joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cb99
Capabilities:
Copy file
Set file attributes

Disassembly:
mov eax, 0x10800ac
call fcn.0105c800
sub esp, 0x34
mov dword [ebp - 0x10], ecx
push ebx
push edi
lea ecx, [ebp - 0x40]
call fcn.01017bf9
mov ebx, dword [ebp + 8]
xor edi, edi
push edi
push ebx
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], edi
call fcn.01017c4d
test al, al
je 0x100cc81
push dword [ebp + 0x10]
lea ecx, [ebp - 0x40]
push dword [ebp + 0xc]
push edi
push 0x81
push str.TRACKINGDATA
call fcn.01017cd4
test al, al
je 0x100cc81
push esi
push 0xffffffffffffff9b
push ebx
lea ecx, [ebp + 8]
call fcn.010087b8
mov esi, str..temp.exe
mov byte [ebp - 4], 1
mov eax, esi
test eax, eax
je 0x100cc12
push esi
call fcn.0105c0e0
pop ecx
jmp 0x100cc14
xor eax, eax
push esi
push eax
lea ecx, [ebp + 8]
call fcn.01008a89
push edi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 0x40]
call fcn.01017fb3
test al, al
pop esi
je 0x100cc79
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x100cc79
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x100cc79
mov ecx, dword [ebp - 0x10]
push 0x2710
push dword [ebp + 8]
call fcn.0100cda9
lea ecx, [ebp + 8]
mov bl, al
call fcn.01001190
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.01017c15
mov al, bl
jmp 0x100cc8f
lea ecx, [ebp + 8]
call fcn.01001190
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.01017c15
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x100cc9f
Capabilities:
Create directory

Disassembly:
mov eax, 0x10800d0
call fcn.0105c800
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
and dword [ebp - 4], 0
and byte [ebp - 0xd], 0
lea ecx, [ebp + 8]
call fcn.01009915
mov edi, dword [ebp + 0x14]
test al, al
je 0x100cccd
mov byte [edi], 1
jmp 0x100cce1
and byte [edi], 0
push 0
lea ecx, [ebp + 8]
call fcn.0100972d
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp + 8]
lea ecx, [ebp - 0x1c]
push eax
call fcn.01009fcf
push 0x10a40b8
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.01009662
lea ecx, [ebp + 8]
call fcn.01009915
test al, al
je 0x100cd41
lea ecx, [ebp - 0x28]
call fcn.01016902
push 1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0100972d
push eax
lea ecx, [ebp - 0x28]
call fcn.01016be3
test eax, eax
jl 0x100cd35
lea ecx, [ebp - 0x28]
call fcn.01016ae8
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.01016958
lea ecx, [ebp - 0x1c]
call fcn.01009915
test al, al
mov esi, 0x2710
je 0x100cd67
push esi
lea ecx, [ebp - 0x1c]
call fcn.0100972d
push eax
mov ecx, ebx
call fcn.0100cda9
mov byte [ebp - 0xd], 1
cmp byte [edi], 0
jne 0x100cd7d
push esi
lea ecx, [ebp + 8]
call fcn.0100972d
push eax
mov ecx, ebx
call fcn.0100ce44
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.010095e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.010095e5
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x100cda9
Capabilities:
Check for time delay via gettickcount
Delete file
Set file attributes

Disassembly:
mov eax, 0x10800e4
call fcn.0105c800
sub esp, 0x10
push ebx
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.01009de4
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.01009915
test al, al
jne 0x100cdd6
mov bl, 1
jmp 0x100ce27
push esi
push edi
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call edi
mov dword [ebp - 0x10], eax
test ebx, ebx
jne 0x100ce22
call edi
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jae 0x100ce20
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call esi
mov ebx, eax
jmp 0x100cdfe
test ebx, ebx
pop edi
pop esi
setne bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.010095e5
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x100ce44
Capabilities:
Check for time delay via gettickcount
Delete directory

Disassembly:
mov eax, 0x10800f8
call fcn.0105c800
sub esp, 0x10
push ebx
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.01009de4
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.01009915
test al, al
jne 0x100ce71
mov bl, 1
jmp 0x100ceb4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push edi
push dword [ebp + 8]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call edi
mov dword [ebp - 0x10], eax
test ebx, ebx
jne 0x100ceaf
call edi
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jae 0x100cead
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call esi
mov ebx, eax
jmp 0x100ce8b
test ebx, ebx
pop edi
pop esi
setne bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.010095e5
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x100ced1
Capabilities:
Create directory

Disassembly:
mov eax, 0x1080154
call fcn.0105c800
sub esp, 0x38
push esi
mov esi, ecx
push 2
lea ecx, [ebp - 0x20]
call fcn.0100943b
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0100c82f
push dword [eax]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.01009731
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.01001190
push 0
lea ecx, [ebp - 0x20]
call fcn.0100972d
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x20]
call fcn.0100972d
push eax
mov ecx, esi
call fcn.0100b289
lea ecx, [ebp - 0x20]
call fcn.01009915
test al, al
je 0x100d0bf
push ebx
lea eax, [ebp - 0x20]
push edi
push eax
lea ecx, [ebp - 0x2c]
call fcn.01009fcf
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
mov byte [ebp - 4], 2
call fcn.0100c897
push dword [eax]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.01009731
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.01001190
mov edi, 0x10989d4
lea ecx, [ebp - 0x20]
push edi
call fcn.01009793
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.0100c897
mov ebx, dword [eax]
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0100c99f
push 0
push ebx
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.0100d53c
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 4
call fcn.010095e5
lea ecx, [ebp - 0x14]
call fcn.01001190
mov eax, dword [0x1098824]
mov dword [ebp - 0x10], eax
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x10]
push eax
push 0x1086880
mov byte [ebp - 4], 6
call fcn.01011ddf
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
je 0x100d082
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x20]
push eax
call fcn.010098c5
push dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
call fcn.01009731
push edi
lea ecx, [ebp - 0x20]
call fcn.01009793
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.0100c99f
push 0xffffffffffffff9b
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.0100972d
push eax
lea ecx, [ebp - 0x14]
call fcn.010087b8
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 9
call fcn.010095e5
push dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
call fcn.01009de4
push 0x1098a84
lea eax, [ebp - 0x38]
push dword [ebp - 0x10]
mov ecx, esi
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0100d53c
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 9
call fcn.010095e5
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.01001190
push 1
push 0x1098a80
lea ecx, [ebp - 0x2c]
call fcn.0100972d
push eax
mov ecx, esi
call fcn.0100b0f5
lea ecx, [ebp - 0x10]
call fcn.01001190
and byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.010095e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.010095e5
pop edi
mov al, 1
pop ebx
jmp 0x100d0cd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.010095e5
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x100d0da
Capabilities:
Delete file

Disassembly:
mov eax, 0x1080180
call fcn.0105c800
sub esp, 0x20
push esi
mov esi, ecx
push 2
lea ecx, [ebp - 0x2c]
call fcn.0100943b
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0100c82f
push dword [eax]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.01009731
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.01001190
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x20]
push eax
call fcn.01009fcf
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
mov byte [ebp - 4], 2
call fcn.0100c636
push dword [eax]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.01009731
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.01001190
push 0x10989d4
lea ecx, [ebp - 0x20]
call fcn.01009793
lea ecx, [ebp - 0x20]
call fcn.0100972d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x100d191
push 0x2710
lea ecx, [ebp - 0x2c]
call fcn.0100972d
push eax
mov ecx, esi
call fcn.0100ce44
test al, al
je 0x100d191
mov byte [ebp - 0xd], 1
jmp 0x100d195
and byte [ebp - 0xd], 0
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.010095e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.010095e5
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10123f6
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x1080a52
call fcn.0105c800
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x10866e4
mov eax, dword [0x1098824]
mov dword [esi + 4], eax
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [0x1098824]
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebx
mov eax, dword [0x1098824]
mov dword [esi + 0x1c], eax
mov eax, dword [0x1098824]
mov dword [esi + 0x20], eax
mov eax, dword [0x1098824]
mov dword [esi + 0x24], eax
mov eax, dword [0x1098824]
lea edi, [esi + 0x28]
mov dword [edi], eax
mov eax, dword [0x1098824]
mov dword [esi + 0x2c], eax
mov eax, dword [0x1098824]
mov dword [esi + 0x30], eax
mov eax, dword [0x1098824]
mov dword [esi + 0x34], eax
fldz
push 0xffffffffffffff9b
push 0x109899c
fstp dword [esi + 0x3c]
fldz
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 8
fstp dword [esi + 0x40]
fldz
mov byte [esi + 0x38], 1
mov dword [esi + 0x60], ebx
fstp dword [esi + 0x44]
fldz
fstp dword [esi + 0x48]
fldz
fstp dword [esi + 0x4c]
fldz
fstp dword [esi + 0x50]
fldz
fstp dword [esi + 0x54]
fldz
fstp dword [esi + 0x58]
fldz
fstp dword [esi + 0x5c]
call fcn.010087b8
push 0x1098bb4
mov ecx, edi
mov byte [ebp - 4], 9
mov dword [esi], 0x108754c
call fcn.01008a50
push ebx
call fcn.0105b62e
pop ecx
mov dword [esi + 0x18], eax
mov ecx, esi
call fcn.01012c59
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10124e6
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x1080aca
call fcn.0105c800
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x108754c
mov ecx, dword [esi + 0xc]
mov dword [ebp - 4], 9
test ecx, ecx
je 0x1012510
call fcn.0103eb53
and dword [esi + 0xc], 0
lea ecx, [esi + 0x64]
call fcn.01001190
lea ecx, [esi + 0x34]
call fcn.01001190
lea ecx, [esi + 0x30]
call fcn.01001190
lea ecx, [esi + 0x2c]
call fcn.01001190
lea ecx, [esi + 0x28]
call fcn.01001190
lea ecx, [esi + 0x24]
call fcn.01001190
lea ecx, [esi + 0x20]
call fcn.01001190
lea ecx, [esi + 0x1c]
call fcn.01001190
lea ecx, [esi + 0x10]
call fcn.01001190
lea ecx, [esi + 4]
call fcn.01001190
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x101266b
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1080afa
call fcn.0105c800
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ecx
push 0x11
mov byte [ebp - 0xd], bl
call esi
movsx eax, ax
mov edi, 0x40000000
test edi, eax
je 0x10126b3
push 0x54
call esi
movsx eax, ax
test edi, eax
je 0x10126b3
push 0x52
call esi
movsx eax, ax
test edi, eax
je 0x10126b3
mov byte [ebp - 0xd], 1
mov edi, dword [ebp - 0x20]
cmp byte [edi + 0x38], bl
je 0x10126c3
mov eax, dword [edi + 4]
cmp dword [eax - 8], ebx
jne 0x10126ca
xor al, al
jmp 0x1012809
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
mov dword [ebp - 0x18], ebx
call fcn.0101281a
test al, al
je 0x10127fe
mov ecx, edi
call fcn.01013111
neg al
sbb eax, eax
and eax, dword [ebp + 8]
cmp dword [edi + 0xc], ebx
mov dword [ebp - 0x20], eax
je 0x10127fc
push 0xffffffffffffff9b
lea ecx, [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.010087b8
cmp dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
je 0x101276c
push 0x4d
lea eax, [ebp - 0x1c]
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
call fcn.01019729
cmp dword [ebp - 0x1c], ebx
je 0x101276c
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.01008a50
mov esi, 0x1098cc0
mov eax, esi
test eax, eax
je 0x1012744
push esi
call fcn.0105c0e0
pop ecx
jmp 0x1012746
xor eax, eax
push esi
push eax
lea ecx, [ebp - 0x14]
call fcn.01008a89
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x1012760
push esi
call fcn.0105c0e0
pop ecx
jmp 0x1012762
xor eax, eax
push esi
push eax
lea ecx, [ebp - 0x14]
call fcn.01008a89
cmp byte [ebp + 0x14], bl
je 0x101279b
mov ecx, dword [ebp + 0x10]
cmp ecx, ebx
jne 0x101277a
mov ecx, edi
cmp byte [ebp - 0xd], bl
lea eax, [edi + 4]
je 0x1012787
mov eax, 0x10a4200
push ecx
push ebx
push ebx
lea ecx, [ebp - 0x14]
push 1
push ecx
mov ecx, dword [edi + 0xc]
push eax
call fcn.0103ed92
jmp 0x10127ed
call fcn.01013f21
mov esi, eax
cmp esi, ebx
je 0x10127ed
push 0x88
call fcn.0105b249
pop ecx
mov dword [ebp + 0x14], eax
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x10127c8
push ebx
push ebx
push esi
mov ecx, eax
call fcn.010193b0
jmp 0x10127ca
xor eax, eax
cmp byte [ebp - 0xd], bl
mov byte [ebp - 4], bl
lea ecx, [edi + 4]
je 0x10127da
mov ecx, 0x10a4200
push ebx
push ebx
push ebx
mov edx, dword [eax]
push ebx
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [ecx]
mov ecx, eax
call dword [edx + 0x60]
mov ecx, edi
call fcn.01012c59
lea ecx, [ebp - 0x14]
call fcn.01001190
mov bl, 1
push dword [ebp - 0x18]
call fcn.0105ad60
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x1013f99
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov al, byte [esi + 0x23]
cmp al, bl
jne 0x1013fb7
cmp byte [esi + 0x22], bl
je 0x1013fcd
mov ecx, dword [esi + 0x24]
cmp dword [ecx - 8], ebx
jbe 0x1013fcd
mov ecx, dword [esi + 0x80]
push eax
push dword [esi + 0x24]
call fcn.01019b8a
mov dword [esi + 8], 3
cmp dword [esi], ebx
je 0x101403a
lea eax, [ebp - 4]
mov byte [esi + 0x6d], bl
push eax
push 4
push esi
push 0x1014040
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.0105e167
add esp, 0x18
mov dword [esi + 0x7c], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [ebp + 8]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [esi + 0x7c]
mov dword [esi + 0x78], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.0101407a
push 1
push esi
push 0x101405e
push 0x3e8
push 0x2710
call dword [sym.imp.WINMM.dll_timeSetEvent]
mov dword [esi + 0x74], eax
pop esi
pop ebx
leave
ret 4

Function at 0x1014118
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, ecx
push str.www.microsoft.com
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x1014140
mov ecx, esi
call fcn.01014271
test al, al
je 0x1014140
cmp dword [esi + 0x60], 0
je 0x1014140
mov dword [esi], 2
xor eax, eax
cmp dword [esi], eax
pop esi
setne al
ret

Function at 0x101431e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
call fcn.010142c2
push 1
pop ebx
cmp eax, ebx
jne 0x101433c
mov edi, ebx
jmp 0x10143f6
mov ecx, esi
call fcn.0101527e
test al, al
je 0x1014376
mov ecx, esi
call fcn.01014149
cmp eax, ebx
je 0x10143f6
mov eax, 0x10a40b8
push ebx
push eax
push eax
push dword [esi + 0x5c]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 2
pop edi
jmp 0x10143f6
cmp dword [esi], ebx
jne 0x10143f6
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetDial
push dword [esi + 0x14]
call ebx
xor ecx, ecx
cmp eax, ecx
je 0x10143f6
lea edx, [ebp - 4]
push ecx
push edx
push 1
push 0x10a40b8
push ecx
mov dword [ebp - 4], ecx
call eax
test eax, eax
je 0x10143b1
cmp eax, 0x277
je 0x10143b1
mov cl, 1
jmp 0x10143b3
xor cl, cl
test eax, eax
sete al
xor edx, edx
mov byte [esi + 0x1c], al
test al, al
setne dl
mov edi, edx
mov byte [esi + 0x64], al
test edi, edi
jne 0x10143f6
test cl, cl
je 0x10143f6
push str.InternetAutodial
push dword [esi + 0x14]
call ebx
test eax, eax
je 0x10143f6
push edi
push 1
call eax
test eax, eax
setne al
xor ecx, ecx
mov byte [esi + 0x1c], al
test al, al
setne cl
mov byte [esi + 0x64], al
mov edi, ecx
mov dword [esi + 8], edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101681f
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov dword [ecx], 0x1087680
jmp fcn.010124e6

Function at 0x10169ce
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 8]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x3c]
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x1016a66
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x10169fa
mov dword [ebp - 4], 0x80040912
cmp dword [ebp - 4], ebx
jl 0x1016a66
mov dword [ebp - 0xc], eax
inc eax
push edi
push eax
call fcn.0105b249
mov ebx, eax
mov eax, dword [ebp - 8]
pop ecx
mov edi, ebx
lea ecx, [eax + 1]
xor eax, eax
mov edx, ecx
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop edi
je 0x1016a45
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
je 0x1016a4c
mov dword [ebp - 4], 0x80040910
cmp dword [ebp - 4], 0
jl 0x1016a66
mov ecx, dword [ebp + 8]
push ebx
call fcn.01008a77
push dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
call fcn.01009197
push ebx
call fcn.0105ad60
mov eax, dword [ebp - 4]
pop ecx
pop esi
pop ebx
leave
ret 4

Function at 0x1016edf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp byte [ecx + 0xc], bl
push esi
je 0x1016f42
mov edx, dword [ebp + 0x14]
push 1
mov dword [ebp - 4], edx
pop eax
lea edx, [ebp + 8]
mov dword [ebp - 8], eax
push edx
lea edx, [ebp + 0x14]
push edx
push ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, dword [ebp + 0x10]
cmp eax, ebx
jne 0x1016f40
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 8]
push esi
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x14]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
pop edi
je 0x1016f46
mov byte [esi], bl
xor al, al
jmp 0x1016f48
mov al, 1
pop esi
pop ebx
leave
ret 0x10

Function at 0x1016fa1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0xd], bl
jne 0x101700a
cmp byte [esi + 0xc], bl
je 0x101700a
push dword [ebp + 0x10]
call fcn.0105c0e0
mov edi, eax
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x101700a
push edi
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x101700a
mov al, 1
jmp 0x101700c
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1017013
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [ecx + 0xc], 0
push 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
jne 0x101702c
xor eax, eax
jmp 0x1017084
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp + 8]
xor esi, esi
push eax
push esi
push 1
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1017080
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
test bl, bl
pop ebx
jne 0x1017083
mov eax, dword [ebp + 0x10]
pop esi
leave
ret 0xc

Function at 0x1017088
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
cmp byte [ecx + 0xc], bl
mov dword [ebp - 8], 3
je 0x10170e9
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
push 1
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10170e9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push dword [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x14]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret 0x10

Function at 0x10170f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0xc], 0
je 0x1017129
lea eax, [ebp + 8]
push eax
push 0xf003f
push 0
push dword [ebp + 8]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1017129
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
ret 8