joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [str.netuser_n]
mov ecx, dword [0x10043b90]
mov dx, word [0x10043b94]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x18], dx
lea ebx, [ebx]
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0xffffffffffffffff
push 0x3e8
push edx
push 1
push 0
call dword [sym.imp.NETAPI32.dll_NetQueryDisplayInformation]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000468f
cmp eax, 0xea
jne 0x1000476a
mov ebx, dword [ebp - 8]
lea eax, [ebp - 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004698
mov edi, dword [ebp - 4]
inc edi
imul edi, edi, 0x64
sub eax, edx
add edi, eax
mov esi, 0
je 0x100046df
lea eax, [edi + 0x13]
and eax, 0xfffffff0
push eax
push 8
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100046df
mov eax, dword [ebp - 0x10]
push eax
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x10], esi
test esi, esi
je 0x100047c1
lea eax, [ebp - 0x20]
mov edx, esi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100046f3
cmp dword [ebp - 4], 0
je 0x10004734
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004708
sub eax, edx
mov edx, dword [ebx]
push edx
push 0x10043b98
add eax, esi
push edi
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, dword [ebx + 0x14]
add esp, 0x10
add ebx, 0x18
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
jne 0x10004703
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10004735
mov cx, word [0x10043b50]
mov word [esi], cx
mov dl, byte [0x10043b52]
mov byte [esi + 2], dl
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp dword [ebp - 0x14], 0xea
mov esi, dword [ebp - 0x10]
je 0x10004660
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004770
sub eax, edx
push 0
lea edx, [ebp - 0x14]
push edx
push eax
mov eax, dword [ebp + 8]
push esi
push eax
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x100047b8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x100047b8
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100047e0
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x20119
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerTypedURLs
push 0x80000001
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004913
push 1
push str.url_i
lea ecx, [ebp - 0x21c]
push 0x104
push ecx
mov dword [ebp - 8], 1
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
test eax, eax
je 0x10004909
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
lea ecx, [ebp - 0x21c]
push ecx
push edx
mov dword [ebp - 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10004908
cmp dword [ebp - 0x10], ebx
jne 0x1000488e
push ebx
lea eax, [ebp - 4]
push eax
push 0xc
push str.IE_history:_n
push edi
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], ebx
call esi
push ebx
lea ecx, [ebp - 4]
push ecx
push 1
push 0x10043be4
push edi
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 0x118]
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100048b0
push ebx
lea edx, [ebp - 4]
push edx
sub eax, ecx
push eax
lea eax, [ebp - 0x118]
push eax
push edi
mov dword [ebp - 4], ebx
call esi
push ebx
lea ecx, [ebp - 4]
push ecx
push 2
push 0x10043b50
push edi
mov dword [ebp - 4], ebx
call esi
mov eax, dword [ebp - 8]
inc eax
push eax
push str.url_i
lea edx, [ebp - 0x21c]
push 0x104
push edx
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
test eax, eax
jne 0x10004843
pop esi
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005f50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x108], bl
call sub.MSVCRT.dll_memset
push 0x103
lea edx, [ebp - 0x20b]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 8], cx
mov byte [ebp - 0x20c], bl
call sub.MSVCRT.dll_memset
add esp, 0x18
cmp esi, ebx
je 0x10006053
push 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
mov word [ebp - 8], 1
xor ecx, ecx
lea ecx, [ecx]
mov byte [ebp + ecx - 0x108], cl
inc ecx
cmp ecx, 0x100
jl 0x10005fc0
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x108], dl
inc eax
cmp eax, 0x20
jl 0x10005fe7
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10005fd2
lea eax, [ebp - 0x20c]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x108]
call fcn.10016c40
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006045
mov edx, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 1
push ebx
push 0x10058e38
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10006053
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100060e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
xor esi, esi
push 0xff
lea eax, [ebp - 0x10f]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
push 0x103
xor ecx, ecx
lea edx, [ebp - 0x213]
push esi
push edx
mov word [ebp - 0x10], cx
mov byte [ebp - 0x214], cl
call sub.MSVCRT.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x101
push esi
push str.softwaremicrosoft
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006224
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 8]
push ecx
push esi
push 0x10058e38
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10006224
mov word [ebp - 0x10], 1
xor ecx, ecx
jmp 0x10006190
mov byte [ebp + ecx - 0x110], cl
inc ecx
cmp ecx, 0x100
jl 0x10006190
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x110], dl
inc eax
cmp eax, 0x20
jl 0x100061b7
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x100061a2
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x110]
call fcn.10016c40
cmp byte [ebp - 0x214], 0
je 0x10006224
push 0x110
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10006224
push 0x110
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
test esi, esi
je 0x10006224
