joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46036c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x479be0]
cmp dword [eax + 0x30], 0
je 0x460416
cmp dword [ebx + 0x94], 0
jne 0x460410
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4602fc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x460410
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4603d6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x460410
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041791c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4603e5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x460f78
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x460fad
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404184
jmp 0x460fba
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004040e8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4620c4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x462105
mov eax, esi
call fcn.00447fac
test al, al
je 0x462105
mov eax, dword [ebx + 0x84]
call fcn.00447ca8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x462105
push 0
mov eax, dword [ebx + 0x84]
call fcn.00447ca8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x462dc4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x414b3c]
call fcn.00404a2c
xor eax, eax
push ebp
push 0x462f08
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x477edc], 0
jne 0x462e17
mov ecx, dword [0x478014]
mov dl, 1
mov eax, dword [0x407310]
call fcn.0040bba0
call fcn.00403ad0
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402d58
mov eax, ebx
call fcn.004048fc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x462f18
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004059b0
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.0040490c
test eax, eax
jle 0x462eaf
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x462ea8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0040431c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404304
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040818c
test eax, eax
jne 0x462ea8
mov ebx, 0x15
jmp 0x462eb4
mov ebx, 0x10
jmp 0x462eb4
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x477edc]
call fcn.00462d1c
mov eax, dword [ebp - 8]
call fcn.00462d1c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004059c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462f0f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004040b8
lea eax, [ebp - 0x10]
mov edx, dword [0x414b3c]
call fcn.00404afc
ret

Function at 0x46ad08
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x46ad40]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x46ad1e
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x46ad2d
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x46ad3c
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x46c0dc
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4782e8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46c102
push 0
mov eax, dword [0x4782e8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x46edfc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x46eeb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x46eed0
mov eax, 0x46ef00
call fcn.0040c798
push 0
push 0
push 0xe
push esi
call sub.user32.dll_SendMessageA
mov ebx, eax
inc ebx
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004046e0
lea eax, [ebp - 4]
call fcn.004045ac
push eax
push ebx
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea ecx, [ebp - 8]
mov edx, 7
mov eax, 0x46ef30
call fcn.0042ee80
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
mov edx, 2
mov eax, 0x46ef5c
call fcn.0042ee80
mov edx, dword [ebp - 0xc]
pop eax
call fcn.004044a0
jne 0x46ee94
lea edx, [ebp - 0x10]
mov eax, 0x46ef6c
call fcn.00407fac
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004040e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46eec0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004040b8
ret
Function at 0x46ef74
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x46ef7c
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404544
xor eax, eax
push ebp
push 0x46f115
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x14]
mov edx, 4
mov eax, 0x46f12c
call fcn.0042ee80
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
mov edx, 2
mov eax, 0x46f15c
call fcn.0042ee80
mov edx, dword [ebp - 0x18]
pop eax
call fcn.004044a0
jne 0x46efe1
lea edx, [ebp - 0x1c]
mov eax, 0x46f16c
call fcn.00407fac
mov eax, edi
call fcn.00404094
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404554
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x46f0f2
mov eax, ebx
call fcn.00402744
mov esi, eax
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x46f15c
mov edx, 0x46f17c
mov eax, 0x46f188
call fcn.0042ede4
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00404554
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x46f1b0
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.004083e8
push dword [ebp - 0x24]
push 0x46f1bc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call fcn.004083e8
push dword [ebp - 0x28]
push 0x46f1bc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.004083e8
push dword [ebp - 0x2c]
push 0x46f1bc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.004083e8
push dword [ebp - 0x30]
mov eax, edi
mov edx, 7
call fcn.00404414
push 0x4015
push 0x80bb3200
push 0
call fcn.00427e34
cmp eax, 0xd0a6eb
jne 0x46f0eb
mov eax, 0x46f1c8
call fcn.0042bec4
mov eax, esi
call fcn.00402764
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f11c
lea eax, [ebp - 0x30]
mov edx, 8
call fcn.004040b8
lea eax, [ebp - 4]
call fcn.00404094
ret
Function at 0x10001040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], 0x10
mov ecx, dword [ebp + 8]
mov eax, edx
push edi
mov dword [ebp - 0x10], eax
mov edi, esi
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 4], ecx
xor eax, dword [edi]
lea edi, [edi + 4]
mov edx, eax
mov dword [ebp - 0xc], eax
mov ebx, eax
shr edx, 8
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [esi + eax*4 + 0x48]
add eax, dword [esi + ecx*4 + 0x448]
movzx ecx, dl
mov edx, ebx
xor eax, dword [esi + ecx*4 + 0x848]
movzx ecx, bl
add eax, dword [esi + ecx*4 + 0xc48]
xor eax, dword [ebp - 4]
sub dword [ebp - 8], 1
mov dword [ebp - 4], edx
jne 0x10001063
mov ecx, dword [esi + 0x44]
xor ecx, edx
mov edx, dword [ebp - 0x10]
pop edi
mov dword [edx], ecx
mov ecx, dword [esi + 0x40]
xor ecx, eax
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100010d0
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
push esi
push edi
mov eax, 0x1001fab8
mov dword [ebp - 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [ebp - 4], ebx
sub eax, ebx
mov dword [ebp - 0xc], 0x12
mov ecx, 0x400
mov dword [ebp - 0x10], eax
mov esi, 0x1001fb00
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 1]
xor edi, edi
cmp eax, 0x10
cmovl edi, eax
xor ecx, ecx
lea eax, [edi + 1]
cmp eax, 0x10
cmovl ecx, eax
xor edx, edx
lea eax, [ecx + 1]
cmp eax, 0x10
cmovl edx, eax
mov eax, dword [ebp - 8]
movzx esi, byte [ebx + eax]
mov ebx, eax
shl esi, 8
movzx eax, byte [edi + ebx]
or esi, eax
movzx eax, byte [ecx + ebx]
mov ecx, dword [ebp - 4]
shl esi, 8
or esi, eax
movzx eax, byte [edx + ebx]
shl esi, 8
xor ebx, ebx
or esi, eax
lea eax, [edx + 1]
cmp eax, 0x10
cmovl ebx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + ecx]
xor eax, esi
mov dword [ecx], eax
add ecx, 4
sub dword [ebp - 0xc], 1
mov dword [ebp - 4], ecx
jne 0x10001106
mov ebx, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
call fcn.10001040
mov eax, dword [ebp - 4]
add esp, 4
mov dword [ebx + esi*4], eax
mov eax, dword [ebp - 8]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jl 0x10001182
lea esi, [ebx + 0x4c]
mov dword [ebp - 0xc], 4
mov edi, 0x80
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
call fcn.10001040
mov eax, dword [ebp - 4]
add esp, 4
mov dword [esi - 4], eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
add esi, 8
sub edi, 1
jne 0x100011b7
sub dword [ebp - 0xc], 1
jne 0x100011b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001260
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x10025478
call fcn.100050d0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x1000128b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10001296
bts eax, 6
shr ecx, 1
test cl, 1
je 0x100012a1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x100012ac
bts eax, 4
shr ecx, 1
test cl, 1
je 0x100012b7
bts eax, 3
shr ecx, 1
test cl, 1
je 0x100012c2
bts eax, 2
shr ecx, 1
test cl, 1
je 0x100012cd
bts eax, 1
test cl, 2
je 0x100012d6
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x1000136f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10001360
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x10025478], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10001280
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100013a0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1002400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x10020cb4
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0
push eax
or ebx, 0xffffffff
call fcn.1000a624
add esp, 0xc
test eax, eax
jne 0x100013f1
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100035b0
mov esp, ebp
pop ebp
ret 4
push esi
push edi
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.1000a853
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x1000143a
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10025478]
sub edx, 1
jne 0x10001420
cmp edi, 0x400
je 0x100013f3
push dword [ebp - 0x408]
call fcn.10007641
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.100035b0
mov esp, ebp
pop ebp
ret 4
Function at 0x10001470
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.10001260
cmp dword [0x10025438], 1
jne 0x1000152a
push 0x10020cb8
call fcn.100013a0
cmp eax, dword [0x1002546c]
je 0x1000152a
push 0x10020b00
lea eax, [ebp - 4]
push 0x10020b04
push eax
call fcn.1000a624
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100014d5
push 0x10020cc4
push 0x10020b14
push eax
call fcn.10001200
push dword [ebp - 4]
call fcn.10007641
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0x10020b18
call esi
push 0
push 0x10020b34
call esi
push 0
push 0x10020b4c
call esi
push 0
push 0x10020b64
call esi
push 0
push 0x10020b7c
call esi
push 0
push 0x10020b7c
call esi
push 0x10
push 0
push 0x10020b98
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x1002543c], 1
jne 0x10001570
push 0x10020cf4
call fcn.100013a0
cmp eax, dword [0x10025470]
je 0x10001570
push 0x10020b00
lea eax, [ebp - 4]
push 0x10020b04
push eax
call fcn.1000a624
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100014d5
push 0x10020d04
jmp 0x100014bf
cmp dword [0x10025440], 1
jne 0x100015b6
push 0x10020d34
call fcn.100013a0
cmp eax, dword [0x10025474]
je 0x100015b6
push 0x10020b00
lea eax, [ebp - 4]
push 0x10020b04
push eax
call fcn.1000a624
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100014d5
push 0x10020d4c
jmp 0x100014bf
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100015c0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push esi
mov esi, dword [0x10029894]
push edi
mov edi, dword [0x10029898]
cmp esi, edi
je 0x100015f0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop dword [eax]
push dword [esi]
call ebx
test eax, eax
jne 0x100015f3
add esi, 4
cmp esi, edi
jne 0x100015e0
pop ebx
pop edi
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0x10020b18
call esi
push 0
push 0x10020b34
call esi
push 0
push 0x10020b4c
call esi
push 0
push 0x10020b64
call esi
push 0
push 0x10020b7c
call esi
push 0
push 0x10020b7c
call esi
push 0x200010
push 0x10020d90
push 0x10020da8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001740
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x1002400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 0xf
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
je 0x100017f6
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100017ef
push esi
nop dword [eax + eax]
mov eax, ebx
lea ecx, [ebp - 0x20c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x100017be
test dx, dx
je 0x100017ba
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x100017be
add ecx, 4
add eax, 4
test dx, dx
jne 0x10001798
xor eax, eax
jmp 0x100017c3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100017dc
push dword [ebp - 0x228]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10001806
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10001790
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.100035b0
mov esp, ebp
pop ebp
ret
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10020b00
lea eax, [ebp - 0x234]
push 0x10020e28
push eax
call fcn.1000a624
push ebx
push 0x10020e3c
push dword [ebp - 0x234]
call fcn.10001200
push dword [ebp - 0x234]
call fcn.10007641
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push 0x10020b34
call esi
push 0
push 0x10020b4c
call esi
push 0
push 0x10020b64
call esi
push 0
push 0x10020b7c
call esi
push 0
push 0x10020b7c
call esi
push 0x200010
push 0x10020d90
push 0x10020da8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100018a0
Capabilities:
Create process on windows
Enumerate processes
Terminate process

Disassembly:
mov ecx, 0x10020e48
call fcn.10001740
mov ecx, 0x10020e60
call fcn.10001740
mov ecx, 0x10020e74
call fcn.10001740
mov ecx, 0x10020e84
call fcn.10001740
mov ecx, 0x10020e98
call fcn.10001740
mov ecx, 0x10020eb8
call fcn.10001740
mov ecx, 0x10020ed4
call fcn.10001740
mov ecx, 0x10020eec
call fcn.10001740
mov ecx, 0x10020f04
call fcn.10001740
mov ecx, 0x10020f04
call fcn.10001740
mov ecx, 0x10020f24
call fcn.10001740
mov ecx, 0x10020f40
jmp fcn.10001740
Function at 0x100019c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10001a5f
push 0x10020b00
lea eax, [ebp - 4]
push 0x10020e28
push eax
call fcn.1000a624
push esi
push 0x10020f54
push dword [ebp - 4]
call fcn.10001200
push dword [ebp - 4]
call fcn.10007641
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push 0x10020b18
call esi
push 0
push 0x10020b34
call esi
push 0
push 0x10020b4c
call esi
push 0
push 0x10020b64
call esi
push 0
push 0x10020b7c
call esi
push 0
push 0x10020b7c
call esi
push 0x200010
push 0x10020d90
push 0x10020da8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001a70
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov ecx, 0x10020f60
call fcn.100019c0
mov ecx, 0x10020f78
call fcn.100019c0
mov ecx, 0x10020f8c
call fcn.100019c0
mov ecx, 0x10020fa0
call fcn.100019c0
mov ecx, 0x10020fb4
call fcn.100019c0
mov ecx, 0x10020fc8
call fcn.100019c0
mov ecx, 0x10020fdc
call fcn.100019c0
mov ecx, 0x10020ff0
call fcn.100019c0
mov ecx, 0x10021004
call fcn.100019c0
mov ecx, 0x10021018
call fcn.100019c0
mov ecx, 0x1002102c
call fcn.100019c0
mov ecx, 0x10021040
call fcn.100019c0
mov ecx, 0x10021054
call fcn.100019c0
mov ecx, 0x10021068
call fcn.100019c0
mov ecx, 0x1002107c
call fcn.100019c0
mov ecx, 0x10021090
call fcn.100019c0
mov ecx, 0x100210a4
call fcn.100019c0
mov ecx, 0x100210b8
call fcn.100019c0
mov ecx, 0x100210c8
call fcn.100019c0
mov ecx, 0x100210dc
call fcn.100019c0
mov ecx, 0x100210f4
call fcn.100019c0
mov ecx, 0x100210c8
call fcn.100019c0
mov ecx, 0x1002111c
call fcn.100019c0
mov ecx, 0x1002112c
jmp fcn.100019c0

Function at 0x10001b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, ecx
push esi
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x10001c23
push 0x10020b00
lea eax, [ebp - 4]
push 0x10020e28
push eax
call fcn.1000a624
push esi
push 0x10021134
push dword [ebp - 4]
call fcn.10001200
push dword [ebp - 4]
call fcn.10007641
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push 0x10020b18
call esi
push 0
push 0x10020b34
call esi
push 0
push 0x10020b4c
call esi
push 0
push 0x10020b64
call esi
push 0
push 0x10020b7c
call esi
push 0
push 0x10020b7c
call esi
push 0x200010
push 0x10020d90
push 0x10020da8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001c30
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov ecx, 0x10021140
call fcn.10001b80
mov ecx, 0x1002114c
call fcn.10001b80
mov ecx, 0x10021160
call fcn.10001b80
mov ecx, 0x10021170
call fcn.10001b80
mov ecx, 0x10021180
call fcn.10001b80
mov ecx, 0x1002114c
call fcn.10001b80
mov ecx, 0x10021194
call fcn.10001b80
mov ecx, 0x100211a0
call fcn.10001b80
mov ecx, 0x100211a4
call fcn.10001b80
mov ecx, 0x100211b4
call fcn.10001b80
mov ecx, 0x100211c4
call fcn.10001b80
mov ecx, 0x100211d8
call fcn.10001b80
mov ecx, 0x100211ec
call fcn.10001b80
mov ecx, 0x100211fc
call fcn.10001b80
mov ecx, 0x10021210
call fcn.10001b80
mov ecx, 0x10021224
call fcn.10001b80
mov ecx, 0x10021234
call fcn.10001b80
mov ecx, 0x10021240
call fcn.10001b80
mov ecx, 0x10021248
call fcn.10001b80
mov ecx, 0x10021250
call fcn.10001b80
mov ecx, 0x10021254
call fcn.10001b80
mov ecx, 0x10021264
call fcn.10001b80
mov ecx, 0x10021274
call fcn.10001b80
mov ecx, 0x10021280
call fcn.10001b80
mov ecx, 0x1002128c
call fcn.10001b80
mov ecx, 0x10021194
call fcn.10001b80
mov ecx, 0x10021298
call fcn.10001b80
mov ecx, 0x100212a4
call fcn.10001b80
mov ecx, 0x100212b0
call fcn.10001b80
mov ecx, 0x100212b8
call fcn.10001b80
mov ecx, 0x10021280
call fcn.10001b80
mov ecx, 0x100212c8
call fcn.10001b80
mov ecx, str.0x150114__1376532_
call fcn.10001b80
mov ecx, str.0x507B6__329654_
jmp fcn.10001b80

Function at 0x10002000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ebx
cmp byte [ebx], 0xe9
jne 0x10002024
lea ecx, [ebx + 5]
add ecx, dword [ebx + 1]
call fcn.10002000
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10024d1c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100298a8]
cmp eax, dword [ecx + 4]
jle 0x1000207c
push 0x100298a8
call fcn.10003ade
add esp, 4
cmp dword [0x100298a8], 0xffffffff
jne 0x1000207c
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x100298a8
mov dword [0x100298a4], eax
call fcn.10003a94
add esp, 4
push esi
mov esi, dword [0x100298a4]
push edi
lea edx, [esi + 0x1000]
cmp esi, edx
je 0x100020a3
nop
lea ecx, [esi + 0x1c]
call fcn.10001ff0
test eax, eax
je 0x100020a5
add esi, 0x20
cmp esi, edx
jne 0x10002090
xor esi, esi
xor edi, edi
lea ecx, [edi + ebx]
call fcn.10001db0
add edi, eax
cmp edi, 5
jl 0x100020a7
test edi, edi
jle 0x100020d1
mov ecx, esi
sub ebx, esi
mov edx, edi
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x100020c0
mov ebx, dword [ebp - 0xc]
lea ecx, [edi + esi]
sub edi, ecx
mov byte [ecx], 0xe9
lea eax, [edi - 5]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add eax, ebx
mov dword [ecx + 1], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ebx
call edi
mov eax, dword [ebp - 0x10]
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret