joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002657
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push 0x44
pop eax
xor edi, edi
push eax
push edi
mov dword [ebp - 0x10], ecx
xor ebx, ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x1002687
mov ebx, 0x8007000e
jmp 0x10026cb
push esi
lea ecx, [ebp - 0xc]
push ecx
push eax
push edi
push 0x16
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10026ae
call esi
push eax
call fcn.01002565
mov ebx, eax
cmp ebx, edi
jl 0x10026ca
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10026ca
call esi
push eax
call fcn.01002565
mov ebx, eax
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 8], edi
pop edi
sete al
mov dword [ecx + 0x10], eax
mov eax, ebx
pop ebx
leave
ret
Function at 0x10035d3
Capabilities:
Get domain controller name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
neg esi
sbb esi, esi
and esi, 0x7ff8ffa9
add esi, 0x80070057
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
js 0x100369b
lea eax, [ebp - 4]
push eax
push 0x40000010
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
je 0x1003625
call edi
push eax
call fcn.01002565
mov esi, eax
test esi, esi
jl 0x1003690
mov eax, dword [ebp - 4]
push 0x185
push dword [eax + 0x1c]
call dword [sym.imp.WLDAP32.dll_Ordinal_145]
mov ebx, eax
mov esi, ebx
neg esi
sbb esi, esi
and esi, 0x7fffbffb
add esi, 0x80004005
pop ecx
pop ecx
js 0x1003690
push 0x486
push 0
push 0
push ebx
call dword [sym.imp.WLDAP32.dll_Ordinal_73]
add esp, 0x10
test eax, eax
je 0x1003673
call edi
push eax
call fcn.01002565
mov esi, eax
test esi, esi
jl 0x1003690
push 0
push ebx
call dword [sym.imp.WLDAP32.dll_Ordinal_88]
pop ecx
pop ecx
test eax, eax
je 0x1003690
call edi
push eax
call fcn.01002565
mov esi, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
test esi, esi
jge 0x10036b5
xor ebx, ebx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], ebx
je 0x10036b5
push 0x266
call edi
mov ecx, dword [ebp - 8]
push eax
call fcn.01002ed8
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x1004d29
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
xor esi, esi
push 0x10016dc
push 1
push esi
mov ebx, ecx
push 0x10017ac
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, esi
jl 0x1004ddb
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebx + 0x18]
push eax
call dword [ecx + 0xc]
mov edi, eax
cmp edi, esi
jl 0x1004ddb
lea eax, [ebp - 8]
push eax
push 0x100152c
call fcn.010025ae
mov edi, eax
cmp edi, esi
jl 0x1004ddb
lea eax, [ebp - 4]
push eax
push dword [0x100b014]
call fcn.010025ae
mov edi, eax
cmp edi, esi
jl 0x1004ddb
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov edi, dword [edx]
lea ebx, [ebp - 0xc]
push ebx
push esi
push 0x30
push eax
push ecx
push edx
call dword [edi + 0x50]
mov edi, eax
cmp edi, esi
jl 0x1004ddb
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
call fcn.01004b25
mov edi, eax
cmp edi, esi
jge 0x1004df8
mov ebx, dword [ebp - 0x18]
cmp dword [ebx + 0x14], esi
je 0x1004df8
push 0x263
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, ebx
call fcn.01002ed8
mov edi, eax
lea ecx, [ebp - 4]
call fcn.010028e5
lea ecx, [ebp - 8]
call fcn.010028e5
lea ecx, [ebp - 0xc]
call fcn.0100296a
lea ecx, [ebp - 0x10]
call fcn.0100296a
lea ecx, [ebp - 0x14]
call fcn.0100296a
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005abf
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x100a2d8
call fcn.01005f74
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100b74c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10058d4
cmp eax, esi
jne 0x10058c7
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x10058d7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10058ae
xor esi, esi
inc esi
mov eax, dword [0x100b748]
cmp eax, esi
jne 0x10058ea
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1005925
mov eax, dword [0x100b748]
test eax, eax
jne 0x100591f
mov dword [0x100b748], esi
push 0x10011f0
push 0x10011e4
call fcn.0100582b
pop ecx
pop ecx
test eax, eax
je 0x1005925
mov dword [ebp - 4], DsGetDcNameW
mov eax, 0xff
jmp 0x10059ef
mov dword [0x100b3d4], esi
mov eax, dword [0x100b748]
cmp eax, esi
jne 0x1005949
push 0x10011e0
push 0x10011d8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100b748], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1005956
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100b754], ebx
je 0x1005977
push 0x100b754
call fcn.01005ee9
pop ecx
test eax, eax
je 0x1005977
push ebx
push 2
push ebx
call dword [0x100b754]
push dword [0x100b3bc]
push dword [0x100b3c0]
push dword [0x100b3b8]
call fcn.0100572b
add esp, 0xc
mov dword [0x100b3d0], eax
cmp dword [0x100b3c4], ebx
jne 0x10059d5
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x100b3d4], ebx
jne 0x10059e3
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], DsGetDcNameW
mov eax, dword [0x100b3d0]
call fcn.01005fb9
ret
call fcn.010060c1
jmp 0x100588c

Function at 0x1009591
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], eax
xor eax, eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 4]
push ecx
push dword [esi + 4]
mov dword [esi + 8], eax
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
call fcn.0100a008
mov dword [esi + 0x10], eax
pop esi
leave
ret

Function at 0x10095ca
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
inc dword [esi + 8]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 4]
push ecx
push dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi + 8]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
call fcn.0100a008
mov dword [esi + 0x10], eax
pop esi
leave
ret
Function at 0x10096d9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp + 0x10], esi
push dword [ecx + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1009718
cmp dword [ebp + 0x10], esi
je 0x1009713
push 0x57
pop eax
mov ecx, dword [ebp - 4]
mov dword [edi], ecx
pop edi
pop esi
test eax, eax
jle 0x1009728
and eax, 0xffff
or eax, 0x80070000
leave
ret 0xc

Function at 0x1009731
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp + 0xc], esi
push dword [ecx + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp + 0xc]
test eax, eax
jne 0x100976a
cmp edx, esi
je 0x100976a
push 0x57
pop eax
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x1009776
mov esi, dword [ebp + 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp + 0x1c]
pop esi
test ecx, ecx
je 0x1009780
mov dword [ecx], edx
test eax, eax
jle 0x100978e
and eax, 0xffff
or eax, 0x80070000
pop ebp
ret 0x18

Function at 0x100990c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push dword [ecx + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jle 0x1009936
and eax, 0xffff
or eax, 0x80070000
pop ebp
ret 0x10
Function at 0x100993f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0xf003f
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov ebx, 0xffff
jmp 0x10099c0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 8], edi
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
call fcn.010093a2
mov esi, eax
cmp esi, edi
jne 0x10099c4
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, edi
jne 0x10099b7
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0100993f
mov esi, eax
and esi, ebx
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp esi, edi
je 0x100996e
cmp dword [ebp - 4], edi
je 0x10099d2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x10099dc
xor esi, esi
cmp esi, edi
jne 0x10099f0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
cmp esi, edi
jle 0x10099fa
and esi, ebx
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x401750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
nop
jmp 0x401763
push edi
nop
mov edx, dword [edx + 0x10]
nop
jmp 0x401779
mov eax, dword [edx + 0x3c]
nop
add eax, edx
mov eax, dword [eax + 0x78]
nop
jmp 0x401791
test eax, eax
je 0x401962
nop
jmp 0x4017a4
add eax, edx
nop
mov ecx, dword [eax + 0x18]
push eax
jmp 0x4017b9
mov ebx, dword [eax + 0x20]
add ebx, edx
test ecx, ecx
jmp 0x4017ce
je 0x40193f
nop
nop
jmp 0x4017e1
xor edi, edi
nop
jmp 0x4017f4
dec ecx
mov esi, dword [ebx + ecx*4]
jmp 0x401805
add esi, edx
nop
xor eax, eax
jmp 0x401818
lodsb al, byte [esi]
nop
ror edi, 0xd
nop
add edi, eax
jmp 0x40182e
cmp al, ah
jmp 0x401840
jne 0x401808
nop
jmp 0x401858
nop
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x4017be
nop
jmp 0x401877
nop
pop eax
nop
jmp 0x40188a
mov ebx, dword [eax + 0x24]
jmp 0x40189a
add ebx, edx
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
nop
jmp 0x4018b7
add ebx, edx
mov eax, dword [ebx + ecx*4]
nop
add eax, edx
nop
mov dword [esp + 0x24], eax
nop
jmp 0x4018d2
pop ebx
nop
jmp 0x4018e6
pop ebx
nop
jmp 0x4018f8
popal
nop
jmp 0x40190c
pop ecx
nop
jmp 0x40191c
pop edx
push ecx
nop
jmp 0x40192c
jmp eax
nop
jmp 0x40194e
pop eax
jmp 0x401962
nop
pop edi
jmp 0x401974
pop edx
jmp 0x401985
mov edx, dword [edx]
jmp 0x40199a
jmp 0x4016bd

Function at 0x40a2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
jg 0x40a2a4
jne 0x40a2ed
add eax, 0xc
push eax
or eax, 0x38
rcl byte [ebx + 0x55], 0x33
rcr byte [ebp - 0x3e], 4
add byte [ebx - 0x6f95f7c0], cl
xor eax, eax
pop ebp
ret 4
mov eax, dword [eax + 8]
push 0xffffffffffffff90
cdq
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40a2e7
cmp eax, 0x80
je 0x40a2e7
cmp edx, dword [edi + 1]
add byte [eax], al
push esi
jne 0x40a316
mov eax, 0x11189
je 0x40a370
int 4
add byte [ebx + 0x40c098ce], cl
push 0xffffffffffffffd3
mov ecx, esi
cwde
rol byte [eax + 0x6a], 0xd3
invalid
movsd dword es:[edi], dword [esi]
invalid
jne 0x40a327
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x4085a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4085b7
pop dword [ebp - 0x20]
mov eax, 0x9a5f6fae
add eax, 0x65e11609
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x36e14
push 0
mov eax, 0xe432bf8c
sub eax, 0xe3f1deb4
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xe63b9b57
add ecx, 0x19c4a2d7
mov edi, eax
mov edx, 0x911558bd
sub edx, 0x90d41cf9
add edx, dword [ebp - 0x20]
mov esi, 0xf709eeb4
mov dword [ebp - 0x18], 0x79d072b0
mov ebx, dword [edx]
add dword [ebp - 0x1c], edi
xor ebx, esi
xor dword [ebp - 0xc], 0x5150f998
mov dword [edi], ebx
xor dword [ebp - 8], ebx
add edi, 4
add edx, 0x91fe15fb
add edx, 0x6e01ea09
loop 0x408610
add eax, 0xeb8b
mov ebx, eax
add eax, 0x8266cef4
sub eax, 0x8266ceef
mov ecx, 0xa30544b5
sub ecx, 0xa2c544b5
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x775d91
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 5], ebp
lea esp, [esp + 2]
jmp 0x775e19
mov dword [esp + 4], ebx
pushfd
call fcn.00775dda
push word [esp + 1]
ja 0x775ed4
mov word [esp], dx
lea esp, [esp + 2]
mov dword [esp + 0x10], esi
jmp 0x775e71
mov dword [esp + 0x10], esi
call fcn.00775e57
lea edx, [edi*4]
xchg di, bp
mov dx, 0x13eb
jmp 0x775ea8
mov edi, dword [esp + 0x2c]
lea edx, [eax - 0x66]
rdtsc
jmp 0x775eaf
xor ax, si
jnp 0x775e92
jp 0x775e92
mov cl, 0xfd
xchg bp, ax
lea esi, [esp]
mov bp, sp
bsf ebp, esi
jmp 0x775ede
mov word [esp], dx
lea esp, [esp + 2]
jmp 0x775e6d
jbe 0x775ef4
mov cx, 0xbc23
jmp 0x775ef8
mov cx, 0xbc23
sub esp, 0xc0
jmp 0x7761c4
not ax
jmp 0x775f6d
not ax
setne cl
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x775f57
mov edx, 0x2c1a3873
mov al, cl
mov al, bh
rol dl, 5
jp 0x775f20
jnp 0x775f29
lea esp, [esp + 0xc]
add edi, 0x3aca022f
mov dl, bh
mov dh, byte [esp]
jmp 0x775f79
setne cl
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x775f57
mov al, byte [esp]
lea eax, [eax + 0xe9]
lea eax, [ebp*4]
rol edi, 0
mov ecx, 0xa5a08bdf
jmp 0x7760dc
mov ecx, 0x74ce17c6
mov edx, 0x26c9d54d
jmp 0x776171
bt dx, cx
rcr al, 2
jmp 0x775fef
rcr edx, 0xe
jl 0x775fb1
bt dx, cx
rcr al, 2
jmp 0x775fef
inc edi
bswap ecx
rdtsc
call fcn.00775fd5
lea ecx, [ecx + edi]
mov ax, word [esp]
jmp 0x776114
mov dx, 0x9fc7
xchg cx, ax
ror edi, 0
rdtsc
mov edx, 0x7f046332
jmp 0x775fc7
sbb ch, 0xc7
jle 0x776139
jg 0x776139
movzx edx, byte [edi]
not eax
mov cl, 0x94
jmp 0x7760f2
call 0x77611d
pushal
mov ecx, 0x74ce17c6
mov edx, 0x26c9d54d
mov ebx, edi
lea edx, [esi + edi]
mov eax, 0x3c906471
jmp 0x775f47
mov ebp, esp
btc cx, si
jp 0x776166
pushal
jmp 0x775fa2

Function at 0x775df5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
je 0x775df7
push dword [esp + 5]
push dword [esp + 4]
jmp 0x775e01
jmp 0x775ddf
push dword [esp + 5]
push dword [esp + 4]
jmp 0x775e47
mov word [esp + 5], sp
lea esp, [esp + 2]
mov dword [esp + 0x10], ebp
jmp 0x775e54
mov word [esp + 5], sp
lea esp, [esp + 2]
mov dword [esp + 0x10], ebp
push eax
jmp 0x775e23

Function at 0x775e57
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0764820
jmp 0x775e76
mov dword [esp + 0x10], edi
lea esp, [esp + 0x10]
jmp 0x775e8c
pushfd
jmp 0x7753ce

Function at 0x782dfe
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x767b53
xor ecx, ecx
jmp 0x767b46
jmp 0x782de8

Function at 0x835049
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x83305d
call fcn.00833062
mov word [esp + 1], bp
mov word [esp + 1], bx
mov dword [esp + 4], esp
mov dword [esp], ebp
jmp 0x83503a
call 0x835032
jmp 0x8350aa
push dx
mov byte [esp], dl
lea esp, [esp + 2]
push esi
call fcn.00835024
lea esp, [esp + 1]
jmp 0x83507a
mov eax, dword [eax + 0x1c]
jmp 0x8350d0
mov dword [esp + 4], edi
lea esp, [esp + 4]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x835064
pop eax
sub eax, 0x435032
push eax
jmp 0x830ebc
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x83502d
Function at 0x401769
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4017c2
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x4018ef
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov dword [ebp - 4], eax
ja 0x4019de
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
mov edi, 0x80000000
push str..htm
push edi
call fcn.00401769
test eax, eax
jne 0x4019de
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x210]
push str._shellopencommand
push eax
call esi
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call fcn.00401769
test eax, eax
jne 0x4019de
lea eax, [ebp - 0x210]
push str.__1_
push eax
call dword [sym.imp.MSVCRT.dll__mbsstr]
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x4019bb
lea eax, [ebp - 0x210]
push 0x40a34c
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x4019bb
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x211]
jmp 0x4019bd
mov byte [edi], bl
push 0x40a348
push edi
call esi
push dword [ebp + 8]
push edi
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401e6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x406414
call fcn.00405ff0
sub esp, 0x2c
push ebx
push esi
and byte [ebp - 0x2c], 0
and byte [ebp - 0x1c], 0
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x10], esp
push eax
lea eax, [ebp - 0x38]
mov byte [ebp - 0x38], 0x4b
push eax
mov byte [ebp - 0x37], 0x45
mov byte [ebp - 0x36], 0x52
mov byte [ebp - 0x35], 0x4e
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x4c
mov byte [ebp - 0x32], 0x33
mov byte [ebp - 0x31], 0x32
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x6c
mov byte [ebp - 0x28], 0x4c
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x61
mov byte [ebp - 0x25], 0x64
mov byte [ebp - 0x24], 0x4c
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x62
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x79
mov byte [ebp - 0x1d], 0x41
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
and dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push 0x4082f8
push eax
mov dword [ebp - 0x14], 0x61
call sub.MSVCRT.dll__CxxThrowException
cmp dword [ebp + 8], 0
je 0x401f38
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 8], eax
mov eax, 0x401f33
ret
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401f4f
push dword [ebp + 0xc]
call dword [ebp - 0x18]
test eax, eax
je 0x401f67
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 8], eax
mov eax, 0x401f62
ret
mov eax, 0x401f6d
ret
Function at 0x401f7e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
lea eax, [ebp - 0x3c]
push edi
push eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push ebx
mov byte [ebp - 0x2c], 0x4b
mov byte [ebp - 0x2b], 0x45
mov byte [ebp - 0x2a], 0x52
mov byte [ebp - 0x29], 0x4e
mov byte [ebp - 0x28], 0x45
mov byte [ebp - 0x27], 0x4c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x3c], 0x47
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x74
mov byte [ebp - 0x39], 0x50
mov byte [ebp - 0x38], 0x72
mov byte [ebp - 0x37], 0x6f
mov byte [ebp - 0x36], 0x63
mov byte [ebp - 0x35], 0x65
mov byte [ebp - 0x34], 0x73
mov byte [ebp - 0x33], 0x73
mov byte [ebp - 0x32], 0x48
mov byte [ebp - 0x31], 0x65
mov byte [ebp - 0x30], 0x61
mov byte [ebp - 0x2f], 0x70
mov byte [ebp - 0x2e], bl
call fcn.00401e6c
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0x19], 0x70
mov byte [ebp - 0x18], 0x52
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x41
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x11], bl
call fcn.00401e6c
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x70
mov byte [ebp - 0xc], 0x41
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6f
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], bl
call fcn.00401e6c
add esp, 0x24
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
je 0x402094
push dword [ebp + 8]
push ebx
call esi
push eax
call edi
jmp 0x40209b
push ebx
call esi
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4020a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
lea eax, [ebp - 0x2c]
push edi
push eax
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
push ebx
mov byte [ebp - 0x1c], 0x4b
mov byte [ebp - 0x1b], 0x45
mov byte [ebp - 0x1a], 0x52
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x18], 0x45
mov byte [ebp - 0x17], 0x4c
mov byte [ebp - 0x16], 0x33
mov byte [ebp - 0x15], 0x32
mov byte [ebp - 0x14], 0x2e
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x10], bl
mov byte [ebp - 0x2c], 0x47
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x50
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x73
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], 0x48
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1f], 0x70
mov byte [ebp - 0x1e], bl
call fcn.00401e6c
mov esi, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
mov byte [ebp - 0xc], 0x48
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x70
mov byte [ebp - 8], 0x46
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], bl
call fcn.00401e6c
add esp, 0x18
mov edi, eax
push dword [ebp + 8]
push ebx
call esi
push eax
call edi
pop edi
pop esi
pop ebx
leave
ret