joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c9b80
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4c9bc9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4ca040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51ae40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004c9bf0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004c9c70
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004c9c70
lea ecx, [esi + 0xc]
call fcn.00508043
lea ecx, [esi + 0x10]
call fcn.00508043
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004cb200
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004cb200
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004cb200
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.005080b8
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.005080b8
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4d4d50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x4d4d9c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x4d4d9c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x4d4d86
push eax
call ebp
test ax, ax
jl 0x4d4d94
inc esi
add edi, 4
cmp esi, 6
jb 0x4d4d78
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.004d4a50
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4d7b70
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x4d7bd0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x4d7bd0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x4d7bd0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x4d7bd0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x4d7be0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x4e3860
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4e386b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4e396e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5500a0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5500a0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5500a0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5500a0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5500a0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5500a0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5500a0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5500a0]
xor eax, edx
inc ecx
dec edi
jne 0x4e3886
pop edi
test esi, esi
je 0x4e3990
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5500a0]
xor eax, edx
inc ecx
dec esi
jne 0x4e3972
pop esi
pop ebx
not eax
ret
Function at 0x50a50f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x50a547
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0050855f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00508537
jmp 0x50a553
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x50bc01
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x50bc43
call fcn.00511f4c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x50bc43
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x50bc3a
xor eax, eax
jmp 0x50bc4b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0050bc51
pop edi
pop esi
pop ebx
ret 4

Function at 0x51247c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5124aa
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5124c8
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005123e2
jmp 0x5124c8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5124c8
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005123e2
test edi, edi
mov eax, edi
jne 0x5124b2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x101660d
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
and ebx, 0x8000
neg ebx
sbb ebx, ebx
push 4
inc ebx
pop eax
inc ebx
call fcn.01016c80
mov dword [ebp - 0x10], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x101675f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
and dword [ebp - 8], 0
mov edi, dword [ebp - 0x58]
mov esi, ebx
dec esi
neg esi
sbb esi, esi
and esi, 0x103
inc esi
mov dword [ebp - 0x14], edi
cmp ebx, 2
jne 0x10166d0
and dword [ebp - 0xc], 0
push 0x10013e8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x10166a7
push 0x10013cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10166d0
push 0x10013b4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10166d0
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
call eax
cmp eax, 1
jne 0x10166d0
mov eax, dword [ebp - 0xc]
test eax, eax
jbe 0x10166d0
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
lea eax, [edi - 1]
push ecx
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.010165e1
add esp, 0xc
test eax, eax
jl 0x101675f
mov eax, dword [ebp - 0xc]
not eax
and dword [ebp - 8], eax
je 0x1016708
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 8]
call fcn.010165e1
add esp, 0xc
test eax, eax
jl 0x101675f
lea eax, [edi + edi]
cmp dword [ebp - 8], eax
jae 0x1016713
mov dword [ebp - 8], eax
dec edi
not edi
and edi, dword [ebp - 0x10]
sub edi, dword [ebp - 8]
cmp ebx, 1
jne 0x1016726
push 0x11
pop eax
jmp 0x1016729
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
add eax, ecx
cmp edi, eax
jb 0x101675f
push 4
push 0x1000
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x101675f
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x101675f
xor eax, eax
inc eax
jmp 0x1016761
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01016c45
leave
ret
Function at 0x1016b6a
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x102e780
call fcn.010174b4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1033224
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x101697f
cmp eax, esi
jne 0x1016972
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1016982
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1016959
xor esi, esi
inc esi
mov eax, dword [0x1033220]
cmp eax, esi
jne 0x1016995
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10169d0
mov eax, dword [0x1033220]
test eax, eax
jne 0x10169ca
mov dword [0x1033220], esi
push 0x1001384
push 0x1001378
call fcn.010168d6
pop ecx
pop ecx
test eax, eax
je 0x10169d0
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1016a9a
mov dword [0x1032ae4], esi
mov eax, dword [0x1033220]
cmp eax, esi
jne 0x10169f4
push 0x1001374
push 0x100135c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1033220], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1016a01
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1033234], ebx
je 0x1016a22
push 0x1033234
call fcn.01017429
pop ecx
test eax, eax
je 0x1016a22
push ebx
push 2
push ebx
call dword [0x1033234]
push dword [0x1032acc]
push dword [0x1032ad0]
push dword [0x1032ac8]
call fcn.01016465
add esp, 0xc
mov dword [0x1032ae0], eax
cmp dword [0x1032ad4], ebx
jne 0x1016a80
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1032ae4], ebx
jne 0x1016a8e
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1032ae0]
call fcn.010174f9
ret
call fcn.010175f9
jmp 0x1016937

Function at 0x1019287
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
push edi
xor edi, edi
push edi
push edi
mov esi, ecx
push esi
push 0x1019128
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, edi
je 0x10192b2
mov dword [esi + 0xc], 1
jmp 0x10192d6
mov edi, 0x4106
push edi
call fcn.01027916
test eax, eax
je 0x10192d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001b90
push edi
call fcn.010279c4
add esp, 0xc
mov eax, dword [esi + 0xc]
pop edi
pop esi
ret
Function at 0x101a0a5
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push 3
mov dword [ebp - 0x808], 0x400
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x101a0ff
mov esi, 0x4102
push esi
call fcn.01027916
test eax, eax
je 0x101a150
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002b90
jmp 0x101a130
mov eax, dword [ebp - 0x808]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x808], eax
cmp eax, 0x800
jbe 0x101a13b
mov esi, 0x4102
push esi
call fcn.01027916
test eax, eax
je 0x101a150
push dword [ebp - 0x808]
push 0x1002ae0
push esi
call fcn.010279c4
add esp, 0xc
jmp 0x101a150
push eax
lea eax, [ebp - 0x804]
push eax
push 1
push 0x100282c
push esi
call fcn.0101cfee
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01016c45
leave
ret 4
Function at 0x101ca60
Capabilities:
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x194]
push eax
push 0x202
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor esi, esi
mov dword [ebp - 0x198], eax
cmp eax, esi
je 0x101cac0
mov esi, 0x4102
push esi
call fcn.01027916
test eax, eax
je 0x101cb32
push dword [ebp - 0x198]
push 0x10042f0
push esi
call fcn.010279c4
add esp, 0xc
jmp 0x101cb32
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x18], eax
cmp eax, esi
jne 0x101cadf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x198], eax
jmp 0x101cb32
push ebx
push 0x10042d0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
jne 0x101caff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x198], eax
jmp 0x101cb31
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10042b0
push ebx
call esi
push 0x1004298
push ebx
mov dword [edi + 0x34], eax
call esi
push 0x1004280
push ebx
mov dword [edi + 0x38], eax
call esi
push 0x1004268
push ebx
mov dword [edi + 0x3c], eax
call esi
mov dword [edi + 0x40], eax
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x198], eax
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.01016c45
leave
ret

Function at 0x101cd98
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
je 0x101cdcc
test eax, eax
je 0x101cdc9
push eax
push 0x3dd
push 0x1002c3c
push 0x1004518
call fcn.0102880e
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x101e98d
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x128], 0
and dword [ebp - 0x124], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
setne bl
mov edi, 0x4104
test bl, bl
je 0x101ea1a
cmp dword [ebp - 0x11c], 6
jb 0x101e9f0
mov dword [ebp - 0x124], 0x10061c8
jmp 0x101ea39
cmp dword [ebp - 0x11c], 5
jne 0x101ea0e
cmp dword [ebp - 0x118], 1
jb 0x101ea0e
mov dword [ebp - 0x124], 0x1006178
jmp 0x101ea39
mov dword [ebp - 0x124], 0x100613c
jmp 0x101ea39
push edi
call fcn.01027916
test eax, eax
je 0x101ea97
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10060b0
push edi
call fcn.010279c4
add esp, 0xc
test bl, bl
je 0x101ea97
push 0
lea eax, [ebp - 0x128]
push eax
push 1
push dword [ebp - 0x124]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
setne bl
test bl, bl
jne 0x101ea7d
push edi
call fcn.01027916
test eax, eax
je 0x101ea97
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1006008
push edi
call fcn.010279c4
add esp, 0xc
jmp 0x101ea97
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x128]
and dword [esi + 8], 0
mov dword [esi + 4], eax
mov dword [esi], 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.01016c45
leave
ret 4
Function at 0x101ead4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
cmp byte [ebp + 8], bl
je 0x101eb6d
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov edi, eax
cmp edi, ebx
je 0x101eb24
mov esi, 0x4104
push esi
call fcn.01027916
test eax, eax
je 0x101ec34
push edi
push 0x10065e0
jmp 0x101ebe9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
mov edi, eax
cmp edi, ebx
je 0x101eb56
mov esi, 0x4104
push esi
call fcn.01027916
test eax, eax
je 0x101ec34
push edi
push 0x1006560
jmp 0x101ebe9
push dword [ebp - 0x18]
push 0x25
push 0x1033060
call fcn.01016e83
add esp, 0xc
jmp 0x101ec11
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push 0x10064b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebx
je 0x101eba8
mov esi, 0x8104
push esi
call fcn.01027916
test eax, eax
je 0x101ec34
push edi
push 0x1006418
jmp 0x101ebe9
lea eax, [ebp - 0x20]
push eax
push 0x1033060
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x1006404
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0x4a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, ebx
je 0x101ebf4
mov esi, 0x8104
push esi
call fcn.01027916
test eax, eax
je 0x101ec34
push edi
push 0x1006360
push esi
call fcn.010279c4
add esp, 0xc
jmp 0x101ec34
cmp dword [ebp - 0x20], 0x48
jb 0x101ec15
cmp dword [ebp - 0x24], 1
jne 0x101ec15
cmp word [0x10330a8], bx
je 0x101ec11
xor eax, eax
mov word [0x10330a8], ax
xor edi, edi
jmp 0x101ec34
push 0xd
pop edi
mov esi, 0x8104
push esi
call fcn.01027916
test eax, eax
je 0x101ec34
push 0x10062b0
push esi
call fcn.010279c4
pop ecx
pop ecx
cmp dword [ebp - 0x1c], ebx
je 0x101ec42
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], ebx
je 0x101ec51
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp edi, ebx
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.01016c45
leave
ret 4
Function at 0x101ec6e
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0101e98d
test al, al
jne 0x101ec9b
push 0xe
pop esi
jmp 0x101ed30
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x2001f
push 1
push ebx
push ebx
push 0x10064b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
je 0x101ecdd
mov edi, 0x8104
push edi
call fcn.01027916
test eax, eax
je 0x101ed30
push esi
push 0x1006708
jmp 0x101ed27
mov ecx, 0x1033060
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x101ece7
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push 0x1006404
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
je 0x101ed30
mov edi, 0x4104
push edi
call fcn.01027916
test eax, eax
je 0x101ed30
push esi
push 0x1006660
push edi
call fcn.010279c4
add esp, 0xc
cmp dword [ebp - 4], ebx
je 0x101ed3e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
call fcn.0101eaaf
xor eax, eax
cmp esi, ebx
pop edi
pop esi
sete al
pop ebx
leave
ret

Function at 0x101ed58
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x101eddc
push esi
push edi
lea eax, [ebp + 8]
push eax
push 2
push 0
push 0x10064b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x101edbc
push 0x1006404
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, 0xc104
push esi
mov edi, eax
call fcn.01027916
test eax, eax
je 0x101edb1
push edi
push 0x1006820
push esi
call fcn.010279c4
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x101edda
mov esi, 0xc104
push esi
call fcn.01027916
test eax, eax
je 0x101edda
push edi
push 0x10067a8
push esi
call fcn.010279c4
add esp, 0xc
pop edi
pop esi
xor eax, eax
mov word [0x1033060], ax
pop ebp
ret 4
Function at 0x10204a1
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push 0x270
mov eax, 0x102db2f
call fcn.01029310
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x24c]
call fcn.01022387
xor ebx, ebx
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], ebx
call fcn.010209e6
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
cmp eax, 0xffffffff
mov dword [ebp - 0x250], eax
setne al
cmp al, bl
je 0x102059b
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1020557
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x27c]
call fcn.010199b6
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 2
call fcn.0102045c
push ebx
push 1
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 1
call fcn.01019504
push esi
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x250]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
cmp eax, ebx
jne 0x102050b
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x24c]
call fcn.01024ae8
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
lea ecx, [ebp - 0x24c]
movsd dword es:[edi], dword [esi]
call fcn.010244d6
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], bl
call fcn.010201c7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.010223d1
xor eax, eax
call fcn.010293a2
ret 4

Function at 0x10205c7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 1
xor ebx, ebx
push ebx
mov edi, 0x1007ce0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x102061a
mov esi, 0xc105
push esi
call fcn.01027916
test eax, eax
je 0x102068d
push edi
push 0x1007f18
push esi
call fcn.010279c4
add esp, 0xc
jmp 0x102068d
push 4
pop esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
mov ebx, 0x1007d40
push ebx
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1020661
mov esi, 0xc105
push esi
call fcn.01027916
test eax, eax
je 0x102068d
push ebx
push edi
push 0x1007e28
push esi
call fcn.010279c4
add esp, 0x10
jmp 0x102068d
cmp dword [ebp - 0x10], esi
je 0x102067e
mov esi, 0xc105
push esi
call fcn.01027916
test eax, eax
je 0x102068d
push ebx
push edi
push 0x1007d58
jmp 0x1020656
mov eax, dword [ebp - 0x14]
cmp eax, 2
mov dword [ebp - 8], eax
jl 0x102068d
and dword [ebp - 8], 0
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x102069f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret