joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10099960
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
mov esi, eax
mov eax, 0xe9
mov ecx, 0x103a0f48
mov dword [ebp - 8], esi
call fcn.1006fd20
mov edi, dword [ebp + 8]
test al, al
je 0x100999ca
cmp edi, 0x201
jne 0x100999a4
pop edi
pop esi
mov byte [0x103a5114], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, esi
sub eax, dword [0x103a5110]
mov byte [0x103a5114], 0
cmp eax, 0x1f4
jb 0x10099bb5
call ebx
mov dword [0x103a5110], eax
call fcn.10099920
mov eax, 0xe0
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10099a26
mov ecx, dword [0x103c22a4]
inc ecx
cmp ecx, 1
jle 0x10099a26
cmp edi, 0x201
jne 0x10099a01
pop edi
pop esi
mov byte [0x103a4e8c], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, esi
sub edx, dword [0x103a4e88]
mov byte [0x103a4e8c], 0
cmp edx, 0x64
jb 0x10099bb5
call ebx
dec dword [0x103c22a4]
mov dword [0x103a4e88], eax
mov eax, 0xe1
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10099a78
mov eax, dword [0x103c22a4]
inc eax
cmp eax, dword [0x103c22a8]
jge 0x10099a78
cmp edi, 0x201
je 0x10099bae
mov ecx, esi
sub ecx, dword [0x103a4ed0]
mov byte [0x103a4ed4], 0
cmp ecx, 0x64
jb 0x10099bb5
call ebx
inc dword [0x103c22a4]
mov dword [0x103a4ed0], eax
xor edi, edi
cmp dword [0x103c22a0], edi
jle 0x10099bb5
mov dword [ebp - 4], edi
lea esp, [esp]
fild dword [0x103aa458]
fstp dword [ebp - 0xc]
fld dword [ebp - 0xc]
fcom qword [0x100d2918]
fnstsw ax
test ah, 5
jnp 0x10099b92
fcomp qword [0x100d2910]
fnstsw ax
test ah, 0x41
je 0x10099b94
fild dword [0x103aa460]
fstp dword [ebp - 0xc]
fld dword [0x103a4f9c]
fadd qword [0x100d2870]
fiadd dword [ebp - 4]
fld dword [ebp - 0xc]
fxch st(1)
fst dword [ebp - 0xc]
fld dword [ebp - 0xc]
fcomp st(2)
fnstsw ax
test ah, 0x41
je 0x10099b90
fadd qword [0x100d20d0]
fstp dword [ebp - 0xc]
fld dword [ebp - 0xc]
fcompp
fnstsw ax
test ah, 5
jnp 0x10099b94
cmp dword [ebp + 8], 0x201
je 0x10099bae
sub esi, dword [0x103a4ed0]
mov byte [0x103a4ed4], 0
cmp esi, 0x64
jb 0x10099bb5
mov eax, dword [0x103c22a4]
lea edx, [eax + eax*4]
lea eax, [edi + edx*2]
imul eax, eax, 0x34
cmp byte [eax + 0x103c0e80], 0
je 0x10099bb5
call ebx
mov dword [0x103a4ed0], eax
mov eax, dword [0x103c22a4]
lea ecx, [eax + eax*4]
lea esi, [edi + ecx*2]
mov edx, esi
imul edx, edx, 0x34
cmp byte [edx + 0x103c0e7b], 0
je 0x10099b81
call fcn.10099920
mov eax, dword [0x103c22a4]
lea eax, [eax + eax*4]
lea ecx, [edi + eax*2]
mov dword [0x103c22ac], ecx
call fcn.10099f40
mov esi, dword [ebp - 8]
jmp 0x10099b94
push 0x103c0e50
call fcn.1009a3c0
mov esi, dword [ebp - 8]
jmp 0x10099b94
fstp st(0)
fstp st(0)
add dword [ebp - 4], 0x14
inc edi
cmp edi, dword [0x103c22a0]
jl 0x10099a90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [0x103a4ed4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10099f80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
mov eax, 0xef
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
setne al
mov byte [0x103a52c6], al
mov eax, 0xf0
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1009a011
cmp dword [ebp + 8], 0x201
jne 0x10099fd1
pop edi
mov byte [0x103a530c], 1
pop esi
pop ebp
ret 4
mov ecx, edi
sub ecx, dword [0x103a5308]
mov byte [0x103a530c], 0
cmp ecx, 0x1f4
jb 0x1009a05b
push ebx
call esi
mov ebx, dword [0x103c22ac]
push 0x103c0e50
mov esi, 0x103a52cd
mov dword [0x103a5308], eax
call fcn.1009a430
call fcn.10099f40
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ebx
mov eax, 0xee
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1009a05b
cmp dword [ebp + 8], 0x201
jne 0x1009a03a
pop edi
mov byte [0x103a527c], 1
pop esi
pop ebp
ret 4
sub edi, dword [0x103a5278]
mov byte [0x103a527c], 0
cmp edi, 0x1f4
jb 0x1009a05b
call esi
mov dword [0x103a5278], eax
call fcn.10099f40
pop edi
pop esi
pop ebp
ret 4
Function at 0x1009fb20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x1009fa20
push 5
sub eax, 0x836486
xor edi, edi
push 0x836481
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1009fb7f
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x836481
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x836481
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1009fb85
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x1009f9a0
push 5
sub ecx, 0x7dd309
push 0x7dd304
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1009fbd5
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x7dd304
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x7dd304
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1009fbdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x1009f9a0
push 5
sub edx, 0x833b0d
push 0x833b08
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1009fc2b
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x833b08
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x833b08
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1009fc31
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1009fdb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, 1
cmp dword [0x10283054], ebx
jne 0x1009fdea
push 0x1009feb0
push 0x5bafab
mov bl, 0xe8
call fcn.100b6700
push 0x1009fe30
push 0x7c5db0
call fcn.100b6700
add esp, 0x10
mov ebx, 1
cmp dword [0x10283050], ebx
jne 0x1009fe1e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push 0x81c03fa
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x81c03fa], bl
mov edx, dword [ebp - 4]
push edx
push ebx
push 0x81c03fa
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a0090
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x100a0130
push 0x7dcfd0
mov bl, 0xe9
call fcn.100b6700
push 0x100a08e0
push 0x7897c7
call fcn.100b6700
push 0x100a0a30
push 0x78aaa6
call fcn.100b6700
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push 0x599183
call esi
mov eax, 0x90909090
mov ecx, 0x599183
mov dword [ecx], eax
mov word [ecx + 4], ax
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 6
push 0x599183
call esi
push 0x100a09a0
push 0x599183
call fcn.100b6700
push 0x100a0b30
push 0x83b934
call fcn.100b6700
add esp, 0x10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a0b50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x103e4924]
push 7
mov ecx, 0x861110
mov dword [ebp - 4], eax
call ecx
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100a0d86
push 8
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100a0d86
push 0xc
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100a0d86
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100a0d86
push 0xf
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100a0d86
push 0x41
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100a0d86
push 0x4e
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100a0d86
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x100a0d86
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edx, dword [0x103c22fc]
add edx, 0xfa
cmp eax, edx
jb 0x100a0d85
mov eax, dword [0x7bc4f04]
push esi
movzx esi, word [eax + 0x208]
mov edx, 0xa
cmp si, 1
jle 0x100a0cca
cmp dword [0xe61e18], edx
jne 0x100a0c91
mov ecx, dword [0x879340c]
cmp ecx, 0x239
jle 0x100a0c91
cmp ecx, 0x275
jge 0x100a0c91
mov ecx, dword [0x8793410]
cmp ecx, 0x29
jle 0x100a0c91
cmp ecx, 0x56
jl 0x100a0d84
cmp si, 1
jle 0x100a0cca
cmp dword [0xe61e18], 0x27
jne 0x100a0cca
mov ecx, dword [0x879340c]
cmp ecx, 0x239
jle 0x100a0cca
cmp ecx, 0x275
jge 0x100a0cca
mov ecx, dword [0x8793410]
cmp ecx, 0x29
jle 0x100a0cca
cmp ecx, 0x56
jl 0x100a0d84
movzx ecx, word [eax + 0x22c]
xor eax, eax
cmp cx, 1
jle 0x100a0d46
cmp si, ax
jg 0x100a0d0c
cmp dword [0xe61e18], edx
jne 0x100a0d0c
mov edx, dword [0x879340c]
cmp edx, 0x1d1
jle 0x100a0d0c
cmp edx, 0x1fc
jge 0x100a0d0c
mov edx, dword [0x8793410]
cmp edx, 0x29
jle 0x100a0d0c
cmp edx, 0x56
jl 0x100a0d84
cmp cx, 1
jle 0x100a0d46
cmp si, ax
jg 0x100a0d46
cmp dword [0xe61e18], 0x27
jne 0x100a0d46
mov ecx, dword [0x879340c]
cmp ecx, 0x1d1
jle 0x100a0d46
cmp ecx, 0x1fc
jge 0x100a0d46
mov ecx, dword [0x8793410]
cmp ecx, 0x29
jle 0x100a0d46
cmp ecx, 0x56
jl 0x100a0d84
mov esi, dword [ebp - 4]
cmp word [esi], ax
jl 0x100a0d84
mov cl, byte [esi + 0x43]
mov word [ebp - 7], ax
lea edx, [ebp - 0xc]
mov dword [ebp - 0xb], eax
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
push edx
mov ecx, 8
mov dword [ebp - 0xc], 0x17908c1
mov word [ebp - 8], ax
mov byte [ebp - 5], al
call fcn.100a8170
add esp, 4
call ebx
mov dword [0x103c22fc], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a2130
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100a2251
push 0x104
lea eax, [ebp - 0x418]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x100a224a
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x418]
call fcn.100b67c0
add esp, 4
test al, al
je 0x100a224a
lea edx, [ebp - 0x210]
push edx
