joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20006000
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
and dword [ebp - 0x128], 0
push esi
push edi
push 0x49
pop ecx
xor eax, eax
lea edi, [ebp - 0x124]
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x128]
push eax
push esi
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.dll_Process32First
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.20005cfb
pop ecx
test eax, eax
pop ecx
jne 0x2000606a
lea eax, [ebp - 0x128]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x20006070
jmp 0x20006042
mov edi, dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x2000619b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
mov ebx, 0x2001f
push eax
push ebx
mov edi, 0x20002984
push 0
mov esi, 0x80000000
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x200061e0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push ebx
push eax
push eax
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x20006230
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 8]
push 1
push 0
push 0x2000297c
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push 0x20002974
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x20006235
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x2001f
push 0
push 0x20002984
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x2000625e
xor eax, eax
leave
ret
push esi
push edi
push 1
lea eax, [ebp - 4]
pop edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 8]
push dword [ebp + 8]
mov dword [ebp - 4], 0x104
mov dword [ebp - 8], edi
push eax
push 0
push 0x2000297c
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 8]
push dword [ebp + 0xc]
mov dword [ebp - 8], edi
push eax
push 0
push 0x20002974
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x200062ba
Capabilities:
Delete registry key
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
push edi
push 0x7f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x407]
mov byte [ebp - 0x408], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], bl
cmp dword [ebp + 8], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x20006309
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push 0x2f
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x200063d2
mov byte [eax + 1], bl
lea eax, [ebp - 0x104]
push 0x200015f0
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x104]
pop ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x200
lea eax, [ebp - 0x408]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x408]
push 0x20
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.20005f82
test eax, eax
je 0x200063d2
lea eax, [ebp - 0x408]
push 0x200015e8
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x200063d2
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, 0x80000000
push 0x20002984
push edi
call esi
push 0x200029a4
push edi
call esi
push 0x20002994
push edi
call esi
push 1
pop eax
pop esi
jmp 0x200063d4
xor eax, eax
pop edi
pop ebx
leave
ret 0xc

Function at 0x2000655b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x200029d0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x200065bb
mov ecx, dword [ebp + 8]
cmp byte [ecx], bl
je 0x20006595
inc eax
cmp byte [eax + ecx], bl
jne 0x2000658f
inc eax
push eax
push ecx
push 1
push ebx
push 0x200029c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret

Function at 0x200065be
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x200029d0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x200065e7
xor eax, eax
leave
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
push eax
push 0
push 0x200029c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
leave
ret
Function at 0x2000661e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x200029e0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x2000667e
mov ecx, dword [ebp + 8]
cmp byte [ecx], bl
je 0x20006658
inc eax
cmp byte [eax + ecx], bl
jne 0x20006652
inc eax
push eax
push ecx
push 1
push ebx
push 0x200029c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret

Function at 0x20006681
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x200029e0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x200066aa
xor eax, eax
leave
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
push eax
push 0
push 0x200029c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
leave
ret

Function at 0x2000673e
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0xf01ff
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x20006776
lea eax, [ebp - 0x1c]
push edi
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x200067e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor edi, edi
push 0x2001f
mov ebx, 0x200029fc
push edi
mov esi, 0x80000000
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x20006827
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x20006890
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 8]
push 1
push edi
push 0x2000297c
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0xc]
push 1
push edi
push 0x20002974
push dword [ebp - 4]
call esi
push dword [ebp + 0x10]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0x10]
push 1
push edi
push 0x200029f4
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2000710d
Capabilities:
Delete file
Encode data using xor
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
push 0x7f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x21f]
mov byte [ebp - 0x220], bl
push 7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
push 0x20
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x20007205
push edi
call sub.MSVCRT.dll_strlen
cmp eax, 0x20
pop ecx
jae 0x20007205
lea eax, [ebp - 0x20]
push edi
push eax
call sub.MSVCRT.dll_strcpy
push edi
xor esi, esi
call sub.MSVCRT.dll_strlen
add esp, 0xc
test eax, eax
jbe 0x2000718f
xor byte [ebp + esi - 0x20], 0xea
push edi
inc esi
call sub.MSVCRT.dll_strlen
cmp esi, eax
pop ecx
jb 0x2000717e
lea eax, [ebp - 0x220]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [0x20002bcc]
lea eax, [ebp - 0x220]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x220]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 0x80
push 1
push ebx
push 3
lea eax, [ebp - 0x220]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x20007205
lea eax, [ebp + 8]
push ebx
push eax
push edi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xda3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00da31a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xda307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda306a
add dl, dl
jne 0xda3089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda30dc
xor eax, eax
add dl, dl
jne 0xda3096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda317d
add dl, dl
jne 0xda30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda30b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda30bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda30c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xda30d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xda3075
mov eax, 1
add dl, dl
jne 0xda30ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda30f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda30e1
sub eax, ebx
mov ebx, 1
jne 0xda3128
mov ecx, 1
add dl, dl
jne 0xda310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda3119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda3105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda3075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xda313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda3136
cmp eax, 0x7d00
jae 0xda316d
cmp eax, 0x500
jb 0xda3168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda3075
cmp eax, 0x7f
ja 0xda3170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda3075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xda319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xda3075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10001030
Capabilities:
Accept command line arguments
Link many functions at runtime

Disassembly:
push esi
cmp dword [esp + 0xc], 1
jne 0x100011d3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
push eax
call dword [0x1000534c]
add esp, 4
test eax, eax
je 0x1000109d
xor ecx, ecx
jmp 0x10001067
add ecx, 1
cmp eax, ecx
je 0x1000109d
cmp word [esi + ecx*2], 0x72
jne 0x10001060
cmp word [esi + ecx*2 + 2], 0x65
jne 0x10001060
cmp word [esi + ecx*2 + 4], 0x6e
jne 0x10001060
cmp word [esi + ecx*2 + 6], 0x64
jne 0x10001060
cmp word [esi + ecx*2 + 8], 0x65
jne 0x10001060
cmp word [esi + ecx*2 + 0xa], 0x72
jne 0x10001060
mov eax, 1
jmp 0x1000109f
xor eax, eax
mov dword [0x1000d0ec], eax
cmp dword [0x1000d0dc], 0
jne 0x100011d3
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernel32.dll
call esi
mov dword [0x1000d0dc], eax
push str.ntdll.dll
call esi
mov dword [0x1000d0e0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000502e
push dword [0x1000d0dc]
call esi
mov dword [0x1000d0f0], eax
push 0x10005043
push dword [0x1000d0dc]
call esi
mov dword [0x1000d0f4], eax
push 0x10005059
push dword [0x1000d0dc]
call esi
mov dword [0x1000d0f8], eax
push 0x1000506e
push dword [0x1000d0dc]
call esi
mov dword [0x1000d104], eax
push 0x1000507e
push dword [0x1000d0dc]
call esi
mov dword [0x1000d0fc], eax
push 0x10005099
push dword [0x1000d0dc]
call esi
mov dword [0x1000d100], eax
push 0x100050b4
push dword [0x1000d0dc]
call esi
mov dword [0x1000d110], eax
push 0x100050ca
push dword [0x1000d0dc]
call esi
mov dword [0x1000d11c], eax
push 0x100050df
push dword [0x1000d0dc]
call esi
mov dword [0x1000d114], eax
push str.NtSetInformationVirtualMemory
push dword [0x1000d0e0]
call esi
mov dword [0x1000d10c], eax
push 0x10005113
push dword [0x1000d0e0]
call esi
mov dword [0x1000d118], eax
push str.NtQueryInformationToken
push dword [0x1000d0e0]
call esi
mov dword [0x1000d120], eax
push str.NtSetInformationThread
push dword [0x1000d0e0]
call esi
mov dword [0x1000d108], eax
call fcn.100011e0
call fcn.10001380
call fcn.10001450
mov dword [0x1000d0bc], eax
mov eax, 1
pop esi
ret
Function at 0x100011e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push eax
call dword [0x1000534c]
add esp, 4
test eax, eax
je 0x10001375
xor ecx, ecx
jmp 0x1000121b
add ecx, 1
cmp eax, ecx
je 0x10001375
cmp word [edi + ecx*2], 0x67
jne 0x10001210
cmp word [edi + ecx*2 + 2], 0x70
jne 0x10001210
cmp word [edi + ecx*2 + 4], 0x75
jne 0x10001210
push edi
call dword [0x1000534c]
add esp, 4
cmp eax, 6
jb 0x10001375
mov ebx, eax
lea esi, [eax + eax]
add esi, 0xa
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10001375
mov esi, eax
lea edx, [ebx + ebx]
xor ebp, ebp
mov eax, 1
jmp 0x1000128b
mov ebp, eax
add eax, 1
cmp cx, 0x22
je 0x100012a1
cmp ebx, eax
je 0x100012a1
movzx ecx, word [edi + eax*2]
cmp cx, 0x5c
je 0x10001280
cmp cx, 0x2f
je 0x10001280
jmp 0x10001282
cmp word [edi], 0x22
lea ebx, [edi + 2]
cmovne ebx, edi
mov eax, ebp
add eax, ebp
push eax
push ebx
mov edi, edx
push edx
push esi
call fcn.10001b20
add esp, 0x10
movzx eax, word [ebx + ebp*2]
or eax, 0x20
cmp ax, 0x63
jne 0x10001365
movzx eax, word [ebx + ebp*2 + 2]
or eax, 0x20
cmp ax, 0x68
jne 0x10001365
movzx eax, word [ebx + ebp*2 + 4]
or eax, 0x20
cmp ax, 0x72
jne 0x10001365
movzx eax, word [ebx + ebp*2 + 6]
or eax, 0x20
cmp ax, 0x6f
jne 0x10001365
movzx eax, word [ebx + ebp*2 + 8]
or eax, 0x20
cmp ax, 0x6d
jne 0x10001365
movzx eax, word [ebx + ebp*2 + 0xa]
or eax, 0x20
cmp ax, 0x65
jne 0x10001365
cmp word [ebx + ebp*2 + 0xc], 0x2e
jne 0x10001365
movzx eax, word [ebx + ebp*2 + 0xe]
or eax, 0x20
cmp ax, 0x65
jne 0x10001365
movzx eax, word [ebx + ebp*2 + 0x10]
or eax, 0x20
cmp ax, 0x78
jne 0x10001365
movzx eax, word [ebx + ebp*2 + 0x12]
or eax, 0x20
cmp ax, 0x65
jne 0x10001365
lea eax, [esi + ebp*2]
push 0x16
push 0x100051d8
push edi
push eax
call fcn.10001b20
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001380
Capabilities:
Start service

