joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edi
test eax, eax
jg 0x1000d95c
jl 0x1000d950
test ecx, ecx
jne 0x1000d95c
pop edi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
je 0x1000da1c
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, ebx
call fcn.1000ad20
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x1000d9c3
jg 0x1000d988
test esi, esi
je 0x1000d9c3
mov ecx, dword [ebp - 4]
cmp ecx, eax
jg 0x1000d99d
mov eax, dword [ebp - 8]
jl 0x1000d998
cmp eax, esi
jae 0x1000d99d
mov esi, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1004eb90
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
sub ecx, esi
sbb edx, dword [ebp - 0xc]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1000d9ec
mov eax, dword [ebx]
mov esi, dword [eax + 0x1c]
mov ecx, esi
call dword [0x10077410]
mov ecx, ebx
call esi
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x1000da06
mov ecx, dword [ebp - 8]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
test edx, edx
jg 0x1000d970
jl 0x1000da06
test ecx, ecx
jne 0x1000d970
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
pop esi
sbb ecx, edx
pop edi
mov edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x1000da59
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x1000da59
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.1004eb90
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x1000dacb
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x1000da7f
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [ebp - 4]
mov ecx, edi
cmp edi, 0xfff
jbe 0x1000dab4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.10054ea5
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x1000dadf
cmp edi, eax
ja 0x1000da90
test ecx, ecx
je 0x1000dacb
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.10054ea5
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000dbe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x1000dcc1
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
test esi, esi
jl 0x1000dcb0
jg 0x1000dc18
test edx, edx
je 0x1000dcb0
call fcn.1000b3f0
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x1000dc66
jg 0x1000dc2e
test esi, esi
je 0x1000dc66
cmp ebx, eax
jg 0x1000dc3d
jl 0x1000dc38
cmp edi, esi
jae 0x1000dc3d
mov esi, edi
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 8]
push esi
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
push dword [eax]
call fcn.1004eb90
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x1000dc95
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
call dword [0x10077410]
mov ecx, dword [ebp - 4]
call esi
cmp eax, 0xffffffff
je 0x1000dcaa
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp - 8], esi
test ebx, ebx
jg 0x1000dc18
jl 0x1000dcaa
test edi, edi
jne 0x1000dc18
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov eax, dword [eax]
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x1000dce0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x1000dce2
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test edi, edi
jl 0x1000dd5b
jg 0x1000dcf4
test esi, esi
je 0x1000dd5b
test eax, eax
jl 0x1000dd3f
jg 0x1000dcfe
test ebx, ebx
je 0x1000dd3f
cmp edi, eax
jg 0x1000dd0d
jl 0x1000dd08
cmp esi, ebx
jae 0x1000dd0d
mov ebx, esi
mov dword [ebp - 0xc], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.1004eb90
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [ebp - 0xc]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x1000dd5b
jg 0x1000dd42
test esi, esi
je 0x1000dd5b
jmp 0x1000dd42
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x1000dd5b
push eax
push esi
push 1
push edx
call fcn.1005552c
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000dfd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
clc
jae 0x1000dfe8
pop esi
inc edx
pushf
push 0xa
Function at 0x1000dff7
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
jae 0x1000dff5
jmp 0x1000dff0
call fcn.1000dff7
jae 0x1000dff0
add esp, 4
jmp 0x1000dffc
dec dword [esp]
jno 0x1000e001
jns 0x1000dfec
jp 0x1000e005
add esp, 4
popf
jmp 0x1000e00c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
xor eax, 0x1b
xor edx, eax
add eax, edx
sub edx, 0x1b
push eax
pop edx
xor edx, 0x51
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x1b
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
jl 0x1000e058
jmp 0x1000e05a
je 0x1000e055
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e074
jne 0x1000e073
call 0x9304d0fb
rol byte [ebx + eax*4], 0xf0
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e082
add eax, 0x1750374
jne 0x1000e082
call 0x35e5264c
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
clc
jae 0x1000e0ed
jg 0x1000e07c
pushf
push 0xa
jae 0x1000e0fa
jmp 0x1000e0f5
call 0x1000e0fc
jae 0x1000e0f5
add esp, 4
jmp 0x1000e101
dec dword [esp]
jno 0x1000e106
jns 0x1000e0f1
jp 0x1000e10a
add esp, 4
popf
jmp 0x1000e111
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
xor eax, 0x20
xor edx, eax
add eax, edx
sub edx, 0x20
push eax
pop edx
xor edx, 0x60
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x20
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
jl 0x1000e15d
jmp 0x1000e15f
je 0x1000e15a
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e179
jne 0x1000e178
call 0x9304d200
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e187
jne 0x1000e187
call 0x9b5c3fea
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
Function at 0x1000e206
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x1000e204
jmp 0x1000e1ff
call fcn.1000e206
jae 0x1000e1ff
add esp, 4
jmp 0x1000e20b
dec dword [esp]
jno 0x1000e210
jns 0x1000e1fb
jp 0x1000e214
add esp, 4
popf
jmp 0x1000e21b
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e234
jne 0x1000e234
call 0x1fc11588
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000e5b6
Capabilities:
Create thread

Disassembly:
jae 0x1000e45c
jmp 0x1000e457
call fcn.1000e45e
jae 0x1000e457
add esp, 4
jmp 0x1000e463
dec dword [esp]
jno 0x1000e468
jns 0x1000e453
jp 0x1000e46c
add esp, 4
popf
jmp 0x1000e473
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e48c
jne 0x1000e48c
call 0x1fc117e0
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.1000dfd0
clc
jae 0x1000e4a7
retf
pushf
push 0xa
jae 0x1000e4b4
jmp 0x1000e4af
call 0x1000e4b6
jae 0x1000e4af
add esp, 4
jmp 0x1000e4bb
dec dword [esp]
jno 0x1000e4c0
jns 0x1000e4ab
jp 0x1000e4c4
add esp, 4
popf
jmp 0x1000e4cb
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
xor eax, 0x8b
xor edx, eax
add eax, edx
sub edx, 0x8b
push eax
pop edx
xor edx, 0x1a1
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x8b
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
jl 0x1000e51f
jmp 0x1000e521
je 0x1000e51c
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e53b
jne 0x1000e53a
call 0x9304d5c2
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e549
jne 0x1000e549
call 0xffd3835
push dword [ebx]
rol byte [ebp + 0x750374c0], 0
call 0x1000e1a0
xor eax, eax
test eax, eax
je 0x1000e557
jne 0x1000e556
call 0x9304d5de
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
lcall 0x7002, 0x73f8fb74
lcall 0x3300, 0x8d35
rol byte [ebx], 1
ret 0xea81
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1000e565
jmp 0x1000e567
je 0x1000e562
clc
jae 0x1000e56c
jo 0x1000e506
xor eax, 0x8d
xor edx, eax
add eax, edx
sub edx, 0x8d
push eax
pop edx
xor edx, 0x1a7
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x8d
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
pushf
push 0xa
jae 0x1000e5b4
jmp 0x1000e5af
call 0x1000e5b6
jae 0x1000e5af
add esp, 4
jmp 0x1000e5bb
dec dword [esp]
jno 0x1000e5c0
jns 0x1000e5ab
jp 0x1000e5c4
add esp, 4
popf
jmp 0x1000e5cb
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e5e4
jne 0x1000e5e4
call 0x1fc11938
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x1000e260
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000e320
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000ded0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000f410
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10073305
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
call fcn.1004caea
add esp, 4
test eax, eax
je 0x1000f44e
mov dword [eax], 0x1000f4d0
jmp 0x1000f450
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x1000ebc0
push 0
push 0
call fcn.10055d4c
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1000f4bb
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x1000f4ae
push ecx
push eax
call fcn.1004b9a2
add esp, 8
test eax, eax
jne 0x1000f4b5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
push 1
call fcn.1004bb5a
push eax
call fcn.1004bb2d
push 6
mov dword [ebp - 0x18], 0
call fcn.1004bb5a
int3
Function at 0x100102a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100733bd
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x148], 0
push 8
lea ecx, [ebp - 0x18]
call fcn.1000fc10
lea ecx, [ebp - 0x18]
call fcn.10010030
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
jne 0x1001033b
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000ffd0
mov ecx, dword [ebp - 0x148]
or ecx, 1
mov dword [ebp - 0x148], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.100100c0
mov eax, dword [ebp + 8]
jmp 0x10010666
clc
jae 0x10010340
lodsd eax, dword [esi]
invalid
pushf
push 0xa
Function at 0x10010e90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10010ec3
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
pop esi
setne al
pop edi
pop ebp
ret
xor al, al
pop edi
pop ebp
ret
Function at 0x10011e10
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10073593
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x10011eed
lea eax, [ebp - 0x160]
mov dword [ebp - 0x160], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10011ee6
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x158]
cmp ecx, eax
je 0x10011ed5
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10011ed5
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push eax
lea eax, [ebp - 0x13c]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
test eax, eax
je 0x10011ece
push 0xc
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x38]
push esi
call sub.KERNEL32.dll_K32GetModuleInformation
test eax, eax
je 0x10011ece
cmp dword [ebp - 0x30], 0x400
jb 0x10011f0a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x160]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10011e70
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x168], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x164], 0xf
mov byte [ebp - 0x178], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10011f38
sub ecx, edx
lea eax, [ebp - 0x13c]
push ecx
push eax
lea ecx, [ebp - 0x178]
call fcn.10005040
mov dword [ebp - 4], 0
mov ecx, 0x15
xor edx, edx
mov al, byte [edx + str.QscznxnpTDLWMDJ_ax_EHI_]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1b0], al
and ecx, 0x800000ff
jns 0x10011f82
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x34
jl 0x10011f62
mov byte [ebp - 0x17c], 0
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10011260
add esp, 0xc
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 4
call fcn.100037b0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10041dc0
add esp, 4
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
call fcn.100037b0
mov al, 1
jmp 0x10011eef
Function at 0x10012000
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100735e3
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x100120f5
lea eax, [ebp - 0x160]
mov dword [ebp - 0x160], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x100120ee
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x158]
cmp ecx, eax
je 0x100120d9
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100120d9
cmp dword [ebp - 0x158], 4
je 0x100120d2
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
lea eax, [ebp - 0x13c]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
test eax, eax
je 0x100120d2
push 0xc
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
push esi
call sub.KERNEL32.dll_K32GetModuleInformation
test eax, eax
je 0x100120d2
cmp dword [ebp - 0x38], 0
je 0x10012112
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x10012112
cmp eax, 0x400
jb 0x10012112
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x160]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10012060
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x168], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x164], 0xf
mov byte [ebp - 0x178], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10012140
sub ecx, edx
lea eax, [ebp - 0x13c]
push ecx
push eax
lea ecx, [ebp - 0x178]
call fcn.10005040
mov dword [ebp - 4], 0
mov ecx, 0x15
xor edx, edx
nop word [eax + eax]
mov al, byte [edx + str.QscznxnpTDLWMDJ_aX_EHI_]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1ac], al
and ecx, 0x800000ff
jns 0x10012190
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x30
jl 0x10012170
mov byte [ebp - 0x17c], 0
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10011260
add esp, 0xc
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 4
call fcn.100037b0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10041dc0
add esp, 4
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
call fcn.100037b0
mov al, 1
jmp 0x100120f7
Function at 0x10012630
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10073697
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.1004ce50
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x1028], esi
mov dword [ebp - 0x1024], 0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x1024], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1001273a
xor edi, edi
test dword [ebp - 0x1014], 0xfffffffc
jbe 0x1001273a
nop dword [eax + eax]
push 0xc
lea eax, [ebp - 0x1020]
push eax
push dword [ebp + edi*4 - 0x1010]
push ebx
call sub.KERNEL32.dll_K32GetModuleInformation
test eax, eax
je 0x1001272c
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x1001271d
movq xmm0, qword [ebp - 0x1020]
movq qword [ecx], xmm0
mov eax, dword [ebp - 0x1018]
mov dword [ecx + 8], eax
add dword [esi + 4], 0xc
jmp 0x1001272c
lea eax, [ebp - 0x1020]
push eax
push ecx
mov ecx, esi
call fcn.100112d0
mov ecx, dword [ebp - 0x1014]
inc edi
shr ecx, 2
cmp edi, ecx
jb 0x100126e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret

Function at 0x10012760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str.NtQueryInformatiGszwm]
lea eax, [ebp - 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
mov dword [ebp - 0x30], 0
xor edi, edi
mov dword [ebp - 0x10], 0x6c64746e
mov dword [ebp - 0xc], 0x6c642e6c
mov word [ebp - 8], 0x6c
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x68546e6f
mov dword [ebp - 0x18], 0x64616572
mov byte [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x100127dc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
push 0x1c
lea eax, [ebp - 0x4c]
push eax
push 0
push ebx
call dword [0x10077410]
call esi
mov ecx, dword [ebp - 4]
test eax, eax
cmovns edi, dword [ebp - 0x48]
xor ecx, ebp
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.1004ce42
mov esp, ebp
pop ebp
ret