joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100045a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x10040a9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
test eax, eax
js 0x10004799
cmp eax, dword [ecx + 0x218]
jge 0x10004799
imul eax, eax, 0x214
cmp dword [eax + ecx + 4], 0
push esi
lea esi, [eax + ecx + 4]
je 0x10004798
push ebx
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x80e]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp ecx, dword [esi + 0x104]
jne 0x10004628
movzx edx, word [ebp - 0x812]
cmp edx, dword [esi + 0x108]
jne 0x10004628
movzx eax, word [ebp - 0x814]
cmp eax, dword [esi + 0x10c]
je 0x100046e5
mov ecx, dword [esi + 0x210]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [ebp - 0x80e]
movzx ecx, word [ebp - 0x812]
movzx edx, word [ebp - 0x814]
push eax
push ecx
push edx
mov dword [esi + 0x10c], edx
lea edx, [esi + 4]
push edx
lea edi, [esi + 0x110]
push str.._s_04d__02d__02d.log
push edi
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
call ebx
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
pop edi
cmp eax, 0xffffffff
jne 0x100046b0
pop ebx
mov dword [esi], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x100046e5
mov eax, dword [esi + 0x210]
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret
push 0x3ff
lea ecx, [ebp - 0x803]
push 0
push ecx
mov byte [ebp - 0x804], 0
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
push edx
push eax
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
push 0x3ff
lea edx, [ebp - 0x403]
push 0
push edx
mov byte [ebp - 0x404], 0
call sub.MSVCR100.dll_memset
movzx ecx, word [ebp - 0x808]
movzx edx, word [ebp - 0x80a]
lea eax, [ebp - 0x804]
push eax
movzx eax, word [ebp - 0x80c]
push ecx
push edx
push eax
lea ecx, [ebp - 0x404]
push str._02d:_02d:_02d__s_r_n
push ecx
call ebx
lea eax, [ebp - 0x404]
add esp, 0x40
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004770
mov ecx, dword [esi + 0x210]
sub eax, edx
push 0
lea edx, [ebp - 0x818]
push edx
push eax
lea eax, [ebp - 0x404]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret
Function at 0x100047e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10040b24], 0
push esi
mov esi, ecx
je 0x100047ff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x10040b24]
cmp eax, dword [ecx]
jne 0x10004840
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, dword [ebp + 8]
call ebx
sub eax, dword [esi + edi*4 + 0xc]
cmp eax, 0x1388
jb 0x10004825
call ebx
mov dword [esi + edi*4 + 0xc], eax
mov dword [esi + edi*4 + 0x14], 0
inc dword [esi + edi*4 + 0x14]
cmp dword [esi + edi*4 + 0x14], 0x19
pop edi
pop ebx
jbe 0x10004840
push 0
push 0
push 9
call fcn.10002030
add esp, 0xc
pop esi
pop ebp
ret 4

Function at 0x10004980
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10040b10], 0
push esi
mov esi, ecx
je 0x100049ba
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
xor eax, eax
push 0x10040a24
push eax
push esi
push 0x10004900
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
push eax
mov dword [esi + 0x14], eax
push eax
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
pop esi
pop ebp
ret 4

Function at 0x10004c40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREPointFireConfig
push connect
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004cb1
lea ecx, [ebp - 8]
push ecx
add esi, 4
push esi
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 4]
push str.LangSelection
push eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10004ca7
push 0x10014860
push 0x10
push esi
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004e10
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x10040a9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, eax
and ebx, 2
push edi
mov edi, dword [ebp + 8]
jne 0x10004e4a
test al, 0xc
jne 0x10004e4a
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret 8
push esi
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10004f84
push 0x104
lea eax, [ebp - 0x454]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10004f7d
push 0x104
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x454]
push edx
call fcn.1000f200
add esp, 0xc
test al, al
je 0x10004f7d
test ebx, ebx
je 0x10004ee8
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x24c]
push ecx
mov ecx, 0x100363c0
call fcn.10004260
test al, al
jne 0x10004ee8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea edx, [ebp - 0x44]
push edx
push 1
call fcn.10002030
add esp, 0xc
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret 8
mov bl, byte [ebp + 0xc]
test bl, 4
je 0x10004f34
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x24c]
push ecx
mov ecx, 0x100363e4
call fcn.10004420
test al, al
jne 0x10004f34
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea edx, [ebp - 0x44]
push edx
push 2
call fcn.10002030
add esp, 0xc
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret 8
test bl, 8
je 0x10004f7d
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x24c]
push ecx
mov ecx, 0x10036340
call fcn.100031b0
test al, al
jne 0x10004f7d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea edx, [ebp - 0x44]
push edx
push 5
call fcn.10002030
add esp, 0xc
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.1000f795
mov esp, ebp
pop ebp
ret 8
Function at 0x10006a10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100124ab
mov eax, dword fs:[0]
push eax
sub esp, 0xc2c
mov eax, dword [0x10040a9c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0xc38], ebx
mov dword [ebp - 0xc34], ebx
mov dword [ebp - 0xc30], ebx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc38]
push eax
push ecx
mov dword [ebp - 4], ebx
call fcn.1000f0e0
add esp, 8
mov word [ebp - 0xc24], 0xac2
mov byte [ebp - 0xc22], 0xc
call dword [sym.imp.MSVCR100.dll_rand]
and eax, 0x800000ff
jns 0x10006a8c
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [ebp - 0xc34]
mov byte [ebp - 0xc21], al
mov eax, dword [ebp - 0xc38]
sub ecx, eax
sar ecx, 2
mov byte [ebp - 0xc20], 0x17
mov dword [ebp - 0xc1c], ecx
cmp ecx, ebx
jbe 0x10006b50
lea edx, [ebp - 0x718]
mov dword [ebp - 0xc28], edx
cmp ebx, 0x14
jge 0x10006b50
mov edx, dword [eax + ebx*4]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp - 0xc38]
mov edx, dword [ecx + ebx*4]
push 0x104
lea eax, [ebp - 0x218]
push eax
push edx
call dword [sym.imp.USER32.dll_GetClassNameA]
mov edi, dword [ebp - 0xc28]
mov eax, dword [ebp - 0xc28]
add edi, 0xfffffb00
mov ecx, 0x10
lea esi, [ebp - 0x114]
rep movsd dword es:[edi], dword [esi]
mov edi, eax
add eax, 0x40
mov ecx, 0x10
lea esi, [ebp - 0x218]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc34]
mov dword [ebp - 0xc28], eax
mov eax, dword [ebp - 0xc38]
sub ecx, eax
inc ebx
sar ecx, 2
cmp ebx, ecx
jb 0x10006ac4
push 0xa0c
lea edx, [ebp - 0xc24]
push edx
mov ecx, 0x10032108
call fcn.10001720
cmp dword [ebp - 0xc38], 0
mov dword [ebp - 4], 0xffffffff
je 0x10006b91
lea ecx, [ebp - 0xc38]
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::_Container_base0::_Orphan_all_void_]
mov eax, dword [ebp - 0xc38]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret 4
Function at 0x100073c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012518
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10040a9c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x44], 0
je 0x100074f2
cmp byte [edi + 0x4a], 0
je 0x100074f2
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffff
call edx
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
je 0x100074e6
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x10007441
lea eax, [ebp - 0x2c]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea ebx, [edi + 0x4c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x10007461
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_wchar_t__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x10007486
dec eax
je 0x1000748a
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x100074e1
jmp 0x100074ed
mov byte [edi + 0x4a], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x1000749a
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x100074c4
cmp edx, 0x10
jae 0x100074a9
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x100074de
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x4a], 0
je 0x100074ea
test esi, esi
jne 0x10007455
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10006960
jmp 0x1000744f
lea ecx, [ebp - 0x2c]
call fcn.10006900
xor al, al
jmp 0x100074f4
lea ecx, [ebp - 0x2c]
call fcn.10006900
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret
Function at 0x10007510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012518
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10040a9c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x44], 0
je 0x10007637
cmp byte [edi + 0x49], 0
je 0x10007637
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x1000762b
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x10007586
lea eax, [ebp - 0x2c]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea ebx, [edi + 0x4c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x100075a6
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x100075cb
dec eax
je 0x100075cf
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x10007626
jmp 0x10007632
mov byte [edi + 0x49], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x100075df
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x10007609
cmp edx, 0x10
jae 0x100075ee
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x10007623
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x1000762f
test esi, esi
jne 0x1000759a
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10006960
jmp 0x10007594
lea ecx, [ebp - 0x2c]
call fcn.10006900
xor al, al
jmp 0x10007639
lea ecx, [ebp - 0x2c]
call fcn.10006900
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret
Function at 0x10008b70
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1110
call fcn.1000f7b0
mov eax, dword [0x10040a9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x10c]
push ecx
push 0x1000
lea edx, [ebp - 0x1110]
push edx
xor esi, esi
push eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x10008bc9
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret 8
push ebx
push edi
mov edi, dword [ebp - 0x10c]
shr edi, 2
cmp edi, esi
jle 0x10008c3e
mov ebx, dword [ebp + 0xc]
jmp 0x10008be0
mov ecx, dword [ebp + esi*4 - 0x1110]
mov edx, dword [ebp - 0x110]
push 0x104
lea eax, [ebp - 0x108]
push eax
push ecx
push edx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x10008c39
mov ecx, ebx
lea eax, [ebp - 0x108]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10008c30
test dl, dl
je 0x10008c2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10008c30
add eax, 2
add ecx, 2
test dl, dl
jne 0x10008c10
xor eax, eax
jmp 0x10008c35
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10008c53
inc esi
cmp esi, edi
jl 0x10008be0
pop edi
pop ebx
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
pop edi
pop ebx
xor ecx, ebp
mov al, 1
pop esi
call fcn.1000f795
mov esp, ebp
pop ebp
ret 8

Function at 0x10008c70
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
push 4
push 0x1000
push ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x10008cb4
mov eax, dword [ebp + 0xc]
push 0
push ebx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10008cbd
push 0x8000
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
push str.LoadLibraryA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10008ca6
push 0
push 0
push esi
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x10008ca6
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push ebx
push esi
push edi
test eax, eax
jne 0x10008cae
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc
Function at 0x1000a520
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.1000f7b0
mov eax, dword [0x10040a9c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 1
push edi
mov edi, ecx
jne 0x1000a56e
cmp dword [0x10040b08], 0
je 0x1000a552
test byte [0x10040b0c], 2
jne 0x1000a565
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret 4
cmp dword [0x1003b82c], 0
je 0x1000a552
push ebx
lea eax, [ebp - 0x1008]
push eax
push 0x1000
lea ecx, [ebp - 0x1004]
xor ebx, ebx
push ecx
mov dword [ebp - 0x1008], ebx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x1000a5a7
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x1008]
shr eax, 2
push esi
mov dword [ebp - 0x100c], eax
cmp eax, ebx
jle 0x1000a626
jmp 0x1000a5c0
mov esi, dword [ebp + ebx*4 - 0x1004]
test esi, esi
je 0x1000a621
push esi
lea edx, [ebp - 0x1014]
push edx
mov ecx, edi
call fcn.1000a120
test al, al
jne 0x1000a61b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push esi
mov ecx, edi
call fcn.1000a190
mov esi, dword [ebp + 8]
mov eax, dword [ebp + ebx*4 - 0x1004]
push esi
push eax
mov ecx, edi
call fcn.10008f00
test al, al
je 0x1000a63b
mov ecx, dword [ebp + ebx*4 - 0x1004]
push esi
push ecx
mov ecx, 0x1003b478
call fcn.10004e10
test al, al
je 0x1000a63b
mov eax, dword [ebp - 0x100c]
inc ebx
cmp ebx, eax
jl 0x1000a5c0
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.1000f795
mov esp, ebp
pop ebp
ret 4
Function at 0x1000ab20
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001287b
mov eax, dword fs:[0]
push eax
sub esp, 0x408
mov eax, dword [0x10040a9c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [ebp - 0x410]
call fcn.10001490
push 0x400
lea eax, [ebx + 0x4de8]
push eax
xor esi, esi
push edi
lea ecx, [ebp - 0x410]
mov dword [ebp - 4], esi
call fcn.10001170
test al, al
je 0x1000abb0
push esi
push 0x20
push 3
push esi
push 1
push connect
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000abb0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x4de4
je 0x1000abc9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x410]
mov dword [ebp - 4], 0xffffffff
call fcn.10002210
xor al, al
jmp 0x1000ac6a
push 0
lea ecx, [ebp - 0x414]
push ecx
mov dword [ebp - 0x414], esi
push 0x4de4
lea esi, [ebx + 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000aba9
xor eax, eax
mov edi, edi
mov ecx, eax
shr ecx, 8
mov dl, cl
xor dl, 0xbb
xor cl, 0xaa
sub dl, cl
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xcc
mov byte [esi + eax], dl
inc eax
cmp eax, 0x4de4
jb 0x1000abf0
mov ecx, 0x10036670
call fcn.10004c40
lea eax, [ebx + 0x90]
push eax
mov ecx, 0x10036670
call fcn.10004cc0
lea ecx, [ebx + 0x1a58]
push ecx
mov ecx, 0x10036670
call fcn.10004d30
add ebx, 0x3420
push ebx
mov ecx, 0x10036670
call fcn.10004da0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x410]
mov dword [ebp - 4], 0xffffffff
call fcn.10002210
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret 4

Function at 0x1000bd30
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x10040a9c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0xd8]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xd8]
push ecx
mov dword [ebp - 0xd8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea edx, [ebp - 0x44]
push edx
mov dword [ebp - 0x44], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f795
mov esp, ebp
pop ebp
ret
Function at 0x1000be80
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012978
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10040a9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x30]
movzx ecx, byte ds:[eax + 2]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x1000bedf
push 0
push 0
push 0xa
call fcn.10002030
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
call fcn.1000aa70
push 2
push 0x23
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.1000a910
test al, al
je 0x1000bf43
lea ecx, [ebp - 0x20]
call fcn.1000a9b0
test eax, eax
je 0x1000bf43
cmp byte [eax], 0
je 0x1000bf43
cmp byte [eax + 1], 0
jne 0x1000bf43
push 0
push 0
push 0xa
call fcn.10002030
add esp, 0xc
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.1000aa90
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
call fcn.1000a8d0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.1000aa90
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000df60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x1000dfcf
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi + 8]
cmp eax, 0x1388
jbe 0x1000dfce
push ebx
lea ebx, [esi + 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x1000dfcd
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x1000dfc6
mov ecx, esi
call fcn.1000ded0
test al, al
jne 0x1000dfc6
push 0x1388
push 0
mov ecx, 0x10036670
call fcn.10004b30
push eax
push 1
push 2
push 0x100408b8
call fcn.1000e2c0
add esp, 0x14
pop ebx
pop edi
pop esi
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop edi
pop esi
ret

Function at 0x1000e070
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call esi
mov ebx, dword [ebp + 8]
sub eax, edi
cmp eax, ebx
jae 0x1000e0a2
jmp 0x1000e090
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
cmp eax, ebx
jb 0x1000e090
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret

Function at 0x1000e170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
test edi, edi
jle 0x1000e195
mov cl, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dl, byte [eax + esi]
add dl, cl
xor dl, 0xb7
mov byte [eax + esi], dl
inc eax
cmp eax, edi
jl 0x1000e184
pop esi
pop edi
pop ebp
ret

Function at 0x1000e1a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
test edi, edi
jle 0x1000e1c5
mov cl, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dl, byte [eax + esi]
xor dl, 0xb8
sub dl, cl
mov byte [eax + esi], dl
inc eax
cmp eax, edi
jl 0x1000e1b4
pop esi
pop edi
pop ebp
ret