joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002a46
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov edi, ecx
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x101ece94]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x10002ac1
mov dword [ebp - 0x1c], ecx
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [ebp - 0x18]
mov dword [edx], 4
push edx
push ecx
push eax
push 0x10
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10002adb
mov ecx, edi
mov edx, esi
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
push esi
call fcn.10002b05
add esp, 8
test al, al
je 0x10002aeb
mov eax, dword [esi]
test eax, eax
je 0x10002b01
push 0xa
push 0
push eax
call fcn.10168db0
add esp, 0xc
cmp eax, 1
jmp 0x10002adf
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015ecd2
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.10002b05
cmp dword [ebp - 0x14], 1
sete al
movzx eax, al
mov dword [ebx], eax
mov bl, 1
jmp 0x10002aed
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015ecd2
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x10002ae2

Function at 0x10002b05
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov edi, edx
mov dword [ebp - 0x220], ecx
mov eax, dword [0x101ece94]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea esi, [ebp - 0x218]
push 0x208
push ebx
push esi
call fcn.10160d80
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 0x104
push eax
push esi
push ebx
push 2
push edi
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x10002b7c
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.10002352
mov ecx, edi
call fcn.10002502
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015ecd2
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002c24
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x101ece94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10002c82
mov edi, eax
push str.CreateWebViewEnvironmentWithOptionsInternal
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002cf8
mov ecx, eax
mov esi, dword [ebp + 0x1c]
mov bl, byte [ebp + 0xc]
call dword [0x10192a68]
movzx eax, bl
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call ecx
mov esi, eax
mov dword [ebp - 0x14], eax
jmp 0x10002d67
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea ebx, [ebp - 0x14]
mov dword [ebx], esi
pcmpeqd xmm0, xmm0
lea edi, [ebp - 0x20]
movq qword [edi], xmm0
mov dword [edi + 8], 0xffffffff
mov ecx, edi
call fcn.10002264
push edi
push 1
push 4
push ebx
call fcn.10002b98
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
call ebx
mov ecx, edi
call fcn.10002502
push eax
call ebx
push str._path
call ebx
push dword [ebp + 8]
call ebx
push 0x10193852
call ebx
mov ecx, edi
call fcn.10002278
jmp 0x10002d7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], esi
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x20]
movq qword [ebx], xmm0
mov dword [ebx + 8], 0xffffffff
mov ecx, ebx
call fcn.10002264
push ebx
push 1
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.10002b98
add esp, 0x10
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.10002502
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x10193852
call eax
mov ecx, ebx
call fcn.10002278
push str.DllCanUnloadNow
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002d7e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015ecd2
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10005d70
Capabilities:
Get graphical window text

Disassembly:
push 0x228
mov eax, 0x10180112
call fcn.1015f9b3
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
mov ecx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x228], esi
push 0x101c86f6
mov dword [ebx], esi
call fcn.10004dba
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x21c]
push str.Chrome_WidgetWin_1
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x21c], esi
call fcn.10004dba
push esi
mov dword [ebp - 4], 1
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_FindWindowA]
jmp 0x10005f06
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x10005efd
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10005efd
push 0x104
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.10160d80
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005e2c
sub ecx, edx
je 0x10005efd
push 0x104
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10160d80
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], esi
push eax
lea ecx, [ebp - 0x220]
call fcn.10004dba
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
mov eax, dword [ebp - 0x21c]
push dword [eax - 0xc]
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.10004ebf
mov byte [ebp - 4], 3
mov ecx, eax
push dword [ebp - 0x21c]
call fcn.10004f44
mov byte [ebp - 4], 2
mov esi, eax
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.10003bf1
test esi, esi
jne 0x10005ee9
push esi
push ecx
mov ecx, esp
mov byte [ebp - 0x221], 0x3b
push ecx
mov edx, edi
call fcn.1000873f
mov dl, byte [ebp - 0x221]
pop ecx
mov ecx, ebx
call fcn.1000831e
pop ecx
pop ecx
jmp 0x10005eeb
xor esi, esi
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x10005ddd
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.10003bf1
mov eax, ebx
call fcn.1015f962
ret 4
Function at 0x10007506
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor edx, edx
xor ecx, ecx
xor esi, esi
mov al, byte [edi]
test al, al
je 0x100075ac
push ebx
movsx eax, al
mov ebx, dword [eax*4 + 0x101c89e0]
cmp ebx, 0xffffffff
je 0x100075a0
mov eax, esi
sub eax, 0
je 0x1000759b
sub eax, 1
je 0x1000757b
sub eax, 1
je 0x1000755c
sub eax, 1
jne 0x1000759e
cmp ecx, 0xdbba0
jge 0x10007558
mov eax, dword [ebp + 0xc]
shl dl, 6
or dl, bl
mov byte [ecx + eax], dl
inc ecx
xor esi, esi
jmp 0x1000759e
cmp ecx, 0xdbba0
jge 0x10007577
mov eax, ebx
shl dl, 4
sar eax, 2
and al, 0xf
or al, dl
mov edx, dword [ebp + 0xc]
mov byte [ecx + edx], al
inc ecx
push 3
jmp 0x10007598
cmp ecx, 0xdbba0
jge 0x10007596
mov eax, ebx
shl dl, 2
sar eax, 4
and al, 3
or al, dl
mov edx, dword [ebp + 0xc]
mov byte [ecx + edx], al
inc ecx
push 2
pop esi
jmp 0x1000759e
xor esi, esi
inc esi
mov edx, ebx
inc edi
mov al, byte [edi]
test al, al
jne 0x1000751f
pop ebx
pop edi
mov eax, ecx
pop esi
pop ebp
ret 0xc
Function at 0x100079e4
Capabilities:
Get common file path

Disassembly:
push 0x810
mov eax, 0x1018074f
call fcn.1015f9b3
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x81c], edi
push 0x800
xor ebx, ebx
mov dword [ebp - 0x81c], edi
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.10160d80
add esp, 0xc
mov dword [ebp - 0x814], ebx
call fcn.10017b77
push eax
lea ecx, [ebp - 0x814]
call fcn.1000509d
mov dword [ebp - 4], ebx
sub esi, 1
je 0x10007b22
sub esi, 1
je 0x10007b1a
sub esi, 3
je 0x10007b13
sub esi, 4
je 0x10007a87
sub esi, 1
je 0x10007a82
sub esi, 1
je 0x10007a7d
sub esi, 1
jne 0x10007b54
push ebx
push 0x1c
lea eax, [ebp - 0x810]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x10007b34
push ebx
push 0x23
jmp 0x10007a6a
push ebx
push 0x1a
jmp 0x10007a6a
push 1
push 2
pop edx
lea ecx, [ebp - 0x818]
call fcn.100079e4
mov byte [ebp - 4], 1
mov dword [esp], str.Links
push eax
lea eax, [ebp - 0x81c]
push eax
call fcn.10004c68
add esp, 0xc
push eax
lea ecx, [ebp - 0x814]
mov byte [ebp - 4], 2
call fcn.1000504d
mov ecx, dword [ebp - 0x81c]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x818]
add ecx, 0xfffffff0
call fcn.10003bf1
push ecx
mov esi, esp
mov dword [ebp - 0x818], esi
mov eax, dword [ebp - 0x814]
add eax, 0xfffffff0
push eax
call fcn.100050fe
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x818]
mov edx, ebx
mov dword [esi], eax
call fcn.100078e3
pop ecx
mov byte [ebp - 4], 3
jmp 0x10007b84
push ebx
push ebx
jmp 0x10007a6a
push ebx
push 6
jmp 0x10007a6a
lea eax, [ebp - 0x810]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x810]
push eax
call fcn.10005033
pop ecx
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.10005220
push ecx
mov esi, esp
mov dword [ebp - 0x818], esi
mov eax, dword [ebp - 0x814]
add eax, 0xfffffff0
push eax
call fcn.100050fe
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x818]
mov edx, ebx
mov dword [esi], eax
call fcn.100078e3
pop ecx
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x814]
call fcn.1000504d
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x818]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov esi, dword [ebp - 0x814]
add esi, 0xfffffff0
push esi
call fcn.100050fe
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.10003bf1
mov eax, edi
call fcn.1015f962
ret
Function at 0x10007c8d
Capabilities:
Delete file

Disassembly:
push 0xc
mov eax, 0x10180786
call fcn.1015f980
mov dword [ebp - 0x10], ecx
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], edi
je 0x10007d3b
push ecx
add eax, 0xfffffff0
mov esi, esp
mov dword [ebp - 0x14], esi
push eax
mov dword [ebp - 0x14], eax
call fcn.100050fe
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.10007c61
pop ecx
test eax, eax
je 0x10007d38
mov ebx, edi
mov esi, edi
cmp dword [ebp - 0x10], ebx
jle 0x10007d33
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10007cf8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x10007cd8
jmp 0x10007cfb
xor ebx, ebx
inc ebx
push ecx
mov esi, esp
push dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
call fcn.100050fe
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.10007c61
pop ecx
test eax, eax
je 0x10007d33
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc edi
cmp edi, dword [ebp - 0x10]
jl 0x10007cfb
mov eax, dword [ebp + 8]
jmp 0x10007d3e
mov eax, dword [ebp + 8]
xor ebx, ebx
inc ebx
lea ecx, [eax - 0x10]
call fcn.10003bf1
mov eax, ebx
call fcn.1015f94e
ret

Function at 0x10007d4e
Capabilities:
Download url
Receive data

Disassembly:
push 4
mov eax, 0x101807b8
call fcn.1015f980
mov dword [ebp - 4], 1
mov edi, dword [ebp + 0xc]
push ecx
mov esi, esp
add edi, 0xfffffff0
push edi
mov dword [ebp - 0x10], esi
call fcn.100050fe
pop ecx
add eax, 0x10
push 5
pop ecx
mov dword [esi], eax
call fcn.10007c8d
pop ecx
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, dword [ebp + 8]
xor ebx, ebx
test eax, eax
setns bl
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov ecx, edi
call fcn.10003bf1
mov eax, ebx
call fcn.1015f94e
ret

Function at 0x10007deb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x101807ea
call fcn.1015f9b3
mov edi, edx
mov ebx, ecx
mov dword [ebp - 4], 1
lea edx, [ebp + 0xc]
or esi, 0xffffffff
mov dword [ebp - 0x14], esi
call fcn.10007dbd
test eax, eax
je 0x10007e76
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
xor eax, eax
push eax
push 0x20019
push eax
push eax
push eax
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10007e40
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10007e76
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
test eax, eax
push dword [ebp - 0x20]
cmovne ecx, ebx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10003bf1
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10003bf1
mov eax, esi
call fcn.1015f962
ret
Function at 0x10007e94
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x10180826
call fcn.1015f9b3
mov edi, edx
mov dword [ebp - 0x14], ecx
xor esi, esi
lea edx, [ebp + 0xc]
inc esi
mov dword [ebp - 4], esi
call fcn.10007dbd
xor ebx, ebx
test eax, eax
je 0x10007ee1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10007f01
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, ebx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10003bf1
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10003bf1
mov eax, esi
call fcn.1015f962
ret
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push ebx
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x1c]
test eax, eax
jne 0x10007edb
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10007ee3
Function at 0x10007f25
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018086a
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.1015fb30
mov eax, dword [0x101ece94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1020], edx
mov ebx, ecx
mov dword [ebp - 0x1014], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1014], ebx
xor eax, eax
mov dword [ebp - 4], 2
push 0x1000
push eax
mov dword [ebp - 0x101c], eax
mov dword [ebp - 0x1018], eax
lea eax, [ebp - 0x1010]
push eax
call fcn.10160d80
add esp, 0xc
lea edx, [ebp + 0x10]
add esi, 0xfffffff0
add edi, 0xfffffff0
call fcn.10007dbd
test eax, eax
jne 0x10007fd2
push 0x101c86f6
mov ecx, ebx
call fcn.10004dba
mov ecx, esi
call fcn.10003bf1
mov ecx, edi
call fcn.10003bf1
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
jmp 0x10008096
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x101c]
push eax
xor eax, eax
push eax
push 0x20019
push eax
push eax
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x1020]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10008011
push dword [ebp - 0x101c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x101c86f6
jmp 0x1000807b
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1014], 0x1000
push eax
lea eax, [ebp - 0x1010]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0x101c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x101c]
test eax, eax
je 0x1000805a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.100050fe
add eax, 0x10
pop ecx
mov dword [ebx], eax
jmp 0x10008082
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1010]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008069
sub ecx, edx
je 0x1000804c
lea eax, [ebp - 0x1010]
push eax
mov ecx, ebx
call fcn.10004dba
mov ecx, esi
call fcn.10003bf1
mov ecx, edi
call fcn.10003bf1
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015ecd2
leave
ret
Function at 0x100080b7
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x101808b1
call fcn.1015f9b3
mov esi, ecx
lea edx, [ebp + 0x10]
mov dword [ebp - 4], 2
call fcn.10007dbd
xor edi, edi
test eax, eax
je 0x10008102
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1000812d
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, edi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10003bf1
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.10003bf1
mov eax, esi
call fcn.1015f962
ret
mov eax, dword [ebp + 0xc]
xor esi, esi
inc esi
mov ecx, dword [eax - 0xc]
inc ecx
push ecx
push eax
push esi
push edi
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x18]
test eax, eax
jne 0x100080fc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10008104

Function at 0x10008156
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x101ece94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x44
pop edi
push edi
xor ebx, ebx
lea eax, [ebp - 0x48]
push ebx
push eax
mov esi, ecx
call fcn.10160d80
add esp, 0xc
mov dword [ebp - 0x48], edi
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
test esi, esi
je 0x100081ae
push 0xffffffffffffffff
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x58]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x54]
call esi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1015ecd2
leave
ret
Function at 0x100089b0
Capabilities:
Delete file

Disassembly:
push 0x18
mov eax, 0x10180b1c
call fcn.1015f9b3
mov edi, ecx
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov dword [edi], ebx
call fcn.10017b77
push eax
mov ecx, edi
call fcn.1000509d
mov edx, esi
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.10007bc5
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x1c], esp
mov esi, esp
push eax
mov dword [ebp - 0x18], esi
call fcn.100050fe
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
mov esi, esp
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff0
mov dword [ebp - 0x18], esi
push ebx
call fcn.100050fe
add eax, 0x10
mov dword [esi], eax
pop ecx
mov byte [ebp - 4], 2
call fcn.10007d4e
pop ecx
pop ecx
test eax, eax
je 0x10008a6e
mov eax, dword [ebp - 0x14]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 0x18], esi
call fcn.100050fe
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x1c]
mov dword [esi], eax
call fcn.10008a91
pop ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.1000504d
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov ecx, ebx
call fcn.10003bf1
mov eax, edi
call fcn.1015f962
ret

Function at 0x100092d7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
pop ebp
jmp fcn.10003bf1
Function at 0x10009674
Capabilities:
Enumerate processes

Disassembly:
push 0x420
mov eax, 0x10180e99
call fcn.1015f9b3
mov dword [ebp - 0x420], edx
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x1000983b
call sub.KERNEL32.dll_GetCurrentProcessId
mov esi, eax
lea ecx, [ebp + 8]
mov dword [ebp - 0x42c], esi
call fcn.10006948
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000983b
push ebx
push edi
mov dword [ebx], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10009834
mov dword [ebp - 0x41c], 1
cmp dword [ebp + 0x14], 0
jne 0x100096fe
cmp esi, dword [ebx + 8]
je 0x10009824
and dword [ebp - 0x414], 0
lea ecx, [ebp - 0x414]
push 0x101c86f6
call fcn.10004dba
mov byte [ebp - 4], 1
push dword [ebx + 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x424], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x418], 0x103
jne 0x100097d4
lea esi, [ebx + 0x24]
push esi
call fcn.10005033
pop ecx
push eax
push esi
lea ecx, [ebp - 0x414]
call fcn.10005220
mov esi, dword [ebp - 0x424]
lea eax, [ebp - 0x410]
push 0x400
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x100097da
cmp dword [ebp - 0x420], 0
je 0x100097ac
lea eax, [ebp - 0x410]
push eax
call fcn.10005033
pop ecx
mov ecx, dword [ebp - 0x420]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.10005220
cmp dword [ebp + 0xc], 0
je 0x100097da
lea eax, [ebp - 0x410]
push eax
call fcn.10005033
pop ecx
push eax
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x414]
call fcn.10005220
jmp 0x100097da
mov esi, dword [ebp - 0x424]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea ecx, [ebp - 0x414]
call fcn.10006948
push dword [ebp - 0x414]
lea ecx, [ebp + 8]
call fcn.10004f44
test eax, eax
jne 0x1000980c
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x10009859
inc dword [eax]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x414]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov esi, dword [ebp - 0x42c]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x100096ef
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x41c], 0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10003bf1
mov eax, dword [ebp - 0x41c]
call fcn.1015f962
ret
push edi
call esi
mov ecx, dword [ebp - 0x414]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
jmp 0x10009842