joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b7108
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5b71fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
xor edx, edx
call fcn.00407c9c
push 0x40
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x5b71e3
mov edi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x5b71a7
push dword [esi]
cmp ebx, 0xff
jbe 0x5b7178
call fcn.00405714
mov eax, dword [edi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1d4]
call fcn.00407e28
push dword [ebp - 0x1d4]
push 0x5b7218
mov eax, esi
mov edx, 3
call fcn.00408264
inc ebx
cmp ebx, 0xff
jbe 0x5b71b4
call fcn.00405714
cmp dword [edi + ebx*4], 0
jne 0x5b7169
mov eax, dword [esi]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1d8]
test eax, eax
je 0x5b71d1
sub eax, 4
mov eax, dword [eax]
mov edx, esi
mov ecx, 1
xchg edx, eax
call fcn.004084bc
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b7203
lea eax, [ebp - 0x1d4]
call fcn.00407c8c
ret

Function at 0x5b79d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407c84
xor eax, eax
push ebp
push 0x5b7aa8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5b7a8b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00407d28
mov esi, eax
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, dword [ebp - 0xc]
call fcn.00404350
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5b7a76
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
mov ecx, edi
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.005b7ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b7a7d
mov eax, dword [ebp - 8]
call fcn.00404384
ret
Function at 0x5eb130
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x5eb14c
add esp, 0xfffffff0
call fcn.00405d88
mov ebx, ecx
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5eb23f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, 0x5eb278
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
mov cl, 1
xor edx, edx
call fcn.005d8ea8
push ebx
push 0
push 0x400
call fcn.004e74f8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5eb1da
push 0x5eb2a8
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040572c
mov eax, dword [ebp - 0x18]
push eax
push 0x5eb2e4
push 0
push 1
mov eax, 0x5eb310
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x11
lea eax, [ebp - 0x20]
push eax
push 0
mov ecx, 0x5eb334
mov dl, 1
mov eax, dword [0x601b2c]
call fcn.0060aa44
call fcn.0040632c
xor eax, eax
push ebp
push 0x5eb21a
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
and esi, 2
cmp esi, 2
sete al
push eax
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x8c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eb221
mov eax, dword [ebp - 0x10]
push eax
call fcn.004e7b10
ret
Function at 0x6125c4
Capabilities:
Reference the vmware io port

Disassembly:
xor eax, eax
push 0x6125ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x564d5868
mov ebx, 0x3c6cf712
mov ecx, 0xa
mov dx, 0x5658
in eax, dx
mov eax, 1
jmp 0x6125ff
xor ebx, ebx
pop dword fs:[ebx]
add esp, 4
ret

Function at 0x612608
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ecx, 0x612652
mov ebp, esp
push ebx
push ecx
push dword fs:[0]
mov dword fs:[0], esp
mov ebx, 0
mov eax, 1
invalid

Function at 0x61297c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
test dl, dl
je 0x612994
add esp, 0xfffffff0
call fcn.00405d88
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x612a2c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0043f914
call sub.kernel32.dll_GetEnvironmentStringsW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x612a16
xor eax, eax
push ebp
push 0x612a0f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00407e58
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0061284c
mov eax, ebx
call fcn.004174d8
inc eax
add eax, eax
add ebx, eax
cmp word [ebx], 0
jne 0x6129d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x612a16
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeEnvironmentStringsW
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x612a33
lea eax, [ebp - 0x10]
call fcn.00407c8c
ret
Function at 0x6146f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x6148a5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x3b0]
xor edx, edx
call fcn.00481c70
mov eax, dword [0x6b2568]
call fcn.004d26b0
xor eax, eax
push ebp
push 0x61474d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x6148c0
mov edx, 0x6148d8
mov eax, 0x80000002
call fcn.00627a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x614757
lea edx, [ebp - 4]
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c8]
call fcn.004a753c
mov eax, dword [ebp - 4]
mov edx, 0x614944
call fcn.00408384
jne 0x6147c0
push 0x614960
push 1
push 2
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xc]
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b4]
call fcn.004a753c
mov edx, dword [ebp - 0xc]
mov eax, dword [0x6ab5e0]
mov eax, dword [eax]
mov ecx, 0x61497c
call fcn.0061f72c
mov eax, dword [ebp - 8]
mov edx, 0x61498c
call fcn.00408384
jne 0x614801
mov eax, dword [0x6ab378]
mov eax, dword [eax]
xor edx, edx
call fcn.00625c80
mov edx, eax
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x5e0]
mov ecx, dword [eax]
call dword [ecx + 0xf0]
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
xor edx, edx
call fcn.0063a2c8
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
xor edx, edx
call fcn.0063a9ac
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
xor edx, edx
call fcn.0063c27c
lea edx, [ebp - 0x10]
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x444]
call fcn.004a753c
mov edx, dword [ebp - 0x10]
mov eax, dword [0x6aaa7c]
call fcn.00408384
jne 0x614846
mov eax, dword [0x6aafd8]
mov eax, dword [eax]
mov edx, 0x6149a8
call fcn.004a7574
jmp 0x614857
mov eax, dword [0x6aafd8]
mov eax, dword [eax]
mov edx, 0x6149e4
call fcn.004a7574
mov eax, dword [0x6aafd8]
mov eax, dword [eax]
mov eax, dword [eax + 0x38c]
mov edx, 0x614a18
call fcn.004a7574
mov eax, dword [0x6aafd8]
mov eax, dword [eax]
call fcn.004d26b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6148ac
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00407c94
lea eax, [ebp - 8]
call fcn.00407c8c
lea eax, [ebp - 4]
call fcn.00407c8c
ret
Function at 0x615b10
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor edx, edx
push ebp
push 0x615c51
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x3b0]
xor edx, edx
call fcn.00481c70
mov eax, dword [0x6b2568]
call fcn.004d26b0
xor eax, eax
push ebp
push 0x615b6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x615c6c
mov edx, 0x615c84
mov eax, 0x80000002
call fcn.00627a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x615b79
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
xor edx, edx
call fcn.0062df9c
mov eax, dword [0x6aad28]
mov eax, dword [eax]
xor edx, edx
call fcn.00625c80
mov edx, eax
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x5e0]
mov ecx, dword [eax]
call dword [ecx + 0xf0]
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
xor edx, edx
call fcn.0063a2c8
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
xor edx, edx
call fcn.0063a9ac
lea edx, [ebp - 4]
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x5bc]
call fcn.004a753c
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x615bef
sub eax, 4
mov eax, dword [eax]
cmp eax, 5
jne 0x615c07
mov eax, dword [0x6aafd8]
mov eax, dword [eax]
mov edx, 0x615cf0
call fcn.004a7574
jmp 0x615c18
mov eax, dword [0x6aafd8]
mov eax, dword [eax]
mov edx, 0x615d2c
call fcn.004a7574
mov eax, dword [0x6aafd8]
mov eax, dword [eax]
mov eax, dword [eax + 0x38c]
mov edx, 0x615d60
call fcn.004a7574
mov eax, dword [0x6aafd8]
mov eax, dword [eax]
call fcn.004d26b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x615c58
lea eax, [ebp - 4]
call fcn.00407c8c
ret
Function at 0x61da94
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x20a]
call fcn.00417904
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x61dcb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, eax
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov edx, ebx
lea eax, [ebp - 0x20a]
call fcn.00417904
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x61edb0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407c84
xor eax, eax
push ebp
push 0x61ee2b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.004169e8
test al, al
je 0x61ee07
push 0
push 0
lea edx, [ebp - 8]
mov ecx, 0x1f01ff
mov eax, dword [ebp - 4]
call fcn.0061e6b0
push 0x80
mov eax, dword [ebp - 4]
call fcn.00407d28
push eax
call sub.kernel32.dll_SetFileAttributesW
cmp dword [ebp - 8], 0
je 0x61ee15
mov eax, dword [ebp - 8]
call fcn.00405854
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61ee32
lea eax, [ebp - 4]
call fcn.00407c8c
ret

Function at 0x61f058
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407290
mov eax, dword [ebp - 8]
call fcn.00407c84
xor eax, eax
push ebp
push 0x61f108
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x61f0e3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea edx, [ebp - 0xc]
mov ecx, 0x1f01ff
mov eax, dword [ebp - 8]
call fcn.0061e6b0
push 0x80
mov eax, dword [ebp - 8]
call fcn.00407d28
push eax
call sub.kernel32.dll_SetFileAttributesW
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0061ddb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f0ea
cmp dword [ebp - 0xc], 0
je 0x61f0e2
mov eax, dword [ebp - 0xc]
call fcn.00405854
ret
Function at 0x61f114
Capabilities:
Get file attributes
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407290
mov eax, dword [ebp - 8]
call fcn.00407c84
xor eax, eax
push ebp
push 0x61f267
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
mov edi, 0x80
xor eax, eax
push ebp
push 0x61f242
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea edx, [ebp - 0xc]
mov ecx, 0x1f01ff
mov eax, dword [ebp - 8]
call fcn.0061e6b0
mov edx, 0x40
mov eax, dword [ebp - 8]
call fcn.00416864
mov esi, eax
test esi, esi
jbe 0x61f1ac
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.kernel32.dll_GetFileTime
mov eax, dword [ebp - 8]
call fcn.00407d28
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
push esi
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
push 0x80
mov eax, dword [ebp - 8]
call fcn.00407d28
push eax
call sub.kernel32.dll_SetFileAttributesW
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0061ddb0
test bl, bl
je 0x61f208
mov edx, 0x40
mov eax, dword [ebp - 8]
call fcn.00416864
mov esi, eax
test esi, esi
jbe 0x61f208
push edi
mov eax, dword [ebp - 8]
call fcn.00407d28
push eax
call sub.kernel32.dll_SetFileAttributesW
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.kernel32.dll_SetFileTime
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f249
cmp dword [ebp - 0xc], 0
je 0x61f241
movzx eax, word [0x61f278]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x5f3ee8]
call fcn.005f8c40
mov eax, dword [ebp - 0xc]
call fcn.00405854
ret

Function at 0x61f520
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407c84
xor eax, eax
push ebp
push 0x61f5cd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x61f5b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 0
lea edx, [ebp - 0xc]
mov ecx, 0x1f01ff
mov eax, dword [ebp - 4]
call fcn.0061e6b0
push 0x80
mov eax, dword [ebp - 4]
call fcn.00407d28
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.00407d28
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f5b7
cmp dword [ebp - 0xc], 0
je 0x61f5af
mov eax, dword [ebp - 0xc]
call fcn.00405854
ret
Function at 0x624260
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, eax
push 0
push esi
call sub.kernel32.dll_GetFileSize_1
mov ebx, eax
push 0
push ebx
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x624291
call fcn.0041e57c
xor eax, eax
push ebp
push 0x624320
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0
push 0
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x6242bd
call fcn.0041e57c
xor eax, eax
push ebp
push 0x624302
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.IMAGEHLP.DLL_CheckSumMappedFile
test eax, eax
setne al
neg al
sbb eax, eax
call fcn.0041e620
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x624309
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
Function at 0x6272d8
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
xor ecx, ecx
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x180], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x627508
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6ab3ec]
mov eax, dword [eax]
call fcn.004d7060
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x20], 0xffffffff
xor eax, eax
mov dword [ebp - 0x24], eax
push 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.kernel32.dll_CreatePipe
xor eax, eax
push ebp
push 0x6274d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x44
call fcn.00404f1c
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 0x101
mov word [ebp - 0x3c], 0
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle_1
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x180]
mov ecx, ebx
mov edx, 0x627520
call fcn.00408180
mov eax, dword [ebp - 0x180]
call fcn.00407d28
mov edx, eax
lea eax, [ebp - 4]
call fcn.00407e58
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x627568
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407d28
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
jne 0x6273fe
mov ecx, 0x627580
mov dl, 1
mov eax, dword [0x41077c]
call fcn.0041bccc
call fcn.0040632c
jmp 0x6274b4
xor eax, eax
push ebp
push 0x6274ad
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
xor edx, edx
call fcn.00407cf0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0xff
lea eax, [ebp - 0x17c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ReadFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [ebp - 0x1c], 0
jbe 0x627478
mov eax, dword [ebp - 0x1c]
cmp eax, 0xff
jbe 0x62744c
call fcn.00405714
mov byte [ebp + eax - 0x17c], 0
lea eax, [ebp - 0x184]
lea edx, [ebp - 0x17c]
mov ecx, pe_nt_image_headers32
call fcn.00407e94
mov edx, dword [ebp - 0x184]
lea eax, [ebp - 8]
call fcn.004080c0
test bl, bl
je 0x627482
cmp dword [ebp - 0x1c], 0
jne 0x627416
push 0xffffffffffffffff
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6274b4
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6274dd
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00407c9c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x62dccc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00407c84
xor eax, eax
push ebp
push 0x62dd87
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x62dd64
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp + 8], 0
jne 0x62dd32
lea eax, [ebp + 8]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00407d28
push eax
push esi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x62dd5a
mov ebx, dword [ebp + 8]
jmp 0x62dd5a
lea eax, [ebp + 8]
push eax
mov eax, dword [edi]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00407d28
push eax
push esi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x62dd57
mov ebx, dword [ebp + 8]
jmp 0x62dd5a
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62dd71
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62dd8e
lea eax, [ebp - 4]
call fcn.00407c8c
ret
Function at 0x63d948
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x63daf6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x6b2640], 0
je 0x63d9aa
mov edx, dword [0x6b2770]
mov eax, 0x63db10
call fcn.0066feec
cmp eax, 4
je 0x63d9aa
mov ecx, 2
mov edx, dword [0x6b2770]
mov eax, 0x63db10
call fcn.0066ffdc
mov ecx, 1
mov edx, dword [0x6b2770]
mov eax, 0x63db10
call fcn.0066fd3c
push 0
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x63db20
mov eax, 0x63db48
call fcn.0066f3b0
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00624a24
cmp byte [0x6b2640], 0
je 0x63da7e
cmp dword [ebp - 8], 0
jne 0x63da19
mov dl, 1
mov eax, 0x63dbb0
call fcn.00672710
push 1
lea eax, [ebp - 4]
push eax
xor ecx, ecx
xor edx, edx
mov eax, 0x63db10
call fcn.004f30d8
inc eax
jne 0x63da0f
mov eax, dword [ebp - 4]
call fcn.0048dc38
mov eax, dword [0x6b2578]
call fcn.004d21c8
cmp dword [ebp - 8], 0xc004d307
je 0x63da7e
mov eax, 0x63dbe4
call fcn.00626d98
test al, al
jne 0x63da3e
mov eax, 0x63dc10
call fcn.00626d98
test al, al
jne 0x63da74
xor eax, eax
push ebp
push 0x63da6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x63dc28
mov edx, 0x63dc40
mov eax, 0x80000002
call fcn.00627a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63da74
mov eax, dword [0x6b2578]
call fcn.004d21c8
cmp byte [0x6b2643], 0
je 0x63dad8
mov ecx, 0x7530
or edx, 0xffffffff
mov eax, dword [0x6b2770]
call fcn.00624c60
mov edx, dword [0x6b2770]
mov eax, 0x63db10
call fcn.0066feec
cmp eax, 4
je 0x63dad8
mov ecx, 2
mov edx, dword [0x6b2770]
mov eax, 0x63db10
call fcn.0066ffdc
mov ecx, 1
mov edx, dword [0x6b2770]
mov eax, 0x63db10
call fcn.0066fd3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63dafd
lea eax, [ebp - 0xc]
call fcn.00407c8c
lea eax, [ebp - 4]
call fcn.00407c8c
ret