joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472740
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x8018
call fcn.0048d590
push ebx
push ebp
mov ebp, dword [esp + 0x8028]
push esi
push edi
mov edi, dword [esp + 0x802c]
mov esi, ecx
test edi, edi
je 0x472769
mov ecx, edi
call fcn.00412530
cmp dword [esp + 0x8038], 0
jne 0x47277e
mov dword [esp + 0x8038], 0x1f4
cmp dword [esp + 0x803c], 1
jge 0x472793
mov dword [esp + 0x803c], 0x32
cmp ebp, 1
jge 0x47279d
mov ebp, 1
test esi, esi
je 0x47296a
mov ebx, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea eax, [esp + 0x20]
push eax
push 0x7d0
push 2
push 0
push 0
push 0x406
push esi
call ebx
test eax, eax
je 0x47296a
cmp ebp, dword [esp + 0x20]
jg 0x47296a
push 0x8000
xor eax, eax
mov ecx, esi
lea edi, [esp + 0x1c]
call fcn.0046fa50
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
test edi, edi
je 0x472963
dec ebp
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x24], eax
jmp 0x472810
lea ecx, [esp + 0x14]
push ecx
push 0x7d0
push 2
push 0
push ebp
push 0x403
push esi
call ebx
test eax, eax
je 0x472887
mov edx, 0x7fff
cmp word [esp + 0x14], dx
ja 0x4728de
lea eax, [esp + 0x14]
push eax
push 0x7d0
push 2
push edi
push ebp
push 0x402
push esi
call ebx
test eax, eax
je 0x472887
movzx ecx, word [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0
inc ecx
push ecx
lea edx, [esp + 0x30]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4728d9
mov edx, dword [esp + 0x8034]
lea eax, [esp + 0x28]
call fcn.00471cd0
test al, al
jne 0x472904
cmp dword [esp + 0x802c], 0
jne 0x4728e8
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x472937
mov edi, dword [esp + 0x8038]
test edi, edi
js 0x4728be
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x24]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x47291c
mov edx, dword [esp + 0x803c]
push 1
push edx
call fcn.00401280
mov edi, dword [esp + 0x24]
add esp, 8
jmp 0x472810
mov byte [esp + 0x28], 0
cmp dword [esp + 0x802c], 0
je 0x472937
mov eax, dword [esp + 0x802c]
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x34]
push edx
push eax
call fcn.00471040
mov esi, eax
jmp 0x47293c
mov eax, dword [0x4a6474]
push 1
push 0
push 0xffffffffffffffff
push 0x494870
push eax
call fcn.00471040
jmp 0x4728de
mov ecx, dword [0x4a6474]
push 1
push 0
push 0xffffffffffffffff
push 0x495ec8
push ecx
call fcn.00471040
mov edi, dword [esp + 0x1c]
mov esi, 1
push 0x8000
push 0
push edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov edi, dword [esp + 0x802c]
mov eax, 0x495ec8
test edi, edi
jne 0x472978
mov eax, 0x496010
mov ecx, dword [0x4a2440]
cmp byte [ecx + 0xe4], 0
jne 0x4729a5
mov edx, dword [0x4a6474]
push 1
push 0
push 0xffffffffffffffff
push eax
push edx
call fcn.00471040
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov ecx, dword [0x4a8048]
push 0x4947f9
push 0
push 0x495ec8
call fcn.0042c870
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
Function at 0x473440
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0xc50]
test ecx, ecx
je 0x4734f7
mov eax, dword [esi]
test eax, eax
je 0x4734f7
push edi
test al, 1
jne 0x473469
mov eax, dword [esi + 0x80c]
cmp byte [eax], 0
je 0x473482
push 0x7fff
lea edi, [esi + 0xc58]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x473482
mov byte [edi], al
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x47349d
mov edx, dword [esi + 0xc50]
lea ecx, [esi + 0xc54]
push ecx
push edx
call edi
test byte [esi], 0x20
je 0x4734d8
mov ecx, dword [esi + 0xc50]
lea eax, [esp + 4]
push eax
push ecx
call edi
test eax, eax
je 0x4734d8
movzx edx, byte [esi + 0xc28]
mov ecx, dword [esp + 4]
push edx
lea eax, [esi + 0x8d58]
call fcn.0044c440
add esp, 4
test eax, eax
jne 0x4734d8
mov byte [esi + 0x8d58], al
test byte [esi], 8
pop edi
je 0x4734f7
mov ecx, dword [esi + 0xc50]
push 0x101
lea eax, [esi + 0x8c57]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
pop ecx
ret

Function at 0x473a70
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e5c
call fcn.0048d590
mov eax, dword [esp + 0x8e60]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x473b1d
mov dword [esp + 0xc44], eax
lea eax, [esp + 4]
push eax
push 0x4741a0
mov dword [esp + 0xc], ebx
mov dword [esp + 0x818], 0x4947f9
mov byte [esp + 0xc35], bl
mov dword [esp + 0xc38], ebx
mov dword [esp + 0xc3c], ebx
mov dword [esp + 0xc40], ebx
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov byte [esp + 0xc50], cl
mov dword [esp + 0xc54], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0xc34], ebx
je 0x473b1d
mov ecx, dword [0x4a2440]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x473b1d
push 1
push eax
call fcn.00401280
add esp, 8
mov eax, 1
pop ebx
add esp, 0x8e5c
ret 4
Function at 0x473b30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x473b4c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4a2440]
push eax
push esi
mov ecx, edi
call fcn.00473fe0
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x473b83
test eax, eax
jne 0x473b87
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.00473c40
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x473c06
test esi, esi
je 0x473c06
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.00401280
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x473be5
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x473be5
push 1
push 0x8000012f
call fcn.00401280
add esp, 8
push esi
call edi
test eax, eax
jne 0x473bc0
mov edx, dword [0x4a2440]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x473bfe
push 1
push eax
call fcn.00401280
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x473c20
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.00473c40
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.00473db0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x473db0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e68
call fcn.0048d590
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x473f30
xor cl, cl
mov eax, edi
call fcn.00473f50
test eax, eax
jne 0x473de5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4a2440]
push eax
push ebp
mov ecx, edi
call fcn.00473fe0
test eax, eax
je 0x473e08
xor eax, eax
mov dword [0x4a7c78], eax
jmp 0x473e0d
mov eax, dword [0x4a7c78]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x824], 0x4947f9
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc64], ebx
mov dword [esp + 0xc68], ebx
cmp byte [esp + 0x8e7c], bl
je 0x473e53
mov byte [esp + 0xc41], bl
cmp eax, ebx
je 0x473e5b
mov byte [esp + 0xc41], 1
mov ecx, dword [0x4a7c74]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xc54], eax
lea eax, [esp + 0x18]
push eax
push 0x4740b0
mov dword [esp + 0xc58], ecx
mov dword [esp + 0xc60], edx
call esi
mov eax, dword [esp + 0xc48]
cmp eax, ebx
je 0x473f08
lea ecx, [esp + 0x10]
push ecx
push 0x472e10
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x473ec5
mov edx, dword [esp + 0xc48]
call fcn.00473890
mov dword [esp + 0xc48], esi
mov eax, dword [esp + 0xc48]
call fcn.00471e60
mov edx, dword [esp + 0xc48]
call fcn.00473890
mov edx, dword [0x4a2440]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x473f30
push 1
push eax
call fcn.00401280
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
mov eax, dword [0x4a7c78]
cmp eax, ebx
je 0x473f30
cmp eax, 1
setg al
mov dword [0x4a7c78], ebx
cmp al, bl
je 0x473f30
mov edx, ebp
call fcn.00473890
push ebx
mov ecx, edi
call fcn.00473db0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8e68
ret 4
Function at 0x487ea4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a1d90]
jne 0x487eae
repz ret
jmp fcn.0048c7d7

Function at 0x48a824
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a1d90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00484ec2
and dword [ebp - 0x14], 0
cmp dword [0x4a44b4], 0
mov dword [ebp - 0x18], eax
jne 0x48a8d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48a97f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x48a97f
mov esi, dword [fcn.00480b90]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4a44b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4a44b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4a44bc], eax
call edi
push eax
call esi
mov dword [0x4a44c4], eax
test eax, eax
je 0x48a8d7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4a44c0], eax
mov eax, dword [0x4a44c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00480b94]
cmp eax, ecx
je 0x48a930
cmp dword [0x4a44c4], ecx
je 0x48a930
push eax
call esi
push dword [0x4a44c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x48a930
test ebx, ebx
je 0x48a930
call edi
test eax, eax
je 0x48a927
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x48a927
test byte [ebp - 8], 1
jne 0x48a930
or dword [ebp + 0x10], 0x200000
jmp 0x48a963
mov eax, dword [0x4a44b8]
cmp eax, dword [ebp - 0x18]
je 0x48a963
push eax
call esi
test eax, eax
je 0x48a963
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x48a963
mov eax, dword [0x4a44bc]
cmp eax, dword [ebp - 0x18]
je 0x48a963
push eax
call esi
test eax, eax
je 0x48a963
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a44b4]
call esi
test eax, eax
je 0x48a97f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x48a981
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00487ea4
leave
ret

Function at 0x4013e4
Capabilities:
Encode data using xor

Disassembly:
push 0x5a9d44
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + 0x47bf6a42], dh
sbb al, 0x33
dec ebp
mov gs, edi
std
adc byte [esi + 0x5f], 0xba
xchg ebx, eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
invalid
Function at 0x10001000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100011cb
push ebx
push esi
mov eax, edi
call fcn.100114c0
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x1001b398
push edi
call esi
test eax, eax
je 0x100010a7
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
je 0x100011c9
lea eax, [ebx + ebx]
xor esi, esi
test eax, eax
je 0x1000107d
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000107a
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, dword [ebp + 8]
test esi, esi
je 0x100011c9
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push esi
push 0x1000edc0
jmp 0x100011b4
mov eax, edi
call fcn.10013560
test eax, eax
je 0x1000112f
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
je 0x100011c9
lea eax, [ebx + ebx]
xor esi, esi
test eax, eax
je 0x10001105
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10001102
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, dword [ebp + 8]
test esi, esi
je 0x100011c9
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push esi
push 0x10013600
jmp 0x100011b4
push str._secrets.key
push edi
call esi
test eax, eax
je 0x10001155
push edi
call fcn.1000e750
test eax, eax
je 0x100011c9
push 0
push 0
push eax
push 0x10014380
jmp 0x100011b4
push str.SIGN1_sign.key
push edi
call esi
test eax, eax
je 0x100011c9
mov ecx, str..SIGN1_sign.key
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000118e
test dx, dx
je 0x1000118a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000118e
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001168
xor eax, eax
jmp 0x10001193
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100011c9
call fcn.10014ac0
test eax, eax
je 0x100011c9
push edi
call fcn.1000e750
test eax, eax
je 0x100011c9
push 0
push 0
push eax
push 0x10014b30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100011c9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
pop edi
pop ebp
ret 4
Function at 0x100011d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
test ebx, ebx
je 0x100013a5
push esi
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.java
lea edx, [ebp - 0x108]
push edx
call esi
test eax, eax
je 0x100013a4
push str..exe
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
je 0x100013a4
cmp dword [0x1001ff08], 0
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push edi
jne 0x100012de
push 0x1001c870
push ebx
call esi
test eax, eax
je 0x100012de
call fcn.1000f060
test eax, eax
je 0x100012de
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
test eax, eax
je 0x100012cf
lea ecx, [eax + eax]
test ecx, ecx
je 0x100012b8
lea edi, [ecx + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100012b5
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
test esi, esi
je 0x100012cf
push 0
push 0
push eax
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push esi
push 0x1000f100
jmp 0x1000138e
cmp dword [0x10020134], 0
jne 0x10001374
push str.serverkey.dat
push ebx
mov dword [0x10020134], 1
call esi
xor ecx, ecx
cmp ecx, eax
sbb edx, edx
neg edx
je 0x10001374
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
test eax, eax
je 0x10001368
lea ecx, [eax + eax]
test ecx, ecx
je 0x10001351
lea edi, [ecx + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000134e
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
test esi, esi
je 0x10001368
push 0
push 0
push eax
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push esi
push 0x10012030
jmp 0x1000138e
push ebx
call fcn.10012e60
test eax, eax
je 0x100013a3
push ebx
call fcn.1000e750
push 0
push 0
push eax
push 0x10012fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100013a3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100017a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, 0x10
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
add esi, 0xfffffffe
xor ecx, ecx
test esi, esi
jle 0x10001832
jmp 0x100017d0
movzx edi, byte [edx + ecx]
shr edi, 2
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax], bl
movsx edi, byte [edx + ecx]
movzx ebx, byte [edx + ecx + 1]
and edi, 3
shr ebx, 4
shl edi, 4
or edi, ebx
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax + 1], bl
movsx ebx, byte [edx + ecx + 1]
movzx edi, byte [edx + ecx + 2]
and ebx, 0xf
add ebx, ebx
shr edi, 6
add ebx, ebx
or edi, ebx
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax + 2], bl
movsx edi, byte [edx + ecx + 2]
and edi, 0x3f
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax + 3], bl
add ecx, 3
add eax, 4
cmp ecx, esi
jl 0x100017d0
cmp ecx, dword [ebp + 8]
jge 0x100018ae
movzx esi, byte [ecx + edx]
shr esi, 2
mov bl, byte [ebp + esi - 0x44]
mov esi, dword [ebp + 8]
dec esi
mov byte [eax], bl
cmp ecx, esi
jne 0x10001871
movsx ecx, byte [ecx + edx]
and ecx, 3
add ecx, ecx
mov dl, byte [ebp + ecx*8 - 0x44]
mov byte [eax + 1], dl
pop edi
mov byte [eax + 2], 0x3d
add eax, 3
pop esi
mov word [eax], 0x3d
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [ecx + edx + 1]
movsx ecx, byte [ecx + edx]
movzx edx, byte [esi]
and ecx, 3
shl ecx, 4
shr edx, 4
or ecx, edx
movzx ecx, byte [ebp + ecx - 0x44]
mov byte [eax + 1], cl
movsx edx, byte [esi]
and edx, 0xf
movzx ecx, byte [ebp + edx*4 - 0x44]
pop edi
mov byte [eax + 2], cl
add eax, 3
pop esi
mov word [eax], 0x3d
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10001b30
Capabilities:
Get disk information
Persist via run registry key
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0x10], 0xff0ff
mov dword [ebp - 8], 0x104
mov dword [ebp - 0xc], 1
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x10001bfe
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.softwaremicrosoftwindows_ntcurrentversionwinlogon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
push 0
lea eax, [ebp - 0x114]
push eax
mov byte [ebp - 0x111], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [ebp - 0x10]
push ecx
push 0x1001b548
lea edx, [ebp - 0x114]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push 0x10023448
lea ecx, [ebp - 0xc]
push ecx
push 0
lea edx, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x10023448
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
push edx
push 0x20119
push 0
push str.softwaremicrosoftwindowscurrentversion_run
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push 0x10023448
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.userinit
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x10023448
mov esp, ebp
pop ebp
ret
Function at 0x10001c50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 4
test eax, eax
jne 0x10001cc7
lea eax, [ebp - 4]
push eax
push 0x101
push 0
push str.SoftwareMicrosoft
push 0x80000001
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x10001cbc
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1002068c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
jne 0x10001d1f
lea ecx, [ebp - 8]
push ecx
push 0x101
push 0
push str.SoftwareMicrosoft
push 0x80000002
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x10001d16
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x1002068c
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp ecx, dword [ebp - 4]
sbb eax, eax
neg eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret