joyce8/EMBER2024-capa huggingface dataset:
Function at 0xedd4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0xedd54
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0xedf62
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
call fcn.00013d18
lea eax, [ebp - 0xc]
mov edx, 0x400
call fcn.000271f0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0xedf70
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xedf07
mov edx, 0x400
mov eax, dword [ebp - 0xc]
call fcn.00018100
mov dword [ebp - 8], 0x3ff
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xedfa0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xede18
cmp dword [ebp - 4], 1
jne 0xede18
cmp dword [ebp - 8], 1
jbe 0xede18
cmp dword [ebp - 8], 0x3ff
ja 0xede18
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00013ee0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.000272e8
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00013fb0
mov edx, 0x400
mov eax, dword [ebp - 0xc]
call fcn.00018100
mov dword [ebp - 8], 0x3ff
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xedfac
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xede8d
cmp dword [ebp - 4], 1
jne 0xede8d
cmp dword [ebp - 8], 1
jbe 0xede8d
cmp dword [ebp - 8], 0x3ff
ja 0xede8d
push dword [ebx]
push 0xedfc8
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00013ee0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.000272e8
push dword [ebp - 0x1c]
mov eax, ebx
mov edx, 3
call fcn.00014068
mov edx, 0x400
mov eax, dword [ebp - 0xc]
call fcn.00018100
mov dword [ebp - 8], 0x3ff
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xedfcc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xedf07
cmp dword [ebp - 4], 1
jne 0xedf07
cmp dword [ebp - 8], 1
jbe 0xedf07
cmp dword [ebp - 8], 0x3ff
ja 0xedf07
push dword [ebx]
push 0xedfe8
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
call fcn.00013ee0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.000272e8
push dword [ebp - 0x24]
push 0xedff4
mov eax, ebx
mov edx, 4
call fcn.00014068
lea eax, [ebp - 0xc]
mov edx, 0x400
call fcn.00027218
cmp dword [ebp - 0x10], 0
je 0xedf23
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x30]
mov eax, dword [ebx]
call fcn.000ed560
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0002e0b8
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.00013d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xedf69
lea eax, [ebp - 0x30]
mov edx, 8
call fcn.00013d3c
ret
Function at 0xf0ad8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0xf0b02
cmp dword [ebx + 0x64], 0
jne 0xf0b02
cmp dword [ebx + 0x6c], 0
jne 0xf0b02
mov esi, edi
jmp 0xf0b90
cmp esi, 0xffffffff
jne 0xf0b0d
dec esi
jmp 0xf0b90
mov eax, dword [ebx + 0x64]
lea edx, [edi + edi]
sub edx, 0x106
cmp eax, edx
jb 0xf0b90
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ebp, edi
mov ecx, ebp
call fcn.0001e154
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0xf0b58
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0xf0b5d
mov word [edx], 0
dec eax
test eax, eax
jne 0xf0b3e
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0xf0b84
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0xf0b89
mov word [edx], 0
dec eax
test eax, eax
jne 0xf0b6a
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0xf0bee
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.000f086c
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0xf0bd9
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0xf0bee
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0xf0ae2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xf5e84
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0xf5f70
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf5f88
push ebx
push 0xf5f98
lea eax, [ebp - 8]
mov edx, 3
call fcn.00014068
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.000f5800
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0xf5fa8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xf5f41
mov eax, dword [0x251568]
cmp dword [eax], 0
je 0xf5f1e
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 0xf5fb8
call fcn.00013ff4
mov eax, dword [ebp - 0xc]
call fcn.0001416c
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0002cd0c
mov edi, eax
jmp 0xf5f41
lea eax, [ebp - 0x10]
mov ecx, ebx
mov edx, 0xf5fb8
call fcn.00013ff4
mov eax, dword [ebp - 0x10]
call fcn.0001416c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov edi, eax
cmp dword [ebp - 4], 0
je 0xf5f50
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf5f77
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00013d3c
ret

Function at 0xf6000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xf60c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 4
lea eax, [ebp - 4]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025ad4
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0xf60dc
call fcn.00013ff4
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xf6096
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf6128
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xf6096
cmp dword [ebp - 0x10], 4
jne 0xf6096
mov ebx, dword [ebp - 8]
cmp dword [ebp - 4], 0
je 0xf60a5
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf60cc
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00013d3c
ret
Function at 0xf722c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xf7461
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0xf7408
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x68]
mov ecx, ebx
mov edx, 0xf747c
call fcn.00013ff4
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 4]
call fcn.000f5800
lea eax, [ebp - 0x70]
call fcn.00027684
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x6c]
call fcn.00027578
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 0x10]
mov ecx, 0xf7494
call fcn.00013ff4
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.00012c70
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00012c70
mov dword [ebp - 0x64], 0x44
mov word [ebp - 0x34], 0
mov dword [ebp - 0x38], 1
push dword [ebp - 0x10]
push 0xf74ac
push ebx
push 0xf74d8
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00014068
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call fcn.0002cc64
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0001416c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov dword [ebp - 0xc], eax
call sub.kernel32.dll_GetLastError_1
mov esi, eax
call fcn.0002ccb8
cmp dword [ebp - 0xc], 0
jne 0xf738d
lea eax, [ebp - 0x78]
call fcn.00025ad4
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
mov edx, 0xf74e8
call fcn.00013ff4
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 4]
call fcn.000f58bc
lea edx, [ebp - 0x7c]
mov eax, esi
call fcn.00027478
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 4]
call fcn.000f58bc
jmp 0xf73e4
push 0xea60
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_WaitForInputIdle
mov dword [ebp - 0xc], eax
push 0x64
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0xc], 0x103
jne 0xf73ce
call sub.kernel32.dll_GetTickCount
mov edx, ebx
call fcn.000292ac
cmp eax, 0xea60
jbe 0xf739e
cmp dword [ebp - 0xc], 0x103
jne 0xf73e4
mov edx, dword [ebp - 4]
mov eax, 0xf7508
call fcn.000f58bc
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0xf73f1
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0xf73fe
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xf743b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf7468
lea eax, [ebp - 0x84]
mov edx, 8
call fcn.00013d3c
lea eax, [ebp - 0x10]
call fcn.00013d18
ret
Function at 0xf768c
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0xf7705
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x2506b0], 0
je 0xf76ef
lea eax, [ebp - 8]
mov ecx, ebx
mov edx, dword [0x25068c]
call fcn.0001469c
mov eax, dword [ebp - 8]
call fcn.00014620
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
push edi
push esi
mov eax, dword [0x2506b0]
push eax
call sub.advapi32.dll_ReportEventW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf770c
lea eax, [ebp - 8]
call fcn.000143f0
ret
Function at 0xf7cfc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0xf7d05
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0xf7ecf
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x1c]
call fcn.00026f34
mov eax, dword [ebp - 0x1c]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
cmp dword [ebp - 0x10], 0
je 0xf7e8e
lea eax, [ebp - 0xc]
mov edx, 0x400
call fcn.000271f0
mov edx, 0x400
mov eax, dword [ebp - 0xc]
call fcn.00018100
mov dword [ebp - 8], 0x3ff
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0xf7ee0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xf7dc8
cmp dword [ebp - 0x18], 1
jne 0xf7dc8
cmp dword [ebp - 8], 1
jbe 0xf7dc8
cmp dword [ebp - 8], 0xc8
ja 0xf7dc8
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00013ee0
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x14]
call fcn.000273cc
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, 0xf7ef8
call fcn.000273cc
mov edx, dword [ebp - 0x24]
pop eax
call fcn.000140b8
sete byte [esi]
mov edx, 0x400
mov eax, dword [ebp - 0xc]
call fcn.00018100
mov dword [ebp - 8], 0x3ff
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0xf7efc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xf7e44
cmp dword [ebp - 0x18], 1
jne 0xf7e44
cmp dword [ebp - 8], 1
jbe 0xf7e44
cmp dword [ebp - 8], 0xc8
ja 0xf7e44
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00013ee0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x14]
call fcn.000273cc
mov eax, dword [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, 0xf7ef8
call fcn.000273cc
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.000140b8
sete byte [edi]
lea eax, [ebp - 0x30]
call fcn.000f9064
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0001442c
lea eax, [ebp - 0xc]
mov edx, 0x400
call fcn.00027218
jmp 0xf7e90
xor ebx, ebx
cmp dword [ebp - 0x10], 0
je 0xf7e9f
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf7ed6
lea eax, [ebp - 0x30]
call fcn.000143f0
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.00013d3c
lea eax, [ebp - 0x14]
call fcn.00013d18
ret
Function at 0xf7f0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0xf7fe1
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, esi
mov eax, 0xf7ff8
call fcn.000b1a0c
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0xf7ffc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xf7fbf
lea eax, [ebp - 0xc]
mov edx, 0x400
call fcn.000271f0
mov dword [ebp - 0x10], 0x3ff
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf802c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xf7fb2
cmp dword [ebp - 4], 1
jne 0xf7fb2
cmp dword [ebp - 0x10], 1
jbe 0xf7fb2
cmp dword [ebp - 0x10], 0xc8
ja 0xf7fb2
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00013ee0
lea eax, [ebp - 0xc]
mov edx, 0x400
call fcn.00027218
cmp dword [ebp - 8], 0
je 0xf7fce
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf7fe8
ret
Function at 0xf8044
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0xf81a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x2506a8]
call fcn.00014630
test eax, eax
jle 0xf808a
mov eax, esi
mov edx, dword [0x2506a8]
call fcn.0001442c
jmp 0xf8188
mov eax, esi
mov edx, 0xf81b8
call fcn.0001442c
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0xf81d4
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xf813c
lea eax, [ebp - 0x10]
mov edx, 0x800
call fcn.000271f0
mov dword [ebp - 8], 0x800
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf8224
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0xf812f
cmp dword [ebp - 4], 2
jne 0xf812f
cmp dword [ebp - 8], 1
jbe 0xf812f
cmp dword [ebp - 8], 0x800
ja 0xf812f
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00014548
mov eax, dword [ebp - 0x14]
mov edx, esi
call fcn.0001bc38
mov eax, 0x2506a8
mov edx, dword [esi]
call fcn.0001442c
mov bl, 1
lea eax, [ebp - 0x10]
mov edx, 0x800
call fcn.00027218
test bl, bl
je 0xf815b
mov ecx, dword [esi]
lea eax, [ebp - 0x18]
mov edx, 0xf823c
call fcn.0001469c
mov eax, dword [ebp - 0x18]
mov edx, edi
call fcn.000f5704
jmp 0xf8174
mov ecx, dword [esi]
lea eax, [ebp - 0x1c]
mov edx, 0xf823c
call fcn.0001469c
mov eax, dword [ebp - 0x1c]
mov edx, edi
call fcn.000f5a4c
cmp dword [ebp - 0xc], 0
je 0xf8183
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf81aa
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00014408
ret
Function at 0xf9064
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xf914f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x800
call fcn.000271f0
mov eax, ebx
call fcn.000143f0
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.00026f34
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], 0x800
cmp dword [ebp - 0xc], 0
je 0xf911d
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf915c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0xf911d
cmp dword [ebp - 4], 1
jbe 0xf911d
cmp dword [ebp - 4], 0x800
ja 0xf911d
cmp dword [ebp - 0x14], 1
jne 0xf911d
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00014548
cmp dword [ebp - 0xc], 0
je 0xf912c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 8]
mov edx, 0x800
call fcn.00027218
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf9156
lea eax, [ebp - 0x18]
call fcn.00013d18
ret
Function at 0x102034
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x10204a
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x102043
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x10205c
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x102055
mov eax, esp
lea esi, [edx + 1]
dec esi
test esi, esi
jl 0x102078
inc esi
mov edx, ecx
mov ecx, dword [ebp + 0xc]
mov bl, byte [eax]
xor bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
inc eax
dec esi
jne 0x10206c
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1045bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x104676
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, 2
lea eax, [ebp - 4]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x10464c
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x104684
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x10464c
cmp dword [ebp - 0xc], 4
jne 0x10464c
mov ebx, dword [ebp - 0x10]
cmp dword [ebp - 4], 0
je 0x10465b
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10467d
lea eax, [ebp - 0x14]
call fcn.00013d18
ret
Function at 0x1046a4
Capabilities:
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x1046ac
push ebx
push esi
xor eax, eax
push ebp
push 0x104849
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x104858
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0x10481a
push 0x104898
lea eax, [ebp - 0x14]
call fcn.00027b40
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00027578
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
call fcn.00025994
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00013fb0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00027578
push dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
call fcn.000252ec
push dword [ebp - 0x1c]
push 0x1048a4
lea eax, [ebp - 8]
mov edx, 4
call fcn.00014068
mov eax, dword [ebp - 8]
call fcn.00013fa8
mov esi, eax
inc esi
push esi
mov eax, dword [ebp - 8]
call fcn.0001416c
push eax
push 1
push 0
push 0x1048b0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
push 0x104898
lea eax, [ebp - 0x28]
call fcn.00027b40
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00027578
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
call fcn.00025994
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00013fb0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00027578
push dword [ebp - 0x20]
lea eax, [ebp - 0x30]
call fcn.00046098
push dword [ebp - 0x30]
push 0x104898
lea eax, [ebp - 8]
mov edx, 4
call fcn.00014068
mov eax, dword [ebp - 8]
call fcn.00013fa8
mov esi, eax
inc esi
push esi
mov eax, dword [ebp - 8]
call fcn.0001416c
push eax
push 1
push 0
push 0x1048c4
lea eax, [ebp - 0x38]
call fcn.000252ec
push dword [ebp - 0x38]
push 0x1048c4
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00014068
mov eax, dword [ebp - 0x34]
call fcn.0001416c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
cmp dword [ebp - 4], 0
je 0x104829
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x104850
lea eax, [ebp - 0x38]
mov edx, 0xd
call fcn.00013d3c
ret