joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007ce60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b44c3
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x100df514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x100df578]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.1007cd50
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x1007d041
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.10080db0
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x100c383c
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1007d041
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x1007cf35
cmp eax, 2
jne 0x1007d041
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x1007cf56
test cl, 1
jne 0x1007d041
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x1007cf5c
jmp 0x1007d041
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x1007d041
call fcn.1000ac40
mov ecx, eax
test ecx, ecx
je 0x1007d06c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.1007b080
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x100c3844
push eax
call fcn.100123f0
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.1007b610
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x1007d025
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1007cfc6
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.1007d080
push dword [0x100df580]
lea eax, [ebp - 0x74]
push dword [0x100df57c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x1007d002
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1007d01e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x1007d043
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1007d041
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x1007d04e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100760cb
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000a5d0
int3
Function at 0x1007d160
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b44f8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100df514]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x100df578]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.1007cd50
test eax, eax
je 0x1007d288
mov esi, dword [ebp - 0x18]
mov edi, dword [0x100df578]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x1007d233
cmp dword [esi], 0
je 0x1007d226
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x1007d1f3
mov eax, 1
jmp 0x1007d254
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007d22c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call eax
jmp 0x1007d254
cmp dword [esi + 4], 0
jne 0x1007d233
mov eax, 1
jmp 0x1007d254
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1007d27e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x1007d266
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x1007d28b
xor ebx, ebx
jmp 0x1007d32f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x1007d32f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x1007d2e8
mov ecx, dword [ebx]
test ecx, ecx
je 0x1007d34e
push ecx
push eax
call fcn.100900c3
add esp, 8
test eax, eax
je 0x1007d2e8
mov edx, dword [edi]
test edx, edx
je 0x1007d2e8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1007d2c0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x1007d2f3
lea eax, [edx + 0xd]
jmp 0x1007d328
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1007d300
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x100c383c
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x1007d33a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000a5d0
int3
Function at 0x1007ea40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1007eab1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x1007ea7f
cmp eax, 2
jne 0x1007ea9b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x1007eaab
test ecx, ecx
je 0x1007eaa6
test cl, 1
jne 0x1007ea9b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x1007eaab
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1009d103
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1009cf82

Function at 0x100a2071
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100a1d31
Function at 0x10004b20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esp
push 0
mov ebx, dword [ebp - 4]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 8], esp
je 0x10004b5a
push 6
call fcn.1001b722
add esp, 4
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esp
mov ebx, dword [ebp - 4]
push dword [ebx]
xor eax, eax
call dword [0x10076404]
nop
nop
cmp dword [ebp - 8], esp
je 0x10004b89
push 6
call fcn.1001b722
add esp, 4
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esp
mov ebx, dword [ebp - 4]
push dword [ebx]
xor eax, eax
call dword [0x10076404]
nop
nop
cmp dword [ebp - 8], esp
je 0x10004bb5
push 6
call fcn.1001b722
add esp, 4
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 8
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 0xc
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 4]
mov dword [ebx], 0
mov ebx, dword [ebp - 8]
mov dword [ebx], 0
mov ebx, dword [ebp - 0xc]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0
mov esp, ebp
pop ebp
ret 4

Function at 0x1000d1f7
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.1001c2d0
add esp, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push str.Shell_TrayWnd
xor eax, eax
call dword [sym.imp.USER32.dll_FindWindowA]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000d248
push 6
call fcn.1001b722
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000d25b
push ebx
call fcn.1001b72e
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x1000d263
mov esp, ebp
pop ebp
ret
Function at 0x1000d8f9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov ecx, 0
push ecx
shl ecx, 2
add ecx, 8
push ecx
call fcn.1001b71c
add esp, 4
mov edi, eax
mov dword [edi], 1
add edi, 4
pop ecx
push eax
push ecx
mov dword [edi], 0
add edi, 4
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.10001e2a
pop edx
test ecx, ecx
je 0x1000d965
push edi
push edx
push ecx
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x1000d95b
push ebx
call fcn.1001b72e
add esp, 4
pop ebx
pop ecx
add ebx, 4
dec ecx
jne 0x1000d94a
pop edx
pop edi
test edx, edx
je 0x1000d973
mov ecx, edx
xor eax, eax
rep stosd dword es:[edi], eax
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.1001b72e
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
xor ecx, ecx
lea eax, [ebp - 4]
mov ebx, eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, 0x1a
jg 0x1000db13
fild dword [ebp - 4]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x10074e02]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.10001ff0
push 0x80000101
push 0
push eax
push 1
mov ebx, 0x140
call fcn.1001c2d0
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x10074e0a
push dword [ebp - 0x18]
mov ecx, 2
call fcn.100019d9
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1000d9fa
push ebx
call fcn.1001b72e
add esp, 4
mov dword [ebp - 0x20], esp
push dword [ebp - 0x1c]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x1000da1c
push 6
call fcn.1001b722
add esp, 4
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1000da2f
push ebx
call fcn.1001b72e
add esp, 4
cmp dword [ebp - 0x24], 5
jne 0x1000db0c
fild dword [ebp - 4]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x10074e02]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.10001ff0
push 0x80000101
push 0
push eax
push 1
mov ebx, 0x140
call fcn.1001c2d0
add esp, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp + 8]
push 4
mov eax, 2
call fcn.1001c160
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov dword [ebp - 0x20], ebx
call fcn.10001e2a
mov dword [ebp - 0x24], ecx
mov edi, dword [ebp - 0x20]
mov dword [edi], 1
add edi, 4
mov eax, ecx
inc eax
mov dword [edi], eax
add edi, 4
cmp edi, ebx
je 0x1000dab4
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x24]
inc eax
shl eax, 2
add eax, 8
push eax
push dword [ebp - 0x20]
call fcn.1001b740
add esp, 8
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov edi, eax
add edi, 8
mov eax, dword [ebp - 0x24]
shl eax, 2
add edi, eax
mov eax, dword [ebp - 0x1c]
push edi
test eax, eax
je 0x1000daf9
push eax
mov ebx, eax
call fcn.100012c4
inc eax
push eax
call fcn.1001b71c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [edi], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1000db0c
push ebx
call fcn.1001b72e
add esp, 4
pop ebx
pop ecx
jmp 0x1000d98d
add esp, 8
mov esp, ebp
pop ebp
ret 4
Function at 0x1000ef4e
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.1001dbd0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000ef93
push ebx
call fcn.1001b72e
add esp, 4
pop eax
mov dword [ebp - 4], eax
push OleUIBusyA
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000efaa
mov eax, 0x10044333
push eax
push 1
mov ebx, 0x130
call fcn.1001c580
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000efe6
push 6
call fcn.1001b722
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000f014
mov eax, dword [ebp - 4]
test eax, eax
je 0x1000f00f
push eax
mov ebx, eax
call fcn.100012c4
inc eax
push eax
call fcn.1001b71c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1000f01e
mov eax, 0x10044333
jmp 0x1000f01e
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000f02f
push ebx
call fcn.1001b72e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1001c8d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x1001c962
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x1001c954
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x1001c94c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x1001c915
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x1001c970
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.10022140
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call fcn.10021400
add esp, 8
test ebx, ebx
je 0x1001cab2
test eax, eax
je 0x1001cab2
inc eax
push eax
call fcn.10034daf
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10029800
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1001c9e1
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1001ca9f
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.10034daf
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x1001ca69
cmp eax, 0xea
jne 0x1001ca8b
push esi
call fcn.10034dd8
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10034daf
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x1001ca34
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x1001ca77
cmp eax, 2
jne 0x1001ca8b
push esi
call fcn.10021400
push eax
push esi
call fcn.10022100
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call fcn.10034dd8
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.10034dd8
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x1001cada
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x1001cae6
mov esi, dword [esp + 0x40]
test esi, esi
je 0x1001cae6
push esi
call fcn.10021400
push eax
push esi
call fcn.10022100
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x1001cb40
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
sub esp, 0x294
lea eax, [esp + 0x104]
push esi
push eax
push 0x202
xor esi, esi
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x1001cb91
lea ecx, [esp + 4]
push 0x104
push ecx
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x1001cb8c
lea edx, [esp + 4]
push edx
call fcn.10021400
push eax
lea eax, [esp + 0xc]
push eax
call fcn.10022100
add esp, 0xc
mov esi, eax
call sub.WS2_32.dll_WSACleanup
mov eax, esi
pop esi
add esp, 0x294
ret
Function at 0x1001d2e0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x1001d349
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.1001c040
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x1001d350
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x1001d391.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x1001d391.2
jmp dword [eax*4 + 0x1001d41c]
mov word [esp + 0x48], di
jmp 0x1001d3ca
mov word [esp + 0x48], 2
jmp 0x1001d3ca
mov word [esp + 0x48], 3
jmp 0x1001d3ca
mov word [esp + 0x48], 4
jmp 0x1001d3ca
mov word [esp + 0x48], 7
jmp 0x1001d3ca
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x1001d414
cmp dword [esp + 0x70], edi
je 0x1001d400
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret
Function at 0x1001dc30
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
ja 0x1001dcb0
je 0x1001dca1
cmp eax, 0x80000101
ja 0x1001dc9a
je 0x1001dca1
cmp eax, 0x80000004
je 0x1001dc7c
cmp eax, 0x80000005
jne 0x1001dcc5
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 3
test eax, eax
je 0x1001dd12
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x1001dd12
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 1
push eax
call fcn.10021400
mov ebp, dword [esp + 0x44]
mov ebx, eax
add esp, 4
inc ebx
jmp 0x1001dd12
cmp eax, 0x80000201
jne 0x1001dcc5
mov ebx, 4
lea ebp, [esp + 0x40]
mov dword [esp + 8], ebx
jmp 0x1001dd12
cmp eax, 0x80000401
je 0x1001dcfd
cmp eax, 0x80000501
je 0x1001dce5
cmp eax, 0x80000601
je 0x1001dccd
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.10029978
mov dword [esp + 0xc], eax
jmp 0x1001dd0e
fld dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.10029978
mov dword [esp + 0xc], eax
jmp 0x1001dd0e
mov ecx, dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
lea ebp, [esp + 0xc]
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.10022140
mov esi, eax
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0
call fcn.10021400
add esp, 8
test esi, esi
je 0x1001ddea
test eax, eax
je 0x1001ddea
inc eax
push edi
push eax
call fcn.10034daf
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10029800
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1001dd8c
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001dde0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1001ddd5
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.10034dd8
add esp, 4
pop edi
mov eax, dword [esp + 0x18]
pop esi
pop ebp
pop ebx
add esp, 0x18
ret