joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cbf0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [eax]
movzx ecx, word [ebx + 0x14]
push ebp
xor edx, edx
xor ebp, ebp
lea eax, [ecx + ebx + 0x18]
cmp dx, word [ebx + 6]
jae 0x1001cca9
push edi
lea edi, [eax + 0x24]
push esi
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x1001cc47
mov eax, dword [edi - 0x14]
mov ecx, dword [edi - 0x1c]
push 0x4000
push eax
push ecx
call dword [0xd49158]
jmp 0x1001cc91
lea edx, [edx + ecx*2]
lea ecx, [esi + edx*2]
mov edx, dword [ecx*4 + 0xd5b408]
test eax, 0x4000000
je 0x1001cc61
or edx, 0x200
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x1001cc7c
test al, 0x40
je 0x1001cc71
mov ecx, dword [ebx + 0x20]
jmp 0x1001cc78
test al, al
jns 0x1001cc91
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x1001cc91
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [0xd49178]
test eax, eax
je 0x1001cca7
mov edx, dword [esp + 0x18]
mov ebx, dword [edx]
movzx eax, word [ebx + 6]
inc ebp
add edi, 0x28
cmp ebp, eax
jl 0x1001cc14
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1001cfc0
Capabilities:
Parse pe header

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov eax, 0x5a4d
push esi
push edi
cmp word [ebp], ax
jne 0x1001d0d3
mov ebx, dword [ebp + 0x3c]
add ebx, ebp
cmp dword [ebx], 0x4550
jne 0x1001d0d3
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x34]
mov esi, dword [0xd49174]
push 0x40
push 0x2000
push ecx
push edx
call esi
mov edi, eax
test edi, edi
jne 0x1001d01d
mov eax, dword [ebx + 0x50]
push 0x40
push 0x2000
push eax
push edi
call esi
mov edi, eax
test edi, edi
je 0x1001d0d3
push 0x14
push 0
call dword [0xd4915c]
push eax
call dword [0xd49150]
mov esi, eax
xor eax, eax
push 0x40
mov dword [esi + 4], edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov ecx, dword [ebx + 0x50]
push 0x1000
push ecx
push edi
call dword [0xd49174]
mov edx, dword [ebx + 0x54]
push 0x40
push 0x1000
push edx
push edi
call dword [0xd49174]
mov ecx, dword [ebx + 0x54]
add ecx, dword [ebp + 0x3c]
mov dword [esp + 0x14], eax
push ecx
push ebp
push eax
call fcn.1009aea0
mov eax, dword [esp + 0x20]
add eax, dword [ebp + 0x3c]
add esp, 0xc
push esi
push ebx
mov dword [esi], eax
push ebp
mov dword [eax + 0x34], edi
call fcn.1001cb40
mov eax, edi
add esp, 0xc
sub eax, dword [ebx + 0x34]
je 0x1001d0a0
push eax
mov eax, esi
call fcn.1001ccb0
add esp, 4
push esi
call fcn.1001cd30
add esp, 4
test eax, eax
je 0x1001d0ce
push esi
call fcn.1001cbf0
mov ecx, dword [esi]
mov eax, dword [ecx + 0x28]
add esp, 4
test eax, eax
je 0x1001d0e1
add eax, edi
je 0x1001d0ce
push 0
push 1
push edi
call eax
test eax, eax
jne 0x1001d0da
call fcn.1001d190
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x10], 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x1001d220
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0xd5dec0], eax
mov edx, 1
mov eax, 0xd5dec0
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0xd5e87c
jl 0x1001d230
mov dword [0xd5b404], 1
mov dword [0xd608e0], 1
pop edi
ret

Function at 0x1001d270
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0xd608e0], 0
push esi
mov esi, 0xd5dec0
jne 0x1001d28a
call dword [0xd492cc]
call fcn.1001d220
mov dword [0xd5b404], 0x270
mov dword [0xd5debc], esi
mov ecx, 0xe3
nop
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi + 0x634]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x1001d2a0
mov ecx, 0x18c
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi - 0x38c]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x1001d2d5
mov ecx, dword [esi]
mov eax, dword [0xd5dec0]
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, dword [esi]
and al, 1
movzx edx, al
shr ecx, 1
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor ecx, edx
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
ret

Function at 0x10022870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xd61028
call fcn.10021800
push 0
push 0
push 0xd5d990
push 0xcab500
push 0
push 0
call fcn.1009397b
push 7
mov dword [0xd5d9a4], eax
mov dword [0xd5b438], 1
call fcn.100938b6
add esp, 0x1c
mov eax, 7
mov esp, ebp
pop ebp
ret
Function at 0x1002b920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov al, byte [0xd5b460]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], al
mov dword [esp + 0xe], 0x3e3c0928
mov dword [esp + 0x12], 0x2d2b3d3a
mov dword [esp + 0x16], 0x7e212f2a
mov dword [esp + 0x1a], 0x5b5e7c26
mov word [esp + 0x1e], 0x3f2e
mov byte [esp + 0x20], 0
mov edi, ebp
test ebp, ebp
je 0x1002b98b
mov dl, byte [ebp]
test dl, dl
je 0x1002b98b
lea ecx, [esp + 0xc]
mov al, 0x20
cmp dl, al
je 0x1002b9de
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x1002b977
mov dl, byte [edi + 1]
inc edi
test dl, dl
jne 0x1002b971
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002b990
sub eax, edx
lea edi, [eax + ebp - 1]
cmp edi, ebp
jbe 0x1002b9b0
mov al, byte [edi]
cmp al, 0x20
je 0x1002b9ab
cmp al, 9
jne 0x1002b9b0
dec edi
cmp edi, ebp
ja 0x1002b9a1
mov esi, edi
sub esi, ebp
inc esi
cmp esi, 0xfd
jbe 0x1002b9e5
cmp byte [esp + 0x30], 0
je 0x1002b9d3
mov ecx, dword [esp + 0x28]
push ebp
push 0xd50db4
call fcn.1003f250
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x18
ret 0xc
cmp edi, ebp
jbe 0x1002b9b0
dec edi
jmp 0x1002b99d
push esi
push ebp
push ebx
call fcn.10094300
add esp, 0xc
mov eax, edi
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x10069810
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1fc
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
push 0
push 0
lea eax, [ebp + 0xc]
push eax
push ecx
call fcn.10068cb0
mov edi, dword [ebp + 0xc]
mov ebx, eax
add esp, 0x10
mov dword [esp + 0x18], ebx
call fcn.1001fb00
mov dword [esp + 0x14], eax
test eax, eax
jne 0x10069893
mov edx, dword [0xd5b4d8]
cmp byte [edx + 0xe0], al
jne 0x10069876
mov eax, dword [0xd5f780]
push eax
or eax, 0xffffffff
mov ecx, 0xd4c008
call fcn.10001df0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ebp + 8]
push 0xd4bc99
push 0
push 0xd4c008
call fcn.1003ec60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test ebx, ebx
jne 0x100698c2
mov ecx, dword [0xd5b4d8]
cmp byte [ecx + 0xe0], bl
jne 0x10069876
mov edx, dword [0xd5f780]
push edx
or eax, 0xffffffff
mov ecx, 0xd4c008
call fcn.10001df0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
push eax
mov edi, ebx
push edi
call fcn.10072190
mov ebx, eax
mov dword [esp + 0x20], ebx
cmp ebx, dword [edi + 0x10]
jb 0x100698ea
mov edi, dword [ebp + 8]
call fcn.10040b80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 1
mov edx, edi
mov eax, dword [edx + 0x18]
push 0
lea ecx, [ebx + ebx*4]
lea edi, [eax + ecx*4]
mov ecx, dword [0xd5f780]
push 0xffffffffffffffff
push 0xd4bfbc
mov dword [esp + 0x2c], edi
call fcn.100811b0
mov ecx, dword [0xd60f34]
mov edx, dword [0xd60f38]
xor eax, eax
mov dword [0xd60f34], eax
mov dword [0xd60f38], eax
mov byte [esp + 0x13], al
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x2c], 1
cmp eax, 0xc
ja 0x10069dbf
jmp dword [eax*4 + 0xd09ad4]
mov bl, byte [edi + 6]
mov ecx, dword [esp + 0x18]
call fcn.100748c0
test eax, eax
je 0x10069e12
mov eax, dword [edi]
push eax
call dword [0xd49514]
test eax, eax
je 0x10069e12
mov edx, dword [edi]
lea ecx, [esp + 0x30]
push ecx
push edx
call dword [0xd494f4]
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 4]
push 2
lea eax, [esp + 0x34]
push eax
push ecx
push 0
call dword [0xd49470]
mov eax, dword [esi + 4]
push 1
lea edx, [esp + 0x34]
push edx
push eax
call dword [0xd495fc]
mov esi, dword [esp + 0x4c]
test esi, esi
je 0x10069e4e
