joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016a50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003e8a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov ecx, dword [esp + 0x28]
push ebx
lea eax, [esp + 0x30]
push esi
push eax
lea edx, [esp + 0x10]
xor ebx, ebx
push ecx
push edx
mov dword [esp + 0x14], ebx
call fcn.10016b00
add esp, 0xc
mov esi, dword [esp + 0x2c]
mov al, byte [esp + 0xc]
mov dword [esp + 0x24], ebx
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea eax, [esp + 0xc]
mov edx, dword [ecx]
mov ecx, esi
push edx
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
je 0x10016aea
mov al, byte [ecx - 1]
cmp al, bl
je 0x10016ae0
cmp al, 0xff
je 0x10016ae0
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x10016c20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003e8c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x28]
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov dword [esp + 0xc], 0
call fcn.10016cc0
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x10]
push edx
push eax
push esi
mov dword [esp + 0x34], 0
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
mov ecx, dword [esp + 0x20]
add esp, 0x14
test ecx, ecx
je 0x10016ca3
mov al, byte [ecx - 1]
test al, al
je 0x10016c99
cmp al, 0xff
je 0x10016c99
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x100177d0
Capabilities:
Enumerate internet cache

Disassembly:
sub esp, 0x404
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
mov edi, 0x400
push ecx
push str.cookie:
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov esi, eax
test esi, esi
je 0x10017898
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x410]
push ebx
push ebp
mov ebp, dword [esp + 0x41c]
push edx
push eax
push ebp
push ecx
call fcn.100174e0
mov ebx, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call ebx
test eax, eax
je 0x10017874
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x418]
push ecx
push edx
push ebp
push eax
call fcn.100174e0
add esp, 0x10
jmp 0x1001783e
push esi
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x103
pop ebp
pop ebx
sete cl
pop edi
mov eax, ecx
pop esi
add esp, 0x404
ret
pop edi
xor eax, eax
pop esi
add esp, 0x404
ret

Function at 0x10017e80
Capabilities:
Download url
Receive data

Disassembly:
sub esp, 0x414
push esi
mov esi, dword [esp + 0x41c]
push edi
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
mov eax, dword [esi + 4]
test eax, eax
jne 0x10017ead
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov eax, dword [esi + 4]
pop edi
test eax, eax
pop esi
jne 0x10017ec2
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push 0
push 0
lea ecx, [esp + 8]
push 0x410
push ecx
push eax
push 0
call sub.urlmon.dll_URLDownloadToCacheFileA
test eax, eax
setge al
add esp, 0x414
ret
Function at 0x1001c7b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40c
push ebx
push ebp
push esi
mov edx, ecx
push edi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
xor esi, esi
rep stosd dword es:[edi], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x14], esi
cmp eax, esi
jne 0x1001c7e0
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov ecx, dword [esp + 0x42c]
mov edx, dword [esp + 0x428]
push eax
lea eax, [esp + 0x1c]
push 0x400
push eax
mov eax, dword [esp + 0x430]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebp, dword [esp + 0x420]
mov cl, byte [esp + 0x13]
mov ebx, eax
cmp ebx, 0xfffffffd
mov byte [ebp], cl
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
jbe 0x1001c82d
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
mov ecx, dword [ebp + 4]
cmp ecx, esi
je 0x1001c860
mov al, byte [ecx - 1]
test al, al
je 0x1001c860
cmp al, 0xff
je 0x1001c860
cmp ebx, esi
jne 0x1001c893
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 0x10
cmp ebx, esi
jne 0x1001c87d
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 0x10
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x1001c889
cmp eax, ebx
jae 0x1001c89c
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push ebx
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
mov edi, dword [ebp + 4]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov dword [ebp + 8], ebx
pop edi
pop esi
mov byte [eax + ebx], 0
mov eax, ebp
pop ebp
pop ebx
add esp, 0x40c
ret 0x10
Function at 0x100208d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1003f770
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
lea eax, [esp + 0x14]
lea ecx, [esi + 0x10]
push eax
mov dword [esp + 0x10], 1
call fcn.1002aa20
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esi + 0x30]
call fcn.1002aa20
mov eax, dword [esp + 0x14]
mov byte [esp + 0xc], 0
test eax, eax
je 0x10020936
mov eax, dword [eax]
test eax, eax
je 0x1002092e
lea edx, [esp + 0x1c]
push 1
lea ecx, [esp + 0x20]
push edx
push ecx
call eax
add esp, 0xc
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], 0xffffffff
test eax, eax
je 0x1002095d
mov eax, dword [eax]
test eax, eax
je 0x1002095d
lea edx, [esp + 0x3c]
push 1
lea ecx, [esp + 0x40]
push edx
push ecx
call eax
add esp, 0xc
mov ecx, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0xc
ret 0x40
Function at 0x100215b0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov esi, dword [ebx + 0x1c4]
test esi, esi
jne 0x100215c8
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
je 0x100215d7
mov edi, eax
jmp 0x100215ed
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x100215e6
or edi, 0xffffffff
jmp 0x100215ed
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edi, dword [ecx]
cmp edi, 0xffffffff
jne 0x10021661
mov esi, dword [ebx + 0x1d4]
test esi, esi
jne 0x10021602
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
je 0x10021611
mov edi, eax
jmp 0x10021627
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x10021620
or edi, 0xffffffff
jmp 0x10021627
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov edi, dword [eax]
cmp edi, 0xffffffff
jne 0x10021661
mov esi, dword [ebx + 0x1e4]
test esi, esi
jne 0x1002163c
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
je 0x1002164b
mov edi, eax
jmp 0x10021661
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x1002165a
or edi, 0xffffffff
jmp 0x10021661
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov edi, dword [edx]
push 0xfa0
mov word [esp + 0x14], 2
xor esi, esi
call sub.WSOCK32.dll_htons
mov word [esp + 0x12], ax
mov eax, dword [esp + 0x10]
add ebx, 0xe4
mov dword [ebx], eax
mov dword [ebx + 4], edi
pop edi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x100216a0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov esi, dword [ebx + 0x1f4]
test esi, esi
jne 0x100216b8
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
je 0x100216c7
mov edi, eax
jmp 0x100216dd
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x100216d6
or edi, 0xffffffff
jmp 0x100216dd
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edi, dword [ecx]
cmp edi, 0xffffffff
jne 0x10021751
mov esi, dword [ebx + 0x204]
test esi, esi
jne 0x100216f2
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
je 0x10021701
mov edi, eax
jmp 0x10021717
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x10021710
or edi, 0xffffffff
jmp 0x10021717
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov edi, dword [eax]
cmp edi, 0xffffffff
jne 0x10021751
mov esi, dword [ebx + 0x214]
test esi, esi
jne 0x1002172c
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
je 0x1002173b
mov edi, eax
jmp 0x10021751
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x1002174a
or edi, 0xffffffff
jmp 0x10021751
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov edi, dword [edx]
push 0x1f40
mov word [esp + 0x14], 2
xor esi, esi
call sub.WSOCK32.dll_htons
mov word [esp + 0x12], ax
mov eax, dword [esp + 0x10]
add ebx, 0xf8
mov dword [ebx], eax
mov dword [ebx + 4], edi
pop edi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x100278e0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100402b8
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
mov ebx, dword [esp + 0x4c]
push ebp
xor ebp, ebp
mov eax, dword [ebx + 8]
push esi
push edi
mov edi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
cmp eax, ebp
mov esi, ecx
je 0x10027913
mov edi, eax
push edi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
je 0x10027922
mov ecx, eax
jmp 0x10027938
push edi
call sub.WSOCK32.dll_gethostbyname
cmp eax, ebp
jne 0x10027931
or ecx, 0xffffffff
jmp 0x10027938
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax]
mov ax, word [ebx + 0x14]
xor edx, edx
mov dword [esp + 0x28], edx
push eax
mov dword [esp + 0x20], 0x10047144
mov word [esp + 0x24], 2
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], ecx
call sub.WSOCK32.dll_htons
mov word [esp + 0x22], ax
mov dword [esp + 0x50], ebp
mov word [esi + 0x16e], bp
call fcn.1002f8e0
mov dword [esi + 0x170], eax
lea edi, [esi + 0x158]
lea ebx, [esi + 0xb0]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], 0x100471d4
mov ecx, ebx
mov byte [esp + 0x50], 1
mov byte [esp + 0x14], 1
mov word [esp + 0x16], 8
call fcn.1002a600
mov dword [esp + 0x18], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
mov ebp, eax
lea ecx, [ebx + 4]
add ebp, 7
push ebp
call fcn.1002a720
lea eax, [ebx + 4]
lea ecx, [esp + 0x30]
mov dword [eax + 8], ebp
mov ebx, dword [ebx + 0xc]
mov eax, dword [eax]
push ebx
push eax
call fcn.10020f30
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], 2
call dword [edx + 0xc]
mov eax, dword [edi]
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
call dword [eax + 0xc]
lea ecx, [esp + 0x30]
call fcn.10021140
mov ecx, esi
mov byte [esp + 0x50], 0
call fcn.1002a290
mov word [esi + 0x16c], ax
mov eax, dword [esi + 0xbc]
mov ecx, dword [esi + 0xb4]
lea edx, [esp + 0x1c]
push edx
push eax
push ecx
mov ecx, dword [esi + 0xa8]
call fcn.100389f0
mov ecx, dword [esi + 0xc0]
mov edi, 1
push 0x2710
mov dword [esi + 0xc4], edi
call fcn.10039df0
mov edx, dword [esp + 0x58]
cmp word [edx + 0x16], di
jne 0x10027a7a
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
add esi, 0xe4
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x1002e5a0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x10040bc1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 0x140], 0
call fcn.10031f20
xor eax, eax
mov ecx, 0x4a
lea edi, [esp + 0xc]
push eax
rep stosd dword es:[edi], eax
push 2
mov byte [esp + 0x148], 1
