joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c5e8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x47c6d0
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x493690], 1
jae 0x47c6c2
xor eax, eax
mov dword [0x49329c], eax
xor eax, eax
mov dword [0x4932a4], eax
xor eax, eax
mov dword [0x4932a8], eax
mov byte [0x4932ae], 2
mov byte [0x4932af], 2
mov byte [0x4932b0], 3
mov word [0x493658], 0
mov word [0x493668], 1
mov word [0x493678], 0xa
mov dword [0x493680], 0x80020004
mov dword [0x49364c], 0x47b7a4
mov dword [0x493650], 0x47b79c
mov dword [0x493654], 0x47b7a4
call fcn.00479e70
test al, al
je 0x47c681
call fcn.00479ea0
call fcn.00479f64
mov eax, 0x4932b4
mov edx, 0x47c6dc
call fcn.004775a2
mov eax, 0x493480
mov edx, 0x47c6dc
call fcn.004775a2
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x493294], eax
call fcn.00478508
mov dword [0x493290], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x493288], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c6d7
ret

Function at 0x47ea78
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x47ea94
call fcn.0047f19c
jmp 0x47eb03
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x47eab0
call fcn.0047f19c
jmp 0x47eb03
cmp dword [0x493f80], 1
je 0x47eb01
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.0048289c
pop ecx
cmp al, 0x41
jl 0x47eb01
cmp al, 0x5a
jg 0x47eb01
cmp byte [ebp - 0x107], 0x3a
jne 0x47eb01
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x47eb01
call fcn.0047f19c
jmp 0x47eb03
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x47eb08
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
cmp byte [ebp - 0x104], 0x61
jl 0x47eb37
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffa0
jmp 0x47eb41
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffc0
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret
Function at 0x47eb4c
Capabilities:
Get disk information
Query environment variable
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
lea ecx, [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x108]
mov dword [esi], eax
mov byte [ebp - 4], 0x3d
mov dl, byte [ebp + 8]
add dl, 0x40
mov byte [ebp - 3], dl
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push 0x104
push edi
push ecx
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
jne 0x47ebb2
mov al, byte [ebp - 3]
mov byte [edi], al
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
push edi
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x47ebb2
call fcn.0047f19c
jmp 0x47ebed
push edi
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x47ebc2
call fcn.0047f19c
jmp 0x47ebed
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
mov byte [edi], 0x41
jmp 0x47ebe8
push edi
call sub.KERNEL32.DLL_GetDriveTypeA
mov ebx, eax
test eax, eax
je 0x47ebe6
cmp ebx, 1
je 0x47ebe6
inc dword [esi]
inc byte [edi]
cmp byte [edi], 0x5a
jle 0x47ebd3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4829b4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x482a16
call fcn.00482964
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0047d684
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0047d684
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x482a94
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x490db0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x482b6e
cmp dword [0x490dac], 0
jne 0x482b6e
cmp dword [0x490fb8], 0
je 0x482b28
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00482844
add esp, 8
mov ebx, eax
test eax, eax
jne 0x482b0e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00482844
add esp, 8
mov ebx, eax
test eax, eax
jne 0x482b0e
lea ebx, [ebp - 0x84]
jmp 0x482b0f
inc ebx
call fcn.00482a50
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x482ba9
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x490db4
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0047d684
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x490db7
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x482ba9
cmp dword [0x490dac], 0
je 0x482b88
cmp dword [0x490dac], 0xffffffff
je 0x482ba9
push esi
call dword [0x490dac]
pop ecx
mov eax, dword [0x490db0]
test eax, eax
je 0x482ba9
cmp dword [0x490db0], 0xffffffff
je 0x482ba9
cmp byte [eax], 0
je 0x482ba9
push esi
push eax
call fcn.004829b4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4833cc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x493f98], 0
jne 0x48344d
cmp dword [0x493fb8], 0
jne 0x4833fc
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x493fb8], eax
test eax, eax
jne 0x4833fc
push str.GetEnvironmentStrings_failed
call fcn.00482bc0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x493fb8]
jmp 0x483410
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0047d684
pop ecx
mov edi, eax
test eax, eax
jne 0x483408
lea edi, [ebp + 1]
push edi
call fcn.0047d0e4
pop ecx
mov ebx, eax
mov dword [0x493f9c], ebx
test ebx, ebx
jne 0x48343a
xor eax, eax
jmp 0x483510
push edi
mov edx, dword [0x493fb8]
push edx
push ebx
call fcn.0047d534
add esp, 0xc
jmp 0x48346d
xor esi, esi
mov ebx, dword [0x493f98]
jmp 0x483467
push eax
call fcn.0047d684
pop ecx
test eax, eax
jne 0x483463
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x483457
lea ebx, [esi + 4]
push 4
mov dword [0x493fa0], ebx
inc ebx
push ebx
call fcn.0047cbbc
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x483490
xor eax, eax
jmp 0x483510
cmp dword [0x493f98], 0
jne 0x4834c1
xor esi, esi
mov ebx, dword [0x493f9c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4834b2
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0047d684
pop ecx
mov edi, eax
test eax, eax
jne 0x4834a8
jmp 0x4834f2
xor esi, esi
mov ebx, dword [0x493f98]
mov eax, dword [esp]
mov edi, eax
jmp 0x4834ec
push eax
call fcn.0047d684
pop ecx
test eax, eax
je 0x4834e1
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4834e5
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4834d0
mov eax, dword [0x493f98]
test eax, eax
je 0x483502
push eax
call fcn.0047d0f4
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x493f98], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1001674
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b10
push 0x101ce27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.DLL___set_app_type]
add esp, 4
mov dword [0x1021024], 0xffffffff
mov dword [0x1021028], 0xffffffff
call dword [sym.imp.MSVCRT.DLL___p__fmode]
mov ecx, dword [0x1021020]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.DLL___p__commode]
mov edx, dword [0x102101c]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.DLL__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x102102c], ecx
call fcn.010017ae
mov eax, dword [0x1021010]
test eax, eax
je 0x101cce3
call fcn.010017af
push 0x102100c
push 0x1021008
call sub.MSVCRT.DLL__initterm
add esp, 8
mov edx, dword [0x1021018]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x1021014]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.DLL___getmainargs]
add esp, 0x14
push 0x1021004
push section..data
call sub.MSVCRT.DLL__initterm
add esp, 8
mov edx, dword [sym.imp.MSVCRT.DLL__acmdln]
mov esi, dword [edx]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x10017a7
jmp 0x101ccf6
mov al, byte [esi]
test al, al
jne 0x101cd16
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
test byte [ebp - 0x30], 1
jne 0x101cd27
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
jmp 0x101cd34
inc esi
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x20
ja 0x10017a3
jmp 0x1001762
push 0x101ce3c
call dword [sym.imp.MSVCRT.DLL___setusermatherr]
add esp, 4
jmp 0x10016fb
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x101cd04
cmp al, 0x22
jne 0x101ccf6
cmp byte [esi], 0x22
jne 0x1001762
inc esi
mov dword [ebp - 0x74], esi
jmp 0x1001762
cmp al, 0x20
ja 0x100176c
inc esi
mov dword [ebp - 0x74], esi
jmp 0x1001762
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x100178c
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a19
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
push 0x2001f
push ebx
push 0x1008cd4
push 0x80000002
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x8c]
mov dword [ebp - 8], 0x80
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
cmp eax, ebx
jne 0x1001b21
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x1008cbc
push dword [ebp - 4]
call esi
cmp eax, 0x7a
je 0x101704f
cmp eax, 0xea
je 0x101704f
cmp eax, ebx
jne 0x1001aa6
push dword [ebp - 8]
push edi
push 1
push ebx
push 0x1008ca8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push edi
push eax
push ebx
push 0x1008c94
push dword [ebp - 4]
call esi
cmp eax, 0x7a
je 0x1001ac6
cmp eax, 0xea
jne 0x1001afc
lea eax, [ebp - 0x8c]
cmp edi, eax
jne 0x101707c
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x1001b89
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push edi
push eax
push ebx
push 0x1008c94
push dword [ebp - 4]
call esi
cmp eax, ebx
jne 0x1001b15
push dword [ebp - 8]
push edi
push 1
push ebx
push 0x1008c84
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push 0x1008c28
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
jne 0x1001b89
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push edi
