joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4031f4
Capabilities:
Link many functions at runtime
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.Py_Initialize
push edi
call esi
push str.PySys_SetArgv
push edi
mov dword [ebp + 8], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 4], eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp - 8], eax
call esi
push str.Py_BuildValue
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyCFunction_New
push edi
mov ebx, eax
call esi
push str.PyArg_ParseTuple
push edi
mov dword [ebp - 0x14], eax
call esi
push str.PyErr_Format
push edi
mov dword [ebp - 0x10], eax
call esi
xor ecx, ecx
cmp dword [ebp + 8], ecx
je 0x40336b
cmp dword [ebp - 4], ecx
je 0x40336b
cmp dword [ebp - 8], ecx
je 0x40336b
cmp dword [ebp - 0xc], ecx
je 0x40336b
cmp ebx, ecx
je 0x40336b
cmp dword [ebp - 0x10], ecx
je 0x40336b
cmp eax, ecx
je 0x40336b
cmp dword [ebp - 0x14], ecx
je 0x40336b
mov esi, dword [ebp + 0xc]
cmp esi, ecx
je 0x403367
cmp byte [esi], cl
je 0x403367
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__open]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
pop ecx
jne 0x4032e5
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push esi
add eax, 0x40
push str.Could_not_open_postinstall_script__s_n
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0xc
push 3
jmp 0x40336d
push str.Running_Script...
push 0x3ec
push dword [0x40d910]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
call dword [ebp + 8]
push edi
call fcn.00402a99
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp - 4]
push 3
lea eax, [ebp - 0x38]
pop esi
push eax
push ebx
mov dword [ebp + 8], esi
call dword [sym.imp.MSVCRT.dll__fstat]
add esp, 0x14
test eax, eax
jne 0x403357
mov edi, dword [ebp - 0x24]
lea eax, [edi + 5]
add eax, esi
and al, 0xfc
call fcn.00406cb0
mov esi, esp
push edi
push esi
push ebx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
test eax, eax
jle 0x403357
add eax, esi
push esi
mov byte [eax], 0xa
and byte [eax + 1], 0
call dword [ebp - 8]
pop ecx
mov dword [ebp + 8], eax
call dword [ebp - 0xc]
push ebx
call dword [sym.imp.MSVCRT.dll__close]
mov eax, dword [ebp + 8]
pop ecx
jmp 0x40336e
push 2
jmp 0x40336d
push 1
pop eax
lea esp, [ebp - 0x44]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403590
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push 1
push 0
push 0x40c444
push str.C:UsersAdminAppDataLocalTemp_a46e99c5da3871c18bbddf7ec2c406a68c0d5e70cbcf96c85c54af0a9629eae6.exe
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4035df
push eax
lea eax, [ebp - 0x80]
push str.Failed_to_start_elevated_process__ShellExecute_returned__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x80]
push 0x10
push str.Setup
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
leave
ret
Function at 0x43fad5
Capabilities:
Encode data using xor

Disassembly:
test byte [eax + 0x11], ah
pop ss
mov byte [eax], 1
outsb dx, byte [esi]
mov byte [eax], 0x8c
mov dword [eax], 0x66a56
lea ecx, [eax + 0x28]
pop esi
cmp dword [ecx - 8], 0x4bf06163
je 0x43fafc
or dword [ebx - 0x7f961fef], ecx
add dword [edx], eax
mov edx, dword [ecx]
loopne 0x43fb60
add byte [ecx], 2
add byte [ebx + 0x7400f479], al
or cl, byte [ebx - 0xa03fdaf]
jns 0x43faf2
add byte [edx + ecx - 0x75], dh
push ecx
add bh, ah
cmc
add cl, al
adc byte [ebx - 0x6f8afe12], al
salc
push dword [eax - 0x17fc2f64]
dec esi
add dword [eax - 0x77], edi
in eax, 0x42
push ecx
push ebx
jno 0x43fb6b
push edi
mov eax, dword [esi - 0x3fee73ff]
xor dword [ebp + edi + 0x23], ebp
push eax
pop ecx
je 0x43fb93
mov word [ecx], ss
sal byte [ecx], 0x6c
cmp eax, 0x74595023
mov eax, dword gs:[esi + eax*2]
mov eax, dword [esi + eax*2]
jl 0x43fb03
add byte [esi - 0x7d], bl
cmp byte [eax], al
jne 0x43fba2
pop ecx
mov eax, dword [esi + 0xc008f2]
jnp 0x43fb23
add byte [ebx], dl
push eax
push eax