mov eax, dword [0xd60f34]
test eax, eax
je 0x10069e3e
push eax
call fcn.100918f3
add esp, 4
cmp dword [0xd60f38], 0x400000
jbe 0x10069e3e
dec dword [0xd60f3c]
mov ecx, dword [esp + 0x48]
mov dword [0xd60f34], esi
mov dword [0xd60f38], ecx
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1023ac6
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x107c472
call fcn.01032938
sub esp, 0x218
mov eax, dword [0x109126c]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x214], esi
push 0x2001f
push eax
push dword [ebx]
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], esi
call fcn.01021f63
cmp eax, esi
jne 0x1023b6f
push edi
mov edi, dword [entry0]
jmp 0x1023b26
lea eax, [ebp - 0x210]
push eax
call fcn.01023ac6
cmp eax, esi
jne 0x1023b6e
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x214]
je 0x1023b16
call fcn.01021ef0
push dword [ebp - 0x21c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.01021ef0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0102a8ee
leave
ret 4

Function at 0x1027f25
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
mov esi, ecx
add ecx, 0xffffff8c
neg esi
sbb esi, esi
and esi, ecx
lea eax, [esi + 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x50]
test esi, esi
je 0x1027f4f
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x10281fa
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
mov esi, ecx
add ecx, 0xffffff74
neg esi
sbb esi, esi
and esi, ecx
lea eax, [esi + 0x98]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x68]
test esi, esi
je 0x1028227
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8
Function at 0x102e6c9
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x109126c]
and dword [ebp - 0x218], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push eax
push 0x1c
push 0
mov dword [ebp - 0x214], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, eax
test esi, esi
jl 0x102e7da
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x102e753
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x102e73e
call esi
mov esi, eax
jmp 0x102e7da
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x102e7da
lea eax, [ebp - 0x210]
push eax
call fcn.0102d36b
test edi, edi
je 0x102e7c6
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0x210]
push ebx
push eax
call esi
mov edi, dword [sym.imp.msvcrt.dll_wcsncat]
mov ebx, 0x104
mov ecx, ebx
sub ecx, eax
push ecx
lea eax, [ebp - 0x210]
push 0x1003768
push eax
call edi
and word [ebp - 8], 0
lea eax, [ebp - 0x210]
push eax
call esi
sub ebx, eax
push ebx
push dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
call edi
and word [ebp - 8], 0
add esp, 0x20
lea eax, [ebp - 0x210]
push eax
call fcn.0102d36b
pop ebx
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push eax
call fcn.010293c1
xor esi, esi
cmp dword [ebp - 0x218], 0
je 0x102e81d
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x102e81d
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x102e81d
push dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.0102a8ee
leave
ret 8

Function at 0x102f909
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
mov dword [esi], ebx
push edi
mov byte [eax], bl
lea eax, [ebp + 0x17]
push eax
mov edi, ecx
call fcn.0102f8a7
cmp eax, ebx
jl 0x102f997
cmp byte [ebp + 0x17], bl
je 0x102f995
push dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push dword [ebp + 8]
push dword [edi + 8]
call esi
cmp eax, ebx
je 0x102f963
cmp eax, 2
je 0x102f995
cmp eax, ebx
jle 0x102f997
and eax, 0xffff
or eax, 0x80070000
jmp 0x102f997
mov eax, dword [ebp + 0x10]
push dword [eax]
mov ecx, dword [ebp + 0xc]
push ebx
call fcn.010324a9
cmp eax, ebx
jl 0x102f997
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
call fcn.0103238a
push eax
push ebx
push ebx
push dword [ebp + 8]
push dword [edi + 8]
call esi
cmp eax, ebx
jne 0x102f955
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x1031ad1
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], edi
mov ecx, 0x80070057
jne 0x1031aef
mov esi, ecx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1031afb
cmp word [eax], bx
jne 0x1031afd
mov esi, ecx
cmp esi, ebx
jl 0x1031bd9
mov ecx, edi
call fcn.010316bc
push dword [ebp + 8]
lea eax, [edi + 0x20]
push eax
call fcn.010252ca
push 0x40
push 1
push ebx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea esi, [edi + 0x24]
push esi
call ebx
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x1031b5c
call edi
cmp eax, 0x80090016
je 0x1031b4d
test eax, eax
jle 0x1031bba
and eax, 0xffff
or eax, 0x80070000
jmp 0x1031bba
push 0x48
push 1
push 0
push 0
push esi
call ebx
test eax, eax
je 0x1031bb2
mov ebx, dword [ebp - 4]
add ebx, 0x2c
push ebx
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1031bb2
push 0
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
shl eax, 1
push eax
push dword [ebp + 0xc]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1031bb2
mov eax, dword [ebp - 4]
add eax, 0x28
push eax
push 1
push dword [ebx]
push 0x6801
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1031bd0
call edi
test eax, eax
jg 0x1031bbe
call edi
mov esi, eax
jmp 0x1031bd2
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1031bd2
xor esi, esi
test esi, esi
jge 0x1031be0
mov edi, dword [ebp - 4]
mov ecx, edi
call fcn.010316bc
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x1046908
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x107e8e1
call fcn.01032938
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], esi
call fcn.01024147
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
push ebx
push 1
push 0x1001b24
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 3
call fcn.0102d2db
push ebx
push 1
push 0x10017f4
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 4
call fcn.0102d2db
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 5
call fcn.01051553
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov edi, 0xfefefefe
mov dword [esi + 0xc0], edi
lea ecx, [esi + 0xc4]
mov byte [ebp - 4], 0xf
call fcn.010501f3
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], edi
lea ecx, [esi + 0x120]
mov byte [ebp - 4], 0x12
call fcn.010501f3
mov dword [esi + 0x174], ebx
mov dword [esi + 0x178], ebx
mov dword [esi + 0x17c], edi
lea ecx, [esi + 0x180]
mov byte [ebp - 4], 0x16
call fcn.010501f3
mov dword [esi + 0x1d4], ebx
mov dword [esi + 0x1d8], ebx
mov byte [ebp - 4], 0x19
lea ecx, [esi + 0x1dc]
call fcn.0103232d
lea eax, [ebp - 0xd]
push eax
lea ecx, [esi + 0x1ec]
mov byte [ebp - 4], 0x1a
call fcn.01044a1c
lea ecx, [esi + 0x1f8]
mov byte [ebp - 4], 0x1b
call fcn.0103232d
lea ecx, [esi + 0x208]
mov byte [ebp - 4], 0x1c
call fcn.01050c98
lea eax, [ebp - 0xd]
push eax
lea ecx, [esi + 0x228]
mov byte [ebp - 4], 0x1d
call fcn.0103e4f0
or dword [esi + 0x84], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x28], bl
mov byte [esi + 0x29], bl
mov byte [esi + 0x2b], bl
mov byte [esi + 0x2c], bl
mov byte [esi + 0x2d], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x40], ebx
mov byte [esi + 0x89], bl
mov byte [esi + 0x88], bl
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0x1e8], ebx
mov dword [esi + 0x204], ebx
pop edi
mov byte [esi + 0x2a], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x104835f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x107eaa8
call fcn.01032938
push ecx
push ecx
push esi
mov esi, ecx
push edi
lea eax, [ebp - 0xd]
xor edi, edi
push eax
lea ecx, [esi + 0x14]
mov dword [ebp - 0x14], esi
mov dword [esi + 0xc], edi
call fcn.01047e89
lea eax, [ebp - 0xd]
push eax
lea ecx, [esi + 0x20]
mov dword [ebp - 4], edi
call fcn.01033296
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x2c], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10616d7
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
cmp ebx, eax
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
je 0x10617a7
cmp dword [ebp + 0xc], eax
je 0x10617a7
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
push 0x40
call edi
test eax, eax
mov dword [ebp - 4], eax
jne 0x1061723
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x10617ae
push eax
push ebx
mov ecx, esi
call fcn.0106167a
test eax, eax
mov dword [ebp + 8], eax
jne 0x10617c3
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
lea eax, [ebp - 8]
push eax
push 0
push 1
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x1061715
mov eax, dword [ebp - 8]
lea eax, [eax + eax + 2]
push eax
push 0x40
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 0xc], edi
je 0x1061715
lea eax, [ebp - 8]
push eax
push edi
push 1
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1061780
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x1061799
mov eax, dword [ebp - 8]
cmp word [edi + eax*2 - 2], 0xa
jne 0x1061799
lea eax, [edi + eax*2 - 4]
cmp word [eax], 0xd
jne 0x1061799
and word [eax], 0
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x10617ae
mov dword [ebp + 8], 0x57
cmp dword [ebp + 8], 0
je 0x10617c3
cmp dword [ebp - 0xc], 0
je 0x10617c3
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x10617d5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 8]
leave
ret 8

Function at 0x10637cf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x101729c
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1063827
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1004a62
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x106381a
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1063829
xor eax, eax
pop esi
leave
ret 4
Function at 0x1071ae8
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1081b6e
call fcn.01032938
sub esp, 0x4c
push ebx
push esi
push edi
lea eax, [ebp + 0xb]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.010293e8
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], 0x3c
call fcn.0102e867
xor edi, edi
mov esi, eax
inc edi
cmp esi, ebx
jl 0x1071b9d
mov eax, dword [ebp - 0x18]
cmp eax, ebx
mov dword [ebp - 0x54], 0x400
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], 0x101a9c4
mov dword [ebp - 0x48], 0x1003ac8
je 0x1071b51
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1071b60
cmp word [eax], bx
mov dword [ebp - 0x44], eax
jne 0x1071b63
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1071b9b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1071b89
call esi
mov esi, eax
jmp 0x1071b9d
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1071b9d
xor esi, esi
cmp dword [ebp - 0x20], ebx
je 0x1071bab
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea ecx, [ebp - 0x1c]
call fcn.01025782
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x1074dc4
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0106cb1f
push 0
push 1
mov ecx, ebx
call fcn.01073bf3
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.01073a35
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
je 0x1074e14
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push 1
push esi
push esi
mov byte [ebx + 0x44], 0
mov byte [ebx + 0x38], 0
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x1074e5a
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x1074e5a
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x1074d06
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
jne 0x1074e7e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1074e6c
call esi
mov esi, eax
jmp 0x1074e82
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1074e82
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18