joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431b50
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x88
push 0xffffffffffffffff
push 0x46a04b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [0x489218], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
mov ecx, 0x41
lea ebx, [ebp]
call fcn.004317b0
add esp, 0xc
xor eax, eax
mov word [ebp + 0x80], ax
xor edi, edi
mov ecx, ebx
push ecx
mov ebx, 1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x431c8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x431bf5
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0
call fcn.00431900
test eax, eax
je 0x431c0c
mov dword [0x489218], eax
jmp 0x431c70
call fcn.00432160
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], bl
test eax, eax
je 0x431c24
push esi
push eax
call fcn.00431fa0
jmp 0x431c26
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x489218], eax
test eax, eax
jne 0x431c44
mov dword [ebp - 0x1c], ebx
push 0x47cb60
lea edx, [ebp - 0x1c]
push edx
call fcn.0044327c
mov edi, ebx
mov dword [ebp - 0x24], edi
push eax
call fcn.004319f0
add esp, 4
test eax, eax
jne 0x431c6b
mov dword [ebp - 0x18], 3
push 0x47cb60
lea eax, [ebp - 0x18]
push eax
call fcn.0044327c
mov eax, dword [0x489218]
add dword [eax + 0x5bc], ebx
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test edi, edi
jne 0x431c8f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x489218
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.0043b155
add ebp, 0x88
mov esp, ebp
pop ebp
ret
Function at 0x431d70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469d30
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x483260]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x489218]
xor edi, edi
cmp ecx, edi
jne 0x431dbb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x431dc8
mov dword [ebp - 0x14], edi
jmp 0x431de0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x431e7d
mov ecx, dword [0x489218]
mov eax, dword [ecx]
cmp eax, edi
je 0x431da7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x431da7
mov dword [ebp - 4], edi
mov ebx, 0x489218
call fcn.00431e90
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x431e1e
mov dword [ebp - 0x18], 1
push 0x47cb60
lea eax, [ebp - 0x18]
push eax
call fcn.0044327c
mov ecx, esi
mov eax, dword [0x489218]
call fcn.00432120
test eax, eax
jne 0x431e43
mov dword [ebp - 0x1c], 4
push 0x47cb60
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0044327c
mov dword [ebp - 4], 0xffffffff
jmp 0x431e68
mov edx, dword [0x489218]
mov eax, dword [edx]
test eax, eax
je 0x431e7b
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431e90
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x431ebd
xor ecx, ecx
jmp 0x431ec9
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x431f7d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x431ef0
mov dword [esp + 0xc], esi
jmp 0x431f50
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x431f49
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x431f3c
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x431f50
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x431f50
push 0x4794b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x431f50
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x431f73
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x431ee2
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x431f91
mov ecx, dword [ebx]
add ecx, 8
call fcn.00432220
test eax, eax
je 0x431f91
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret
Function at 0x431fa0
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x46a01b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x483260]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.0043e1d0
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x432038
push 0x47cb60
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.0044327c
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x4330e0
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x80
mov eax, dword [0x483260]
xor eax, esp
mov dword [esp + 0x7c], eax
push ebx
push ebp
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.00434350
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x94]
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
mov dword [esp + 0x2c], 0xc3d2e1f0
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x78], ebx
call fcn.00435610
add esp, 4
lea eax, [esp + 0x18]
lea ecx, [esp + 0x78]
call fcn.00435700
mov dword [esp + 0x10], ebx
jmp 0x433180
movzx ebx, byte [esp + ebx + 0x78]
mov eax, ebx
shr eax, 4
movzx ecx, word [eax*2 + str.0123456789abcdef]
mov eax, dword [esi]
mov ebp, dword [eax - 0xc]
mov edx, 1
sub edx, dword [eax - 4]
mov eax, dword [eax - 8]
lea edi, [ebp + 1]
sub eax, edi
or edx, eax
mov dword [esp + 0x14], ecx
jge 0x4331b8
mov ecx, edi
mov eax, esi
call fcn.00434eb0
mov ecx, dword [esi]
mov dx, word [esp + 0x14]
mov word [ecx + ebp*2], dx
test edi, edi
jl 0x433251
mov eax, dword [esi]
cmp edi, dword [eax - 8]
jg 0x433251
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + edi*2], cx
mov eax, dword [esi]
and ebx, 0xf
movzx ebp, word [ebx*2 + str.0123456789abcdef]
mov ebx, dword [eax - 0xc]
mov edx, 1
sub edx, dword [eax - 4]
mov eax, dword [eax - 8]
lea edi, [ebx + 1]
sub eax, edi
or edx, eax
jge 0x43320a
mov ecx, edi
mov eax, esi
call fcn.00434eb0
mov ecx, dword [esi]
mov word [ecx + ebx*2], bp
test edi, edi
jl 0x433251
mov eax, dword [esi]
cmp edi, dword [eax - 8]
jg 0x433251
mov ebx, dword [esp + 0x10]
mov dword [eax - 0xc], edi
mov edx, dword [esi]
inc ebx
xor eax, eax
mov word [edx + edi*2], ax
mov dword [esp + 0x10], ebx
cmp ebx, 0x14
jb 0x433180
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043b155
add esp, 0x80
ret
push 0x80070057
call fcn.00403221
int3
Function at 0x4335e0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x469fe8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x483260]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea eax, [esp + 0x14]
push eax
push 0x202
push ebx
push str.SOFTWARE360SafeLiveup
mov dword [esp + 0x38], ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4336ec
mov eax, dword [esi]
mov edi, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x200
je 0x43369e
mov ecx, dword [esp + 0x30]
mov ecx, dword [ecx]
test ecx, ecx
jne 0x433675
push 0x80004005
call fcn.00403221
push ecx
push eax
call fcn.0043f739
add esp, 8
test eax, eax
je 0x43369e
mov esi, dword [esi]
test esi, esi
je 0x43369e
push esi
call ebp
lea edx, [eax + eax + 2]
push edx
push esi
push 1
push 0
push str.m2_old
push edi
call ebx
mov eax, dword [esp + 0x30]
mov esi, dword [eax]
test esi, esi
jne 0x4336ad
lea eax, [esi + 0xd]
jmp 0x4336c2
push esi
call ebp
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0
push 0x479b9c
push edi
call ebx
xor edx, edx
test eax, eax
sete dl
mov esi, edx
test edi, edi
je 0x4336d6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x435440
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4354ae
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x43547f
cmp eax, 2
jne 0x43549a
mov eax, dword [esp]
test esi, esi
je 0x4354a8
test eax, eax
je 0x4354a3
test al, 1
jne 0x43549a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x4354a8
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x436fd0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x454
mov eax, dword [0x483260]
xor eax, esp
mov dword [esp + 0x44c], eax
mov eax, dword [esp + 0x458]
push ebx
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x468]
push edi
mov dword [eax], ebp
mov dword [esp + 0x30], ecx
mov dword [ecx], ebp
lea ecx, [esp + 0x28]
push ecx
push 8
push ebp
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x437038
mov edi, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x24], eax
jmp 0x437044
xor eax, eax
jmp 0x437166
mov edi, dword [esp + 0x38]
lea edx, [esp + 0x40]
push edx
push ebp
push ebp
push ebp
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x264]
push edx
push eax
mov esi, 0x104
push edi
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x437152
lea eax, [esp + 0x20]
push eax
push 1
push ebp
lea ecx, [esp + 0x25c]
push ecx
push edi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esp + 0x1c], ebp
cmp eax, ebp
jne 0x4370e5
mov ebx, dword [esp + 0x20]
push str.NetCfgInstanceId
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], esi
push edx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x50]
mov dword [esp + 0x20], ebx
call fcn.00435440
test eax, eax
jne 0x4370d2
mov eax, dword [esp + 0x34]
push eax
mov ecx, esi
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4370fb
cmp ebx, ebp
je 0x4370e1
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x24]
inc eax
cmp eax, 0x100
mov dword [esp + 0x24], eax
jl 0x437040
jmp 0x437152
push str.BusType
lea edx, [esp + 0x1c]
push edx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x50]
mov dword [esp + 0x1c], 0x104
call fcn.00435440
test eax, eax
jne 0x437147
mov eax, esi
push eax
call fcn.0043f08a
add esp, 4
cmp eax, 5
jne 0x437147
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [ecx], 1
push edx
mov ecx, ebx
call fcn.00436e90
add esp, 4
cmp ebx, ebp
je 0x437152
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x437161
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x45c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043b155
add esp, 0x454
ret
Function at 0x43ac32
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x485fc0], 0
push esi
jne 0x43aba0
call fcn.0043aab4
test eax, eax
je 0x43abe3
mov eax, dword [0x485fc0]
cmp eax, 1
jne 0x43abc1
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x43abe3
pop esi
ret
push eax
call dword [0x485fc8]
test eax, eax
jne 0x43ac2b
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x43abe7
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x485fc0]
call dword [0x485fc8]
mov edi, eax
test edi, edi
je 0x43ac0c
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x43ac28
mov edi, esi
add esi, 0xff0
push edi
push dword [0x485fc0]
call dword [0x485fc4]
add edi, 0x10
cmp edi, esi
jb 0x43ac14
mov eax, edi
pop edi
pop esi
ret
jmp 0x43ab8d

Function at 0x43b155
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x483260]
jne 0x43b15f
repz ret
jmp fcn.00443b97

Function at 0x4564f1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00444de4
and dword [ebp - 4], 0
cmp dword [0x486b84], 0
mov ebx, eax
jne 0x4565a2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x456653
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x456653
push eax
call fcn.00444d72
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x486b84], eax
call esi
push eax
call fcn.00444d72
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x486b88], eax
call esi
push eax
call fcn.00444d72
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x486b8c], eax
call esi
push eax
call fcn.00444d72
pop ecx
mov dword [0x486b94], eax
test eax, eax
je 0x4565a2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00444d72
pop ecx
mov dword [0x486b90], eax
mov eax, dword [0x486b90]
cmp eax, ebx
je 0x4565fa
cmp dword [0x486b94], ebx
je 0x4565fa
push eax
call fcn.00444ded
push dword [0x486b94]
mov esi, eax
call fcn.00444ded
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4565fa
test edi, edi
je 0x4565fa
call esi
test eax, eax
je 0x4565f1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4565f1
test byte [ebp - 0xc], 1
jne 0x4565fa
or dword [ebp + 0x10], 0x200000
jmp 0x456633
mov eax, dword [0x486b88]
cmp eax, ebx
je 0x456633
push eax
call fcn.00444ded
pop ecx
test eax, eax
je 0x456633
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x456633
mov eax, dword [0x486b8c]
cmp eax, ebx
je 0x456633
push eax
call fcn.00444ded
pop ecx
test eax, eax
je 0x456633
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x486b84]
call fcn.00444ded
pop ecx
test eax, eax
je 0x456653
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x456655
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001b97a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1001b989
pop dword [ebp - 0x1c]
mov eax, 0x1001b989
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x38e5b
push 0
mov eax, 0x546c93f8
add eax, 0xbb95ad74
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x3a50a9e2
sub ecx, 0x3a5065fa
mov edx, eax
mov ebx, 0x10038c00
add ebx, dword [ebp - 0x1c]
mov esi, 0xd0f983e1
add esi, 0xcfcaaa8d
xor dword [ebp - 8], 0x244138ec
mov edi, dword [ebx]
add dword [ebp - 0x18], 0x7e170f65
sub edi, esi
sub dword [ebp - 0x18], eax
mov dword [edx], edi
add dword [ebp - 8], 0x72c52387
add edx, 4
add ebx, 0x591267cc
add ebx, 0xa6ed9838
loop 0x1001b9dd
add eax, 0x10273
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x6d01378d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x6d030030]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x6d013830
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.6d02357a
pop ecx
pop ecx
test eax, eax
je 0x6d013819
test ebx, ebx
je 0x6d01380d
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.6d02357a
pop ecx
pop ecx
test eax, eax
jle 0x6d013819
push ebx
call fcn.6d015895
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.6d015874
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x6d0137da
xor edi, edi
cmp ebx, edi
jne 0x6d013834
xor eax, eax
jmp 0x6d0138a0
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x6d013863
call fcn.6d015895
pop ecx
cmp dword [ebp - 0x70], edi
je 0x6d013830
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x6d013830
call fcn.6d015895
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d013853
cmp dword [ebp - 0x70], edi
je 0x6d013896
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.6d015874
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d018259
add ebp, 0x9c
leave
ret
Function at 0x6d01555d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x294
mov eax, dword [0x6d030030]
xor eax, ebp
mov dword [ebp + 0x210], eax
mov eax, dword [ebp + 0x21c]
push ebx
push esi
push edi
push 0x10
pop edi
mov dword [ebp - 0x78], eax
call fcn.6d0153ca
push 8
mov esi, eax
call fcn.6d01582d
mov ebx, eax
pop ecx
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x6d0155c8
mov dword [ebx], eax
lea eax, [ebp + 0xfc]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x6d0155cf
and dword [ebx + 4], 0
jmp 0x6d0155e4
xor eax, eax
jmp 0x6d0156af
lea eax, [ebp - 0x70]
push eax
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindNextFileA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x44]
and edi, eax
test edi, edi
je 0x6d015695
push edi
call fcn.6d017a10
pop ecx
cmp eax, 4
jl 0x6d0155bb
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x6d0155bb
add eax, 0xfffffffd
push 0x6d02982c
push eax
mov dword [ebp - 0x74], eax
call fcn.6d018270
pop ecx
pop ecx
test eax, eax
je 0x6d01562a
push 0x6d029828
push dword [ebp - 0x74]
call fcn.6d018270
pop ecx
pop ecx
test eax, eax
jne 0x6d0155bb
push 0x3b
push edi
call fcn.6d0193f0
pop ecx
pop ecx
test eax, eax
jne 0x6d0155bb
push dword [ebp - 0x78]
call fcn.6d017a10
push edi
mov ebx, eax
call fcn.6d017a10
mov dword [ebp - 0x74], eax
add eax, ebx
push eax
call fcn.6d01582d
lea ecx, [ebx - 1]
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
call fcn.6d02357a
mov eax, dword [ebp - 0x74]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x7c]
lea eax, [edi + ebx - 1]
push eax
call fcn.6d02357a
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.6d015420
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x80]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x6d0155bb
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindClose]
push dword [ebx + 4]
call fcn.6d015895
push ebx
call fcn.6d015895
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d018259
add ebp, 0x214
leave
ret

Function at 0x6d018259
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d030030]
jne 0x6d018263
repz ret
jmp fcn.6d01e721
Function at 0x6d02357a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x6d023589
pop dword [ebp - 0x50]
mov eax, 0x57557c02
add eax, 0x15acb987
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd8d0296c
add dword [ebp - 0x60], 0x75821bdf
mov dword [ebp - 0x5c], 0x2231ab65
sub dword [ebp - 0x5c], 0xeffe5f20
mov dword [ebp - 0x58], 0x8326bc59
add dword [ebp - 0x58], 0xc92587d5
mov dword [ebp - 0x54], 0x6ebc54ad
sub dword [ebp - 0x54], 0x6ebc54ad
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x4aa5ef3e
add dword [ebp - 0x60], 0x29cc7a18
mov dword [ebp - 0x5c], 0xff8839f
sub dword [ebp - 0x5c], 0xce8c222a
mov dword [ebp - 0x58], 0x4d468a21
sub dword [ebp - 0x58], 0xe9d71db5
mov dword [ebp - 0x54], 0xc04e45c4
add dword [ebp - 0x54], 0x3fb1ba3c
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x352b5
push 0
call eax
mov ecx, 0x2fe1
xor edx, edx
add edx, eax
mov edi, 0x5261a722
sub edi, 0xe55e3f22
add edi, dword [ebp - 0x50]
mov esi, 0x258accb
sub esi, 0x6661e5fb
xor dword [ebp - 0x2c], 0x5916c6a5
mov ebx, dword [edi]
sub dword [ebp - 0x40], edi
add ebx, esi
xor dword [ebp - 0x10], ecx
mov dword [edx], ebx
sub dword [ebp - 0x14], edx
add edx, 4
add edi, 0xaa3429f7
add edi, 0x55cbd60d
loop 0x6d02369d
add eax, 0xb257
mov ebx, eax
add eax, 5
mov ecx, 0xf448ecc0
add ecx, 0x78b81340
add ecx, dword [ebp - 0x50]
call ebx
leave
ret