push 0x104
lea edx, [ebp - 0x214]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10006232
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10006240
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
xor esi, esi
push 0xff
lea eax, [ebp - 0x10f]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
push 0x103
xor ecx, ecx
lea edx, [ebp - 0x213]
push esi
push edx
mov word [ebp - 0x10], cx
mov byte [ebp - 0x214], cl
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x101
push esi
push str.softwaremicrosoft
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006384
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 8]
push eax
push esi
push 0x10058e38
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10006384
mov word [ebp - 0x10], 1
xor ecx, ecx
jmp 0x100062f0
mov byte [ebp + ecx - 0x110], cl
inc ecx
cmp ecx, 0x100
jl 0x100062f0
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x110], dl
inc eax
cmp eax, 0x20
jl 0x10006317
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10006302
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x110]
call fcn.10016c40
cmp byte [ebp - 0x214], 0
je 0x10006384
push 0x110
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10006384
push 0x110
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
test esi, esi
je 0x10006384
push 0x104
lea edx, [ebp - 0x214]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10006392
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100063a5
push 0x80000001
call fcn.100060e0
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100064d0
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
test eax, eax
je 0x10006562
cmp dword [ebp + 8], edi
je 0x10006562
test ebx, ebx
je 0x10006562
push esi
push edi
push 0x80
push 2
push edi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10006559
mov ecx, dword [ebp + 8]
push edi
lea eax, [ebp + 0xc]
push eax
push ebx
push ecx
push esi
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10006532
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x10006532
mov edi, 1
mov dword [ebp + 8], 0
test esi, esi
je 0x10006559
lea edx, [ebp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10006559
test byte [ebp + 8], 2
jne 0x10006559
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 8
mov eax, edi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10006570
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
xor ebx, ebx
push edi
test eax, eax
je 0x10006674
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
je 0x10006674
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1000664d
cmp dword [ebp + 0xc], esi
je 0x100065ce
inc ebx
xor esi, esi
test ebx, ebx
je 0x100065ff
lea edi, [ebx + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100065fc
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test esi, esi
je 0x1000664a
push 0
lea ecx, [ebp - 4]
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000664a
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10006643
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp + 0xc], 0
mov esi, dword [ebp + 0xc]
mov dword [ebp + 0xc], 0
test edi, edi
je 0x10006674
lea edx, [ebp + 0xc]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10006674
test byte [ebp + 0xc], 2
jne 0x10006674
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
test edi, edi
je 0x10006695
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
mov eax, esi
jne 0x10006697
mov dword [edi], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10006a10
Capabilities:
Delete file
Set file attributes

Disassembly:
xor eax, eax
test esi, esi
je 0x10006a25
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret

Function at 0x10006b50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x213]
push ebx
push eax
xor edi, edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], ebx
mov byte [ebp - 0x214], bl
call sub.MSVCRT.dll_memset
push 0xff
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call sub.MSVCRT.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x101
push ebx
push str.softwaremicrosoft
xor edx, edx
push ecx
mov word [ebp - 0x10], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006cab
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10006cab
mov word [ebp - 0x10], 1
xor ecx, ecx
jmp 0x10006c00
mov byte [ebp + ecx - 0x110], cl
inc ecx
cmp ecx, 0x100
jl 0x10006c00
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x110], dl
inc eax
cmp eax, 0x20
jl 0x10006c27
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10006c12
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x110]
call fcn.10016c40
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10006c53
sub eax, edx
push esi
inc eax
xor esi, esi
cmp eax, ebx
je 0x10006c8b
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x10006c8b
push edi
push ebx
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
cmp esi, ebx
je 0x10006caa
lea eax, [ebp - 0x214]
mov edx, eax
sub esi, edx
jmp 0x10006ca0
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x10006ca0
pop esi
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10006cb9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10006cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x10006e4e
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x213]
push ebx
push eax
xor edi, edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], ebx
mov byte [ebp - 0x214], bl
call sub.MSVCRT.dll_memset
push 0xff
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x101
push ebx
push str.softwaremicrosoft
xor edx, edx
push 0x80000001
mov word [ebp - 0x10], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006e3b
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x214]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10006e3b
mov word [ebp - 0x10], 1
xor ecx, ecx
jmp 0x10006d90
mov byte [ebp + ecx - 0x110], cl
inc ecx
cmp ecx, 0x100
jl 0x10006d90
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x110], dl
inc eax
cmp eax, 0x20
jl 0x10006db7
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10006da2
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x110]
call fcn.10016c40
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10006de3
sub eax, edx
push esi
inc eax
xor esi, esi
cmp eax, ebx
je 0x10006e1b
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x10006e1b
push edi
push ebx
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
cmp esi, ebx
je 0x10006e3a
lea eax, [ebp - 0x214]
mov edx, eax
sub esi, edx
jmp 0x10006e30
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x10006e30
pop esi
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10006e49
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
pop ebx
jne 0x10006e63
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call fcn.10006b50
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10006e70
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push 0xff
mov esi, eax
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call sub.MSVCRT.dll_memset
push 0x103
lea edx, [ebp - 0x20f]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0xc], cx
mov byte [ebp - 0x210], bl
call sub.MSVCRT.dll_memset
add esp, 0x18
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x10006f3a
lea edx, [ebp - 0x210]
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10006ed0
xor eax, eax
mov word [ebp - 0xc], 1
xor ecx, ecx
jmp 0x10006ef0
mov byte [ebp + ecx - 0x10c], cl
inc ecx
cmp ecx, 0x100
jl 0x10006ef0
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x10c], dl
inc eax
cmp eax, 0x20
jl 0x10006f17
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10006f02
lea eax, [ebp - 0x210]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x10c]
call fcn.10016c40
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006f95
cmp esi, ebx
je 0x10006f77
mov edx, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 1
push ebx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x10006f82
mov eax, dword [ebp - 4]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
jne 0x10006f95
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
or esi, 0xffffffff
jmp 0x10006f97
mov esi, ebx
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10006fa5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10007020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x10007068
nop
push 0x64
call ebx
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x10007050
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edi, edi
mov dword [esp + 0xc], edi
cmp esi, edi
je 0x10007097
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10007097
test byte [esp + 0xc], 2
jne 0x10007097
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10057bb0], edi
jne 0x100070a8
call fcn.10006fb0
test eax, eax
je 0x100070ef
push 0x104
lea ecx, [esp + 0x14]
push ecx
push edi
mov dword [0x10057bb0], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.10006fb0
test eax, eax
je 0x100070e3
push str.explorer.exe
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x100070e3
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1004cc20]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x7d0
call ebx
call fcn.10007020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008240
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [0x10057bc8]
push ebx
push esi
mov esi, dword [0x1004cc18]
mov al, 1
push edi
mov byte [ebp - 1], al
cmp ecx, dword [ebp + 8]
jne 0x10008279
mov edx, dword [0x10057bcc]
cmp edx, dword [ebp + 0xc]
jne 0x10008279
mov cl, byte [0x10057bad]
cmp cl, byte [ebp + 0x10]
je 0x100083c1
mov edx, dword [0x1004d74c]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov eax, dword [0x1004cc30]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [0x1004cc24]
push 0xffffffffffffffff
push ecx
call edi
mov edi, dword [esi + 0x2f4]
call fcn.100080b0
mov edx, dword [0x1004d6bc]
push 0
push 6
push edx
call fcn.1000d330
call fcn.10007fb0
mov eax, dword [0x10057c0c]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x10057c14]
mov ebx, eax
mov dword [ebp + 0x10], 0
test eax, eax
je 0x100082fb
lea ecx, [ebp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100082fb
test byte [ebp + 0x10], 2
jne 0x100082fb
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1004d6b8]
mov eax, dword [edx + 0x11b]
push 0x1004d66c
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0
push 0
push 0xf001f
push eax
mov dword [0x10057c14], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x10057c0c], eax
test eax, eax
jne 0x1000833f
xor bl, bl
jmp 0x100083a8
mov ecx, dword [0x1004d6b8]
mov edx, dword [0x10057bcc]
mov eax, dword [0x10057bc8]
movzx ecx, byte [ecx + 0x11a]
push edx
push eax
call fcn.10028500
test edi, edi
je 0x10008372
mov ecx, dword [0x1004c814]
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0x1004d6bc]
push 1
push 6
push edx
call fcn.1000d330
movzx eax, word [0x10057bcc]
movzx ecx, word [0x10057bc8]
movzx edx, byte [0x10057bad]
shl eax, 0x10
or eax, ecx
push eax
push edx
push 0x7e
call fcn.1000d330
mov bl, byte [ebp - 1]
mov eax, dword [0x1004cc24]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push eax
call esi
mov ecx, dword [0x1004cc30]
push ecx
call esi
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc