joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445180
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov esi, eax
mov eax, dword [esi]
call fcn.0044509c
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.0044509c
mov esi, eax
mov eax, 0xc6ef3720
mov ecx, dword [0x6095cc]
mov edx, dword [0x6095d0]
mov dword [esp + 4], edx
mov edx, dword [0x6095d4]
mov dword [esp + 8], edx
mov edx, dword [0x6095d8]
mov dword [esp + 0xc], edx
mov edx, 0x20
mov edi, ebx
shl edi, 4
mov ebp, dword [esp + 8]
xor ebp, ebx
add edi, ebp
mov ebp, ebx
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 0xc]
sub esi, edi
mov edi, esi
shl edi, 4
mov ebp, esi
xor ebp, ecx
add edi, ebp
mov ebp, esi
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 4]
sub ebx, edi
sub eax, 0x9e3779b9
dec edx
jne 0x4451cf
mov eax, ebx
call fcn.0044509c
mov edx, dword [esp]
mov dword [edx], eax
mov eax, esi
call fcn.0044509c
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x460054
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov edx, dword [0x604a90]
mov dl, byte [edx]
mov byte [ebp - 1], dl
mov ecx, eax
mov dl, 1
mov eax, dword [0x45afd0]
call fcn.0045fec8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x460124
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.0045ff40
test al, al
je 0x46010e
cmp word [ebp - 4], 0x5a4d
jne 0x46010e
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.00426790
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0045ff40
test al, al
je 0x46010e
cmp dword [ebp - 8], 0
je 0x46010e
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.00426790
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0045ff40
test al, al
je 0x46010e
cmp dword [ebp - 0xc], 0x4550
jne 0x46010e
lea edx, [ebp - 0x24]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.0045ff40
test al, al
je 0x46010e
test byte [ebp - 0x11], 0x20
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46012b
mov eax, dword [ebp - 0x10]
call fcn.00403e50
ret
Function at 0x460134
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4602cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x45afd0]
call fcn.0045fec8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4602ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.0045ff40
test al, al
je 0x460298
cmp word [ebp - 4], 0x5a4d
jne 0x460298
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.00426790
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0045ff40
test al, al
je 0x460298
cmp dword [ebp - 8], 0
je 0x460298
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.00426790
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0045ff40
test al, al
je 0x460298
cmp dword [ebp - 0xc], 0x4550
jne 0x460298
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.0045ff40
test al, al
je 0x460294
test byte [ebp - 0x15], 0x20
je 0x460294
push 2
push 0
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0045b8e0
mov eax, dword [ebp - 0x2c]
call fcn.00405250
push eax
call fcn.00407d64
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x46028d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x4602dc
mov eax, dword [ebp - 0x14]
push eax
call fcn.00407aa4
test eax, eax
je 0x460272
push 0xa
push 0x4602e8
mov eax, dword [ebp - 0x14]
push eax
call fcn.00407aa4
test eax, eax
je 0x460272
mov byte [ebp - 1], 2
jmp 0x460276
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460298
mov eax, dword [ebp - 0x14]
push eax
call fcn.00407abc
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4602b5
mov eax, dword [ebp - 0x10]
call fcn.00403e50
ret
Function at 0x462a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x462be6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
lea edx, [ebp - 5]
mov ecx, 1
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f6
jb 0x462a92
cmp byte [ebp - 5], 0x80
jb 0x462a92
and byte [ebp - 5], 0x7f
mov byte [ebp - 6], 1
xor edx, edx
mov dl, byte [ebp - 5]
mov eax, ebx
call fcn.00402df0
xor ecx, ecx
mov cl, byte [ebp - 5]
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f4
jb 0x462bb9
cmp byte [esi + 0x3b], 0
je 0x462af5
mov eax, dword [0x6099b8]
mov edx, dword [esi + 0x37]
call fcn.0040519c
je 0x462ae4
mov eax, dword [esi + 0x37]
call fcn.00445230
mov eax, 0x6099b8
mov edx, dword [esi + 0x37]
call fcn.00404db8
xor ecx, ecx
mov cl, byte [ebx]
lea edx, [ebx + 1]
lea eax, [ebx + 1]
call fcn.004452d0
jmp 0x462b47
cmp byte [ebx], 0
je 0x462b47
