joyce8/EMBER2024-capa huggingface dataset:
Function at 0xfd0dc
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x12
push 0
push 0
dec ecx
jne 0xfd0e4
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xfd377
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0xfd30b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x6c]
mov eax, 0xfd388
call fcn.00031d88
lea eax, [ebp - 0x6c]
mov edx, ebx
call fcn.00013ed4
mov eax, dword [ebp - 0x6c]
mov edx, dword [ebp - 4]
call fcn.000fafd8
lea eax, [ebp - 0xc]
call fcn.000295cc
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x44
call fcn.00012b94
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.00012b94
mov dword [ebp - 0x68], 0x44
mov word [ebp - 0x38], 0
mov dword [ebp - 0x3c], 1
push dword [ebp - 0xc]
lea edx, [ebp - 0x70]
mov eax, 0xfd398
call fcn.00031d88
push dword [ebp - 0x70]
push ebx
lea edx, [ebp - 0x74]
mov eax, 0xfd3bc
call fcn.00031d88
push dword [ebp - 0x74]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00013f8c
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xfd2fa
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00030064
xor eax, eax
push ebp
push 0xfd213
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00014090
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xfd21a
call fcn.000300cc
ret

Function at 0xfd564
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0xfd5dd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x2a759c], 0
je 0xfd5c7
lea eax, [ebp - 8]
mov ecx, ebx
mov edx, dword [0x2a75d4]
call fcn.000145b4
mov eax, dword [ebp - 8]
call fcn.00014538
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
push edi
push esi
mov eax, dword [0x2a759c]
push eax
call sub.advapi32.dll_ReportEventW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xfd5e4
lea eax, [ebp - 8]
call fcn.00014314
ret
Function at 0x113aec
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x113afb
add esp, 0xfffffff0
call fcn.00013214
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.0005d17c
mov dl, 1
mov eax, dword [0x47500]
call fcn.00047774
mov dword [edi + 0x34], eax
mov dl, 1
mov eax, dword [0x47500]
call fcn.00047774
mov dword [edi + 0x64], eax
mov dl, 1
mov eax, dword [0x38fec]
call fcn.00012ee4
mov dword [edi + 0x48], eax
mov dl, 1
mov eax, dword [0x38fec]
call fcn.00012ee4
mov dword [edi + 0x5c], eax
mov dl, 1
mov eax, dword [0x57bf4]
call fcn.0005c6ac
mov esi, eax
mov dword [edi + 0x1c], esi
mov dword [esi + 0x1cc], edi
mov byte [esi + 0x92], 1
mov edx, 0x10000
mov eax, esi
call fcn.0005a87c
mov edx, 0x10000
mov eax, dword [edi + 0x1c]
call fcn.0005a8a4
mov dword [edi + 0xc], 0x15f90
lea eax, [edi + 0x10]
mov edx, 0x113c28
call fcn.00013c90
lea eax, [edi + 0x28]
call fcn.00013c3c
lea eax, [edi + 0x74]
mov edx, 0x113c34
call fcn.00013c90
lea eax, [edi + 0x58]
call fcn.00013c3c
lea eax, [edi + 0x40]
call fcn.00013c3c
lea eax, [edi + 0x30]
call fcn.00013c3c
lea eax, [edi + 0x20]
call fcn.00013c3c
lea eax, [edi + 0x6c]
mov edx, 0x113c40
call fcn.00013c90
mov byte [edi + 0x2c], 1
mov byte [edi + 0x3c], 0
lea eax, [edi + 0x50]
mov edx, 0x113c4c
call fcn.00013c90
xor eax, eax
mov dword [edi + 0x60], eax
xor eax, eax
mov dword [edi + 0x38], eax
mov byte [edi + 0x70], 1
mov dword [edi + 0x7c], 0x12c
mov eax, edi
call fcn.00113cc8
mov eax, edi
test bl, bl
je 0x113c17
call fcn.0001326c
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x11712c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x117156
cmp dword [ebx + 0x64], 0
jne 0x117156
cmp dword [ebx + 0x6c], 0
jne 0x117156
mov esi, edi
jmp 0x1171e4
cmp esi, 0xffffffff
jne 0x117161
dec esi
jmp 0x1171e4
mov eax, dword [ebx + 0x64]
lea edx, [edi + edi]
sub edx, 0x106
cmp eax, edx
jb 0x1171e4
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ebp, edi
mov ecx, ebp
call fcn.0001ff00
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x1171ac
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x1171b1
mov word [edx], 0
dec eax
test eax, eax
jne 0x117192
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x1171d8
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x1171dd
mov word [edx], 0
dec eax
test eax, eax
jne 0x1171be
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x117242
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.00116ec0
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x11722d
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x117242
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x117136
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x118448
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x118569
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x118580
call fcn.00013c90
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x118547
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
lea eax, [ebp - 0xc]
call fcn.00025330
mov eax, dword [ebp - 0xc]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x118501
push 6
push 0x2a82dc
push 3
push 0
push 0x118588
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
test ebx, ebx
je 0x118525
push ebp
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0002b100
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x1185a4
call fcn.00013f18
mov eax, dword [ebp - 0x10]
call fcn.001183b8
pop ecx
jmp 0x118525
push ebp
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0002b100
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x1185bc
call fcn.00013f18
mov eax, dword [ebp - 0x18]
call fcn.001183b8
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x11854e
cmp dword [ebp - 8], 0
je 0x118541
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret

Function at 0x118954
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x118a19
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x1189fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
call fcn.00025330
mov eax, dword [ebp - 0x10]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x1189da
mov dword [ebp - 4], ebx
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x118a28
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x118a03
cmp dword [ebp - 8], 0
je 0x1189f6
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret
Function at 0x118a38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x118b17
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x118afa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x118ad8
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x118b28
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x118ad8
cmp dword [ebp - 8], 4
jne 0x118ad8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x118b01
cmp dword [ebp - 0xc], 0
je 0x118af4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret

Function at 0x118b38
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x118c47
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, esi
mov edx, 0x118c60
call fcn.00013f18
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00013cd4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x118c1d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x118bf3
mov eax, dword [ebp - 0x14]
call fcn.00013ecc
inc eax
push eax
mov eax, dword [ebp - 0x14]
call fcn.00014090
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00014090
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
jmp 0x118bfb
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x118c24
cmp dword [ebp - 0xc], 0
je 0x118c17
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x1192d8
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x1193b9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x11939c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
call fcn.00025330
mov eax, dword [ebp - 0x10]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x11937a
push 0x1193c8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov ebx, 0x104
push ebx
mov eax, dword [0x31f640]
call fcn.00014090
push eax
push 1
push 0
push 0x1193d4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1193a3
cmp dword [ebp - 8], 0
je 0x119396
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret

Function at 0x1197f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x1198cd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x1198b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x11988e
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x1198dc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x11988e
cmp dword [ebp - 0x14], 4
jne 0x11988e
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1198b7
cmp dword [ebp - 0xc], 0
je 0x1198aa
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x1198f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1199bd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x1199a0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 1
push 0
push 0
lea eax, [ebp - 0x14]
call fcn.00025330
mov eax, dword [ebp - 0x14]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x11997e
mov dword [ebp - 0x10], ebx
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x1199cc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1199a7
cmp dword [ebp - 0xc], 0
je 0x11999a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x11e110
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x11e1ea
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x11e204
push edi
push 0x11e218
lea eax, [ebp - 4]
mov edx, 3
call fcn.00013f8c
cmp byte [ebx + 0x30], 0
je 0x11e179
test esi, esi
jle 0x11e179
push dword [ebp - 4]
push 0x11e224
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 8]
call fcn.0002b0cc
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00013f8c
cmp byte [ebx + 0x38], 0
je 0x11e19d
lea eax, [ebp - 0xc]
call fcn.0011ca40
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00013ed4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x10]
mov ecx, 0x11e234
mov edx, dword [ebp - 4]
call fcn.00013f18
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, ebx
call fcn.0011cbf4
mov ecx, 0x64
cdq
idiv ecx
cmp eax, 2
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x11e1f1
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00013c60
ret

