joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010c610
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3348
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x10245db0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x1024ca04]
mov byte [eax + 0x154], 0
movzx ecx, byte [ebp - 0x14d]
push ecx
push str.The_file_is_corrupted._Please_contact_with_administrator._n
lea ecx, [ebp - 0x14c]
call fcn.1010dbb0
mov ecx, eax
call fcn.1010c840
push eax
lea ecx, [ebp - 0x64]
call fcn.100450b0
mov byte [ebp - 4], 1
movzx edx, byte [ebp - 0x14e]
push edx
push str.If_you_constantly_see_this_message_
lea ecx, [ebp - 0x110]
call fcn.1010e2a0
mov ecx, eax
call fcn.1005db00
push eax
lea ecx, [ebp - 0x48]
call fcn.100450b0
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0x14f]
push eax
push str.disable_the_anti_virus_program.
lea ecx, [ebp - 0xe8]
call fcn.1005eb40
mov ecx, eax
call fcn.1005da00
push eax
lea ecx, [ebp - 0x2c]
call fcn.100450b0
mov byte [ebp - 4], 3
push 0x101e9cee
lea ecx, [ebp + 8]
push ecx
call fcn.10082d30
add esp, 8
movzx edx, al
test edx, edx
je 0x1010c79b
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x9c]
push edx
call fcn.1009c240
add esp, 0xc
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x15c]
push edx
lea eax, [ebp - 0x80]
push eax
call fcn.100e83a0
add esp, 0xc
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x164], ecx
mov byte [ebp - 4], 5
push 0x30
movzx edx, byte [ebp - 0x150]
push edx
push str.KnightOnline.exe
lea ecx, [ebp - 0xb0]
call fcn.1005efd0
mov ecx, eax
call fcn.1005da80
push eax
mov ecx, dword [ebp - 0x164]
call fcn.10044d80
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x80]
call fcn.10044fc0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x9c]
call fcn.10044fc0
jmp 0x1010c7ce
push 0x30
movzx eax, byte [ebp - 0x151]
push eax
push 0x10207124
lea ecx, [ebp - 0xc4]
call fcn.1010e700
mov ecx, eax
call fcn.1005da80
push eax
lea ecx, [ebp + 8]
call fcn.10044d80
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.101726f0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.10044fc0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.10044fc0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.10044fc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10044fc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10154220
mov esp, ebp
pop ebp
ret
Function at 0x1010cc70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10245db0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102070e8]
mov dword [ebp - 0xc], eax
mov cx, word [0x102070ec]
mov word [ebp - 8], cx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x10]
sub edx, 5
mov dword [ebp - 0xb], edx
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0xc], 0xe9
push 5
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.10156a70
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 5
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10154220
mov esp, ebp
pop ebp
ret
Function at 0x1010d910
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x10245db0]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1024ca14], eax
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push 0x1024ca20
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1010d9cb
push 0x1024ca10
push 0
push 0
push 0x8004
mov eax, dword [0x1024ca20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1010d9cb
push 1
push 0x1d
movzx ecx, byte [ebp - 0x45]
push ecx
push str._A_dq1DPVFgVs1Asieaqkise59z_VS3R0hge_NvM_TJvblD4.af0h_r4bUzp
lea ecx, [ebp - 0x44]
call fcn.10110770
mov ecx, eax
call fcn.1010da00
push eax
mov edx, dword [0x1024ca10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1010d9cb
push 0x1024ca28
push 0x800000
mov eax, dword [0x1024ca10]
push eax
push 0x6801
mov ecx, dword [0x1024ca20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1010d9cb
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1010d840
push 0x468e60
call fcn.100020f0
mov dword [0x1024ca18], eax
push 0x1010d8f0
push 0x468eb6
call fcn.100020f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10154220
mov esp, ebp
pop ebp
ret

Function at 0x10111be0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x10111a30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10111c50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x10111c00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x10129130
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x10129080
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x1012b350
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 9
ja case.0x1012b36c.0
mov ecx, dword [ebp - 0x10]
jmp dword [ecx*4 + 0x1012b4e0]
push 0
lea edx, [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012b4d3
push 0
lea edx, [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012b4d3
push 0
lea edx, [ebp - 4]
push edx
push 2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012b4d3
push 0
lea edx, [ebp - 4]
push edx
push 2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012b4d3
push 0
lea edx, [ebp - 4]
push edx
push 4
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012b4d3
push 0
lea edx, [ebp - 4]
push edx
push 4
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012b4d3
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x101e9e2e
mov ecx, dword [ebp - 0xc]
call fcn.10044f60
cmp dword [ebp - 8], 0
jle 0x1012b478
push 0x20
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100a8070
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0
mov ecx, dword [ebp - 0xc]
call fcn.1007cd80
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012b4d3
push 0
lea ecx, [ebp - 4]
push ecx
push 4
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012b4d3
push 0
lea ecx, [ebp - 4]
push ecx
push 8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012b4d3
mov ecx, 1
test ecx, ecx
je 0x1012b4cf
push 0x110
push 0x10211438
push 0x101e9e32
push 0x10211700
call fcn.100a3500
add esp, 0x10
xor eax, eax
jmp 0x1012b4d8
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1012d4c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x58]
mov dword [0x1024cc88], ecx
cmp dword [ebp + 8], 0
je 0x1012d4e5
cmp dword [ebp + 8], 0
je 0x1012d4e5
cmp dword [ebp + 0xc], 1
je 0x1012d4f1
xor al, al
jmp 0x1012d637
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x6c]
jne 0x1012d56b
mov ecx, dword [0x1024ca04]
cmp dword [ecx + 0x46c], 0
jne 0x1012d51e
mov edx, dword [0x1024ca04]
mov ecx, dword [edx + 0x468]
call fcn.10137d70
jmp 0x1012d566
mov eax, dword [0x1024ca04]
mov ecx, dword [eax + 0x46c]
mov edx, dword [ecx + 0xd0]
push edx
mov ecx, dword [0x1024ca04]
call fcn.100db4a0
movzx eax, al
test eax, eax
je 0x1012d555
mov ecx, dword [0x1024ca04]
mov ecx, dword [ecx + 0x46c]
call fcn.10079cb0
jmp 0x1012d566
mov edx, dword [0x1024ca04]
mov ecx, dword [edx + 0x46c]
call fcn.10079c80
jmp 0x1012d635
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x74]
jne 0x1012d59a
push 1
push 0
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x3c
call fcn.10044d80
push eax
push 0x10212d7c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x1012d635
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x60]
jne 0x1012d5cf
mov ecx, dword [ebp - 4]
call fcn.1012d890
mov ecx, dword [0x1024ca04]
cmp dword [ecx + 0x508], 0
je 0x1012d5cd
mov edx, dword [0x1024ca04]
mov ecx, dword [edx + 0x508]
call fcn.10089130
jmp 0x1012d635
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x64]
jne 0x1012d603
mov ecx, dword [ebp - 4]
call fcn.1012d810
mov edx, dword [0x1024ca04]
cmp dword [edx + 0x504], 0
je 0x1012d601
mov eax, dword [0x1024ca04]
mov ecx, dword [eax + 0x504]
call fcn.10058590
jmp 0x1012d635
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0x68]
jne 0x1012d635
mov ecx, dword [ebp - 4]
call fcn.1012d850
mov eax, dword [0x1024ca04]
cmp dword [eax + 0x50c], 0
je 0x1012d635
mov ecx, dword [0x1024ca04]
mov ecx, dword [ecx + 0x50c]
call fcn.10055200
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x10133c60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac98d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10245db0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x30]
call fcn.10044b60
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x214
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.10051440
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x30]
call fcn.10051440
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp - 0x30]
push edx
call fcn.100515a0
push 0xf3690c
mov ecx, dword [0x1024ca04]
call fcn.100daaa0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
jne 0x10133d02
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10051550
jmp 0x10133d59
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xd], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0xc], 0
mov ecx, dword [ebp - 0x10]
call fcn.10133d70
mov ecx, dword [ebp - 0x10]
call fcn.10133f00
push 0
push 0
push 0
push 0x10133bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10133b80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10051550
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1013d0f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10245db0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov edx, dword [ebp - 0x24]
sub eax, dword [edx + 0x30]
sbb ecx, dword [edx + 0x34]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0
jg 0x1013d12d
jl 0x1013d128
cmp dword [ebp - 0x38], 0x14
ja 0x1013d12d
jmp 0x1013d23e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3c], esp
mov eax, dword [ebp - 0x24]
add eax, 0x14
push eax
call fcn.10045280
mov ecx, dword [0x1024ca04]
add ecx, 0xb0
call fcn.100e1730
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0
jne 0x1013d188
mov edx, dword [ebp - 0x24]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x24]
mov byte [eax + 0x42], 0
jmp 0x1013d23e
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 4], 0
jne 0x1013d196
jmp 0x1013d23e
mov edx, dword [ebp - 0x24]
movzx eax, byte [edx + 0x42]
test eax, eax
jne 0x1013d1a6
jmp 0x1013d23e
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [0x1024ca04]
call fcn.100dad40
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, 0x102c7904
call fcn.1004dd80
lea ecx, [ebp - 0x20]
call fcn.10044fc0
mov ecx, 0x102c7904
call fcn.10044d60
test eax, eax
ja 0x1013d1f6
mov edx, dword [ebp - 0x24]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x24]
mov byte [eax + 0x42], 0
jmp 0x1013d23e
mov ecx, dword [ebp - 0x28]
movzx edx, byte [ecx + 0x20]
cmp edx, 0x14
jne 0x1013d21b
push 0xffdf3434
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [0x1024ca04]
call fcn.100dd740
jmp 0x1013d23e
mov edx, dword [ebp - 0x28]
movzx eax, byte [edx + 0x20]
cmp eax, 0x15
jne 0x1013d23e
push 0xffff0000
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [0x1024ca04]
call fcn.100dd740
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10154220
mov esp, ebp
pop ebp
ret
Function at 0x1014f670
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b59c0
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x10245db0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x1014f791
push 1
lea ecx, [ebp - 0xd0]
call fcn.1014f910
mov dword [ebp - 4], 0
push 0x40
push 0xa
mov ecx, dword [0x1024cd5c]
push ecx
lea ecx, [ebp - 0xd0]
call fcn.1014f850
push 0x100f7890
push 0x10226248
lea edx, [ebp - 0xc0]
push edx
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 0x100f7890
push 0x1022619c
mov eax, dword [0x1024cd58]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.100f7570
add esp, 8
push eax
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 0x100f7890
push 0x1022628c
mov edx, dword [0x1024cd58]
push edx
lea eax, [ebp - 0xc0]
push eax
call fcn.100f7570
add esp, 8
push eax
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 1
push 0
push 0
mov ecx, dword [0x1024cd5c]
push ecx
push 0x102262bc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call fcn.101726f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd0]
call fcn.1014f7a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1014f830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x1014f810
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1014fcd0
Capabilities:
Create process on windows
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b5ad0
mov eax, dword fs:[0]
push eax
sub esp, 0x1f4
mov eax, dword [0x10245db0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffff
je 0x1014fe77
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1014fe77
mov edx, dword [ebp - 0x130]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x1014fe5b
mov eax, dword [ebp - 0x140]
push eax
call fcn.1014fea0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x1014fe5b
push 1
lea ecx, [ebp - 0x200]
call fcn.1014f910
mov dword [ebp - 4], 0
push 0x40
push 0xa
mov edx, dword [0x1024cd5c]
push edx
lea ecx, [ebp - 0x200]
call fcn.1014f850
push 0x100f7890
push 0x10226438
lea eax, [ebp - 0x1f0]
push eax
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 0x100f7890
push 0x1022647c
mov ecx, dword [0x1024cd58]
push ecx
lea edx, [ebp - 0x1f0]
push edx
call fcn.100f7570
add esp, 8
push eax
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 0x100f7890
push 0x102262f4
mov eax, dword [0x1024cd58]
push eax
lea ecx, [ebp - 0x1f0]
push ecx
call fcn.100f7570
add esp, 8
push eax
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 1
push 0
push 0
mov edx, dword [0x1024cd5c]
push edx
push 0x102264bc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call fcn.101726f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x200]
call fcn.1014f7a0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1014fd3e
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10154220
mov esp, ebp
pop ebp
ret