push eax
push ebx
push 0x1008c00
push dword [ebp - 4]
call esi
cmp eax, 0x7a
je 0x1017088
cmp eax, 0xea
je 0x1017088
cmp eax, ebx
je 0x10170c6
push 0x1008bdc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
jne 0x10170e0
lea eax, [ebp - 0x8c]
cmp edi, eax
je 0x1001ba3
push edi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x1001b89
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push edi
push eax
push ebx
push 0x1008cbc
push dword [ebp - 4]
call esi
jmp 0x1001a8d
push edi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x1001ad4
lea eax, [ebp - 0x8c]
cmp edi, eax
je 0x1017099
push edi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x1001b89
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push edi
push eax
push ebx
push 0x1008c00
push dword [ebp - 4]
call esi
jmp 0x1001b67
push dword [ebp - 8]
push edi
push 1
push ebx
push 0x1008bdc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExW]
jmp 0x1001b7d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
jmp 0x1001b92
Function at 0x1001d0b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x1008da4
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x1001d60
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1008d90
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x1001d65
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
and dword [ebp - 0xc], 0
push esi
mov esi, dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
lea eax, [ebp - 4]
push edi
mov ebx, 0x20019
push eax
push ebx
push 0
mov edi, 0x80000002
push 0x1008dc0
push edi
call esi
test eax, eax
jne 0x1001dc1
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1008ea0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x1008e2c
push edi
call esi
test eax, eax
jne 0x1001e00
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1008ea0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov dword [0x1021050], eax
pop ebx
leave
ret
Function at 0x1001e0d
Capabilities:
Delete file
Delete registry value
Get common file path
Get system information on windows
Move file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea eax, [ebp - 0x254]
push 0x20a
push eax
call edi
mov ebx, 0x1008ebc
lea eax, [ebp - 0x254]
push ebx
push eax
call dword [sym.imp.MSVCRT.DLL_wcscat]
pop ecx
lea eax, [ebp - 0x254]
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, dword [sym.imp.NTDLL.DLL_NtQuerySystemInformation]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push 0x18
push eax
push 0x12
call esi
mov dword [ebp - 0x30], eax
push 0
lea eax, [ebp - 0x38c]
push 0x138
push eax
push 2
call esi
xor esi, esi
cmp dword [ebp - 0x30], esi
jge 0x10146c4
cmp eax, esi
jl 0x1001e9b
cmp dword [ebp - 0x358], 0x157c
jbe 0x10146cd
lea eax, [ebp - 8]
push eax
push 0x20006
push esi
push str.SystemCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x1001eda
cmp dword [ebp - 4], 1
je 0x10147a6
push str.TempPageFile
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 0x14], esi
jne 0x1001e87
lea eax, [ebp - 0x254]
push 0x20a
push eax
mov dword [ebp - 4], 1
mov byte [0x10219a0], 1
call edi
lea eax, [ebp - 0x254]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push 0x14
lea eax, [ebp - 0x254]
pop ebx
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.NTDLL.DLL_RtlInitUnicodeString]
mov eax, 0x1400000
push esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
push esi
push eax
xor ecx, ecx
push dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.NTDLL.DLL_RtlDosPathNameToNtPathName_U]
test al, al
je 0x1001e9b
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.NTDLL.DLL_NtCreatePagingFile]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
call edi
cmp eax, esi
jge 0x101477f
cmp ebx, esi
jle 0x101478b
dec ebx
push esi
dec ebx
push 0x100000
mov eax, ebx
cdq
push edx
push eax
call fcn.01005c07
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], edx
push eax
jmp 0x1014748
push 4
push esi
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov eax, dword fs:[0x18]
push dword [ebp - 0x20]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.NTDLL.DLL_RtlFreeHeap]
jmp 0x1001e9b
lea eax, [ebp - 4]
push 4
push eax
push 4
push esi
push str.TempPageFile
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExW]
jmp 0x1001ed1
Function at 0x1002a40
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
mov edi, 0x1021160
xor ebx, ebx
mov esi, 0x1021150
push edi
mov dword [ebp - 0xc], 0x105
mov dword [ebp - 8], ebx
mov dword [0x1021154], esi
mov dword [0x1021150], esi
call dword [sym.imp.NTDLL.DLL_RtlInitializeCriticalSection]
cmp eax, ebx
jl 0x1018c5b
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x1008fa4
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
jne 0x1002b66
push edi
call dword [sym.imp.NTDLL.DLL_RtlEnterCriticalSection]
cmp dword [0x102103c], ebx
je 0x1002ac9
call fcn.01002b70
cmp eax, ebx
je 0x1002ac9
mov ecx, dword [0x1021154]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [0x1021154], eax
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.DLL_RegEnumKeyExW]
push eax
push ebx
push ebx
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push dword [ebp - 4]
jmp 0x1002b4c
lea eax, [ebp - 0x220]
push 0x1008f94
push eax
call dword [sym.imp.MSVCRT.DLL__wcsicmp]
pop ecx
test eax, eax
pop ecx
je 0x1002b2a
mov eax, dword [ebp + 8]
push dword [eax + 0x30]
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 4]
call fcn.01002c44
cmp eax, ebx
je 0x1002b2a
mov ecx, dword [0x1021154]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [0x1021154], eax
lea eax, [ebp - 0x14]
inc dword [ebp - 8]
push eax
push ebx
push ebx
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0xc], 0x105
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call edi
test eax, eax
je 0x1002ae7
push 0x1021160
call dword [sym.imp.NTDLL.DLL_RtlLeaveCriticalSection]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
xor eax, eax
jmp 0x1002b69

Function at 0x1002b70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
push 0x48
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1018c42
lea eax, [ebp - 0x208]
push 0x104
push eax
push 0x1009044
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x208]
push eax
call fcn.01002c06
push eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x20102
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1018c3b
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x1009030
push ebx
mov dword [esi + 0x10], ebx
call edi
push 0x1009020
push ebx
mov dword [esi + 0x24], eax
call edi
cmp dword [esi + 0x24], 0
mov dword [esi + 0x40], eax
je 0x1018c34
test eax, eax
je 0x1018c34
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
xor eax, eax
jmp 0x1002c01
Function at 0x1002c44
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
push ebx
push esi
push edi
xor ebx, ebx
push 0x48
push 0x40
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x1018c2d
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
jne 0x1018c19
cmp dword [ebp + 0x10], ebx
mov edi, dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
jne 0x1018bec
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x410
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x1009100
push dword [ebp - 8]
call edi
cmp eax, ebx
jne 0x1018c19
lea eax, [ebp - 0x528]
push 0x104
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x104
lea eax, [ebp - 0x528]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_SearchPathW]
test eax, eax
je 0x1018c19
lea eax, [ebp - 0x21c]
push eax
call fcn.01002c06
cmp eax, ebx
mov dword [esi + 8], eax
je 0x1018c19
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x1c]
push ecx
push eax
mov dword [eax], 0x3c
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x10090f0
mov dword [esi + 0x10], ebx
push dword [ebp - 8]
mov dword [ebp - 4], 4
call edi
mov dword [ebp + 0xc], ebx
mov edi, 0x1021178
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [edi]
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
cmp eax, ebx
je 0x1002d8b
inc dword [ebp + 0xc]
add edi, 4
cmp edi, 0x10211a0
jb 0x1002d4e
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [ebp - 0xc], 1
jne 0x1002d74
mov ecx, dword [ebp + 0xc]
push 1
pop eax
shl eax, cl
or dword [esi + 0xc], eax
jmp 0x1002d74
lea eax, [ebp - 4]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x100c5b0
mov dword [ebp - 4], 4
push dword [ebp - 8]
call edi
mov dword [ebp - 0x10], 1
jmp 0x1002c96
cmp dword [ebp - 8], ebx
je 0x1018c27
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push esi
call fcn.01018b91
xor eax, eax
jmp 0x1002d84
Function at 0x1002dd9
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push 0x20019
push esi
push 0x1009110
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, esi
jne 0x1002e4f
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x100915c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
cmp eax, esi
jne 0x1002e46
push dword [ebp - 0xc]
call fcn.01002e54
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push 0x10034c4
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x10211e8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
xor eax, eax
pop esi
leave
ret