Disassembly:
push ebx
push edi
push esi
push eax
push str.chrome.exe
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10001446
push str.IsSandboxedProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1000d124], eax
test eax, eax
je 0x100013f3
call eax
test al, al
je 0x10001409
push str.dwrite.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10001446
mov esi, eax
mov dword [esp], 0
mov eax, esp
push eax
push esi
call fcn.10001f50
add esp, 8
push dword [esp]
push eax
push esi
push section..data
push str.ADVAPI32.DLL
call fcn.10001fa0
add esp, 0x14
jmp 0x10001446
push 0x40
push str._BUG_
push str.Function__IsSandboxedProcess____not_found_in_EXPORT_TABLE__
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x10001446
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
je 0x10001446
mov esi, eax
push 0x14
push str.FontCache
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x10001446
mov edi, eax
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call ebx
push esi
call ebx
add esp, 4
pop esi
pop edi
pop ebx
ret

Function at 0x10001790
Capabilities:
Get uefi variable

Disassembly:
mov eax, dword [0x1000d104]
test eax, eax
je 0x1000179b
jmp eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
push str.00000000_0000_0000_0000_000000000000
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 1
sete cl
mov eax, 2
sub eax, ecx
ret 4

Function at 0x10001f50
Capabilities:
Parse pe header

Disassembly:
push esi
mov ecx, dword [esp + 8]
movzx edx, word [ecx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x10001f9e
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10001f9e
movzx esi, word [ecx + edx + 0x18]
cmp esi, 0x20b
je 0x10001f88
xor eax, eax
movzx esi, si
cmp esi, 0x10b
jne 0x10001f9c
mov eax, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x84]
mov dword [eax], esi
mov eax, dword [ecx + edx + 0x80]
add eax, ecx
pop esi
ret
Function at 0x10001fa0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x20]
xor eax, eax
test ebp, ebp
je 0x10002171
mov edi, dword [esp + 0x24]
test edi, edi
je 0x10002171
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x10002171
mov edx, 0x62
mov eax, dword [ecx]
mov dword [esp], eax
test eax, eax
jne 0x10002000
cmp dword [ecx + 0x10], 0
jne 0x10002000
cmp dword [ecx + 8], 0
jne 0x10002000
cmp dword [ecx + 0xc], 0
jne 0x10002000
cmp dword [ecx + 4], 0
je 0x10002179
nop word [eax + eax]
mov esi, dword [ecx + 0xc]
mov eax, dword [esp + 0x28]
mov al, byte [esi + eax]
test al, al
je 0x1000206c
add esi, dword [esp + 0x28]
mov ebx, ebp
mov ah, byte [ebx]
add ebx, 1
add esi, 1
nop dword [eax]
test ah, ah
je 0x1000206c
or al, 0x20
or ah, 0x20
cmp al, ah
jne 0x10002056
movzx eax, byte [esi]
cmp al, 0x2e
jne 0x10002050
mov ah, byte [ebx]
add ebx, 1
add esi, 1