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 8]
mov esi, eax
call fcn.10017290
lea eax, [esp + 0xc]
mov dword [esp + 8], esi
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
setne al
mov byte [esp + 0x134], al
test al, al
mov dword [esp + 0x140], 2
je 0x1002e6c8
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0xf
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002e64d
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [esp + 0x30]
push eax
push ecx
call esi
test eax, eax
jne 0x1002e6f0
push 2
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002e675
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea edx, [esp + 0x30]
push eax
push edx
call esi
test eax, eax
jne 0x1002e6f0
push 0xb
mov ecx, 0x10056110
call fcn.1000b570
mov eax, dword [eax + 4]
test eax, eax
jne 0x1002e699
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
lea eax, [esp + 0x34]
push eax
call esi
test eax, eax
jne 0x1002e6f0
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
setne al
test al, al
mov byte [esp + 0x134], al
jne 0x1002e635
mov eax, dword [esp + 8]
test eax, eax
je 0x1002e6d7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
add esp, 0x13c
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x1002e6ff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x138]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x13c
ret
Function at 0x1002f070
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x10040c78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
push 0x20019
push ebp
push str.SoftwareMicrosoftInternet_ExplorerMain
push reloc.WSOCK32.dll_accept
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x1002f183
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push ebp
push edx
push ebp
push str.Disable_Script_Debugger
push esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call ebx
test eax, eax
je 0x1002f10b
cmp esi, ebp
je 0x1002f183
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov eax, dword [esp + 0x10]
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
lea ecx, [esp + 0x10]
mov edi, eax
lea edx, [esp + 0x14]
push ecx
push edi
push edx
push ebp
push str.Disable_Script_Debugger
push esi
mov dword [esp + 0x2c], ebp
call ebx
test eax, eax
je 0x1002f148
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x1002f145
push esi
call ebx
xor esi, esi
push edi
jmp 0x1002f174
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x1002f157
push esi
call ebx
xor esi, esi
mov eax, dword [0x10054d78]
lea ecx, [esp + 0x18]
push ecx
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
push edi
je 0x1002f198
call sub.MFC42.DLL_operatordelete
add esp, 4
cmp esi, ebp
je 0x1002f183
push esi
call ebx
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
call sub.MFC42.DLL_operatordelete
add esp, 4
cmp esi, ebp
je 0x1002f1a7
push esi
call ebx
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x10031160
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x10040ecf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push esi
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x158], 1
call fcn.10031f20
xor eax, eax
mov ecx, 0x4a
lea edi, [esp + 0x24]
push eax
rep stosd dword es:[edi], eax
push 2
mov byte [esp + 0x160], 2
mov dword [esp + 0x2c], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.10017290
lea eax, [esp + 0x24]
mov dword [esp + 0x20], esi
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
setne al
mov byte [esp + 0x14c], al
test al, al
je 0x1003123b
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov eax, dword [esp + 0x164]
mov esi, dword [eax]
cmp esi, eax
je 0x1003121c
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x100311ff
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [esp + 0x48]
push eax
push ecx
call edi
test eax, eax
jne 0x100312bb
mov esi, dword [esi]
mov eax, dword [esp + 0x164]
cmp esi, eax
jne 0x100311f3
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
setne al
test al, al
mov byte [esp + 0x14c], al
jne 0x100311e6
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], 5
call fcn.10017290
mov esi, dword [esp + 0x164]
mov dword [esp + 0x158], 0xffffffff
mov eax, dword [esi]
cmp eax, esi
mov dword [esp + 0xc], eax
je 0x10031292
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [esp + 0x14]
call fcn.1000eab0
mov eax, dword [eax]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x168]
call fcn.1000ea40
cmp dword [esp + 0xc], esi
jne 0x10031268
mov edx, dword [esp + 0x164]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x148]
mov dword fs:[0], ecx
add esp, 0x154
ret
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], 4
call fcn.10017290
mov esi, dword [esp + 0x164]
mov dword [esp + 0x158], 0xffffffff
mov eax, dword [esi]
cmp eax, esi
mov dword [esp + 8], eax
je 0x10031312
lea ecx, [esp + 0x1c]
push 0
push ecx
lea ecx, [esp + 0x10]
call fcn.1000eab0
mov edx, dword [eax]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x168]
call fcn.1000ea40
cmp dword [esp + 8], esi
jne 0x100312e8
mov ecx, dword [esp + 0x164]
push ecx
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x154]
add esp, 4
mov al, 1
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x154
ret