joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018123
Capabilities:
Encode data using xor

Disassembly:
push 0x40
mov eax, 0x1004eab6
call fcn.1004d36e
cmp byte [0x1005c663], 0
je 0x1001830d
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x37293f1a
mov dword [ebp - 0x18], 0x7150129
xor ebx, ebx
mov dword [ebp - 0x14], 0x1004507
call fcn.1000fb4a
push eax
call fcn.1002a230
pop ecx
cmp byte [0x1005c665], bl
je 0x100181af
push 0x1b
pop ecx
mov edx, ebx
mov al, byte [edx + str.Mynj]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x18], al
and ecx, 0x800000ff
jns 0x1001818c
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 4
jl 0x1001816f
mov byte [ebp - 0x14], bl
sub esp, 0xc
mov dword [ebp - 4], ebx
mov edx, 0x1005c6b8
lea ecx, [ebp - 0x18]
call fcn.10030c20
add esp, 0xc
or dword [ebp - 4], 0xffffffff
cmp byte [0x1005c6d1], 0
push 0xa
pop ebx
je 0x1001821b
movaps xmm0, xmmword [0x100576a0]
xor ecx, ecx
movups xmmword [ebp - 0x4c], xmm0
mov byte [ebp - 0x2c], 1
movaps xmm0, xmmword [str.0Y__r_BMF___]
movups xmmword [ebp - 0x3c], xmm0
lea eax, [ecx + 0x5b]
xor byte [ebp + ecx - 0x4c], al
inc ecx
cmp ecx, 0x1f
jb 0x100181d7
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x1c], 0x11
mov byte [ebp - 0x1b], bl
mov dword [ebp - 0x1a], 0x2d34107b
mov word [ebp - 0x16], 0x2b
mov byte [ebp - 0x14], 1
call fcn.1000214e
push ecx
lea ecx, [ebp - 0x4c]
mov edx, 0x1005c6bc
push ecx
mov ecx, eax
call fcn.100312e3
pop ecx
pop ecx
cmp byte [0x1005c667], 0
je 0x1001826b
xor ecx, ecx
mov al, byte [ecx + str.Bn__k]
xor al, bl
inc ebx
mov byte [ebp + ecx - 0x18], al
and ebx, 0x800000ff
jns 0x10018243
dec ebx
or ebx, 0xffffff00
inc ebx
inc ecx
cmp ecx, 6
jl 0x10018226
mov byte [ebp - 0x12], 0
sub esp, 0xc
mov dword [ebp - 4], 1
mov edx, 0x1005c6c4
lea ecx, [ebp - 0x18]
call fcn.10030c20
add esp, 0xc
or dword [ebp - 4], 0xffffffff
cmp byte [0x1005c666], 0
je 0x100182be
push 0x66
pop ecx
xor edx, edx
mov al, byte [edx + 0x10051e74]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x18], al
and ecx, 0x800000ff
jns 0x10018296
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 4
jl 0x10018279
mov byte [ebp - 0x14], 0
sub esp, 0xc
mov dword [ebp - 4], 2
mov edx, 0x1005c6cc
lea ecx, [ebp - 0x18]
call fcn.10030c20
add esp, 0xc
or dword [ebp - 4], 0xffffffff
cmp byte [0x1005c6d0], 0
je 0x1001830d
push 0x73
pop ecx
xor edx, edx
mov al, byte [edx + 0x10051e7c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x100182e9
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 8
jl 0x100182cc
mov byte [ebp - 0x20], 0
sub esp, 0xc
mov dword [ebp - 4], 3
mov edx, 0x1005c6c0
lea ecx, [ebp - 0x28]
call fcn.10030c20
add esp, 0xc
call fcn.1004d32c
ret
Function at 0x10018b66
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x1005b040]
xor eax, esp
mov dword [esp + 0x40], eax
movaps xmm0, xmmword [0x10056a60]
lea ecx, [esp + 0xc]
and dword [esp + 4], 0
and dword [esp + 8], 0
push ebx
movups xmmword [esp + 0x10], xmm0
mov byte [esp + 0x20], 1
call fcn.10013089
xor ebx, ebx
lea edx, [esp + 8]
push ebx
mov ecx, eax
call fcn.1002aa73
pop ecx
test al, al
je 0x10018bf3
movaps xmm0, xmmword [0x10057460]
lea ecx, [esp + 0x24]
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x34], 0xd04033d
mov dword [esp + 0x38], 0x1319330a
mov dword [esp + 0x3c], 0xe105a07
mov word [esp + 0x40], 0x12
mov byte [esp + 0x42], 1
call fcn.10018c99
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
pop ecx
and dword [esp + 8], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0x392d3b0a
mov dword [esp + 0x14], 0x13a187d
mov dword [esp + 0x18], 0x1111715
mov word [esp + 0x1c], 0x16
mov byte [esp + 0x1e], 1
call fcn.1000216f
push ebx
lea edx, [esp + 0xc]
mov ecx, eax
call fcn.1002aa73
pop ecx
test al, al
je 0x10018c3e
call fcn.1000fb6b
and dword [esp + 8], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0x383a3515
mov dword [esp + 0x14], 0x13a187d
mov dword [esp + 0x18], 0x1111715
mov word [esp + 0x1c], 0x16
mov byte [esp + 0x1e], 1
call fcn.1000216f
push ebx
lea edx, [esp + 0xc]
mov ecx, eax
call fcn.1002aa73
pop ecx
test al, al
je 0x10018c89
call fcn.1001314f
mov ecx, dword [esp + 0x44]
pop ebx
xor ecx, esp
call fcn.100498be
mov esp, ebp
pop ebp
ret

Function at 0x10018c99
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1e], 0
je 0x10018cb7
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x5b]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1d
jb 0x10018ca4
pop ebx
mov byte [edx + 0x1e], 0
mov eax, edx
ret
Function at 0x1001b656
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x50
mov eax, 0x1004ebe9
call fcn.1004d36e
cmp dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
jne 0x1001b716
lea ecx, [ebp - 0x40]
call fcn.1000edf9
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
call fcn.1000807b
call fcn.1000eed7
add esp, 0x18
test al, al
je 0x1001b721
mov ecx, esi
call fcn.1000894a
mov ecx, esi
call fcn.100088ee
push 0x64
push 0x232
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x1001b651
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x1000889c
push ebx
push ebx
call esi
push 6
pop ecx
movaps xmm0, xmmword [0x10057640]
lea edi, [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0x5b545d
rep stosd dword es:[edi], eax
push ecx
push ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x14], 1
movups xmmword [ebp - 0x28], xmm0
call fcn.1000ed5a
lea edx, [ebp - 0x5c]
mov ecx, eax
call fcn.100022e2
pop ecx
pop ecx
call fcn.1000ed7b
lea ecx, [ebp - 0x40]
call fcn.100078c3
xor eax, eax
inc eax
call fcn.1004d32c
ret 0xc
movaps xmm0, xmmword [0x10057100]
lea ecx, [ebp - 0x28]
push 0x10
push 0x10050593
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 0x100
call fcn.100130ec
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1001b75c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf1], 0
je 0x1001b782
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0xf0
jb 0x1001b76a
mov byte [esi + 0xf1], 0
pop esi
ret

Function at 0x1001b784
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x1001b7a1
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x20
jb 0x1001b78f
mov byte [esi + 0x21], 0
pop esi
ret

Function at 0x1001b7a3
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x90], 0
je 0x1001b7c9
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x8f
jb 0x1001b7b1
mov byte [esi + 0x90], 0
pop esi
ret

Function at 0x1001b7cb
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4b], 0
je 0x1001b7e8
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x4a
jb 0x1001b7d6
mov byte [esi + 0x4b], 0
pop esi
ret

Function at 0x1001b7ea
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x1001b807
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x23
jb 0x1001b7f5
mov byte [esi + 0x24], 0
pop esi
ret

Function at 0x1001b809
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3c], 0
je 0x1001b826
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x3b
jb 0x1001b814
mov byte [esi + 0x3c], 0
pop esi
ret
Function at 0x1001b828
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x74], 0
je 0x1001b845
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x73
jb 0x1001b833
mov byte [esi + 0x74], 0
pop esi
ret

Function at 0x1001b847
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2d0], 0
je 0x1001b86d
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x2cf
jb 0x1001b855
mov byte [esi + 0x2d0], 0
pop esi
ret

Function at 0x1001b86f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xbe], 0
je 0x1001b895
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0xbd
jb 0x1001b87d
mov byte [esi + 0xbe], 0
pop esi
ret

Function at 0x1001b8f7
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x1001b914
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x1d
jb 0x1001b902
mov byte [esi + 0x1e], 0
pop esi
ret

Function at 0x1001b9fb
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x1001ba18
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x1c
jb 0x1001ba06
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x1001ba1a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x1001ba37
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x17
jb 0x1001ba25
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x1001ba39
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x1001ba56
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x16
jb 0x1001ba44
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x1001ba58
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x1001ba75
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x1a
jb 0x1001ba63
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x1001ba77
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x1001ba94
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x10
jb 0x1001ba82
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x1001ba96
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x1001bab3
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x1001baa1
mov byte [esi + 0x15], 0
pop esi
ret

Function at 0x1001bab5
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x1001bad2
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0xe
jb 0x1001bac0
mov byte [esi + 0xf], 0
pop esi
ret
Function at 0x1001bad4
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x1001baf1
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0xf
jb 0x1001badf
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x1001baf3
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x1001bb10
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0xa
jb 0x1001bafe
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x1001bbb2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x1001bbcf
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x12
jb 0x1001bbbd
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x1001bbd1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x1001bbee
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5b]
xor byte [ecx], al
inc edx
cmp edx, 0x13
jb 0x1001bbdc
mov byte [esi + 0x14], 0
pop esi
ret
Function at 0x1001cd38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1005b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100d1bc0]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push dword [0x101087d4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x20]
mov ecx, edi
sub ecx, dword [0x101087d8]
mov esi, dword [ebp - 0x1c]
mov edx, esi
sbb edx, dword [0x101087dc]
call fcn.1004d8f0
mov edx, dword [0x101087e4]
mov ecx, dword [0x101087e0]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.1004d8f0
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x101087dc], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x101087d8], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xf1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xf2], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebx + 0xf4], 0
mov byte [ebx + 0xf3], al
call fcn.1001cc91
cmp byte [ebx + 0xf0], 0
pop edi
pop esi
pop ebx
je 0x1001ce32
or eax, 0xffffffff
jmp 0x1001ce3d
mov eax, dword [0x100d1bc0]
mov eax, dword [eax + 0x1cfc]
cmp dword [0x1005bc70], eax
je 0x1001ce4f
mov dword [0x1005bc70], eax
call fcn.1001cbf5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100498be
leave
ret

Function at 0x1001e35b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1010882c], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x1001e39a
xor esi, esi
push 8
mov edx, esi
pop ecx
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub ecx, 1
jne 0x1001e375
mov dword [esi*4 + 0x10108828], edx
inc esi
cmp esi, 0x100
jb 0x1001e370
mov esi, dword [ebp + 8]
not esi
mov edx, esi
test ebx, ebx
jle 0x1001e3df
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10108828]
inc edi
sub ebx, 1
jne 0x1001e3a5
jmp 0x1001e3e6
cmp al, 0x23
jne 0x1001e3cd
cmp byte [edi], al
jne 0x1001e3cd
cmp byte [edi + 1], al
cmove edx, esi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10108828]
mov al, byte [edi]
inc edi
test al, al
jne 0x1001e3bf
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x1001ebe0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1001ebef
and dword [edi], 0
mov edx, 0x10055f50
call fcn.1001eb4e
mov esi, eax
test esi, esi
je 0x1001ec8d
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1001ec82
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
je 0x1001ec82
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1001ec82
mov ecx, ebx
call fcn.1002030b
mov dword [ebp + 8], eax
test eax, eax
je 0x1001ec82
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x1001ec70
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp + 8]
dec dword [0x101087e8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x1001ec89
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
test edi, edi
je 0x1001ec7d
mov dword [edi], ebx
mov eax, dword [ebp + 8]
jmp 0x1001ec8c
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1002336f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100d1bc0]
push esi
mov esi, ecx
and dword [eax + 0x2c8c], 0
test esi, esi
je 0x100233bf
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push edi
call fcn.100233c2
mov edx, 0x10055f54
mov ecx, esi
mov edi, eax
call fcn.1001eb4e
mov esi, eax
test esi, esi
je 0x100233be
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x1002a1e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [0x100d1bc0]
mov eax, dword [edi + 0x1a20]
mov byte [eax + 0x78], 1
mov eax, dword [edi + 0x1a20]
cmp byte [eax + 0x7b], 0
jne 0x1002a22d
push edx
lea esi, [edi + 0x2ec4]
mov edx, 0xc01
push ecx
mov ecx, esi
call fcn.1001e32d
pop ecx
pop ecx
lea edx, [edi + 0x2ec4]
mov ecx, esi
lea edx, [edx + eax]
pop edi
pop esi
jmp fcn.1002a292
pop edi
pop esi
ret
Function at 0x1003b102
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x1005b040]
xor eax, esp
mov dword [esp + 0x2c], eax
movaps xmm0, xmmword [0x10056a80]
xor edx, edx
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0xe5130e0f
movaps xmm0, xmmword [0x10056d60]
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x24], 0xf6e2c6a1
mov dword [esp + 0x28], 0x10086ee
mov al, dl
add al, 0x5d
xor byte [esp + edx], al
inc edx
cmp edx, 0x2a
jb 0x1003b147
push ecx
lea eax, [esp + 4]
mov byte [esp + 0x2f], 0
push eax
mov edx, 0x10108c34
call fcn.100312e3
pop ecx
pop ecx
test al, al
je 0x1003b1b4
mov eax, dword [0x10108c34]
sub eax, 0
je 0x1003b1a9
sub eax, 1
je 0x1003b1a2
sub eax, 1
je 0x1003b19b
sub eax, 1
je 0x1003b194
sub eax, 1
jne 0x1003b1b0
call fcn.10044112
jmp 0x1003b1b0
call fcn.1004477c
jmp 0x1003b1b0
call fcn.1004358a
jmp 0x1003b1b0
call fcn.10043c06
jmp 0x1003b1b0
xor ecx, ecx
call fcn.10042c14
mov al, 1
jmp 0x1003b1b6
xor al, al
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100498be
mov esp, ebp
pop ebp
ret
Function at 0x1003db7b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x1003db98
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5d]
xor byte [ecx], al
inc edx
cmp edx, 0x33
jb 0x1003db86
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x1003db9a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a5], 0
je 0x1003dbc0
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5d]
xor byte [ecx], al
inc edx
cmp edx, 0x1a4
jb 0x1003dba8
mov byte [esi + 0x1a5], 0
pop esi
ret

Function at 0x1003dbc2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2c], 0
je 0x1003dbdf
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5d]
xor byte [ecx], al
inc edx
cmp edx, 0x2b
jb 0x1003dbcd
mov byte [esi + 0x2c], 0
pop esi
ret

Function at 0x1003dbe1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x1003dbfe
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5d]
xor byte [ecx], al
inc edx
cmp edx, 0x21
jb 0x1003dbec
mov byte [esi + 0x22], 0
pop esi
ret

Function at 0x1003dc00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5f], 0
je 0x1003dc1d
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5d]
xor byte [ecx], al
inc edx
cmp edx, 0x5e
jb 0x1003dc0b
mov byte [esi + 0x5f], 0
pop esi
ret

Function at 0x1003dc1f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x68], 0
je 0x1003dc3c
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5d]
xor byte [ecx], al
inc edx
cmp edx, 0x67
jb 0x1003dc2a
mov byte [esi + 0x68], 0
pop esi
ret

Function at 0x1003dc3e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x41], 0
je 0x1003dc5b
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5d]
xor byte [ecx], al
inc edx
cmp edx, 0x40
jb 0x1003dc49
mov byte [esi + 0x41], 0
pop esi
ret

Function at 0x1003dc5d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x8b], 0
je 0x1003dc83
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5d]
xor byte [ecx], al
inc edx
cmp edx, 0x8a
jb 0x1003dc6b
mov byte [esi + 0x8b], 0
pop esi
ret

Function at 0x1003dc85
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x1003dca2
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x5d]
xor byte [ecx], al
inc edx
cmp edx, 0x2a
jb 0x1003dc90
mov byte [esi + 0x2b], 0
pop esi
ret
Function at 0x1004a980
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1004ab30
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1004aa4d
mov edx, dword [ebp - 4]
cmp edx, dword [0x1005b090]
jb 0x1004a9ca
mov eax, dword [ebp - 4]
cmp eax, dword [0x1005b094]
ja 0x1004a9ca
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004a99a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004a9f0
jmp 0x1004aa4d
cmp dword [ebp - 0x14], 0x10000
jne 0x1004aa33
cmp dword [ebp - 0x18], 0x10000
jb 0x1004aa33
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004aa26
mov eax, dword [ebp - 8]
jmp 0x1004aa4f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1004aa48
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1004ab30
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004a99a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1004aa60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1004ab60
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1004ab25
mov edx, dword [ebp - 4]
cmp edx, dword [0x1005b090]
jb 0x1004aaa5
mov eax, dword [ebp - 4]
cmp eax, dword [0x1005b094]
ja 0x1004aaa5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004aa75
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004aacb
jmp 0x1004ab25
cmp dword [ebp - 0x14], 0x10000
jne 0x1004ab0e
cmp dword [ebp - 0x18], 0x10000
jb 0x1004ab0e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004ab01
mov eax, dword [ebp - 8]
jmp 0x1004ab27
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1004ab20
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1004ab60
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004aa75
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401708
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov dword [0x402c28], 0x94
push 0x402c28
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [0x402c2c], 4
je 0x4017d4
push 0x4e20
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetCurrentProcessId
mov dword [0x402c13], eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x4017d4
mov dword [0x402ae7], eax
push 0x402aeb
push dword [0x402ae7]
mov dword [0x402aeb], 0x128
call sub.KERNEL32.DLL_Process32First
cmp eax, 0
je 0x4017d4
push 0x402aeb
push dword [0x402ae7]
mov dword [0x402aeb], 0x128
call sub.KERNEL32.DLL_Process32Next
mov dword [0x402c24], eax
push 0x402b0f
push str.explorer.exe
call sub.KERNEL32.DLL_lstrcmpi
cmp eax, 0
je 0x4017cb
mov edx, dword [0x402c13]
cmp edx, dword [0x402af3]
je 0x4017cb
push dword [0x402af3]
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
cmp dword [0x402c24], 0
jne 0x401773
ret