joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd8a74
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xd8c9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 1
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0xd8bbf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0xd8b95
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0xd8b8e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.000140bc
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0xd8b23
push 2
mov eax, dword [ebp - 4]
call fcn.000140bc
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0xd8b64
push 0
call sub.kernel32.dll_SetLastError
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_ChangeServiceConfigA
test eax, eax
jne 0xd8b5d
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
jmp 0xd8b6c
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0xd8b6c
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xd8b9d
cmp dword [ebp - 0x24], 0
je 0xd8b88
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
mov dword [ebp - 0x24], eax
ret
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xd8bc6
cmp dword [ebp - 0x10], 0
je 0xd8bb9
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
mov dword [ebp - 0x10], eax
ret
Function at 0xd9114
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xd936e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x38]
mov eax, 0xd937c
call fcn.0007a2b0
push dword [ebp - 0x38]
push dword [ebp - 4]
lea edx, [ebp - 0x3c]
mov eax, 0xd9390
call fcn.0007a2b0
push dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00013fb8
mov eax, dword [ebp - 0x34]
call fcn.000d90c4
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xd92db
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0xd91c0
push 0
call sub.kernel32.dll_SetLastError
call fcn.000d905c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xc], 0
je 0xd92ae
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0xd9299
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.000140bc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0xd920c
push 0
call sub.kernel32.dll_SetLastError
cmp dword [ebp - 0x14], 0
jne 0xd921a
call fcn.000d905c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0xd926c
lea edx, [ebp - 0x40]
mov eax, 0xd9394
call fcn.0007a2b0
mov eax, dword [ebp - 0x40]
call fcn.000d90c4
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x1c
call fcn.00012b38
lea eax, [ebp - 0x30]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
je 0xd925e
push 0
call sub.kernel32.dll_SetLastError
cmp dword [ebp - 0x14], 0
jne 0xd926c
call fcn.000d905c
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xd92a0
cmp dword [ebp - 0x10], 0
je 0xd9293
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0xd9293
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 0x10], eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xd92e2
cmp dword [ebp - 0xc], 0
je 0xd92d5
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0xd92d5
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0xd93b8
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xd9607
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x34]
mov eax, 0xd9618
call fcn.0007a2b0
mov eax, dword [ebp - 0x34]
call fcn.000d90c4
xor eax, eax
mov dword [ebp - 0x2c], eax
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0xd9553
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80000000
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0xd943a
push 0
call sub.kernel32.dll_SetLastError
call fcn.000d905c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0
je 0xd9526
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0xd9511
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.000140bc
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0xd9486
push 0
call sub.kernel32.dll_SetLastError
cmp dword [ebp - 0xc], 0
jne 0xd9494
call fcn.000d905c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0
je 0xd94e4
lea edx, [ebp - 0x38]
mov eax, 0xd962c
call fcn.0007a2b0
mov eax, dword [ebp - 0x38]
call fcn.000d90c4
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x1c
call fcn.00012b38
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0xd94d6
push 0
call sub.kernel32.dll_SetLastError
cmp dword [ebp - 0xc], 0
jne 0xd94e4
call fcn.000d905c
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xd9518
cmp dword [ebp - 0x14], 0
je 0xd950b
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0xd950b
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 0x14], eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xd955a
cmp dword [ebp - 0x10], 0
je 0xd954d
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0xd954d
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 0x10], eax
ret
Function at 0xda034
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xda1e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, 0xda1f4
call fcn.0007a2b0
mov eax, dword [ebp - 0x18]
call fcn.000d90c4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xda1a2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0xda09c
push 0
call sub.kernel32.dll_SetLastError
call fcn.000d905c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
je 0xda175
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0xda160
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.000140bc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0xda0e8
push 0
call sub.kernel32.dll_SetLastError
cmp dword [ebp - 0x10], 0
jne 0xda0f6
call fcn.000d905c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0
je 0xda133
lea edx, [ebp - 0x1c]
mov eax, 0xda208
call fcn.0007a2b0
mov eax, dword [ebp - 0x1c]
call fcn.000d90c4
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
je 0xda125
push 0
call sub.kernel32.dll_SetLastError
cmp dword [ebp - 0x10], 0
jne 0xda133
call fcn.000d905c
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xda167
cmp dword [ebp - 0x14], 0
je 0xda15a
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0xda15a
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 0x14], eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xda1a9
cmp dword [ebp - 0xc], 0
je 0xda19c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0xda19c
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0xdcea0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xdd0ff
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0xdcf02
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.000dc968
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0001b320
cmp al, 1
jne 0xdcf02
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.000dcc80
test al, al
je 0xdd08e
cmp dword [ebp - 8], 0
jge 0xdcf20
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.000dc968
mov eax, dword [ebp - 0x210]
call fcn.00013ef8
cmp ebx, eax
jge 0xdcf6a
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.000dc968
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0xfb75c]
and eax, 0xff
bt dword [edx], eax
jae 0xdcf6a
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
cmp eax, dword [ebp - 8]
jg 0xdcf7e
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.000dce7c
cmp ebx, dword [ebp - 8]
je 0xdd080
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0xdcfaa
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.000130ec
and eax, 0x7f
movzx eax, word [eax*2 + 0xfb0f8]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 1
xor eax, eax
push ebp
push 0xdd06d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.000130ec
and eax, 0x7f
movzx eax, word [eax*2 + 0xfb0f8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00059088
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.000130ec
and eax, 0x7f
movzx eax, word [eax*2 + 0xfb0f8]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00059088
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xdd074
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x218], edx
jmp 0xdd0e1
cmp dword [ebp - 8], 0
jge 0xdd099
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.000dc968
mov eax, dword [ebp - 0x218]
call fcn.00013ef8
cmp eax, dword [ebp - 8]
jg 0xdd0d3
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.000dc968
mov eax, dword [ebp - 0x21c]
call fcn.00013ef8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.000dce7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xdd106
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00013c9c
ret
Function at 0xeae4c
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xeaf01
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x800
call fcn.0007b580
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0xeaee4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
call fcn.0007ac04
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.0007ac40
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.advapi32.dll_LookupAccountNameW
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xeaeeb
lea eax, [ebp - 0x1c]
call fcn.0007b5a4
ret

Function at 0xeaf90
Capabilities:
Manipulate user privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.000eaf10
xor eax, eax
push ebp
push 0xeb004
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
je 0xeafd6
push 1
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.Advapi32.dll_LsaAddAccountRights
mov dword [ebp - 0x10], eax
jmp 0xeafee
push 1
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.Advapi32.dll_LsaRemoveAccountRights
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xeb00b
lea eax, [ebp - 0x18]
call fcn.000eaf70
ret

Function at 0xeb4c4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xeb572
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0xfb1e0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0xeb580
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0xeb550
cmp dword [ebp - 8], 0
jne 0xeb550
mov eax, 0xeb5bc
call fcn.000eb370
push 0xeb5c0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0xeb5d0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0xeb5e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0xeb5f4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xeb579
cmp dword [ebp - 4], 0
je 0xeb56c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 4], eax
ret
Function at 0xeb8cc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0xeb991
