joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56aac4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x56acea
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebx + 0x34c]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x56acc7
mov eax, dword [0x5b26f4]
mov eax, dword [eax]
call fcn.0059fdf0
test al, al
je 0x56acc7
mov eax, dword [0x5b2c40]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0049f3b0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x56abbe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov edx, dword [0x5b2bb8]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x56ad04
call fcn.00404740
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x41aa58]
call fcn.0041fa6c
mov dword [ebp - 0xc], eax
push 0xffff
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x34c]
call fcn.00437fc4
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x41aa58]
call fcn.0041fa6c
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0041f5d8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0041f7f0
mov eax, dword [ebp - 0xc]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56abfa
mov eax, dword [ebp - 8]
call fcn.0041f554
mov dword [ebp - 0x10], eax
mov edx, dword [0x5b2bb8]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004f8468
test al, al
jne 0x56ac36
mov eax, dword [ebp - 8]
call fcn.00403600
mov eax, dword [0x5b2c40]
mov eax, dword [eax]
xor edx, edx
call fcn.0049f3b0
jmp 0x56acc7
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, dword [ebp - 8]
call fcn.00403600
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x34c]
call fcn.00437fc4
mov eax, dword [ebp - 0x1c]
mov edx, 0x56ad1c
call fcn.004fd284
mov eax, dword [0x5b2c40]
mov eax, dword [eax]
xor edx, edx
call fcn.0049f3b0
mov byte [ebp - 1], 1
push 0x44
mov ecx, 0x56ad2c
mov edx, 0x56ad3c
mov eax, dword [0x5b29d8]
mov eax, dword [eax]
call fcn.004a1678
cmp eax, 6
jne 0x56acc7
push 5
push 0
push 0
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x34c]
call fcn.00437fc4
mov eax, dword [ebp - 0x20]
call fcn.004048f4
push eax
push 0x56ad60
mov eax, ebx
call fcn.00486a08
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56acf1
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404458
lea eax, [ebp - 0x14]
call fcn.00404434
ret

Function at 0x56e980
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov ebx, 0x600
push ebx
push 0x160
mov eax, dword [ebp + 8]
add eax, 0xfffffea0
push eax
push 0
mov eax, esi
call fcn.004048f4
push eax
call sub.shell32.dll_SHGetFileInfoA
pop esi
pop ebx
pop ebp
ret
Function at 0x56eef0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x56f014
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea ecx, [ebp - 4]
mov eax, dword [0x5b2bb8]
mov eax, dword [eax]
mov edx, 0x56f02c
call fcn.004f916c
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x4e0]
add eax, 0x78
call fcn.00404488
mov eax, dword [esi + 0x4e0]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x56efdc
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x4e0]
call fcn.00437fc4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040898c
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
mov eax, dword [0x5b2bb8]
mov eax, dword [eax]
mov edx, 0x56f02c
call fcn.004f916c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040898c
mov edx, dword [ebp - 0x10]
pop eax
call fcn.00404840
je 0x56efdc
push 0
lea ecx, [ebp - 0x18]
mov eax, dword [0x5b2bb8]
mov eax, dword [eax]
mov edx, 0x56f02c
call fcn.004f916c
mov eax, dword [ebp - 0x18]
call fcn.004048f4
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [esi + 0x4e0]
call fcn.00437fc4
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x56efda
mov eax, 0x13ec
call fcn.004fb6c0
jmp 0x56efdc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56f01b
lea eax, [ebp - 0x1c]
call fcn.00404434
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404458
lea eax, [ebp - 0xc]
call fcn.00404434
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404458
ret
Function at 0x56f7f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x56f7f9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x56fa3d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, dword [esi]
call fcn.004044cc
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408bdc
mov eax, dword [ebp - 0x14]
mov edx, 0x56fa58
call fcn.00404840
jne 0x56f849
lea eax, [ebp - 8]
call fcn.00404434
mov eax, dword [edi + 0x49c]
add eax, 0x60
mov edx, dword [ebp - 4]
call fcn.00404488
cmp dword [ebp - 8], 0
je 0x56f89e
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
je 0x56f878
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, 0x56fa58
call fcn.00404740
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00408bdc
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x5b2bb8]
mov edx, dword [edx]
mov eax, dword [edi + 0x49c]
add eax, 0x78
call fcn.00404740
jmp 0x56f8bf
mov edx, dword [0x5b2bb8]
mov edx, dword [edx]
mov eax, dword [edi + 0x49c]
call fcn.0043802c
mov eax, dword [edi + 0x49c]
add eax, 0x78
call fcn.00404434
mov eax, dword [edi + 0x49c]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x56fa22
lea edx, [ebp - 0xc]
mov eax, dword [edi + 0x49c]
call fcn.00437fc4
lea ecx, [ebp - 8]
mov eax, dword [0x5b2bb8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
call fcn.004f908c
cmp dword [ebp - 8], 0
jne 0x56fa16
push 0x24
mov ecx, 0x56fa5c
mov edx, 0x56fa68
mov eax, dword [0x5b29d8]
mov eax, dword [eax]
call fcn.004a1678
cmp eax, 6
jne 0x56fa22
lea eax, [ebp - 8]
mov edx, 0x56fab0
call fcn.004f8f14
test al, al
je 0x56fa22
mov eax, dword [ebp - 8]
mov edx, 0x56fa58
call fcn.00404840
jne 0x56f949
lea eax, [ebp - 8]
call fcn.00404434
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00409930
cmp dword [ebp - 0x10], 0
je 0x56f972
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0x5c
je 0x56f972
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, 0x56fa58
call fcn.00404740
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004046fc
mov edx, dword [0x5b2bb8]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
call fcn.00404740
mov eax, dword [ebp - 0x1c]
call fcn.00409430
test al, al
je 0x56f9d8
push 0x24
push 0x56fae4
push dword [ebp - 0x10]
push 0x56faf0
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x20]
call fcn.004048f4
mov edx, eax
mov ecx, 0x56fb10
mov eax, dword [0x5b29d8]
mov eax, dword [eax]
call fcn.004a1678
cmp eax, 6
jne 0x56fa22
push 0
mov edx, dword [0x5b2bb8]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
call fcn.00404740
mov eax, dword [ebp - 0x24]
call fcn.004048f4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048f4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x56fa22
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404488
mov bl, 1
jmp 0x56fa22
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404488
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56fa44
lea eax, [ebp - 0x24]
mov edx, 8
call fcn.00404458
ret
Function at 0x588c58
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push 0x588c70
push 0x588c88
push eax
call sub.shell32.dll_ShellExecuteA
ret

Function at 0x588c90
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push 0x588ca8
push 0x588cd0
push eax
call sub.shell32.dll_ShellExecuteA
ret

Function at 0x588cd8
Capabilities:
Create process on windows

Disassembly:
push 1
push 0
push 0
push 0x588cec
push 0
push eax
call sub.shell32.dll_ShellExecuteA
ret
Function at 0x5a6394
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov edi, edx
mov esi, eax
lea eax, [ebp - 0x158]
mov edx, dword [0x407ca0]
call fcn.00404e2c
xor eax, eax
push ebp
push 0x5a6621
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x15c]
mov ecx, 0x5a663c
mov edx, esi
call fcn.00404740
mov eax, dword [ebp - 0x15c]
lea ecx, [ebp - 0x158]
mov edx, 0x3f
call fcn.00409634
test eax, eax
jne 0x5a65f0
mov eax, dword [ebp - 0x14c]
mov edx, 0x5a664c
call fcn.00404840
je 0x5a65d2
mov eax, dword [ebp - 0x14c]
mov edx, 0x5a6658
call fcn.00404840
je 0x5a65d2
test byte [ebp - 0x150], 0x10
je 0x5a654c
push esi
push 0x5a6664
push dword [ebp - 0x14c]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x160]
call fcn.00409440
test al, al
je 0x5a654c
push edi
push 0x5a6664
push dword [ebp - 0x14c]
lea eax, [ebp - 0x164]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x164]
call fcn.00409440
test al, al
jne 0x5a64ef
push edi
push 0x5a6664
push dword [ebp - 0x14c]
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x168]
call fcn.00409acc
test al, al
je 0x5a65f2
mov eax, dword [ebp + 8]
push eax
push edi
push 0x5a6664
push dword [ebp - 0x14c]
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x16c]
push eax
push esi
push 0x5a6664
push dword [ebp - 0x14c]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x170]
pop edx
call fcn.005a6394
pop ecx
test al, al
je 0x5a65f2
jmp 0x5a65d2
push esi
push 0x5a6664
push dword [ebp - 0x14c]
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x174]
call fcn.00409430
test al, al
je 0x5a65d2
push 0
push edi
push 0x5a6664
push dword [ebp - 0x14c]
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x178]
call fcn.004048f4
push eax
push esi
push 0x5a6664
push dword [ebp - 0x14c]
lea eax, [ebp - 0x17c]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x17c]
call fcn.004048f4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x5a65f2
lea eax, [ebp - 0x158]
call fcn.00409684
test eax, eax
je 0x5a642d
lea eax, [ebp - 0x158]
call fcn.004096a8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a6628
lea eax, [ebp - 0x17c]
mov edx, 9
call fcn.00404458
lea eax, [ebp - 0x158]
mov edx, dword [0x407ca0]
call fcn.00404efc
ret

Function at 0x5a7a5c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
mov esi, eax
mov ebx, 0x101
push ebx
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, esi
call fcn.004048f4
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp - 0x160]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7f20e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ecx + 0x3f]
xchg ebx, edx
xchg dword [esp], ecx
mov bx, dx
bswap ebx
lea eax, [eax*4]
mov eax, 0x924fb0b0
setge ah
jmp 0x7f204c
inc ebx
add eax, 0xf9ff2ae7
rdtsc
rdtsc
lea edx, [ebx + ebx]
jmp 0x7f2087

Function at 0x7f3ba2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
jmp 0x7f4137
lea esp, [esp + 7]
pushal
pop word [esp + 1]
lea esp, [esp + 3]
jmp 0x7f3e20
mov dword [esp + 0x18], ecx
call fcn.007f3bf4
sub esp, 0xb4
jmp 0x7f3e78
jmp 0x7f3e90
mov esi, esp
mov dx, word [esp]
push bx
bts dx, cx
jo 0x7f3e5c
lea esp, [esp + 2]
jmp fcn.007f3e94
lea esp, [esp + 2]
pop word [esp + 1]
lea esp, [esp + 3]
mov dword [esp + 0x18], ecx
jmp 0x7f3e24
jle 0x7f3bac
lea esp, [esp + 7]
pushal
jmp 0x7f3ff7

Function at 0x7f3d52
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
push word [esp + 2]
jmp 0x7f3dae
mov dword [esp], edi
lea esp, [esp + 1]
xchg dword [esp + 4], edi
call fcn.007f3d92

Function at 0x7f6164
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7f61c6
lea esp, [esp + 3]
mov dword [esp + 0x1c], esp
mov dword [esp + 0x18], ebp
call fcn.007f61b0
xchg al, bl
bsf di, bx
jne 0x7f61fb
je 0x7f6257
loopne 0x7f6249
hlt
jmp 0x7f6257
setae ah
jmp 0x7f6241
setae ah
cmp bx, si
jmp 0x7f6264
cmp bx, si
jmp 0x7f6264
mov esp, 0xf67eff4f
add edi, esi
aas
mov ds, word [bx + di]
js 0x7f62b2
mov esi, dword [esp + 0x2c]
setnp bl
inc cx
jp 0x7f61fd
jnp 0x7f6206
lea edi, [esp]
rdtsc
xchg ebx, ebp
lea edx, reloc.RASAPI32.dll_RasDialA
bswap ebx
call 0x7f6289
mov dl, 0xad
mov edx, 0xcaa59242
mov ecx, dword [esp]
xchg dl, dh
call fcn.007f6005
mov ax, 0xe09c
shl dx, cl
mov cx, 0xfd9a
btr bx, cx
xchg dword [esp], esi
jmp 0x7f62c9
rcl cx, 2
rcl al, 3
mov dh, 0x29
call fcn.007f65cf
mov bh, 0x3e
lodsb al, byte [esi]
retf
push ss
sub esp, 0xc0
jmp 0x7f6423
mov ecx, dword [esp]
mov ebp, esi
neg cl
xchg dl, ch
bsr ax, bp
lea esi, [esi + 0x3b]
jmp 0x7f629d
dec ch
jmp 0x7f633f
lea edx, [edi*4]
jmp 0x7f634e
mov ebx, esi
lea ecx, [esi + esi]
inc al
jl 0x7f62fb
dec ch
lea ecx, [edx*4]
bsr dx, bx
rdtsc
lea edx, [edi*4]
jmp 0x7f634e
lea ecx, [edx*4]
bsr dx, bx
rdtsc
jmp 0x7f62ff
rol esi, 0
xchg cx, ax
xchg edx, ecx
inc eax
jle 0x7f63e1
mov ah, 0x9d
jmp 0x7f639a
jmp 0x7f6318
mov ax, 0xd78f
jmp 0x7f63bc
mov edx, 0xa38ef774
mov al, byte [esp]
lea ecx, [ecx + 0x34]
mov cx, word [esp]
jmp 0x7f636a
mov ah, 0x9d
add esi, 0x78177e0c
mov dh, dl
xchg cx, ax
jmp 0x7f6380
add esi, 0x14dea840
mov ecx, 0x1c6966fd
call fcn.007f63a6
xor ah, byte [esi + 0x1aae5334]
inc eax
fisttp dword [ebx + 0x2e]
invalid
jmp 0x7f6398
mov ebp, esp
mov al, dl
mov edx, dword [esp]
stc
jae 0x7f6368
jb 0x7f6318
xchg dword [esp], ebx
lea ecx, [ebx*4]
shr ah, cl
mov cx, 0xbcc9
ror cx, cl
lea edx, reloc.RASAPI32.dll_RasDialA
jmp 0x7f6490
push dword [esp]
ret 4
lea ebx, [ebx + 1]
lea edx, reloc.RASAPI32.dll_RasDialA
bsf eax, ebx
xchg dword [esp], ebx
neg ax
dec cx
jmp 0x7f6467
Function at 0x7f61b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07e1158
jmp 0x7f61d7
mov dword [esp], ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
jmp 0x7f61f1
lea esp, [esp + 0x14]
pushfd
jmp 0x7f5cd8

Function at 0x7f6c29
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
xchg dword [esp + 4], ebp
mov edx, 0x7e56d26c
call fcn.007f6bb1
bt edx, eax
mov edx, esp
lea edx, reloc.RASAPI32.dll_RasDialA
jmp 0x7f6be2

Function at 0xa16bad
Capabilities:
Packed with generic packer

Disassembly:
call fcn.00a16089
mov eax, dword fs:[0x30]
jmp 0xa16bbc
mov dword [esp + 0x38], esi
push ebx
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
jmp 0xa16b78
lea esp, [esp + 1]
lea esp, [esp + 1]
pushal
lea esp, [esp + 2]
jmp 0xa16b8e
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0xa16c0c
mov eax, dword [eax + 8]
push eax
jmp 0xa16084
Function at 0x74fd17d5
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push 0x2c
push 0x74fd1800
call fcn.74fd1320
mov esi, ecx
mov dword [ebp - 0x24], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
cmp dword [esi + 0x28], edi
jne 0x74fd7ec9
call fcn.74fd1550
ret
lea ecx, [esi + 8]
call fcn.74fd1400
mov dword [ebp - 4], edi
lea eax, [ebp - 0x1c]
push eax
push 0x74fd4008
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x3c]
call fcn.74fe1d16
mov eax, dword [esi + 0x58]
mov dword [ebp - 0x3c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x4c]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x20], edi
jne 0x74fd7f37
push 0x18
lea eax, [ebp - 0x3c]
push eax
push 3
push edi
push dword [esi + 0x28]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
call fcn.74fd7f54
jmp 0x74fd17f4

Function at 0x74fd27a5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
mov edi, ecx
push dword [edi + 0x10]
lea eax, [ebp - 0x10]
push dword [edi + 8]
mov dword [ebp - 8], esi
push eax
push esi
push esi
push esi
push ebx
mov dword [ebp - 4], esi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
je 0x74fd40c1
cmp eax, esi
jl 0x74fd6d55
mov eax, dword [0x74fe6010]
cmp eax, esi
je 0x74fd27fa
lea ecx, [eax + 0x20]
call fcn.74fd2815
mov eax, dword [edi + 0x10]
cmp eax, dword [ebp - 0xc]
jne 0x74fd6d70
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
leave
ret 4
push esi
push esi
push ebx
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp eax, esi
jl 0x74fd6d55
mov eax, dword [ebp - 0x10]
jmp 0x74fd27e1
mov ecx, 0xc000026e
cmp eax, ecx
jne 0x74fd6d61
push ecx
jmp 0x74fd6d66
push 0x8dead001
call fcn.74fd921a
jmp 0x74fd27e9
push 0x8dead001
call fcn.74fd921a
jmp 0x74fd2806
Function at 0x74fd2a1a
Capabilities:
Get domain controller name
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [section..data]
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], 0x10
je 0x74fd2a44
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp eax, 1
je 0x74fd2aba
cmp eax, ebx
push esi
jne 0x74fd81b4
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x74fd825d
push ebx
push ebx
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x34]
push eax
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x74fd827e
mov eax, dword [ebp - 0x40]
inc eax
cmp eax, 0x10
ja 0x74fd828b
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x14]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x74fd2aa7
mov ecx, dword [ebp - 0x38]
call fcn.74fd2ad8
pop esi
mov ecx, dword [ebp - 0x38]
call fcn.74fd2ad8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
pop edi
pop ebx
call fcn.74fd1300
leave
ret 4
cmp eax, 1
jle 0x74fd2a90
push 4
pop edi
cmp eax, edi
jg 0x74fd2a90
jne 0x74fd81d1
mov esi, 0x80
jmp 0x74fd81d3
xor esi, esi
lea ecx, [ebp - 0x3c]
push ecx
xor ecx, ecx
cmp eax, 3
sete cl
or ecx, esi
or ecx, 0x80001110
push ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
cmp eax, ebx
je 0x74fd81fc
push eax
call fcn.74fd98c1
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
add eax, edi
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov dword [ebp - 0x40], eax
inc eax
cmp eax, 0x10
pop ecx
jbe 0x74fd8226
push dword [ebp - 0x3c]
call sub.NETAPI32.dll_NetApiBufferFree
push 0x8007007b
call fcn.74fd921a
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
push ebx
push ebx
push 0x10
push dword [ebp - 0x38]
add eax, edi
push 0xffffffffffffffff
push eax
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x74fd8250
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.74fd98c1
push dword [ebp - 0x3c]
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x74fd2ab9
call esi
test eax, eax
jg 0x74fd8267
call esi
jmp 0x74fd8273
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
call fcn.74fd921a
jmp 0x74fd2a71
call esi
push eax
call fcn.74fd98c1
jmp 0x74fd2a90
push 0x8007007b
call fcn.74fd921a
jmp 0x74fd2ab9
Function at 0x74fd3399
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [section..data]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [esi]
push edi
call dword [eax]
test eax, eax
je 0x74fd69b2
cmp eax, 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x74fd69e2
cmp eax, 2
jne 0x74fd6a41
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.74fd1300
leave
ret 8
push edi
mov ecx, esi
call fcn.74fda4b9
push dword [ebp + 0xc]
lea ecx, [ebp - 0x418]
call fcn.74fda248
push 0
push eax
push 1
push 0xc00030d7
call fcn.74fda287
xor eax, eax
add esp, 0x10
inc eax
jmp 0x74fd33c1
lea eax, [ebp - 0x210]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x210]
push 0x74fd6a50
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
mov eax, dword [esi]
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
mov ecx, esi
call dword [eax + 4]
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x74fd6a2d
call ebx
push eax
call fcn.74fd98c1
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax]
jmp 0x74fd33d0
call ebx
push eax
call fcn.74fd98c1
jmp 0x74fd33d9

Function at 0x74fd388d
Capabilities:
Delete registry value

Disassembly:
push 0x14
push 0x74fd38b8
call fcn.74fd1320
mov esi, ecx
mov dword [ebp - 0x24], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
cmp dword [esi + 0x28], edi
jne 0x74fd7d54
call fcn.74fd1550
ret
lea ecx, [esi + 8]
call fcn.74fd1400
mov dword [ebp - 4], edi
lea eax, [ebp - 0x1c]
push eax
push 0x74fd4008
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x74fd7d92
push dword [esi + 0x28]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
call fcn.74fd7dad
jmp 0x74fd38ac