joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100243ee
Capabilities:
Create directory
Persist via run registry key

Disassembly:
mov eax, 0x1006b4d8
call fcn.10055640
sub esp, 0x30
push ebx
push esi
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
xor ebx, ebx
push SysReAllocString
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], ebx
call fcn.10038798
xor esi, esi
inc esi
push ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], 7
call fcn.1000205b
lea ecx, [ebp - 0x10]
call fcn.1000b767
lea eax, [ebp - 0x3c]
push eax
push str.Local_AppData
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.100388d3
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x10024458
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x10]
call fcn.100016dd
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jg 0x10024497
lea eax, [ebp - 0x3c]
push eax
push str.AppData
lea ecx, [ebp - 0x18]
call fcn.100388d3
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x10024486
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x10]
call fcn.100016dd
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jle 0x1002449f
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.Google
lea ecx, [ebp - 0x1c]
call fcn.100056ac
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 4
call fcn.100371f3
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 6
call fcn.10001337
push dword [ebp - 0x14]
call fcn.10057edf
cmp eax, 0xffffffff
pop ecx
jne 0x100244e6
call fcn.10057e5a
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.1000287c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [ebp - 0x20], esi
call fcn.10001337
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001337
push esi
lea ecx, [ebp - 0x3c]
call fcn.1000289a
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.100385bd
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1002b77a
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1006c130
call fcn.10055640
sub esp, 0x2c
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
lea ecx, [ebp - 0x20]
call fcn.10027454
mov ecx, dword [esi + 0x10]
cmp ecx, edi
mov dword [ebp - 4], edi
je 0x1002b7ad
push dword [esi + 8]
lea eax, [ebp - 0x20]
push eax
call fcn.10024362
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
mov bx, ax
shr ebx, 0xf
and bl, 1
cmp dword [ebp - 0x1c], edi
je 0x1002b7d3
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
sar eax, 3
mov dword [ebp - 0x10], eax
jne 0x1002b7f2
mov ecx, dword [esi + 4]
call fcn.1000e099
test al, al
je 0x1002b85a
mov ecx, dword [esi + 0x10]
cmp ecx, edi
je 0x1002b85a
push dword [esi + 8]
lea eax, [ebp - 0x20]
push eax
call fcn.10024362
test bl, bl
mov eax, dword [esi + 4]
mov edi, dword [eax + 0xd8]
je 0x1002b81c
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
call fcn.1001ed7d
push edi
lea ecx, [ebp - 0x38]
call fcn.1003b356
cmp ax, 1
je 0x1002b84a
jmp 0x1002b85a
lea eax, [esi + 0xe]
cmp byte [eax], 0
je 0x1002b84a
push eax
lea ecx, [ebp - 0x34]
call fcn.1001edf8
mov eax, dword [esi + 4]
push dword [eax + 0xd8]
lea ecx, [ebp - 0x34]
call fcn.1003b356
cmp ax, 1
jne 0x1002b85a
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1002b85a
push dword [esi + 8]
push edi
call fcn.1001fe5c
lea ecx, [ebp - 0x20]
call fcn.10028220
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1002e5da
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x24]
call fcn.1002e529
mov ecx, dword [esi + 0x28]
pop esi
jmp fcn.1002de87

Function at 0x10030417
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
add ecx, 4
mov eax, dword [ecx]
mov eax, dword [eax - 0xc]
push esi
push edi
lea eax, [eax + eax + 2]
push eax
call fcn.1001ae43
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push eax
push 1
push str.allow2
mov ebx, str.SoftwareGoogleNavClient1.1whitelist
push ebx
mov edi, SysReAllocString
push edi
call esi
push 0
call fcn.10056b94
pop ecx
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push str.lastmod
push ebx
push edi
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1003046d
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1006c86b
call fcn.10055640
sub esp, 0x10
push esi
and dword [ebp - 0x10], 0
push edi
push 4
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push str.lastmod
mov esi, str.SoftwareGoogleNavClient1.1whitelist
push esi
push SysReAllocString
mov edi, ecx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100304e7
cmp eax, dword [edi]
je 0x100304e7
push 0x10074514
push str.allow2
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.1001dd08
add esp, 0x10
and dword [ebp - 4], 0
push eax
lea ecx, [edi + 4]
call fcn.10009077
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.10001337
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10031a82
Capabilities:
Parse url

Disassembly:
mov eax, 0x1006c974
call fcn.10055640
sub esp, 0x244
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x50]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.10055e00
mov ebx, dword [ebp + 0xc]
add esp, 0xc
cmp ebx, edi
lea eax, [ebp - 0x250]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x100
je 0x10031acc
mov esi, dword [ebx]
jmp 0x10031ace
xor esi, esi
lea eax, [ebp - 0x50]
push eax
push edi
lea ecx, [ebp + 0xc]
call fcn.10002131
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
cmp eax, edi
je 0x10031aef
lea eax, [ebp - 0x250]
jmp 0x10031b13
push 0x10074514
lea ecx, [ebp - 0x14]
call fcn.100014a0
mov eax, dword [eax]
cmp eax, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], 1
je 0x10031b11
mov eax, dword [eax]
jmp 0x10031b13
xor eax, eax
mov ecx, dword [ebp + 8]
push eax
call fcn.100014a0
or dword [ebp - 0x10], 2
test byte [ebp - 0x10], 1
je 0x10031b35
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
je 0x10031b35
call fcn.100015ca
mov dword [ebp - 0x14], edi
cmp ebx, edi
je 0x10031b40
mov ecx, ebx
call fcn.100015ca
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10031bad
Capabilities:
Parse url

Disassembly:
mov eax, 0x1006c986
call fcn.10055640
sub esp, 0x40
push ebx
push esi
push edi
and dword [ebp - 4], 0
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.100028c7
call fcn.10031b52
test al, al
pop ecx
jne 0x10031c04
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push str.http:__
push eax
call fcn.1000d0ae
add esp, 0xc
push eax
lea ecx, [ebp + 8]
call fcn.1000428a
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10031c04
call fcn.100015ca
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.10055e00
mov edi, dword [ebp + 8]
xor ebx, ebx
inc ebx
add esp, 0xc
test edi, edi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
je 0x10031c39
mov esi, dword [edi]
jmp 0x10031c3b
xor esi, esi
lea eax, [ebp - 0x4c]
push eax
push 0
lea ecx, [ebp + 8]
call fcn.10002131
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
cmp dword [ebp - 0x40], 3
jne 0x10031d9f
xor ecx, ecx
cmp dword [ebp - 0x30], ecx
je 0x10031c6b
cmp dword [ebp - 0x2c], ecx
ja 0x10031da3
cmp dword [ebp - 0x28], ecx
je 0x10031c79
cmp dword [ebp - 0x24], ecx
ja 0x10031da3
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
je 0x10031da3
mov edx, dword [ebp - 0x38]
lea esi, [eax + edx*2]
cmp word [esi], 0x2e
mov edx, esi
je 0x10031ca2
cmp edx, eax
jb 0x10031da3
dec edx
dec edx
cmp word [edx], 0x2e
jne 0x10031c92
inc edx
inc edx
mov cx, word [edx]
cmp cx, 0x30
jb 0x10031d4d
cmp cx, 0x39
ja 0x10031d4d
sub esi, edx
and esi, 0xfffffffe
cmp esi, 6
jg 0x10031d9f
push eax
call fcn.100565c8
cmp eax, 0xa
pop ecx
je 0x10031d9f
cmp eax, 0xac
jne 0x10031d08
mov eax, dword [ebp - 0x3c]
add eax, 8
push eax
call fcn.100565c8
pop ecx
cmp eax, 0x10
jge 0x10031d9f
test edi, edi
je 0x10031d01
mov ecx, edi
call fcn.100015ca
mov al, 1
jmp 0x10031db0
cmp eax, 0xc0
jne 0x10031d39
mov esi, dword [ebp - 0x3c]
add esi, 8
push str.168.
push esi
call fcn.10001c3f
test eax, eax
pop ecx
pop ecx
jne 0x10031d9f
push str.0.2.
push esi
call fcn.10001c3f
test eax, eax
pop ecx
pop ecx
je 0x10031cf6
jmp 0x10031d9f
test eax, eax
je 0x10031d9f
cmp eax, ebx
je 0x10031d9f
cmp eax, 2
je 0x10031d9f
cmp eax, 0xe0
jmp 0x10031cf0
mov eax, esi
sub eax, edx
and eax, 0xfffffffe
cmp eax, 4
je 0x10031cf6
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1007b860]
xor ecx, ecx
mov cx, word [eax]
xor ebx, ebx
test cx, cx
je 0x10031d8a
mov edi, edx
sub edi, eax
cmp cx, word [edi + eax]
jne 0x10031d87
inc ebx
inc eax
inc eax
mov cx, word [eax]
test cx, cx
jne 0x10031d76
mov edi, dword [ebp + 8]
lea eax, [edx + ebx*2]
cmp eax, esi
je 0x10031cf6
add dword [ebp - 0x10], 4
cmp dword [ebp - 0x10], 0x40
jb 0x10031d5d
test edi, edi
jmp 0x10031da5
cmp edi, ecx
je 0x10031dae
mov ecx, edi
call fcn.100015ca
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x10036722
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x10036757
test byte [ebp - 4], 0x20
jne 0x10036757
cmp byte [ebp + 8], 0
mov al, 1
je 0x10036759
test byte [ebp - 4], al
je 0x10036759
push dword [0x10091328]
call fcn.100366da
pop ecx
leave
ret
xor al, al
leave
ret