Function at 0x1014ff50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x1014ff30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1014ff70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b59c0
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x10245db0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x10150073
push 1
lea ecx, [ebp - 0xd0]
call fcn.1014f910
mov dword [ebp - 4], 0
push 0x40
push 0xa
mov ecx, dword [0x1024cd5c]
push ecx
lea ecx, [ebp - 0xd0]
call fcn.1014f850
push 0x100f7890
push 0x10227630
lea edx, [ebp - 0xc0]
push edx
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 0x100f7890
push 0x10227688
mov eax, dword [0x1024cd58]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.100f7570
add esp, 8
push eax
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 0x100f7890
push 0x102275fc
mov edx, dword [0x1024cd58]
push edx
lea eax, [ebp - 0xc0]
push eax
call fcn.100f7570
add esp, 8
push eax
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 0
call fcn.101726f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd0]
call fcn.1014f7a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x10150ad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x10150ab0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10150af0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b5b10
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x10245db0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
lea ecx, [ebp - 0xcc]
call fcn.1014f910
mov dword [ebp - 4], 0
push 0x40
push 0xa
mov eax, dword [0x1024cd5c]
push eax
lea ecx, [ebp - 0xcc]
call fcn.1014f850
push 0x100f7890
push str._n_________________________________________________________________
lea ecx, [ebp - 0xbc]
push ecx
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 0x100f7890
push str.___Hile_Program
mov edx, dword [0x1024cd58]
push edx
lea eax, [ebp - 0xbc]
push eax
call fcn.100f7570
add esp, 8
push eax
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 0x100f7890
push str.___Oyun_Kapan
mov ecx, dword [0x1024cd58]
push ecx
lea edx, [ebp - 0xbc]
push edx
call fcn.100f7570
add esp, 8
push eax
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 1
push 0
push 0
mov eax, dword [0x1024cd5c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call fcn.101726f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.1014f7a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x10150dc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x10150c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1015a7c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1015a3e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1015a7f2
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x101b73e0]
call dword [ebp - 8]
jmp 0x1015a7fc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x10191150
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10191177
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10170860
add esp, 4
or eax, 0xffffffff
jmp 0x10191179
xor eax, eax
pop ebp
ret

Function at 0x10191d9e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101a7b60

Function at 0x1019c9f8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1019c3ee

Function at 0xc36ead
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00c36ead
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp int.00401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219