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0xeb95c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0xfb10c], 0
jne 0xeb928
mov ecx, dword [0xfb6b8]
mov ecx, dword [ecx]
lea eax, [ebp - 4]
mov edx, 0xeb9a8
call fcn.00013f44
mov eax, dword [ebp - 4]
call fcn.000140bc
push eax
push 0xffffffffffffffff
push 0xf001f
call sub.kernel32.dll_OpenFileMappingA
mov dword [0xfb10c], eax
cmp dword [0xfb10c], 0
je 0xeb952
cmp dword [0xfb110], 0
jne 0xeb952
push 0xc
push 0
push 0
push 6
mov eax, dword [0xfb10c]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0xfb110], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xeb974
cmp dword [0xfb110], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xeb998
lea eax, [ebp - 4]
call fcn.00013c78
ret
Function at 0xed8bc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xedae5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, 0x400
call fcn.0007b580
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xedabb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0xfb1e0]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0xedaf0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0xeda64
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0xeda35
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0xeda0b
mov eax, dword [ebp - 0xc]
call fcn.0007ac04
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
call fcn.0007abc8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0007ac40
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0xed9d2
cmp dword [ebp - 0x10], 2
jb 0xeda08
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0007ac20
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0xeda08
cmp dword [ebp - 0x14], 0x103
je 0xeda08
lea edx, [ebp - 0x24]
mov eax, 0xedb1c
call fcn.0007a2b0
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x14]
call fcn.000766dc
mov edx, dword [ebp - 0x28]
pop eax
call fcn.00013f00
mov eax, dword [ebp - 0x24]
call fcn.000eb73c
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cdq
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0xeda25
cmp eax, dword [esp]
pop edx
pop eax
jbe 0xeda91
jmp 0xeda29
pop edx
pop eax
jle 0xeda91
cmp dword [ebp - 0x14], 0
je 0xed976
jmp 0xeda91
lea edx, [ebp - 0x2c]
mov eax, 0xedb34
call fcn.0007a2b0
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x14]
call fcn.000766dc
mov edx, dword [ebp - 0x30]
pop eax
call fcn.00013f00
mov eax, dword [ebp - 0x2c]
call fcn.000eb73c
jmp 0xeda91
lea edx, [ebp - 0x34]
mov eax, 0xedb4c
call fcn.0007a2b0
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x14]
call fcn.000766dc
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00013f00
mov eax, dword [ebp - 0x34]
call fcn.000eb73c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xedac2
lea eax, [ebp - 0xc]
call fcn.0007b5a4
cmp dword [ebp - 0x18], 0
je 0xedab5
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x18], eax
ret
Function at 0xef688
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x51b
push 0
push 0
dec ecx
jne 0xef690
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xefb57
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x28a0]
mov eax, 0xefb68
call fcn.0007a2b0
push dword [ebp - 0x28a0]
push dword [ebp - 4]
lea edx, [ebp - 0x28a4]
mov eax, 0xefb70
call fcn.0007a2b0
push dword [ebp - 0x28a4]
lea eax, [ebp - 0x289c]
mov edx, 3
call fcn.00013fb8
mov eax, dword [ebp - 0x289c]
mov edx, dword [ebp - 8]
call fcn.0007b860
xor eax, eax
push ebp
push 0xefa8c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x88]
xor ecx, ecx
mov edx, 0x44
call fcn.00012b38
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.00012b38
xor eax, eax
push ebp
push 0xefa7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x94], 0xc
mov dword [ebp - 0x8c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x90], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x28], eax
push 0x2800
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_CreatePipe
mov dword [ebp - 0x88], 0x44
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x5c], 0x101
mov word [ebp - 0x58], 0
lea eax, [ebp - 0x24]
call fcn.000769d0
push 0xefb7c
lea edx, [ebp - 0x28a8]
mov eax, 0xefb88
call fcn.0007a2b0
push dword [ebp - 0x28a8]
push dword [ebp - 4]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00013fb8
mov eax, dword [0xfb40c]
call fcn.00078df4
xor eax, eax
push ebp
push 0xef875
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x28b0]
mov eax, 0xefb8c
call fcn.0007a2b0
mov eax, dword [ebp - 0x28b0]
lea ecx, [ebp - 0x28ac]
mov edx, dword [0xfb40c]
call fcn.00078fa8
mov eax, dword [ebp - 0x28ac]
call fcn.000eb6d8
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebp - 0x24]
call fcn.000140bc
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.000140bc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x2d], al
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x1c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xef87c
mov eax, dword [0xfb40c]
call fcn.00078ec8
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2d820536
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x483447a0
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219