lea ecx, [ebp - 0x458]
call fcn.10090010
test al, al
jne 0x100a21d3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 1
lea ecx, [ebp - 0x458]
call fcn.100422d0
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x458]
call fcn.100902e0
test al, al
jne 0x100a2212
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 2
lea ecx, [ebp - 0x458]
call fcn.100422d0
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
call fcn.1008e0f0
test al, al
jne 0x100a224a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 5
lea ecx, [ebp - 0x458]
call fcn.100422d0
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
Function at 0x100a2400
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c15eb
mov eax, dword fs:[0]
push eax
sub esp, 0xc40
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0xc48], ebx
mov dword [ebp - 0xc44], ebx
mov dword [ebp - 0xc40], ebx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc48]
mov dword [ebp - 4], ebx
call fcn.100b6f60
add esp, 4
mov word [ebp - 0xc34], 0xac2
mov byte [ebp - 0xc32], 0xc
call dword [sym.imp.MSVCR100.dll_rand]
and eax, 0x800000ff
jns 0x100a247b
dec eax
or eax, 0xffffff00
inc eax
mov esi, dword [ebp - 0xc48]
mov byte [ebp - 0xc31], al
mov eax, dword [ebp - 0xc44]
sub eax, esi
sar eax, 2
mov byte [ebp - 0xc30], 0x17
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xc2c], eax
cmp eax, ebx
jbe 0x100a2537
lea ecx, [ebp - 0x728]
mov dword [ebp - 0xc38], ecx
lea esp, [esp]
cmp ebx, 0x14
jge 0x100a2537
mov eax, dword [esi + ebx*4]
push 0x104
lea edx, [ebp - 0x11c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [esi + ebx*4]
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClassNameA]
mov edi, dword [ebp - 0xc38]
mov eax, dword [ebp - 0xc38]
add edi, 0xfffffb00
mov ecx, 0x10
lea esi, [ebp - 0x11c]
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov ecx, 0x10
lea esi, [ebp - 0x224]
inc ebx
add eax, 0x40
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xc48]
mov dword [ebp - 0xc38], eax
cmp ebx, dword [ebp - 0xc4c]
jb 0x100a24c0
mov ecx, 0xa0c
lea edx, [ebp - 0xc34]
call fcn.10012360
test esi, esi
je 0x100a2555
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 4
Function at 0x100a4890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c19f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x44], 0
je 0x100a49a3
cmp byte [edi + 0x4a], 0
je 0x100a49a3
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffff
mov ecx, edi
call edx
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
je 0x100a4997
lea esi, [ebp - 0x2c]
call fcn.100a5930
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x100a490e
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_wchar_t__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x100a4936
dec eax
je 0x100a493a
sub eax, 2
lea esi, [ebp - 0x2c]
jne 0x100a4992
jmp 0x100a499e
mov byte [edi + 0x4a], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x100a494a
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x100a4974
cmp edx, 0x10
jae 0x100a4959
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x100a498f
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x4a], 0
je 0x100a499b
test esi, esi
jne 0x100a4902
push esi
lea ebx, [esi + 8]
lea esi, [ebp - 0x2c]
call fcn.100a5860
jmp 0x100a48fc
lea esi, [ebp - 0x2c]
call fcn.10006ce0
xor al, al
jmp 0x100a49a5
lea esi, [ebp - 0x2c]
call fcn.10006ce0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
Function at 0x100a4b80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c19f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x44], 0
je 0x100a4c88
cmp byte [edi + 0x49], 0
je 0x100a4c88
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x100a4c7c
lea esi, [ebp - 0x2c]
call fcn.100a5930
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x100a4bf3
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x100a4c1b
dec eax
je 0x100a4c1f
sub eax, 2
lea esi, [ebp - 0x2c]
jne 0x100a4c77
jmp 0x100a4c83
mov byte [edi + 0x49], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x100a4c2f
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x100a4c59
cmp edx, 0x10
jae 0x100a4c3e
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x100a4c74
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x100a4c80
test esi, esi
jne 0x100a4be7
push esi
lea ebx, [esi + 8]
lea esi, [ebp - 0x2c]
call fcn.100a5860
jmp 0x100a4be1
lea esi, [ebp - 0x2c]
call fcn.10006ce0
xor al, al
jmp 0x100a4c8a
lea esi, [ebp - 0x2c]
call fcn.10006ce0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret

Function at 0x100a5c60
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.100c1160
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea ecx, [ebp - 0x1008]
xor ebx, ebx
push ecx
mov dword [ebp - 0x100c], ebx
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x100a5cb2
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x100c]
shr edi, 2
mov dword [ebp - 0x1010], edi
cmp edi, ebx
jle 0x100a5d04
mov esi, dword [ebp + ebx*4 - 0x1008]
test esi, esi
je 0x100a5cff
call fcn.100a60b0
test al, al
je 0x100a5cff
mov ecx, dword [ebp + ebx*4 - 0x1008]
call fcn.100a5d20
test al, al
je 0x100a5c9f
mov edi, dword [ebp + ebx*4 - 0x1008]
call fcn.100a2130
test al, al
je 0x100a5c9f
mov edi, dword [ebp - 0x1010]
inc ebx
cmp ebx, edi
jl 0x100a5cc5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
Function at 0x100a5df0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x110c
call fcn.100c1160
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10c]
push eax
push 0x1000
lea ecx, [ebp - 0x110c]
push ecx
xor esi, esi
push ebx
mov dword [ebp - 0x10c], esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x100a5e41
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [ebp - 0x10c]
shr edi, 2
test edi, edi
jle 0x100a5ea6
nop
mov eax, dword [ebp + esi*4 - 0x110c]
push 0x104
lea edx, [ebp - 0x108]
push edx
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
test eax, eax
je 0x100a5ea1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100a5e98
test dl, dl
je 0x100a5e94
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100a5e98
add eax, 2
add ecx, 2
test dl, dl
jne 0x100a5e78
xor eax, eax
jmp 0x100a5e9d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100a5eba
inc esi
cmp esi, edi
jl 0x100a5e50
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 4

Function at 0x100a5ed0
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 4
push 0x1000
push ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x100a5f0c
mov eax, dword [ebp + 8]
push 0
push ebx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x100a5f13
push 0x8000
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
pop esi
pop ebp
ret 4
push 0x100d0bc8
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100a5efe
push 0
push 0
push esi
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x100a5efe
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push ebx
push esi
push edi
test eax, eax
jne 0x100a5f06
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x100a6f50
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea esi, [ebp - 0x408]
call fcn.100087d0
lea eax, [ebp - 0x408]
push eax
lea esi, [ebx + 0xe7958]
mov eax, str.plugin.xtm
call fcn.100089e0
test al, al
je 0x100a6fc3
push 0
push 0x20
push 3
push 0
push 1
push closesocket
push str.plugin.xtm
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100a6fc3
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xe7954
je 0x100a6fd5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 0x40c]
push ecx
push 0xe7954
lea esi, [ebx + 4]
push esi
push edi
mov dword [ebp - 0x40c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100a6fbc
mov eax, esi
mov ecx, 0xe7954
mov dl, byte [eax]
add dl, 0x78
xor dl, 0xb3
mov byte [eax], dl
inc eax
dec ecx
jne 0x100a7003
call fcn.10090cc0
lea eax, [ebx + 0xbd4]
call fcn.10090d40
lea eax, [ebx + 0x18b8]
call fcn.10090da0
lea eax, [ebx + 0x259c]
call fcn.10090e00
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.100c06a6
mov esp, ebp
pop ebp
ret

Function at 0x100a8800
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0xe609e8], 5
jne 0x100a88b1
cmp dword [0x103ac150], 1
jne 0x100a88b1
push esi
call fcn.100a8980
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103ac15c]
cmp eax, dword [0x103ac164]
jbe 0x100a8879
mov dword [0x103ac150], 2
mov dword [0x103ac154], 0
call esi
mov dword [0x103ac158], eax
call esi
mov dword [0x103ac15c], eax
mov dword [0x103ac160], 0
mov dword [0x103ac164], 0
mov eax, 0x63a180
mov ecx, 0x8793750
pop esi
jmp eax
call esi
sub eax, dword [0x103ac158]
cmp eax, dword [0x103ac160]
jb 0x100a88b0
mov eax, dword [0x103ac154]
sub eax, 0
je 0x100a88a4
dec eax
jne 0x100a88a9
call fcn.100a8e70
call esi
mov dword [0x103ac158], eax
pop esi
ret
call fcn.100a8e10
call esi
mov dword [0x103ac158], eax
pop esi
ret