joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001daf0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0x288
push 0x12
call fcn.10053b6e
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 0
jne 0x1001db2b
push str.Error_allocating_memory_needed_for_MAC_address_n
call fcn.10021b90
add esp, 4
xor eax, eax
jmp 0x1001dcdd
push 0x288
call fcn.10053b6e
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001db61
push str.Error_allocating_memory_needed_for_adapter_info_n
call fcn.10021b90
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.10053b51
add esp, 4
xor eax, eax
jmp 0x1001dcdd
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x1001dbb4
mov eax, dword [ebp - 8]
push eax
call fcn.10053b51
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10053b6e
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001dbb4
push str.Error_reallocating_memory_needed_for_adapter_info_n
call fcn.10021b90
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.10053b51
add esp, 4
xor eax, eax
jmp 0x1001dcdd
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x1001dcb5
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1001dcb3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 6
jne 0x1001dca6
mov ecx, 1
imul edx, ecx, 5
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 2
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
imul eax, edx, 3
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 1
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + ecx + 0x194]
push eax
push str._02X_02X_02X_02X_02X_02X
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10010bf0
add esp, 0x20
mov edx, dword [ebp - 0xc]
push edx
call fcn.1001f340
add esp, 4
test eax, eax
jne 0x1001dca6
push 0x12
call fcn.10053b6e
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1001dca4
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10058dc0
add esp, 8
jmp 0x1001dcb3
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
jmp 0x1001dbcf
jmp 0x1001dcc2
push str.Error_getting_adapter_information_n
call fcn.10021b90
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.10053b51
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.10053b51
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x1001f200
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x1008b274]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x64
call fcn.10053b6e
add esp, 4
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x1001f23a
push str.Error_allocating_memory_for_serial_number_n
call fcn.10021b90
add esp, 4
xor eax, eax
jmp 0x1001f2e0
mov al, byte [0x10072fd9]
mov byte [ebp - 0x74], al
push 0x63
push 0
lea ecx, [ebp - 0x73]
push ecx
call fcn.1004e010
add esp, 0xc
mov dl, byte [0x10072fda]
mov byte [ebp - 0x10], dl
xor eax, eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov byte [ebp - 7], al
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
push 0xa
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x7c]
push ecx
push 0x64
lea edx, [ebp - 0x74]
push edx
push 0x1007368c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp eax, 1
jne 0x1001f2c0
mov eax, dword [ebp - 0x7c]
push eax
push 0x10073690
mov ecx, dword [ebp - 0x78]
push ecx
call fcn.10010bf0
add esp, 0xc
jmp 0x1001f2d1
push str.Error_getting_serial_number
mov edx, dword [ebp - 0x78]
push edx
call fcn.10058dc0
add esp, 8
mov eax, dword [ebp - 0x78]
push eax
call fcn.10053b51
add esp, 4
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c355
mov esp, ebp
pop ebp
ret

Function at 0x1001f2f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 0x10], 1
jle 0x1001f318
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x1001f320
mov edx, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov byte [edx], al
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10020f90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
push ecx
push 0x40
push 4
mov edx, 1
imul eax, edx, 0
add eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov dx, word [ebp + 0xc]
mov word [ecx], dx
mov esp, ebp
pop ebp
ret

Function at 0x100218a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0x400
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
shl ecx, 2
push ecx
call fcn.10053b6e
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100218d2
xor eax, eax
jmp 0x10021992
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10021990
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xea
jne 0x10021961
mov eax, dword [ebp - 4]
add eax, 0x400
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.10053b79
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
jmp 0x10021915
cmp dword [ebp - 0xc], 0
je 0x10021975
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10021992
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x10021992
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10021ab0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x10021b10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10021b80
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10021b6f
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10021b82
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x10021b82
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10021c10
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x1008b274]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x135], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
je 0x10021d56
mov dword [ebp - 0x134], 0x128
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call sub.KERNEL32.dll_Process32First
mov edx, dword [ebp - 0x12c]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x10021d3b
mov dword [ebp - 0x13c], 0
jmp 0x10021ca5
mov eax, dword [ebp - 0x13c]
add eax, 1
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xa7
jae 0x10021d2e
lea ecx, [ebp - 0x148]
push ecx
push 7
lea edx, [ebp - 0xc]
push edx
imul eax, dword [ebp - 0x13c], 0xc
mov ecx, dword [eax + 0x1008a268]
push ecx
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10021d29
cmp dword [ebp - 0x148], 7
jne 0x10021d29
push 7
imul eax, dword [ebp - 0x13c], 0xc
add eax, 0x1008a26c
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.1004ea6d
add esp, 0xc
test eax, eax
jne 0x10021d29
push 0
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10022100
call fcn.1002a4a0
jmp 0x10021c96
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10021c63
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x135]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c355
mov esp, ebp
pop ebp
ret
Function at 0x10021d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 3
mov dword [ebp - 4], 0
jmp 0x10021da2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x10021de1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x472aed4d]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10021ddc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10021d99
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10022100
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
test eax, eax
je 0x1002211a
jne 0x10022119
call 0x930611a1
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10022128
jmp 0x1002212a
je 0x10022125
clc
jae 0x1002212f
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x10022134
jne 0x10022134
pop eax
pushf
push 0xa
jae 0x10022141
jmp 0x1002213c
call 0x10022143
jae 0x1002213c
add esp, 4
jmp 0x10022148
dec dword [esp]
jno 0x1002214d
jns 0x10022138
jp 0x10022151
add esp, 4
popf
jmp 0x10022158
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10022171
jne 0x10022171
call 0x1fc254c5
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.10059c38
clc
jae 0x1002218e
shl byte [ecx], 1
pushf
push 0xa
jae 0x1002219b
jmp 0x10022196
call 0x1002219d
jae 0x10022196
add esp, 4
jmp 0x100221a2
dec dword [esp]
jno 0x100221a7
jns 0x10022192
jp 0x100221ab
add esp, 4
popf
jmp 0x100221b2
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100221cb
jne 0x100221cb
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x100221d0
jmp 0x100221d2
je 0x100221cd
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100221ec
jne 0x100221eb
call 0x93061273
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100221fa
jne 0x100221fa
call fcn.100222ba
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x10022208
add esi, dword [ebp]
jne 0x10022207
call 0x9306128f
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10022216
jmp 0x10022218
je 0x10022213
clc
jae 0x1002221d
jp 0x10022204
je 0x10022222
jne 0x10022222
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x1002222f
jmp 0x1002222a
call 0x10022231
jae 0x1002222a
add esp, 4
jmp 0x10022236
dec dword [esp]
jno 0x1002223b
jns 0x10022226
jp 0x1002223f
add esp, 4
popf
jmp 0x10022246
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1002225f
jne 0x1002225f
call 0x1fc255b3
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10022143
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
test eax, eax
je 0x1002211a
jne 0x10022119
call 0x930611a1
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10022128
jmp 0x1002212a
je 0x10022125
clc
jae 0x1002212f
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x10022134
jne 0x10022134
pop eax
pushf
push 0xa
jae 0x10022141
jmp 0x1002213c
call 0x10022143
jae 0x1002213c
add esp, 4
jmp 0x10022148
dec dword [esp]
jno 0x1002214d
jns 0x10022138
jp 0x10022151
add esp, 4
popf
jmp 0x10022158
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10022171
jne 0x10022171
call 0x1fc254c5
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.10059c38
clc
jae 0x1002218e
shl byte [ecx], 1
pushf
push 0xa
jae 0x1002219b
jmp 0x10022196
call 0x1002219d
jae 0x10022196
add esp, 4
jmp 0x100221a2
dec dword [esp]
jno 0x100221a7
jns 0x10022192
jp 0x100221ab
add esp, 4
popf
jmp 0x100221b2
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100221cb
jne 0x100221cb
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x100221d0
jmp 0x100221d2
je 0x100221cd
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100221ec
jne 0x100221eb
call 0x93061273
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100221fa
jne 0x100221fa
call fcn.100222ba
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x10022208
add esi, dword [ebp]
jne 0x10022207
call 0x9306128f
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10022216
jmp 0x10022218
je 0x10022213
clc
jae 0x1002221d
jp 0x10022204
je 0x10022222
jne 0x10022222
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x1002222f
jmp 0x1002222a
call 0x10022231
jae 0x1002222a
add esp, 4
jmp 0x10022236
dec dword [esp]
jno 0x1002223b
jns 0x10022226
jp 0x1002223f
add esp, 4
popf
jmp 0x10022246
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1002225f
jne 0x1002225f
call 0x1fc255b3
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10022280
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebp
ret
Function at 0x10027570
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1008b274]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10027690
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 4]
add eax, 5
push eax
call fcn.1004c3c5
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1004d510
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x10]
mov byte [eax + edx], 0xe9
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 4]
push ecx
call fcn.10027670
add esp, 8
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx + 4]
mov edx, dword [ebp - 0x10]
mov dword [edx + ecx + 1], eax
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0xc], 0xe9
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10027670
add esp, 8
mov ecx, 1
shl ecx, 0
mov dword [ebp + ecx - 0xc], eax
push 5
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1004d510
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c355
mov esp, ebp
pop ebp
ret

Function at 0x10027690
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x1008aa3c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x1008aa44
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 5
mov ecx, 1
imul edx, ecx, 0
add edx, 0x1008aa3c
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1004ea6d
add esp, 0xc
test eax, eax
jne 0x100276f4
mov eax, 0xb
jmp 0x1002771f
push 5
mov ecx, 1
imul edx, ecx, 0
add edx, 0x1008aa44
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1004ea6d
add esp, 0xc
test eax, eax
jne 0x1002771c
mov eax, 5
jmp 0x1002771f
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1002a5d2
Capabilities:
Enumerate process modules

Disassembly:
jae 0x1002a5d0
jmp 0x1002a5cb
call fcn.1002a5d2
jae 0x1002a5cb
add esp, 4
jmp 0x1002a5d7
dec dword [esp]
jno 0x1002a5dc
jns 0x1002a5c7
jp 0x1002a5e0
add esp, 4
popf
jmp 0x1002a5e7
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1002a600
jne 0x1002a600
call 0x1fc2d954
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, 1
test eax, eax
je 0x1002a699
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], 0x224
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
call sub.KERNEL32.dll_Module32First
test eax, eax
jne 0x1002a654
jmp 0x1002a70a
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call sub.KERNEL32.dll_Module32Next
test eax, eax
je 0x1002a67c
lea edx, [ebp - 0x108]
push edx
call fcn.10029ac0
add esp, 4
jmp 0x1002a654
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002a611
clc
jae 0x1002a69e
movsd dword es:[edi], dword [esi]
test byte [esi - 0x64], ah
pushf
push 0xa
jae 0x1002a6ab
jmp 0x1002a6a6
call 0x1002a6ad
jae 0x1002a6a6
add esp, 4
jmp 0x1002a6b2
dec dword [esp]
jno 0x1002a6b7
jns 0x1002a6a2
jp 0x1002a6bb
add esp, 4
popf
jmp 0x1002a6c2
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1002a6db
jne 0x1002a6db
test byte [ebx + eax - 0x15], bh
add eax, dword [esp + esi*2 - 0x3fccaf05]
jl 0x1002a6e0
jmp 0x1002a6e2
je 0x1002a6dd
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1002a6fc
jne 0x1002a6fb
call 0x93069783
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1002a70a
jne 0x1002a70a
call 0x9b5e056d
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c355
mov esp, ebp
pop ebp
ret
Function at 0x1002b710
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x1002f6e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
movzx eax, byte [0x1008cabc]
test eax, eax
jne 0x1002f712
mov ecx, dword [ebp + 8]
mov dword [0x1008cab8], ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x1008caf4]
push eax
call fcn.100225d0
add esp, 8
mov byte [0x1008cabc], al
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 3
ja case.default.0x1002f725
mov edx, dword [ebp - 4]
jmp dword [edx*4 + 0x1002f928]
push 0
push 0
push 0
push 0x10022500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
clc
jae 0x1002f746
sbb byte [ecx], ah
pushf
push 0xa