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404fd8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004456ac
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, 0xff
call fcn.0040502c
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404fd8
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x462bfc
call fcn.0040509c
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, 0xff
call fcn.0040502c
cmp byte [ebp - 6], 0
je 0x462bcb
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00404fd8
lea eax, [ebp - 0x1c]
mov edx, 0x462c08
call fcn.00405058
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, 0xff
call fcn.0040502c
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00404fd8
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x124]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00462a30
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x24]
call fcn.00404fd8
mov edx, dword [ebp - 0x24]
pop eax
call fcn.00405058
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, 0xff
call fcn.0040502c
jmp 0x462bcb
xor edx, edx
mov dl, byte [ebx]
test edx, edx
jle 0x462bcb
lea eax, [ebx + 1]
xor byte [eax], 0x62
inc eax
dec edx
jne 0x462bc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462bed
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404d88
ret

Function at 0x485ce0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x485ce6
ret

Function at 0x508a2c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00408a08
ret
Function at 0x569bfc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x569c98
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.004053dc
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.004052a8
lea edx, [ebp + 0x30]
mov byte [eax + esi - 1], dl
dec esi
test ebx, ebx
jne 0x569c24
cmp byte [esp], 0
je 0x569c69
mov eax, edi
call fcn.004052a8
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x569ca4
mov eax, edi
call fcn.004052a8
push eax
mov eax, edi
call fcn.004052a8
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.00402bc4
mov edx, ebx
mov eax, edi
call fcn.004053dc
jmp 0x569ca4
mov eax, edi
mov edx, 0x569cb4
call fcn.00404db8
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x56ab18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405240
xor eax, eax
push ebp
push 0x56ab7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404db8
mov eax, ebx
call fcn.004052a0
mov eax, dword [ebx]
call fcn.00405050
test eax, eax
jle 0x56ab64
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x56ab59
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56ab81
lea eax, [ebp - 4]
call fcn.00404d64
ret

Function at 0x5715e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, eax
dec ecx
test ecx, ecx
jl 0x57160f
inc ecx
mov eax, edx
mov edx, esi
xor dl, byte [eax]
and edx, 0xff
mov edx, dword [edx*4 + 0x601bd4]
shr esi, 8
xor edx, esi
mov esi, edx
inc eax
dec ecx
jne 0x5715f3
mov eax, esi
pop esi
ret
Function at 0x571a38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x571a57
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00571678
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x1048], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x1044], ecx
inc edi
cmp edi, 9
jne 0x571ab9
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1000]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00571678
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x571b08
add ebx, 0x400
dec edi
jne 0x571b06
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x571ef4
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
test edi, edi
jle 0x572016
lea eax, [edi + 2]
mov ecx, 3
cdq
idiv ecx
mov edx, eax
shl edx, 2
mov eax, esi
call fcn.004053dc
mov ecx, dword [esi]
mov eax, edi
mov esi, 3
cdq
idiv esi
mov esi, eax
test esi, esi
jle 0x571f8d
xor eax, eax
mov al, byte [ebx]
shl eax, 0x10
xor edx, edx
mov dl, byte [ebx + 1]
shl edx, 8
add eax, edx
xor edx, edx
mov dl, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x60301c]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x60301c]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
mov dl, byte [edx + 0x60301c]
mov byte [ecx + 2], dl
and eax, 0x3f
mov al, byte [eax + 0x60301c]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec esi
jne 0x571f2e
mov eax, edi
mov esi, 3
cdq
idiv esi
dec edx
je 0x571f9f
dec edx
je 0x571fcf
jmp 0x57201d
xor eax, eax
mov al, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x60301c]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + 0x60301c]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x57201d
xor eax, eax
mov al, byte [ebx]
shl eax, 0x10
xor edx, edx
mov dl, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x60301c]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x60301c]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
mov al, byte [eax + 0x60301c]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
jmp 0x57201d
mov eax, esi
call fcn.00404d64
pop edi
pop esi
pop ebx
ret

Function at 0x58946c
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffdc
xor ebx, ebx
push esp
push 0x28
call fcn.00407b14
push eax
call fcn.004078dc
test eax, eax
je 0x5894ed
lea eax, [esp + 8]
push eax
push 0x5894f4
push 0
call fcn.004078d4
test eax, eax
jne 0x5894a4
mov eax, dword [esp]
push eax
call fcn.0040797c
jmp 0x5894ed
mov dword [esp + 0x14], 1
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 2
lea eax, [esp + 0x10]
push eax
push 0
push 0x10
lea eax, [esp + 0x20]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call fcn.00407894
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [esp]
push eax
call fcn.0040797c
mov eax, ebx
add esp, 0x24
pop ebx
ret
Function at 0x18040b9
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [0x18122f0], edi
mov dword [ebp - 8], ebx
jbe 0x18040fa
xor esi, esi
push dword [ebp + 8]
mov eax, dword [0x18179a4]
push dword [esi + eax]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1804104
inc ebx
add esi, 0x14
cmp ebx, dword [0x18122f0]
mov dword [ebp - 8], ebx
jb 0x18040d4
mov eax, 0x490
jmp 0x18042a9
cmp dword [0x18122ec], edi
jbe 0x1804131
xor esi, esi
mov eax, dword [0x18179a8]
cmp dword [esi + eax + 0x30], ebx
jne 0x1804123
push edi
call fcn.01803fe5
dec edi
sub esi, 0x48
inc edi
add esi, 0x48
cmp edi, dword [0x18122ec]
jb 0x180410e
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x1804198
lea eax, [ebp - 4]
push eax
push 0xf003f
push edi
push 0x180137c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x180417b
mov ecx, dword [0x18179a4]
lea eax, [ebx + ebx*4]
push dword [ecx + eax*4 + 4]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x1804198
push dword [ebp + 8]
push 0x3e9
push dword [0x1813978]
call sym.NETSH.EXE_PrintMessageFromModule
add esp, 0xc
mov eax, esi
jmp 0x18042a9
mov eax, dword [0x18179a4]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea ebx, [ebx + ebx*4]
shl ebx, 2
push dword [ebx + eax]
push edi
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
mov eax, dword [0x18179a4]
and dword [ebx + eax], 0
mov eax, dword [0x18179a4]
push dword [ebx + eax + 4]
push 0
call esi
push eax
call edi
mov eax, dword [0x18179a4]
and dword [ebx + eax + 4], 0
mov eax, dword [0x18122f0]
lea eax, [eax + eax*4 - 5]
shl eax, 2
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp + 8], eax
jne 0x1804202
push 8
pop eax
jmp 0x18042a9
mov esi, dword [0x18179a4]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp - 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x18122f0]
mov esi, dword [0x18179a4]
sub ecx, edx
dec ecx
lea ecx, [ecx + ecx*4]
shl ecx, 2
lea edi, [ebx + eax]
mov eax, ecx
shr ecx, 2
lea esi, [ebx + esi + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
dec dword [0x18122f0]
xor edi, edi
xor esi, esi
cmp dword [0x18122ec], edi
jbe 0x1804276
xor ecx, ecx
mov eax, dword [0x18179a8]
lea eax, [ecx + eax + 0x30]
cmp dword [eax], edx
jbe 0x180426a
dec dword [eax]
inc esi
add ecx, 0x48
cmp esi, dword [0x18122ec]
jb 0x180425b
mov eax, dword [0x18179a4]
add ebx, eax
cmp dword [ebx + 8], edi
je 0x180428b
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [0x18179a4]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 8]
mov dword [0x18179a4], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x18046eb
Capabilities:
Persist via netsh registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x18122c8]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor ebx, ebx
xor edi, edi
cmp dword [0x18122f0], ebx
mov dword [ebp - 0xa8], eax
jbe 0x1804742
xor esi, esi
push dword [ebp - 0xa8]
mov eax, dword [0x18179a4]
push dword [esi + eax]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1804837
inc edi
add esi, 0x14
cmp edi, dword [0x18122f0]
jb 0x1804718
push ebx
lea eax, [ebp - 0xac]
push eax
push ebx
push 0xf003f
push ebx
push 0x1801414
push ebx
push 0x180137c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x180481c
push dword [ebp - 0xa8]
call dword [sym.imp.msvcrt.dll__wcsdup]
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x1804798
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 8
pop eax
jmp 0x1804852
mov esi, dword [sym.imp.msvcrt.dll_wcsrchr]
push 0x2f
push edi
mov ebx, edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x18047b6
push 0x5c
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x18047b9
lea ebx, [eax + 2]
lea eax, [ebp - 0xa4]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0xa4]
push 0x2e
push eax
call esi
add esp, 0x10
test eax, eax
je 0x18047dd
and word [eax], 0
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xac]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.msvcrt.dll_free]
test esi, esi
pop ecx
je 0x1804837
push dword [ebp - 0xa8]
push 0x3e8
push dword [0x1813978]
call sym.NETSH.EXE_PrintMessageFromModule
add esp, 0xc
jmp 0x1804850
push dword [ebp - 0xa8]
lea eax, [ebp - 0xa4]
push eax
call fcn.01804583
mov esi, eax
call fcn.01803072
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0180865b
leave
ret 4
Function at 0x1804866
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push 0x20019
push ebx
push 0x180137c
push 0x80000002
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
jne 0x1804975
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1804975
cmp dword [ebp - 0x10], ebx
je 0x1804975
mov eax, dword [ebp - 0x1c]
push edi
lea eax, [eax + eax + 2]
push eax
push 8
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x18048ff
push 0x68
push dword [0x1813978]
call sym.NETSH.EXE_PrintMessageFromModule
pop ecx
pop ecx
jmp 0x1804974
mov eax, dword [ebp - 0x18]
inc eax
push eax
push 8
call esi
push eax
call edi
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x14], edi
jne 0x1804923
push dword [ebp - 4]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18048ee
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
jbe 0x1804974
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
je 0x1804960
cmp eax, 0x103
je 0x1804974
jmp 0x1804969
push edi
push dword [ebp - 4]
call fcn.01804583
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jb 0x180492b
pop edi
cmp dword [ebp - 8], ebx
je 0x1804983
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], ebx
je 0x1804995
push dword [ebp - 4]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x14], ebx
je 0x18049a7
push dword [ebp - 0x14]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.01803072
pop esi
pop ebx
leave
ret
Function at 0x1805f4a
Capabilities:
Connect network resource
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x18122c8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x210], eax
mov eax, dword [0x18122f4]
xor esi, esi
cmp eax, esi
push edi
mov edi, dword [ebp + 8]
je 0x1805f91
push eax
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.01805f00
cmp edi, esi
je 0x1805fce
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, esi
mov dword [0x18122f4], eax
jne 0x1805fc2
push 8
pop eax
jmp 0x180610d
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x1805fd4
mov dword [0x18122f4], esi
push 0x1801370
call fcn.01804cc7
push dword [ebp - 0x210]
push dword [ebp - 0x214]
push dword [0x18122f4]
call fcn.018085c9
mov edi, eax
cmp edi, esi
jge 0x1806045
mov eax, dword [0x18122f4]
cmp eax, esi
jne 0x1806028
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x218], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x20c]
push eax
push 0xb4
push dword [0x1813978]
call sym.NETSH.EXE_PrintMessageFromModule
add esp, 0xc
push edi
push esi
call sym.NETSH.EXE_PrintError
pop ecx
pop ecx
mov eax, dword [0x18122f4]
cmp eax, esi
je 0x180610b
cmp dword [ebp - 0x214], esi
jne 0x1806066
cmp dword [ebp - 0x210], esi
je 0x180610b
push eax
lea eax, [ebp - 0x20c]
push 0x1801568
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 8
pop ecx
xor eax, eax
push 0x808
push dword [ebp - 0x214]
lea edi, [ebp - 0x238]
push dword [ebp - 0x210]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
push eax
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x21c], esi
call sub.MPR.dll_WNetAddConnection2W
cmp eax, esi
jne 0x1806102
push 0x208
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, esi
mov dword [0x18122f8], eax
jne 0x18060ea
push 0xe
push esi
call sym.NETSH.EXE_PrintMessageFromModule
jmp 0x1806109
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x180610b
push eax
push esi
call sym.NETSH.EXE_PrintError
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0180865b
leave
ret 0xc