mov al, 0x2e
cmp ah, 0x2e
jne 0x10002020
jmp 0x1000206c
test al, al
jne 0x10002014
jmp 0x1000206c
add ecx, 0x14
mov eax, 1
sub edx, 1
jae 0x10001fd2
jmp 0x10002171
mov ebx, dword [edi]
mov eax, 2
test ebx, ebx
je 0x10002171
mov eax, dword [esp + 0x28]
add dword [esp], eax
mov ecx, dword [ecx + 0x10]
add ecx, eax
mov dword [esp + 4], ecx
jmp 0x1000209e
mov ebx, dword [edi + 8]
add edi, 8
test ebx, ebx
je 0x1000216c
mov eax, dword [esp]
mov eax, dword [eax]
test eax, eax
je 0x10002090
mov esi, dword [esp + 4]
mov ebp, dword [esp]
mov ecx, dword [esp + 0x28]
mov cl, byte [eax + ecx + 2]
test cl, cl
je 0x10002130
mov edx, dword [esp + 0x28]
add edx, eax
add edx, 2
mov eax, ebx
mov ch, byte [eax]
add eax, 1
add edx, 1
nop dword [eax]
test ch, ch
je 0x10002130
or cl, 0x20
or ch, 0x20
cmp cl, ch
jne 0x10002110
movzx ecx, byte [edx]
cmp cl, 0x2e
jne 0x10002100
mov ch, byte [eax]
add eax, 1
add edx, 1
mov cl, 0x2e
cmp ch, 0x2e
jne 0x100020d0
jmp 0x10002130
test cl, cl
jne 0x100020c5
jmp 0x10002130
add esi, 4
mov eax, dword [ebp + 4]
add ebp, 4
test eax, eax
jne 0x100020ae
jmp 0x10002090
test esi, esi
je 0x10002090
mov dword [esp + 8], 0
lea ebx, [esp + 8]
push ebx
push 0x40
push 4
push esi
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebp
test eax, eax
je 0x10002090
mov eax, dword [edi + 4]
mov dword [esi], eax
push ebx
push 0x20
push 4
push esi
call ebp
jmp 0x10002090
mov eax, 2
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 1
jmp 0x10002171

Function at 0x10003c90
Capabilities:
Manipulate console buffer

Disassembly:
push eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], ecx
mov ecx, dword [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
pop ecx
ret

Function at 0x10003f90
Capabilities:
Get process image filename

Disassembly:
jmp 0x100040b2
jmp dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]

Function at 0x10003fa0
Capabilities:
Get process image filename

Disassembly:
jmp 0x100040b8
jmp dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
Function at 0x43534b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042708b
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x435383
xor eax, eax
jmp 0x4353af
cmp esi, dword [ebp - 4]
je 0x4353ac
cmp dword [ebp + 0xc], 0
je 0x4353ac
push dword [edi + 0x9c]
call fcn.00434f59
push dword [edi + 0x9c]
mov esi, eax
call fcn.00424fcd
pop ecx
pop ecx
cmp esi, eax
je 0x43537f
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
xchg dword [ebx - 0x6e], edx
sub eax, dword es:[edx]
dec ebp
sbb ebx, dword [esi + 0x65]
rcr dword [eax], 1
outsb dx, byte [esi]
stc
push cs
cmpsd dword [esi], dword es:[edi]
mov al, byte [0x21826ee]
sbb byte [edx], al
out dx, al
xor dword [eax], ebx
jp 0x4153b1
ljmp 0x5ff3:0x76eea0aa
wait
jp 0x41539d
xlatb
retf