joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10b0910
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebx + 4]
mov dword [ebp - 4], 0x10
cmp dword [edi + 0x18], 0
lea eax, [ebp - 0x30]
push 0x10045a8
push eax
jne 0x10b0959
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [ebp + eax*2 - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x10b0972
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [edi + 0x18]
push dword [eax + 0x34]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
mov esi, dword [ebp + 0xc]
and dword [esi + 0x38], 0
and dword [esi + 0x3c], 0
lea eax, [ebp + 8]
push eax
push 0x80000002
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
jne 0x10b0a50
mov eax, dword [edi + 0x5c]
mov eax, dword [eax]
cmp eax, 5
jne 0x10b09f9
mov eax, dword [ebx + 0x14]
cmp word [eax + 0x1a], 0
jne 0x10b09e8
mov ebx, 0x10020dc
push ebx
mov edi, 0x1012550
push edi
push 0x10124d0
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call fcn.010b07ce
add dword [esi + 0x38], eax
push ebx
push edi
adc dword [esi + 0x3c], edx
push 0x1012448
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call fcn.010b07ce
add dword [esi + 0x38], eax
adc dword [esi + 0x3c], edx
push 0x1012428
push 0x1012410
push 0x1012390
jmp 0x10b0a35
cmp eax, 6
jne 0x10b0a47
mov eax, dword [ebx + 0x14]
cmp word [eax + 0x1a], 0
mov edi, 0x1012318
jne 0x10b0a2a
push 0x10020dc
push 0x10122f4
push edi
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call fcn.010b07ce
add dword [esi + 0x38], eax
adc dword [esi + 0x3c], edx
push 0x1012428
push 0x10122c4
push edi
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call fcn.010b07ce
add dword [esi + 0x38], eax
adc dword [esi + 0x3c], edx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10b0c5f
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10b0c7b
mov si, 0xfe05
jmp 0x10b0cae
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10b0c92
cmp dword [ebp - 0x18], 2
jne 0x10b0cab
call fcn.0106e781
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xb4
jl 0x10b0c7d
xor si, si
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ax, si
pop esi
leave
ret
Function at 0x10b1ccc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
cmp dword [ebp + 0x10], 0
je 0x10b1d79
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x668]
push 0x1004284
push eax
call esi
push dword [ebp + 0x14]
lea eax, [ebp - 0x668]
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10b1d78
push ebx
push edi
mov edi, dword [ebp + 8]
test byte [ebp - 0x250], 0x10
jne 0x10b1d55
mov edx, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x234]
xor eax, eax
xor ebx, ebx
or eax, edx
or ecx, ebx
add dword [edi], eax
adc dword [edi + 4], ecx
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10b1d71
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
cmp esi, 0xffffffff
jne 0x10b1d33
pop edi
pop ebx
pop esi
leave
ret 0x10
Function at 0x10b3985
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
mov esi, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x7c]
push dword [eax + 0x18]
mov dword [ebp - 4], ebx
push dword [edi + 0xc]
push edi
call fcn.010a7a67
test ax, ax
je 0x10b39b6
or ax, 0xffff
jmp 0x10b3a3f
push ebx
push 0x2000080
push 3
push ebx
push 1
push 0x80000000
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x80], eax
je 0x10b3a2e
mov ecx, dword [edi + 0x14]
mov ebx, 0x4000000
test dword [ecx + 0x9c], ebx
jne 0x10b39fd
lea ecx, [esi + 0x70]
push ecx
lea ecx, [esi + 0x68]
push ecx
lea ecx, [esi + 0x60]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [esi + 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x10b3a15
mov esi, 0x80
mov eax, dword [edi + 0x14]
test dword [eax + 0x9c], ebx
jne 0x10b3a35
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x10b3a35
mov dword [ebp - 4], 0xfffffe05
push edi
call fcn.010a7422
mov ax, word [ebp - 4]
pop esi
pop ebx
leave
ret

Function at 0x10b3a43
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
push edi
mov esi, eax
mov eax, dword [esi + 0x7c]
mov eax, dword [eax + 0x18]
lea ecx, [ebp - 4]
push ecx
push edi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.010a7a67
test ax, ax
je 0x10b3a71
or ax, 0xffff
jmp 0x10b3aa2
mov eax, dword [ebp - 4]
cmp word [eax + 6], di
je 0x10b3a97
mov esi, dword [esi + 0x40]
cmp esi, edi
jne 0x10b3a86
mov esi, 0x80
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x10b3a97
mov edi, 0xfffffe05
push dword [ebp + 8]
call fcn.010a7422
mov ax, di
pop edi
pop esi
leave
ret 4

Function at 0x10b3e85
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0
push 0
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x7c]
push dword [eax + 0x18]
push dword [esi + 0xc]
push esi
call fcn.010a7a67
test ax, ax
je 0x10b3eb2
or ax, 0xffff
jmp 0x10b3ee7
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
test eax, eax
jne 0x10b3edc
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x10b3edc
mov dword [ebp - 4], 0xfffffe05
push esi
call fcn.010a7422
mov ax, word [ebp - 4]
pop edi
leave
ret 4
Function at 0x10b3eeb
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x18]
push esi
xor esi, esi
push esi
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.010a7a67
test ax, ax
je 0x10b3f16
or ax, 0xffff
jmp 0x10b3f4a
push edi
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call edi
test eax, eax
jne 0x10b3f3e
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x10b3f3e
mov esi, 0xfffffe05
push dword [ebp + 8]
call fcn.010a7422
mov ax, si
pop edi
pop esi
leave
ret 4

Function at 0x10b419e
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
push esi
mov esi, dword [eax + 0x270]
xor ecx, ecx
push edi
push ecx
push 1
push dword [esi + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov word [esi + 8], 1
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x10b41ec
push 0
push dword [esi]
call edi
test eax, eax
je 0x10b41fa
call fcn.0106e781
push 0x64
push dword [esi + 0x10]
call edi
cmp eax, 0x102
je 0x10b41dd
push 0x1388
push dword [esi]
call edi
cmp eax, 0x102
jne 0x10b4216
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x10b422c
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 8], 0
je 0x10b4233
mov dword [ebp - 4], 0xfffffe36
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CloseEncryptedFileRaw]
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 0xc]
call edi
push dword [esi + 0x10]
call edi
push esi
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0xc]
and dword [eax + 0x270], 0
cmp word [ebp - 4], 0
pop ecx
pop edi
pop esi
jne 0x10b4288
mov eax, dword [ebp - 0x10]
cmp byte [eax], 9
push 1
push eax
push ebx
push dword [ebx]
jne 0x10b4280
call fcn.010a123f
jmp 0x10b4285
call fcn.010a0d44
mov dword [ebp - 4], eax
mov ax, word [ebp - 4]
leave
ret
Function at 0x10b43ab
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0x14]
push ebx
mov ebx, eax
mov eax, dword [ebx]
push esi
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
push edi
xor edi, edi
mov dword [ebx], edi
inc ecx
mov dword [eax], ecx
cmp dword [edx], edi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xc], edi
mov esi, dword [eax + 0x270]
mov dword [ebp - 4], edi
mov dword [ebp + 0x10], eax
je 0x10b4436
cmp dword [esi], edi
jne 0x10b4422
mov ebx, dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push edi
push ecx
push edi
push edi
call ebx
push edi
push 1
push edi
push edi
mov dword [esi + 0xc], eax
call ebx
mov dword [esi + 0x10], eax
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push 0x10b4188
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi], eax
jne 0x10b4422
mov ax, 0xfe30
jmp 0x10b44cd
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0x4445544e
je 0x10b44c9
jmp 0x10b44be
xor ecx, ecx
mov dword [ebp + 0x14], ecx
cmp ecx, dword [ebp - 8]
je 0x10b449d
mov eax, dword [ebp + 0xc]
add eax, ecx
push edi
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 8]
push 1
push dword [esi + 0xc]
sub eax, ecx
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0x64
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10b4482
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10b4490
call fcn.0106e781
jmp 0x10b445c
mov eax, dword [esi + 0x18]
add dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
jmp 0x10b443b
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 4], 0xfffffe30
cmp word [ebp - 4], di
mov dword [ebx], ecx
jne 0x10b44c9
test byte [eax + 0x228], 4
je 0x10b44c9
mov edx, dword [eax + 0x238]
sub edx, dword [eax + 0x230]
cmp ecx, edx
jne 0x10b44c9
mov ebx, dword [ebp + 8]
call fcn.010b419e
mov dword [ebp - 4], eax
mov ax, word [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10b9cd8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x23e0], 0
jg 0x10b9cfa
mov dword [ebp - 4], 0xfffffdf3
jmp 0x10b9dee
push esi
mov esi, dword [ebp + 0xc]
push edi
push dword [ebx]
mov edi, dword [sym.imp.msvcrt.dll_fread]
push 1
push 0x11
push esi
call edi
add esp, 0x10
cmp eax, 1
je 0x10b9d22
mov dword [ebp - 4], 0xfffffdf3
jmp 0x10b9dec
movzx eax, word [esi + 0xc]
lea ecx, [ebx + 0x2040]
cmp eax, dword [ecx]
jbe 0x10b9d4a
push eax
push ecx
lea eax, [ebx + 0x2044]
push eax
call fcn.010b95e6
test ax, ax
mov dword [ebp - 4], eax
jne 0x10b9dec
push dword [ebx]
movzx ecx, word [esi + 0xc]
mov eax, dword [ebx + 0x2044]
push ecx
push 1
push eax
mov dword [ebp - 8], eax
call edi
movzx ecx, word [esi + 0xc]
add esp, 0x10
cmp ecx, eax
jne 0x10b9d16
movzx eax, word [esi + 0xe]
cmp eax, 1
lea edx, [ebx + 0x2058]
mov ecx, dword [edx]
mov edi, ecx
mov dword [ebp + 8], edi
jle 0x10b9d90
dec eax
jmp 0x10b9d84
inc edi
cmp byte [edi], 0
jne 0x10b9d83
inc edi
dec eax
jne 0x10b9d84
mov dword [ebp + 8], edi
mov eax, edi
sub eax, ecx
lea ecx, [ebx + 0x2054]
mov dword [ecx], eax
movzx edi, word [esi + 0xc]
lea eax, [edi + eax + 1]
mov dword [ecx], eax
lea ecx, [ebx + 0x205c]
cmp eax, dword [ecx]
jbe 0x10b9dc0
push eax
push ecx
push edx
call fcn.010b95e6
test ax, ax
mov dword [ebp - 4], eax
jne 0x10b9dec
movzx ecx, word [esi + 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx eax, word [eax + 0xc]
mov ecx, dword [ebp + 8]
and byte [eax + ecx], 0
dec dword [ebx + 0x23e0]
pop edi
pop esi
mov ax, word [ebp - 4]
pop ebx
leave
ret 8
Function at 0x10bb2c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ax, word [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
cmp word [esi + 0x394], ax
mov ebx, dword [esi + 0xf0]
push edi
mov dword [ebp + 8], ebx
jae 0x10bb34d
mov dx, word [esi + 0x394]
add dx, 0x200
cmp dx, ax
mov cx, dx
jb 0x10bb2e6
movzx eax, cx
push 1
push eax
mov word [esi + 0x394], dx
call dword [sym.imp.msvcrt.dll_calloc]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x10bb317
mov ax, 0xfdfc
jmp 0x10bb3cb
mov ax, word [esi + 0x39c]
test ax, ax
je 0x10bb337
movzx eax, ax
push eax
push dword [esi + 0x398]
push ebx
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
lea edi, [esi + 0x390]
push dword [edi]
call dword [sym.imp.msvcrt.dll_free]
mov dword [edi], ebx
mov ebx, dword [ebp + 8]
pop ecx
jmp 0x10bb372
mov ax, word [esi + 0x39c]
test ax, ax
je 0x10bb372
movzx eax, ax
push eax
push dword [esi + 0x398]
push dword [esi + 0x390]
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
movzx eax, word [esi + 0x39c]
movzx edi, word [esi + 0x394]
mov ecx, dword [esi + 0x390]
push ebx
sub edi, eax
push edi
add ecx, eax
push 1
push ecx
mov dword [esi + 0x398], ecx
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, edi
je 0x10bb3b5
mov ebx, dword [ebx + 0xc]
test bl, 0x20
jne 0x10bb3af
test bl, 0x10
jne 0x10bb3b5
mov ax, 0xfde7
jmp 0x10bb3cb
mov ecx, dword [esi + 0x390]
add word [esi + 0x39c], ax
mov dword [esi + 0x398], ecx
xor ax, ax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10bb9e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x1012f48
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10bba40
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x1012f84
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10bba33
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10bba42
xor eax, eax
pop esi
leave
ret 4

Function at 0x10bbd8b
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov esi, 0x10045a8
lea edi, [ebp - 0x30]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x2a]
mov ecx, 7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
push edi
call sub.RPCRT4.dll_RpcNetworkIsProtseqValidW
test eax, eax
je 0x10bbdc1
xor eax, eax
jmp 0x10bbeaf
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x10bbdd3
cmp word [ebx], 0x5c
jne 0x10bbdd3
add ebx, 2
jne 0x10bbdc8
push 0x10133c0
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push edi
call esi
add esp, 8
test eax, eax
jne 0x10bbe2a
test ebx, ebx
je 0x10bbe11
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0xc], 0x10
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [ebp - 0x50]
push ecx
push ebx
call esi
add esp, 8
test eax, eax
jne 0x10bbe23
xor ebx, ebx
mov eax, dword [ebp + 0x10]
cmp eax, dword [0x10d0b88]
jne 0x10bbe63
mov eax, 0x1013348
jmp 0x10bbe77
xor eax, eax
jmp 0x10bbeaf
push 0x10133ac
push edi
call esi
add esp, 8
test eax, eax
jne 0x10bbe11
test ebx, ebx
je 0x10bbe11
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 4
cmp eax, 0xf
ja 0x10bbe5f
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ebx, [ebp - 0x30]
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 8
jmp 0x10bbe11
xor eax, eax
jmp 0x10bbeaf
mov eax, dword [0x10d0b90]
cmp dword [ebp + 0x10], eax
mov eax, 0x1013358
je 0x10bbe77
mov eax, 0x1013368
lea ecx, [ebp - 4]
push ecx
push eax
call sub.RPCRT4.dll_UuidToStringW
mov esi, eax
test esi, esi
jne 0x10bbea8
lea eax, [ebp - 8]
push eax
push 0
push 0
push ebx
push edi
push dword [ebp - 4]
call sub.RPCRT4.dll_RpcStringBindingComposeW
mov esi, eax
lea eax, [ebp - 4]
push eax
call sub.RPCRT4.dll_RpcStringFreeW
test esi, esi
je 0x10bbeac
xor eax, eax
jmp 0x10bbeaf
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10bc121
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [ebp - 0xc], edi
cmp dword [ebp + 0x10], edi
je 0x10bc174
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 4
lea ebx, [eax + 1]
lea eax, [ebx*2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x10bc164
xor eax, eax
jmp 0x10bc271
push dword [ebp + 0x10]
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 8
sub dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
mov word [ebx], 0
push eax
push 0x20019
push 0
push dword [0x1013384]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10bc24b
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 0xc]
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 4]
push 0
lea eax, [ebp - 0x210]
push edx
inc dword [ebp - 0xc]
mov dword [ebp - 4], pe_nt_image_headers32
push eax
push ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10bc242
push 4
mov eax, dword [ebp - 4]
push dword [ebp + eax*2 - 0x212]
call dword [sym.imp.ntdll.dll_iswctype]
add esp, 8
test eax, eax
je 0x10bc200
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x210], 0
test edi, edi
je 0x10bc207
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, edi
inc eax
cmp eax, dword [ebp + 0xc]
ja 0x10bc242
test edi, edi
je 0x10bc21d
mov word [ebx + edi*2], 0x2c
inc edi