Function at 0x10036ab8
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov eax, 0x1006d015
call fcn.10055640
sub esp, 0x60
push ebx
push esi
lea ecx, [ebp - 0x10]
call fcn.1000b767
lea eax, [ebp - 0x14]
push eax
xor ebx, ebx
push 0x106
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 0x18], 1
call fcn.1001dce9
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push str.CLSID0002DF01_0000_0000_C000_000000000046LocalServer32
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.1000b2bf
push 0x1007c6a8
lea ecx, [ebp - 0x10]
call fcn.1000f28a
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.1000f28a
push 0x1007c6a4
lea ecx, [ebp - 0x10]
call fcn.1000f28a
push 0x44
pop esi
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.10055e00
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x6c], esi
call fcn.1003170f
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10036b80
push dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x24]
call esi
mov bl, 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001337
mov ecx, dword [ebp - 0xc]
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10036e57
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
push ebx
xor ebx, ebx
test byte [0x10095438], 1
push esi
mov dword [ebp - 4], ebx
mov esi, 0x1009541c
jne 0x10036e99
or dword [0x10095438], 1
push ebx
mov ecx, esi
mov dword [0x10095434], 7
call fcn.1000205b
push 0x100730b1
call fcn.10055de2
pop ecx
cmp byte [0x10095418], bl
jne 0x10037010
push str.Mozilla_4.0__compatible_
mov ecx, esi
mov byte [0x10095418], 1
call fcn.10004249
push 0xffffffffffffffff
push ebx
push dword [ebp + 0xc]
mov ecx, esi
call fcn.1000337e
push str.__Windows
mov ecx, esi
call fcn.1000412b
push 0x114
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.10055e00
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10036f1b
push 0x10076730
push 0x1009541c
push dword [ebp + 8]
call fcn.1000e4d3
add esp, 0xc
jmp 0x1003701d
mov eax, dword [ebp - 0x108]
sub eax, ebx
je 0x10036fd6
dec eax
je 0x10036f72
dec eax
jne 0x10036fe2
cmp dword [ebp - 0x114], 4
ja 0x10036f46
push 0x1007c784
jmp 0x10036fdb
cmp dword [ebp - 0x114], 5
jne 0x10036fe2
cmp dword [ebp - 0x110], ebx
jne 0x10036f62
push str._2000
jmp 0x10036fdb
cmp dword [ebp - 0x110], 1
jne 0x10036fe2
push 0x1007c770
jmp 0x10036fdb
cmp dword [ebp - 0x114], 4
jne 0x10036fe2
cmp dword [ebp - 0x110], ebx
jne 0x10036fa0
push 0x1007c768
mov ecx, esi
call fcn.1000412b
cmp word [ebp - 0x102], 0x43
jne 0x10036fe2
push str._OSR2
jmp 0x10036fdb
cmp dword [ebp - 0x110], 0xa
jne 0x10036fc6
push 0x1007c754
mov ecx, esi
call fcn.1000412b
cmp word [ebp - 0x102], 0x41
jne 0x10036fe2
push 0x1007c74c
jmp 0x10036fdb
cmp dword [ebp - 0x110], 0x5a
jne 0x10036fe2
push 0x1007c744
jmp 0x10036fdb
push str._32s
mov ecx, esi
call fcn.1000412b
push dword [ebp - 0x110]
lea eax, [ebp - 0x17c]
push dword [ebp - 0x114]
push str.__d._d_
push eax
call fcn.10056928
add esp, 0x10
lea eax, [ebp - 0x17c]
push eax
mov ecx, esi
call fcn.1000412b
mov ecx, dword [ebp + 8]
push 0x1009541c
call fcn.1000570a
mov eax, dword [ebp + 8]
pop esi
pop ebx
leave
ret
Function at 0x10037024
Capabilities:
Create http request
Delete file
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov eax, 0x1006d071
call fcn.10055640
mov eax, 0x1050
call fcn.100570c0
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.GoogleClient
lea ecx, [ebp - 0x40]
call fcn.10005748
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x5c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.10036e57
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x1003706e
mov eax, dword [eax + 4]
jmp 0x10037071
add eax, 4
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
push 1
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x1c], eax
call fcn.1000289a
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x40]
call fcn.1000289a
cmp dword [ebp - 0x1c], ebx
je 0x100370ae
cmp dword [ebp + 0x14], ebx
je 0x100370b5
push dword [ebp + 0x18]
push ebx
call dword [ebp + 0x14]
test al, al
pop ecx
pop ecx
jne 0x100370b5
xor al, al
jmp 0x1003719b
mov eax, dword [ebp + 0x10]
push ebx
push 0x200
neg eax
sbb eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x10037190
push esi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x105c]
push ebx
push eax
call fcn.10055e00
add esp, 0xc
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x20], eax
je 0x10037186
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x14], ebx
jmp 0x10037163
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x14], eax
cmp dword [ebp + 0x14], ebx
je 0x1003713a
push dword [ebp + 0x18]
push dword [ebp - 0x14]
call dword [ebp + 0x14]
test al, al
pop ecx
pop ecx
je 0x1003717a
cmp dword [ebp - 0x10], ebx
je 0x1003717a
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x105c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1003717c
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
jne 0x1003717c
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x105c]
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x10037120
jmp 0x1003717c
mov bl, 1
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100371a8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push edi
push dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call edi
cmp eax, 0xffffffff
jne 0x100371be
xor al, al
pop edi
ret
cmp byte [esp + 0xc], 0
push esi
mov esi, eax
je 0x100371cd
or esi, 1
jmp 0x100371d0
and esi, 0xfffffffe
cmp esi, eax
jne 0x100371d8
mov al, 1
jmp 0x100371f0
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 0xc]
call edi
sub eax, esi
neg eax
sbb eax, eax
inc eax
pop esi
pop edi
ret

Function at 0x100382a2
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor edx, edx
xor eax, eax
mov ecx, edi
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x100382b2
mov byte [edi + 0x101], dl
mov byte [edi + 0x100], dl
xor esi, esi
mov dword [ebp - 4], 0x100
mov bl, byte [edi]
mov eax, dword [ebp + 8]
movzx ecx, dl
movzx edx, byte [ecx + eax]
add esi, edx
movzx eax, bl
add eax, esi
cdq
mov esi, 0x100
idiv esi
mov eax, dword [ebp + 0x10]
movzx esi, dl
add eax, esi
mov dl, byte [eax]
mov byte [edi], dl
mov byte [eax], bl
lea eax, [ecx + 1]
cdq
idiv dword [ebp + 0xc]
inc edi
dec dword [ebp - 4]
jne 0x100382d1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1003830c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x10]
mov al, byte [ecx + 0x100]
mov dl, byte [ecx + 0x101]
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
jle 0x100383a8
push esi
push edi
movzx esi, al
movzx edi, dl
mov dword [ebp - 0xc], ebx
jmp 0x1003833c
mov edi, dword [ebp - 0x10]
lea eax, [esi + 1]
cdq
mov esi, 0x100
idiv esi
movzx esi, dl
mov bl, byte [esi + ecx]
mov byte [ebp + 0x13], dl
movzx eax, bl
add eax, edi
cdq
mov edi, 0x100
idiv edi
movzx eax, dl
mov dword [ebp - 0x10], eax
add eax, ecx
mov byte [ebp - 1], dl
mov dl, byte [eax]
mov byte [esi + ecx], dl
mov edx, dword [ebp - 0xc]
mov byte [eax], bl
mov eax, dword [ebp + 8]
lea edi, [edx + eax]
movzx edx, byte [esi + ecx]
movzx eax, bl
add eax, edx
cdq
mov ebx, 0x100
idiv ebx
movzx eax, dl
mov al, byte [eax + ecx]
xor byte [edi], al
inc dword [ebp - 8]
movsx eax, word [ebp - 8]
cmp eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
jl 0x10038339
mov al, byte [ebp + 0x13]
mov dl, byte [ebp - 1]
pop edi
pop esi
mov byte [ecx + 0x100], al
mov byte [ecx + 0x101], dl
pop ebx
leave
ret

Function at 0x1003867a
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx]
test eax, eax
jne 0x10038684
xor al, al
jmp 0x100386a2
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x18]
push 0
push dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
ret 0x10
Function at 0x100386a5
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx]
test eax, eax
jne 0x100386af
xor al, al
jmp 0x100386cd
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x18]
push 0
push dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
ret 0x10

Function at 0x10038a36
Capabilities:
Delete registry value
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
push dword [esp + 0x10]
mov esi, ecx
push eax
call fcn.10055eac
test eax, eax
pop ecx
pop ecx
jne 0x10038a61
push dword [esp + 0xc]
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x10038a7b
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
shl ecx, 1
push ecx
push eax
push 1
push dword [esp + 0x18]
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
pop esi
ret 0xc

Function at 0x10038a80
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1006d1b2
call fcn.10055640
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
call fcn.1000b767
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [esi + 4]
mov dword [ebp - 0x14], ebx
push dword [esi]
mov dword [ebp - 0x18], 2
call edi
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jbe 0x10038b02
mov ecx, dword [esi + 4]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x14]
push ecx
add eax, 2
push eax
lea ecx, [ebp - 0x10]
call fcn.1001dce9
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
push dword [esi]
call edi
cmp dword [ebp - 0x14], ebx
jbe 0x10038b02
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.1000b2bf
jmp 0x10038b0d
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
call fcn.100016dd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.1000287c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001337
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x10038b6a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea esi, [ecx + 0x28]
push 0x10
mov edx, esi
pop edi
mov eax, dword [edx]
mov ebx, eax
mov dword [ebp - 8], eax
shl ebx, 0x10
and eax, 0xff00
or ebx, eax
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
xor eax, eax
mov ah, byte [ebp - 6]
or ebx, eax
mov dword [edx], ebx
add edx, 4
dec edi
jne 0x10038b7a
push 0x40
mov edx, esi
pop edi
mov eax, dword [edx + 0x34]
xor eax, dword [edx + 0x20]
xor eax, dword [edx + 8]
xor eax, dword [edx]
add edx, 4
mov ebx, eax
shr ebx, 0x1f
add eax, eax
or ebx, eax
dec edi
mov dword [edx + 0x3c], ebx
jne 0x10038ba8
mov eax, dword [ecx + 0x14]
and dword [ebp - 4], 0
mov dword [ecx], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0x1c]
mov dword [ecx + 8], eax
mov eax, dword [ecx + 0x20]
mov dword [ecx + 0xc], eax
mov eax, dword [ecx + 0x24]
mov dword [ecx + 0x10], eax
mov dword [ebp - 8], esi
cmp dword [ebp - 4], 0x14
mov edi, dword [ecx]
mov eax, dword [ecx + 0xc]
mov ebx, dword [ecx + 8]
mov esi, dword [ecx + 4]
jae 0x10038c08
mov edx, esi
not edx
and edx, eax
mov eax, esi
and eax, ebx
or edx, eax
jmp 0x10038c26
cmp dword [ebp - 4], 0x28
jb 0x10038c20
cmp dword [ebp - 4], 0x3c
jae 0x10038c20
mov edx, ebx
or edx, eax
and edx, esi
and ebx, eax
or edx, ebx
jmp 0x10038c26
mov edx, esi
xor edx, ebx
xor edx, eax
cmp dword [ebp - 4], 0x14
jae 0x10038c33
mov ebx, 0x5a827999
jmp 0x10038c52
cmp dword [ebp - 4], 0x28
jae 0x10038c40
mov ebx, 0x6ed9eba1
jmp 0x10038c52
cmp dword [ebp - 4], 0x3c
sbb ebx, ebx
and ebx, 0xc4b8fb06
add ebx, 0xca62c1d6
mov eax, edi
shr eax, 0x1b
shl edi, 5
or eax, edi
mov edi, dword [ebp - 8]
add eax, dword [edi]
add dword [ebp - 8], 4
add eax, dword [ecx + 0x10]
add eax, ebx
add eax, edx
mov edx, dword [ecx + 0xc]
mov dword [ecx + 0x10], edx
mov edx, dword [ecx + 8]
mov dword [ecx + 0xc], edx
mov edx, esi
shr esi, 2
shl edx, 0x1e
or edx, esi
mov esi, dword [ecx]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x50
mov dword [ecx + 8], edx
mov dword [ecx + 4], esi
mov dword [ecx], eax
jb 0x10038be9
mov esi, dword [ecx + 0x14]
add esi, eax
mov eax, dword [ecx + 4]
add eax, dword [ecx + 0x18]
pop edi
mov dword [ecx + 0x18], eax
mov eax, dword [ecx + 0x1c]
add edx, eax
mov eax, dword [ecx + 0xc]
add eax, dword [ecx + 0x20]
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x20], eax
mov eax, dword [ecx + 0x10]
add eax, dword [ecx + 0x24]
and dword [ecx + 0x168], 0
pop esi
mov dword [ecx + 0x1c], edx
mov dword [ecx + 0x24], eax
pop ebx
leave
ret