov eax, str.__old
cmovne eax, ecx
push eax
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.10032391
mov edi, dword [esp + 0x99c]
add esp, 0xc
mov esi, dword [esp + 0x99c]
test edi, edi
jne 0x100154da
test esi, esi
je 0x100154f0
push str.__high
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.10032391
add esp, 0xc
cmp dword [esp + 0x998], 0
je 0x10015510
push str.__settreatas
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.10032391
add esp, 0xc
test esi, esi
je 0x1001552a
push str.__regdeploy
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.10032391
add esp, 0xc
push 0x3c
pop esi
push esi
lea eax, [esp + 0x14]
push 0
push eax
call fcn.10020dd0
add esp, 0xc
mov dword [esp + 0x10], esi
lea eax, [esp + 0x7c]
mov dword [esp + 0x24], eax
test edi, edi
je 0x10015562
call fcn.10032391
test eax, eax
mov ecx, str.runas
cmove ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x994], 0
push 0x40
pop ecx
cmovne eax, ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x14], eax
lea eax, [esp + 0x180]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x100155b7
cmp dword [esp + 0x48], 0
je 0x100155b3
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [esp + 0x48]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, ebp
jmp 0x100155b9
xor eax, eax
mov ecx, dword [esp + 0x980]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001df6b
add esp, 0x974
ret