lea eax, [ebp - 0x210]
lea ecx, [ebx + edi*2]
push eax
push ecx
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 8
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 4
mov edi, eax
jmp 0x10bc1a7
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10bc26f
test edi, edi
je 0x10bc25a
mov word [ebx + edi*2], 0x2c
inc edi
push esi
lea eax, [ebx + edi*2]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10bc278
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0xc], 1
push ebx
lea eax, [ebp - 4]
push esi
xor ebx, ebx
push edi
lea esi, [ebp - 0x28c]
push eax
mov dword [ebp - 4], ebx
push 0x20019
push ebx
push dword [0x1013380]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10bc2d9
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push esi
push edx
mov eax, dword [0x1013378]
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10bc2ef
mov eax, dword [0x1013388]
lea ecx, [ebp - 0x28c]
push eax
push ecx
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 8
cmp dword [ebp - 4], 0
je 0x10bc2fe
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x28c]
lea edi, [ebp - 0x8c]
mov dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
cmp edi, eax
jae 0x10bc3c9
push 0x2c
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
add esp, 8
mov esi, eax
test esi, esi
je 0x10bc339
mov word [esi], 0
add esi, 2
mov eax, dword [0x101337c]
push eax
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x10bc38b
push esi
lea eax, [ebp - 0x28c]
push pe_nt_image_headers32
push eax
call fcn.010bc121
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x10bc3be
test ebx, ebx
je 0x10bc382
lea esi, [ebp - 0x8c]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
add esi, 4
dec ebx
jne 0x10bc374
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 4
lea eax, [eax*2 + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [edi], eax
test eax, eax
je 0x10bc36a
add edi, 4
inc ebx
push dword [ebp - 8]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 8
mov dword [ebp - 8], esi
test esi, esi
jne 0x10bc314
lea eax, [ebx*4]
push eax
mov dword [ebp - 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp + 8]
mov edi, eax
test edi, edi
mov dword [ecx + 0x14], eax
je 0x10bc36a
mov eax, dword [ebp - 8]
lea esi, [ebp - 0x8c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov eax, 4
lea edx, [ebp - 4]
mov dword [ebp - 0x10], eax
push edx
mov dword [ecx + 0x10], ebx
push 0x20019
mov dword [ebp - 0xc], eax
push 0
push dword [0x101338c]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10bc45f
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0xc]
push ecx
mov eax, dword [0x1013390]
push edx
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10bc45f
cmp dword [ebp - 0x14], 1
sbb eax, eax
mov ecx, dword [ebp + 8]
neg eax
mov dword [ecx + 0x18], eax
cmp dword [ebp - 4], 0
je 0x10bc46e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x10bc384
Function at 0x4085a0
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov ecx, dword [eax + 0x3c]
xor ebp, ebp
add eax, ecx
push edi
mov cx, word [eax + 6]
lea edi, [eax + 0xf8]
movsx ebx, cx
test ebx, ebx
jle 0x408637
mov esi, dword [esp + 0x1c]
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4085ea
test cl, cl
je 0x4085e6
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4085ea
add eax, 2
add esi, 2
test cl, cl
jne 0x4085c6
xor eax, eax
jmp 0x4085ef
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408600
add edi, 0x28
inc ebp
cmp ebp, ebx
jl 0x4085c0
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebx, dword [edi + 0x10]
mov esi, dword [edi + 0xc]
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x14]
push eax
add esi, edi
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
push esi
call fcn.00408550
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret