joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434080
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x434098
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x434176
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00434a50
add esp, 8
sar eax, 0xc
cmp eax, 3
jne 0x434171
mov dword [ebp - 0x10], 0xfff
mov dword [ebp - 0xc], 0x9922c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00434a50
add esp, 8
and eax, dword [ebp - 0x10]
add eax, 0x8702
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
cmp dword [ebp - 4], 0
jne 0x43414a
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x43414a
xor eax, eax
jmp 0x434176
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx - 0x8702]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx - 0x8702], eax
jmp 0x43408f
mov esp, ebp
pop ebp
ret

Function at 0x434a50
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x240be8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x240be8
push 0x15b9
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x434a85
xor eax, eax
jmp 0x434a8f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx eax, word [eax + edx*2]
mov esp, ebp
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1003fbe
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 2
xor ebx, ebx
push ebx
push 0x1001a48
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1004008
push 0x1001a78
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x1003ff9
cmp eax, 2
jne 0x1003ffb
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x100400a
xor al, al
pop ebx
leave
ret

Function at 0x1004076
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
or edx, 0xffffffff
cmp ebx, 4
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], ecx
jbe 0x10040ea
push edi
lea edi, [ebx - 5]
shr edi, 2
inc edi
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001ab0]
inc esi
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001ab0]
inc esi
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001ab0]
inc esi
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001ab0]
inc esi
sub ebx, 4
dec edi
jne 0x1004097
pop edi
test ebx, ebx
jbe 0x1004104
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001ab0]
inc esi
dec ebx
jne 0x10040ee
mov eax, dword [ebp - 4]
pop esi
mov dword [eax], edx
pop ebx
leave
ret 8

Function at 0x40191a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401959
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401959
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401959
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401959
cmp dword [ecx + 0x74], 0xe
jbe 0x401959
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x51d070
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc6000]
push edi
jmp 0x51d08a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51d091
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51d080
mov eax, 1
add ebx, ebx
jne 0x51d0a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51d0b4
jne 0x51d0d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51d0d3
dec eax
add ebx, ebx
jne 0x51d0c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51d098
add ebx, ebx
jne 0x51d0cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51d125
xor ecx, ecx
sub eax, 3
jb 0x51d0eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51d15a
sar eax, 1
mov ebp, eax
jmp 0x51d0f6
add ebx, ebx
jne 0x51d0f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51d0c4
inc ecx
add ebx, ebx
jne 0x51d104
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51d0c4
add ebx, ebx
jne 0x51d111
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51d106
jne 0x51d122
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51d106
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51d144
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51d136
jmp 0x51d086
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51d144
add edi, ecx
jmp 0x51d086
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51d162
cmp byte [edi], 0x11
jne 0x51d162
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51d167
lea edi, [esi + 0x116000]
mov eax, dword [edi]
or eax, eax
je 0x51d1df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16198c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x161b08]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51d194
mov ecx, edi
jns 0x51d1c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x161b0c]
or eax, eax
je 0x51d1d9
mov dword [ebx], eax
add ebx, 4
jmp 0x51d1b1
call dword [esi + 0x161b1c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x51d210
cmp al, 0xef
ja 0x51d203
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x51d1e5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x51d1f2
mov ebp, dword [esi + 0x161b10]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51d244
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x4ad8e2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4ad921
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4ad921
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ad921
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4ad921
cmp dword [ecx + 0x74], 0xe
jbe 0x4ad921
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4b3353
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4b33f0
push ebx
push esi
call fcn.004b331c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004b32b0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4b339d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4b33ef
push edi
push eax
call fcn.004b3f70
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4b33bd
call fcn.004b1e11
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4b33ee
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004b32b0
add esp, 0x20
test eax, eax
jne 0x4b33dc
push edi
call fcn.004b1e11
jmp 0x4b33e4
push ebx
call fcn.004b1e11
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4b46ed
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4e1ab0
push 0x4e1aa8
push str.FlsAlloc
push 0x1f
call fcn.004b45ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b4721
push dword [ebp + 8]
mov ecx, esi
call dword [0x4ba130]
call esi
jmp 0x4b4727
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4b476b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4e1ac0
push 0x4e1ab8
push str.FlsGetValue
push 0x21
call fcn.004b45ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b47a2
push dword [ebp + 8]
mov ecx, esi
call dword [0x4ba130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4b47aa
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4e1ac8
push 0x4e1ac0
push str.FlsSetValue
push 0x22
call fcn.004b45ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b47e4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4ba130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4b9c40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b9c6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b9c6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x922058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009221a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x92207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92206a
add dl, dl
jne 0x922089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9220dc
xor eax, eax
add dl, dl
jne 0x922096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92217d
add dl, dl
jne 0x9220a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9220b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9220bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9220c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9220d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x922075
mov eax, 1
add dl, dl
jne 0x9220ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9220f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9220e1
sub eax, ebx
mov ebx, 1
jne 0x922128
mov ecx, 1
add dl, dl
jne 0x92210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x922119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x922105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x922075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x92213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x92214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x922136
cmp eax, 0x7d00
jae 0x92216d
cmp eax, 0x500
jb 0x922168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x922075
cmp eax, 0x7f
ja 0x922170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x922075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x92219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x922075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10009883
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10009920
push ebx
push esi
call fcn.1000984c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10009795
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100098cd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000991f
push edi
push eax
call fcn.1000a83a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100098ed
call fcn.100083a5
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000991e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10009795
add esp, 0x20
test eax, eax
jne 0x1000990c
push edi
call fcn.100083a5
jmp 0x10009914
push ebx
call fcn.100083a5
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10009b8b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10011b00
push 0x10011af8
push str.FlsAlloc
push 0x1e
call fcn.10009aa9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009bbf
push dword [ebp + 8]
mov ecx, esi
call dword [0x10010118]
call esi
jmp 0x10009bc5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10009c09
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10011b10
push 0x10011b08
push str.FlsGetValue
push 0x20
call fcn.10009aa9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009c40
push dword [ebp + 8]
mov ecx, esi
call dword [0x10010118]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1000f0e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f10d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000f10d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1000f52a
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x128
lea ebp, [esp - 4]
mov eax, dword [0x10028180]
xor eax, ebp
mov dword [ebp + 0x128], eax
push 0x48
mov eax, 0x1001f333
call fcn.10012db4
mov esi, dword [ebp + 0x134]
and dword [ebp - 0x20], 0
push 0
push 2
mov dword [ebp], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0
push 2
mov dword [ebp - 0x10], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x10], 0xffffffff
je 0x1000f6b4
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Process32First
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x1000f6ab
mov dword [ebp - 0x20], ecx
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.10002795
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
and dword [ebp - 4], 0
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.1000dfbd
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
jmp 0x1000f624
lea ecx, [ebp - 0x1c]
call fcn.1000ddb1
push eax
lea ecx, [ebp - 0x40]
call fcn.1000e0ed
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.1000e09f
push dword [eax]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.1000dd65
mov ecx, dword [ebp - 0x2c]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.100010c6
lea ecx, [ebp - 0x40]
test bl, bl
jne 0x1000f682
mov byte [ebp - 4], bl
call fcn.1000e131
lea ecx, [ebp - 0x1c]
call fcn.1000dde0
mov eax, dword [esi + 0x14]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.1000dfbd
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000db39
test al, al
je 0x1000f5cb
push ecx
mov ecx, esp
mov dword [ebp - 0x54], esp
push 0x10021b53
call fcn.10002795
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x44], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 3
call fcn.10001c1e
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.1000e9c6
lea eax, [ebp - 0x50]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.1000ef3a
lea ecx, [ebp - 0x50]
call fcn.1000e131
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.100010c6
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x1000f59e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x128]
xor ecx, ebp
call fcn.10011f6b
add ebp, 0x12c
leave
ret 4
Function at 0x1001104f
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [0x10029f98], esi
je 0x100110c3
lea eax, [ebp - 4]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x10029f98]
test eax, eax
je 0x100110ba
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push esi
call dword [0x10029fa0]
test eax, eax
je 0x100110ba
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push esi
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [0x10029f9c]
push dword [ebp - 4]
call dword [0x10029fa8]
pop esi
leave
ret

Function at 0x100113d2
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10028180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, ecx
call fcn.10011394
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x10029fb0]
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 8], 0x64
mov byte [ebp - 0xb], 0x48
mov byte [ebp - 6], 0x65
mov byte [ebp - 9], 0x6e
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 0x17], 0x6e
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x6c
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x18], 0x49
mov byte [ebp - 0x12], 0x65
test eax, eax
jne 0x10011460
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10029fb0], eax
test eax, eax
je 0x100114b2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenA
push eax
call esi
push str.InternetConnectA
mov dword [ebx + 0x38], eax
push dword [0x10029fb0]
call esi
push str.HttpOpenRequestA
mov dword [ebx + 0x3c], eax
push dword [0x10029fb0]
call esi
push str.HttpSendRequestA
mov dword [ebx + 0x40], eax
push dword [0x10029fb0]
call esi
mov dword [ebx + 0x44], eax
lea eax, [ebp - 0x18]
push eax
push dword [0x10029fb0]
call esi
mov dword [ebx + 0x48], eax
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10011f6b
leave
ret

Function at 0x10011f6b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10028180]
jne 0x10011f75
repz ret
jmp fcn.10014bf8