call 0x3e04f6a5
mov dh, 0x11
add ebp, eax
sub ecx, dword fs:[ebx]
sub ecx, dword [ebx]
sar dword [ebx + ecx*4 - 0x7a], 1
inc edx
or dl, byte [edi]
add dh, byte [edi]
add eax, 0x90070217
nop
dec ebp
pop ecx
pop ecx
push dword [esi + 0x7c]
je 0x43fb51
and al, byte [edi + 1]
pop ss
add dword [edi], edx
mov al, byte [0xe2036100]
or al, 0xc0
test byte [ebp + eax*2 + 0x61], dh
add eax, dword [eax - 0x75]
xchg byte [eax + 0x2d4400e0], dl
invalid
push eax
call 0x166ddc3
cwde
aam 0
aam 0xd0
add bh, bh
mov dh, 0x99
add dword [eax + ebp*8], eax
leave
mov al, byte [0xff193000]
mov dh, 0xf2
or eax, 0x4a819702
push 6
pop eax
lea ebx, [esi + 0x9043a0]
xor dword [ebp + 0x7e], esp
sub byte [ecx + 0x1d12437f], al
or cl, byte [ebx - 0x1eebbfef]
push es
movmskps ebp, xmm0
xchg ecx, eax
xor dword [ecx], esp
add al, 0x33
call 0xc0445c62
or byte [ebp - 4], al
test byte [ebx + 0x1613807f], al
mov eax, dword [edi - 4]
sar dword [ecx + 0x61], 1
xor dword [edx], eax
pop es
push eax
call 0xb145bd5d
add ebx, eax
xor byte [ebx + eax*4], al
invalid
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x401460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 8]
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::c_str___const
mov dword [esp], eax
call sym._GetFileAttributesW_4
sub esp, 4
cmp eax, 0xffffffff
setne al
leave
ret
Function at 0x402390
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408048
call sym._EnterCriticalSection_4
mov ebx, dword [0x408040]
sub esp, 4
test ebx, ebx
je 0x4023db
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4023d4
test esi, esi
je 0x4023d4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4023b0
mov dword [esp], 0x408048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4025c0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402610
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4026e8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40264e
cmp eax, 4
jne 0x402670
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40265e
cmp edx, 4
je 0x40265e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004025c0
Function at 0x40ca10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x45f410], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x45f40c]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x45f410], eax
cmp ecx, 0x26f
jl 0x40ca20
mov dword [0x44ed60], 0x270
ret

Function at 0x40ca60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x45e010]
cmp eax, dword [0x44e500]
je 0x40ca78
mov dword [0x44ed60], 0x271
cmp dword [0x44ed60], 0x270
jl 0x40cb97
cmp dword [0x44ed60], 0x271
jne 0x40caaf
mov eax, dword [0x45e010]
call fcn.0040ca10
mov eax, dword [0x45e010]
not eax
mov dword [0x45e010], eax
mov dword [0x44e500], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x45f414]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x45f410]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x45fa44]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x44ed70]
xor edx, eax
mov dword [ebx*4 + 0x45f410], edx
cmp ebx, 0xe2
jl 0x40cab8
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x45f414]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x45f410]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x45f084]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x44ed70]
xor edx, eax
mov dword [ebx*4 + 0x45f410], edx
cmp ebx, 0x26e
jl 0x40cb0c
mov eax, dword [0x45fdcc]
and eax, 0x80000000
mov edx, dword [0x45f410]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x45fa40]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x44ed70]
xor eax, edx
mov dword [0x45fdcc], eax
mov dword [0x44ed60], 0
mov eax, dword [0x44ed60]
mov eax, dword [eax*4 + 0x45f410]
add dword [0x44ed60], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret
Function at 0x40e630
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x44e220]
cmp ax, 0xcb
je 0x40e72c
cmp ax, 0xcc
je 0x40e72c
mov edx, dword [0x460020]
test edx, edx
je 0x40e662
mov eax, dword [0x45fec0]
call edx
mov ebx, eax
jmp 0x40e667
mov ebx, 0x45fec4
cmp word [0x45feb0], 0
jle 0x40e68a
mov eax, 0x45fe90
call fcn.0040e8a0
mov eax, ebx
call fcn.0040e210
mov eax, ebx
call fcn.0040e280
mov edi, dword [ebx]
jmp 0x40e6aa
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40e6a5
mov edx, edi
mov eax, ebx
call fcn.0040d6e0
jmp 0x40e6a8
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40e690
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x45feb0], 0
jle 0x40e72c
mov edx, 0x45fdd0
mov eax, ebx
call fcn.0040d810
mov edi, eax
test edi, edi
je 0x40e6ff
mov eax, dword [0x45fe64]
mov dword [edi + 0xc], eax
cmp dword [0x45fe64], 0
je 0x40e6f4
mov eax, dword [0x45fe64]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x45fe64], eax
sub word [0x45feb0], 1
cmp word [0x45feb0], 0
sete bl
mov eax, 0x45fe90
call fcn.0040e8b0
test bl, bl
je 0x40e72c
mov eax, 0x45fe90
call fcn.0040e890
pop edi
pop esi
pop ebx
ret
Function at 0x42b630
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0
mov edx, ecx
and edx, 0x4000000
je 0x42b64f
mov edx, eax
or edx, 0x200
mov eax, edx
mov edx, ecx
and edx, 0x20000000
je 0x42b6a1
mov edx, ecx
and edx, 0x40000000
je 0x42b682
mov edx, ecx
and edx, 0x80000000
je 0x42b679
mov edx, eax
or edx, 0x40
mov eax, edx
jmp 0x42b6df
mov edx, eax
or edx, 0x20
mov eax, edx
jmp 0x42b6df
mov edx, ecx
and edx, 0x80000000
je 0x42b698
mov edx, eax
or edx, 0x80
mov eax, edx
jmp 0x42b6df
mov edx, eax
or edx, 0x10
mov eax, edx
jmp 0x42b6df
mov edx, ecx
and edx, 0x40000000
je 0x42b6c7
mov edx, ecx
and edx, 0x80000000
je 0x42b6be
mov edx, eax
or edx, 4
mov eax, edx
jmp 0x42b6df
mov edx, eax
or edx, 2
mov eax, edx
jmp 0x42b6df
and ecx, 0x80000000
je 0x42b6d8
mov edx, eax
or edx, 8
mov eax, edx
jmp 0x42b6df
mov edx, eax
or edx, 1
mov eax, edx
leave
ret 4
Function at 0x44aae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x5c]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
call fcn.00407560
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x5c], 0
mov eax, 1
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x3c]
call fcn.0040bc00
call fcn.0040d480
push eax
test eax, eax
jne 0x44ac9a
mov dword [ebp - 0x20], 0
sub dword [ebp - 0x20], 1
lea esi, [esi]
add dword [ebp - 0x20], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
mov byte [eax + edx], 0
cmp dword [ebp - 0x20], 0xf
jl 0x44ab30
mov dword [ebp - 0x20], 0
sub dword [ebp - 0x20], 1
nop
add dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
mov word [ebp + eax*2 - 0x18], 0
cmp dword [ebp - 0x20], 7
jl 0x44ab50
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0044a980
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 4]
call fcn.00407590
cmp dword [ebp - 4], 0
jne 0x44ac1c
jmp 0x44ac9a
cmp dword [ebp - 0x1c], 7
jg 0x44ac9a
lea ecx, [ebp - 0x2c]
mov edx, 0x45d2ac
lea eax, [ebp - 4]
call fcn.00449fc0
mov edx, 0x45d2fc
mov eax, dword [ebp - 0x2c]
call fcn.00408000
test eax, eax
je 0x44ac26
cmp dword [ebp - 0x2c], 0
jne 0x44abcd
mov eax, dword [ebp - 0x1c]
mov word [ebp + eax*2 - 0x18], 0
jmp 0x44ac18
lea eax, [ebp - 0x5c]
call fcn.004028d0
push 0
mov ecx, dword [ebp - 0x2c]
mov edx, 0x45d2cc
lea eax, [ebp - 0x5c]
call fcn.00407690
mov eax, dword [ebp - 0x5c]
mov edx, 0xffffffff
call fcn.00420640
mov dword [ebp - 0x30], eax
cmp eax, 0xffff
jg 0x44ac9a
cmp dword [ebp - 0x30], 0
jl 0x44ac9a
mov eax, dword [ebp - 0x1c]
mov dx, word [ebp - 0x30]
mov word [ebp + eax*2 - 0x18], dx
add dword [ebp - 0x1c], 1
cmp dword [ebp - 4], 0
jne 0x44ab90
mov dword [ebp - 0x20], 0
sub dword [ebp - 0x20], 1
lea esi, [esi]
add dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
movzx eax, word [ebp + eax*2 - 0x18]
mov edx, eax
sar edx, 0x1f
and edx, 0xff
add eax, edx
sar eax, 8
mov byte [ebp - 0x24], al
mov eax, dword [ebp - 0x20]
movzx eax, word [ebp + eax*2 - 0x18]
mov edx, eax
sar edx, 0x1f
mov ecx, eax
xor ecx, edx
sub ecx, edx
and ecx, 0xff
mov ebx, edx
xor ebx, ecx
sub ebx, edx
mov edx, ebx
mov byte [ebp - 0x28], dl
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
shl eax, 1
mov cl, byte [ebp - 0x24]
mov byte [edx + eax], cl
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
shl eax, 1
mov cl, byte [ebp - 0x28]
mov byte [edx + eax + 1], cl
cmp dword [ebp - 0x20], 7
jl 0x44ac34
call fcn.0040be80
lea eax, [ebp - 0x5c]
call fcn.004028d0
lea eax, [ebp - 0x2c]
call fcn.004028d0
lea eax, [ebp - 4]
call fcn.004028d0
pop eax
test eax, eax
je 0x44acc1
call fcn.0040bfb0
pop ebx
leave
ret
Function at 0x10001370
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
lea eax, [ebp - 8]
xor ebx, ebx
cmp dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSet_serviceshphubfilterParameters
push 0x80000002
setne bl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100013ee
push 4
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push 4
push 0
push str.MassStorageReadOnly
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100013ee
mov eax, dword [ebp + 8]
test eax, eax
je 0x100013dc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call fcn.10006df0
neg eax
sbb eax, eax
pop ebx
mov esp, ebp
pop ebp
neg eax
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x100013fc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001410
Capabilities:
Set registry value

Disassembly:
xor eax, eax
push edi
mov edi, esp
push ecx
push esi
cmp dword [edi + 8], eax
setne al
push ebp
xor esi, esi
push esi
mov dword [edi - 4], eax
lea eax, [edi + 8]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SystemCurrentControlSetControlStorageDevicePolicies
push 0x80000002
mov dword [edi + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10001487
lea eax, [edi - 4]
push 4
push eax
push 4
push esi
push str.WriteProtect
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
push dword [edi + 8]
mov ebp, 1
cmove esi, ebp
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10001487
mov eax, ebp
pop ebp
pop esi
mov esp, edi
pop edi
ret
xor eax, eax
pop ebp
pop esi
mov esp, edi
pop edi
ret

Function at 0x10001490
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
mov edi, esp
add esp, 0xfffffff0
lea eax, [edi - 4]
push ebp
push esi
mov dword [edi - 0x10], 4
push eax
xor esi, esi
push 0x20019
push esi
push str.SystemCurrentControlSetControlStorageDevicePolicies
push 0x80000002
mov dword [edi - 8], esi
mov dword [edi - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ebp, [esi + 1]
or eax, eax
jne 0x100014f3
lea eax, [edi - 0x10]
push eax
lea eax, [edi - 8]
push eax
push esi
push esi
push str.WriteProtect
push dword [edi - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or eax, eax
jne 0x100014ea
cmp dword [edi - 8], ebp
cmove esi, ebp
push dword [edi - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [edi - 0xc]
mov eax, dword [edi + 0xc]
mov dword [edi - 0xc], 0
mov dword [eax], esi
call fcn.10004d00
test eax, eax
jne 0x10001511
pop esi
pop ebp
mov esp, edi
pop edi
ret
pop esi
mov eax, ebp
xor ecx, ecx
cmp ecx, dword [edi - 0xc]
sbb edx, edx
mov ecx, dword [edi + 8]
neg edx
mov dword [ecx], edx
pop ebp
mov esp, edi
pop edi
ret
Function at 0x100026b0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
lea eax, [ebp - 8]
xor ebx, ebx
cmp dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSet_serviceshphubfilterParameters
push 0x80000002
setne bl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10002728
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 4
push 0
push str.EnableLog
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
or eax, eax
jne 0x10002728
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000271c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x10002736
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov esp, ebp
xor eax, eax
pop ebp
ret 4

Function at 0x10003b20
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, esp
sub esp, 8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push ebx
push 0
push 0x80000080
push 3
push 0
push 3
lea ebx, [ecx + 0x20]
push 0x40000000
push ebx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x10003bb4
push 0
push 0x80000080
push 2
push 0
push 3
push 0x40000000
push ebx
mov word [edi - 4], 0xfeff
mov dword [edi - 8], 0
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x10003b98
lea eax, [edi - 8]
push 0
push eax
push 2
lea eax, [edi - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80000080
push 3
push 0
push 3
push 0x40000000
push ebx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x10003be2
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [edi - 8]
push 0
push eax
push dword [edi + 0xc]
push dword [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
pop ebp
mov esp, edi
pop edi
ret 8
Function at 0x10003cf0
Capabilities:
Query or enumerate registry key

Disassembly:
push esi
mov esi, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001558b
mov eax, dword fs:[0]
push eax
add esp, 0xfffff5a0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa58], eax
push edi
push ebp
push ebx
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0xa70]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x20], ebx
mov edi, dword [esi + 8]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x64], ax
lea eax, [esp + 0x66]
push eax
call fcn.1000e070
add esp, 0xc
mov dword [esp + 0x18], 0x104
lea eax, [esp + 0x30]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x34]
push eax
lea ebp, [esp + 0x30]
push ebp
lea ebp, [esp + 0x48]
push ebp
lea eax, [esp + 0x54]
push eax
lea ebp, [esp + 0x40]
push ebp
lea ebp, [esp + 0x30]
push ebp
push 0
lea ebp, [esp + 0x3c]
push ebp
lea eax, [esp + 0x84]
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
or eax, eax
je 0x10003dad
xor eax, eax
jmp 0x10003ea0
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x10003e83
xor ebp, ebp
or ebx, ebx
je 0x10003e83
mov dword [esp + 0x1c], 0x400
lea ebx, [esp + 0x30]
push ebx
push 0
push 0
push 0
lea ebx, [esp + 0x2c]
push ebx
lea ebx, [esp + 0x278]
push ebx
mov eax, dword [esp + 0x38]
push ebp
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10003e76
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], eax
mov word [esp + 0x44], ax
cmp word [esp + 0x264], ax
je 0x10003e2f
lea ecx, [ecx]
lea eax, [esp + 0x264]
lea edx, [eax + 2]
mov cx, word [eax]
sub eax, 0xfffffffe
test cx, cx
jne 0x10003e20
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x268]
push eax
lea ecx, [esp + 0x4c]
call fcn.100030e0
lea eax, [esp + 0x44]
mov dword [esp + 0xa78], 0
push eax
mov ecx, edi
call fcn.100043c0
mov dword [esp + 0xa78], 0xffffffff
cmp dword [esp + 0x58], 8
jb 0x10003e76
push dword [esp + 0x44]
call fcn.10006e6a
sub esp, 0xfffffffc
mov ebx, dword [esp + 0x14]
inc ebp
cmp ebp, ebx
jb 0x10003dc3
mov ebp, dword [edi + 4]
mov eax, 0x2aaaaaab
sub ebp, dword [edi]
imul ebp
xor eax, eax
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
cmp edi, ebx
sete al
mov ebx, dword [esp + 0xa70]
mov dword fs:[0], ebx
pop ecx
pop ebx
pop ebp
pop edi
mov ecx, dword [esp + 0xa58]
xor ecx, esp
call fcn.10006e5b
mov esp, esi
pop esi
ret 4

Function at 0x10003ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], 4
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
mov dword [esi], 0
push dword [ecx]
mov dword [ebp + 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10003f20
cmp dword [ebp + 0x10], 4
jne 0x10003f37
mov dword [esi], 1
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 2
jne 0x10003f37
mov dword [esi], 0
pop esi
mov esp, ebp
pop ebp
mov eax, 1
ret 0xc
pop esi
mov esp, ebp
pop ebp
xor eax, eax
ret 0xc