Function at 0x11e808
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x11e81e
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x11e817
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x11e830
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x11e829
mov eax, esp
lea esi, [edx + 1]
dec esi
test esi, esi
jl 0x11e84c
inc esi
mov edx, ecx
mov ecx, dword [ebp + 0xc]
mov bl, byte [eax]
xor bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
inc eax
dec esi
jne 0x11e840
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x120f50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x121031
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 2
xor eax, eax
push ebp
push 0x121014
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x120ff2
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x121040
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x120ff2
cmp dword [ebp - 8], 4
jne 0x120ff2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x12101b
cmp dword [ebp - 0xc], 0
je 0x12100e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x121060
Capabilities:
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x121068
push ecx
push ebx
xor eax, eax
push ebp
push 0x121276
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x12124c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x121288
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x12122a
lea edx, [ebp - 0x10]
mov eax, 0x1212c0
call fcn.00031d88
push dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
call fcn.0002b6e4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0002b220
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
call fcn.00027f5c
mov edx, dword [ebp - 0x20]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0002b220
push dword [ebp - 0x14]
lea eax, [ebp - 0x24]
call fcn.0002782c
push dword [ebp - 0x24]
lea edx, [ebp - 0x28]
mov eax, 0x1212c4
call fcn.00031d88
push dword [ebp - 0x28]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00013f8c
mov eax, dword [ebp - 8]
call fcn.00013ecc
mov ebx, eax
inc ebx
push ebx
mov eax, dword [ebp - 8]
call fcn.00014090
push eax
push 1
push 0
push 0x1212d0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
lea edx, [ebp - 0x2c]
mov eax, 0x1212c0
call fcn.00031d88
push dword [ebp - 0x2c]
lea eax, [ebp - 0x38]
call fcn.0002b6e4
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0002b220
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3c]
call fcn.00027f5c
mov edx, dword [ebp - 0x3c]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.0002b220
push dword [ebp - 0x30]
lea eax, [ebp - 0x40]
call fcn.000ad128
push dword [ebp - 0x40]
lea edx, [ebp - 0x44]
mov eax, 0x1212c0
call fcn.00031d88
push dword [ebp - 0x44]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00013f8c
mov eax, dword [ebp - 8]
call fcn.00013ecc
mov ebx, eax
inc ebx
push ebx
mov eax, dword [ebp - 8]
call fcn.00014090
push eax
push 1
push 0
lea edx, [ebp - 0x4c]
mov eax, 0x1212dc
call fcn.00031d88
push dword [ebp - 0x4c]
lea eax, [ebp - 0x50]
call fcn.0002782c
push dword [ebp - 0x50]
lea edx, [ebp - 0x54]
mov eax, 0x1212dc
call fcn.00031d88
push dword [ebp - 0x54]
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.00013f8c
mov eax, dword [ebp - 0x48]
call fcn.00014090
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x121253
cmp dword [ebp - 0xc], 0
je 0x121246
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x1212e0
Capabilities:
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x1212e8
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x1214a3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x121471
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x1214b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x12144f
lea eax, [ebp - 0x10]
mov ecx, 0x1214f0
mov edx, ebx
call fcn.000145b4
mov eax, dword [ebp - 0x10]
call fcn.00014548
inc eax
mov ebx, eax
add ebx, ebx
push ebx
mov eax, dword [ebp - 0x10]
call fcn.00014538
push eax
push 1
push 0
push 0x1214f4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
mov dword [ebp - 4], eax
lea edx, [ebp - 0x14]
mov eax, 0x121508
call fcn.00031d88
push dword [ebp - 0x14]
lea eax, [ebp - 0x20]
call fcn.0002b6e4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0002b220
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
call fcn.00027f5c
mov edx, dword [ebp - 0x24]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0002b220
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
call fcn.000ad128
push dword [ebp - 0x28]
lea edx, [ebp - 0x2c]
mov eax, 0x121508
call fcn.00031d88
push dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00013f8c
mov eax, dword [ebp - 0xc]
call fcn.00013ecc
mov ebx, eax
inc ebx
push ebx
mov eax, dword [ebp - 0xc]
call fcn.00014090
push eax
push 1
push 0
lea edx, [ebp - 0x34]
mov eax, 0x12150c
call fcn.00031d88
push dword [ebp - 0x34]
lea eax, [ebp - 0x38]
call fcn.0002782c
push dword [ebp - 0x38]
lea edx, [ebp - 0x3c]
mov eax, 0x12150c
call fcn.00031d88
push dword [ebp - 0x3c]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00013f8c
mov eax, dword [ebp - 0x30]
call fcn.00014090
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x121478
cmp dword [ebp - 8], 0
je 0x12146b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret