joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e7a9c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a9371
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
cld
invalid
inc dword [ebx]
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.1e7a93bc
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a9371
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
lcall 0xffff, 0xfc1b85c6
mov dword [0xfc1c85c6], eax
invalid
inc dword [ecx - 0x3e27a3a]
invalid
dec dword [edx - 0x3e17a3a]
invalid
call [ebx - 0x3e07a3a]
cld
invalid
inc dword [edx - 0x3df7a3a]
invalid
dec dword [ebx - 0x3de7a3a]
invalid
jmp dword [esi - 0x3dd7a3a]
invalid
dec dword [edi - 0x3dc7a3a]
invalid
invalid
invalid
Function at 0x1e7aa080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x398], 0
je 0x1e7aa0a0
cmp dword [ebp - 0x398], 0
je 0x1e7aa26a
cmp dword [ebp + 0xc], 1
je 0x1e7aa26a
cmp dword [ebp + 0xc], 8
jne 0x1e7aa232
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.1e7a93bc
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a9371
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
stc
invalid
dec dword [ecx - 0x6977b]
invalid
call fcn.1e7a93ac
pop ebx
mov ch, 0x1e
retf 0xb5ff
call fcn.1e7a93ac
sbb eax, 0x80623d4d
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
add byte [eax], al
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1e7a938a
or byte [eax + 0x2ff845c6], ah
das

Function at 0x1e7aa2d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
das
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
invalid
invalid
sahf
cld
invalid
Function at 0x5053d14b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x5053d15a
pop dword [ebp - 0x24]
mov eax, 0x5053d15a
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x4ae98504
add dword [ebp - 0x34], 0x368c047
mov dword [ebp - 0x30], 0x3b667c1
sub dword [ebp - 0x30], 0xd1831b7c
mov dword [ebp - 0x2c], 0x77f1ba0a
add dword [ebp - 0x2c], 0xd45a8a24
mov dword [ebp - 0x28], 0x1954978e
add dword [ebp - 0x28], 0xe6ab6872
lea eax, [ebp - 0x34]
push eax
mov eax, 0xd69381be
sub eax, 0x8640709a
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x2a153801
add dword [ebp - 0x34], 0x4a5d3155
mov dword [ebp - 0x30], 0x31ab6e4a
add dword [ebp - 0x30], 0xfc0f32b
mov dword [ebp - 0x2c], 0xc8af07e1
add dword [ebp - 0x2c], 0x9ac0648b
mov dword [ebp - 0x28], 0x51534e9b
sub dword [ebp - 0x28], 0x51534e9b
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3579e
push 0
call eax
mov ecx, 0xa1f7e451
add ecx, 0x5e0853e4
xor edi, edi
add edi, eax
mov esi, 0x8f944b5c
add esi, 0xc0c204a4
add esi, dword [ebp - 0x24]
mov ebx, 0xbd3a8d3b
xor dword [ebp - 0x1c], esi
mov edx, dword [esi]
sub dword [ebp - 0x1c], ecx
xor edx, ebx
mov dword [ebp - 0x10], 0x2ef79d59
mov dword [edi], edx
add edi, 4
add esi, 0xa197a8ff
add esi, 0x5e685705
loop 0x5053d26e
add eax, 0xd3a7
xor ebx, ebx
add ebx, eax
add eax, 0xb8870bb7
add eax, 0x4778f44e
mov ecx, 0xd7e58efa
sub ecx, 0x87928efa
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x50540fec
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
test eax, eax
jle 0x50541011
and eax, 0xffff
or eax, 0x80070000
ret 8
Function at 0x5054eb3e
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x468
push ebx
push ebp
push esi
xor esi, esi
cmp dword [0x5055df98], esi
push edi
mov dword [esp + 0x10], esi
jne 0x5054ed0f
push 0x14
call sub.MSVCR70.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x5054eb6f
mov ecx, eax
call fcn.5054e63e
jmp 0x5054eb71
xor eax, eax
mov dword [0x5055df98], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov dword [esp + 0x14], esi
mov esi, 0x5055dfa0
push esi
call fcn.5053d14b
test eax, eax
je 0x5054ed0f
mov ebx, dword [sym.imp.MSVCR70.dll_wcscat]
push 0x505342dc
push esi
call ebx
push esi
mov edi, str.file:__
push edi
call ebx
add esp, 0x10
lea eax, [esp + 0x10]
push eax
mov eax, 0x50537848
push eax
push eax
mov ecx, 0x5055df50
call fcn.50538f90
test eax, eax
mov ebp, dword [sym.imp.MSVCR70.dll_swprintf]
jl 0x5054ec07
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x5054ec07
push dword [esp + 0x1c]
push esi
push 0x505342c4
push esi
call ebp
push dword [esp + 0x2c]
push edi
push 0x505342b8
push edi
call ebp
add esp, 0x20
mov dword [esp + 0x14], 1
jmp 0x5054ec11
push 0x505342ac
push esi
call ebx
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5054ec24
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esp + 0x10], 0
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x5054ecc7
cmp dword [esp + 0x14], 0
je 0x5054ed0f
push 0x5053429c
push edi
call dword [sym.imp.MSVCR70.dll_wcscpy]
pop ecx
pop ecx
push esi
call fcn.5053d14b
push 0x505342dc
push esi
call ebx
push esi
push edi
call ebx
push 0x505342ac
push esi
call ebx
add esp, 0x18
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5054ed0f
lea eax, [esp + 0x4c]
push eax
push edi
lea eax, [esp + 0x278]
push 0x50534290
push eax
call ebp
mov eax, dword [0x5055df98]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [esp + 0x270]
push edx
push eax
call dword [ecx + 0x20]
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindNextFileW]
test eax, eax
jne 0x5054ec8a
jmp 0x5054ed0f
lea eax, [esp + 0x4c]
push eax
push edi
lea eax, [esp + 0x278]
push 0x50534290
push eax
call ebp
mov eax, dword [0x5055df98]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [esp + 0x270]
push edx
push eax
call dword [ecx + 0x20]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.vsansi.dll_FindNextFileW]
test eax, eax
jne 0x5054ecc7
push dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, dword [0x5055df98]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x468
ret
Function at 0x5055a599
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.5055a582
and byte [esi + 0xc], 0
mov eax, 0x50530000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x5055a5f3
cmp dword [ebp - 0x18], 5
jb 0x5055a60b
jmp 0x5055a607
cmp dword [ebp - 0xc], 1
jne 0x5055a60b
cmp dword [ebp - 0x18], 4
ja 0x5055a607
jne 0x5055a60b
cmp dword [ebp - 0x14], 0
jbe 0x5055a60b
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x5055c050
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x100024e3
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x454
mov eax, dword [0x1006a1fc]
xor eax, esp
mov dword [esp + 0x450], eax
push esi
mov esi, dword [esp + 0x45c]
push edi
mov edi, dword [esp + 0x464]
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
push 0
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0x58
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call esi
push 0x5a
push dword [esp + 0x1c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x1c], xmm0
call esi
movss xmm0, dword [esp + 0x14]
mulss xmm0, dword [0x10046d40]
push 1
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm0, dword [0x10046d58]
cvttss2si eax, xmm0
mov dword [esp + 0xc], eax
imul eax, dword [esp + 0x46c], 0xa
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
divss xmm0, dword [0x10046d58]
cvttss2si eax, xmm0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DPtoLP]
movd xmm0, dword [esp + 0xc]
cvtdq2pd xmm0, xmm0
push 0x400
andps xmm0, xmmword [0x10046d60]
divsd xmm0, qword [0x10046d50]
addsd xmm0, qword [0x10046d48]
cvttsd2si eax, xmm0
neg eax
mov dword [esp + 0x20], eax
xor eax, eax
cmp dword [esp + 0x470], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
setne byte [esp + 0x35]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x34], al
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], ax
mov eax, dword [esp + 0x474]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [esp + 0x30], eax
lea eax, [esp + 0x5c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [esp + 0x5c]
push 0x10044eac
push eax
call fcn.100233a0
test eax, eax
mov ecx, 0x10044eb4
lea eax, [esp + 0x44]
cmovne ecx, edi
push ecx
push 0x20
push eax
call fcn.10037861
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [esp + 0x10]
mov esi, eax
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [esp + 0x458]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1001df6b
add esp, 0x454
ret 0x14
Function at 0x10008eeb
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x454
mov eax, dword [0x1006a1fc]
xor eax, esp
mov dword [esp + 0x450], eax
push esi
mov esi, dword [esp + 0x45c]
push edi
mov edi, dword [esp + 0x464]
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
push 0
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0x58
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call esi
push 0x5a
push dword [esp + 0x1c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x1c], xmm0
call esi
movss xmm0, dword [esp + 0x14]
mulss xmm0, dword [0x10046d40]
push 1
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm0, dword [0x10046d58]
cvttss2si eax, xmm0
mov dword [esp + 0xc], eax
imul eax, dword [esp + 0x46c], 0xa
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
divss xmm0, dword [0x10046d58]
cvttss2si eax, xmm0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DPtoLP]
movd xmm0, dword [esp + 0xc]
cvtdq2pd xmm0, xmm0
push 0x400
andps xmm0, xmmword [0x10046d60]
divsd xmm0, qword [0x10046d50]
addsd xmm0, qword [0x10046d48]
cvttsd2si eax, xmm0
neg eax
mov dword [esp + 0x20], eax
xor eax, eax
cmp dword [esp + 0x470], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
setne byte [esp + 0x35]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x34], al
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], ax
mov eax, dword [esp + 0x474]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [esp + 0x30], eax
lea eax, [esp + 0x5c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [esp + 0x5c]
push 0x10046ddc
push eax
call fcn.100233a0
test eax, eax
mov ecx, 0x10046de4
lea eax, [esp + 0x44]
cmovne ecx, edi
push ecx
push 0x20
push eax
call fcn.10037861
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [esp + 0x10]
mov esi, eax
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [esp + 0x458]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1001df6b
add esp, 0x454
ret 0x14
Function at 0x1000cf1a
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x1006a1fc]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push ebx
push dword [edi]
call fcn.10037861
mov esi, eax
test esi, esi
jne 0x1000cfc9
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000cfa4
lea eax, [esp + 0x28]
push eax
call fcn.1000cf1a
mov esi, eax
test esi, esi
jne 0x1000cfc9
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x30]
mov dword [esp + 0x30], 0x100
call ebp
lea ecx, [esp + 0x14]
test eax, eax
je 0x1000cf7f
call fcn.10003fa0
push ebx
mov ecx, edi
call fcn.1000c8c8
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.10003fa0
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001df6b
add esp, 0x11c
ret 4
Function at 0x1000e480
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
mov eax, 0x114c
call fcn.1001e1d0
mov eax, dword [0x1006a1fc]
xor eax, esp
mov dword [esp + 0x1148], eax
push ebx
mov ebx, dword [esp + 0x1154]
lea eax, [esp + 0x14c]
push ebp
push esi
push edi
mov ebp, 0x800
xor esi, esi
push ebp
push esi
push eax
mov dword [esp + 0x1c], esi
call fcn.10020dd0
push ebp
lea eax, [esp + 0x968]
push esi
push eax
call fcn.10020dd0
push str.SOFTWAREMozillaMozilla_Firefox
lea eax, [esp + 0x174]
mov dword [esp + 0x30], ebp
push ebp
push eax
call fcn.10037861
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0x34]
add esp, 0x24
push eax
lea eax, [esp + 0x15c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x1000e532
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x95c]
push eax
push esi
push esi
push 0x1004a76c
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
test eax, eax
je 0x1000e54d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x1158]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001df6b
add esp, 0x114c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [esp + 0x958]
push eax
lea eax, [esp + 0x15c]
push str.SOFTWAREMozillaMozilla_Firefox_sMain
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x15c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x1000e532
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x800
push eax
push ebx
xor ebp, ebp
push ebp
push ebp
push 0x1004a7a8
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
test eax, eax
je 0x1000e5b7
call esi
jmp 0x1000e532
call esi
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000e5be
sub ecx, edx
cmp byte [ecx + ebx - 1], 0x5c
je 0x1000e5e2
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000e5d1
mov ax, word [0x1004a7bc]
mov word [edi], ax
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000e5e5
mov esi, str.extensions
lea eax, [esp + 0x18]
push eax
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x1000e619
push ebp
push ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000e62b
jmp 0x1000e532
push eax
call dword [sym.imp.kernel32.dll_FindClose]
test byte [esp + 0x18], 0x10
je 0x1000e532
xor eax, eax
inc eax
jmp 0x1000e534
Function at 0x1000e633
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x10c4]
mov eax, 0x1144
call fcn.1001e1d0
mov eax, dword [0x1006a1fc]
xor eax, ebp
mov dword [ebp + 0x10c0], eax
push esi
push edi
mov edi, dword [ebp + 0x10cc]
lea eax, [ebp - 0x80]
push 0x140
push 0
push eax
call fcn.10020dd0
push edi
lea eax, [ebp + 0xc0]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xc0]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000e753
lea eax, [ebp - 0x54]
push 0x1004a7ec
push eax
call fcn.10037861
pop ecx
pop ecx
test eax, eax
je 0x1000e71f
lea eax, [ebp - 0x54]
push 0x1004a7f0
push eax
call fcn.10037861
pop ecx
pop ecx
test eax, eax
je 0x1000e71f
lea eax, [ebp - 0x54]
push eax
push edi
lea eax, [ebp + 0x8c0]
push 0x1004a7f4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x80]
add esp, 0x10
and eax, 0xfffffffe
push eax
lea eax, [ebp + 0x8c0]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test byte [ebp - 0x80], 0x10
lea eax, [ebp + 0x8c0]
push eax
jne 0x1000e719
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x1000e71f
push eax
lea eax, [ebp + 0x8c0]
push eax
call fcn.1000b54d
pop ecx
jmp 0x1000e71e
call fcn.1000e633
pop ecx
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x1000e69c
push esi
call dword [sym.imp.kernel32.dll_FindClose]
push edi
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
mov esi, eax
test esi, esi
jne 0x1000e74f
push eax
push edi
call fcn.1000b54d
pop ecx
pop ecx
mov eax, esi
jmp 0x1000e756
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x10c0]
pop edi
xor ecx, ebp
pop esi
call fcn.1001df6b
add ebp, 0x10c4
leave
ret

Function at 0x100117ed
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, 0x8c
test esi, esi
lea edx, [esi + 0xc]
cmove edx, eax
push edx
mov eax, dword [edx]
call dword [eax + 0x18]
push 0x58
test esi, esi
lea eax, [esi - 0x28]
pop ecx
cmove eax, ecx
pop esi
cmp dword [eax], 0
je 0x1001181e
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 8
Function at 0x100153fb
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x974
mov eax, dword [0x1006a1fc]
xor eax, esp
mov dword [esp + 0x970], eax
push ebx
push ebp
xor ebp, ebp
mov ebx, 0x400
push esi
mov esi, dword [esp + 0x99c]
inc ebp
push edi
mov edi, dword [esp + 0x988]
test esi, esi
jne 0x10015452
push ebx
lea eax, [esp + 0x584]
push eax
push ebp
push edi
call fcn.1001a9f6
add esp, 0x10
test eax, eax
je 0x10015452
mov eax, str._s_ssvagent.exe
lea esi, [esp + 0x580]
jmp 0x10015467
test edi, edi
jne 0x100155b7
test esi, esi
je 0x100155b7
mov eax, str._s_bin_ssvagent.exe
push esi
push eax
lea eax, [esp + 0x188]
push ebx
push eax
call fcn.100082eb
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x194]
push eax
call fcn.10037861
add esp, 0x18
test eax, eax
jne 0x100155b7
cmp dword [esp + 0x98c], 0
mov ecx, str.__new
mov byte [esp + 0x7c], al
mov ebx, 0x104
mov eax, str.__old
cmovne eax, ecx
push eax
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.10037861
mov edi, dword [esp + 0x99c]
add esp, 0xc
mov esi, dword [esp + 0x99c]
test edi, edi
jne 0x100154da
test esi, esi
je 0x100154f0
push str.__high
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.10037861
add esp, 0xc
cmp dword [esp + 0x998], 0
je 0x10015510
push str.__settreatas
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.10037861
add esp, 0xc
test esi, esi
je 0x1001552a
push str.__regdeploy
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.10037861
add esp, 0xc
push 0x3c
pop esi
push esi
lea eax, [esp + 0x14]
push 0
push eax
call fcn.10020dd0
add esp, 0xc
mov dword [esp + 0x10], esi
lea eax, [esp + 0x7c]
mov dword [esp + 0x24], eax
test edi, edi
je 0x10015562
call fcn.10037861
test eax, eax
mov ecx, str.runas
cmove ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x994], 0
push 0x40
pop ecx
cmovne eax, ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x14], eax
lea eax, [esp + 0x180]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x100155b7
cmp dword [esp + 0x48], 0
je 0x100155b3
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [esp + 0x48]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, ebp
jmp 0x100155b9
xor eax, eax
mov ecx, dword [esp + 0x980]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001df6b
add esp, 0x974
ret