joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100041e0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
sub esp, 0x28
movaps xmm1, xmmword [0x10013ed0]
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 4], 0x4d703a8c
mov dword [esp + 8], 0x1e30278b
mov dword [esp + 0xc], 0x406f2ad5
mov dword [esp + 0x10], 0x2c034efb
movups xmm0, xmmword [esp + 4]
push esi
push edi
pxor xmm1, xmm0
push eax
movups xmmword [esp + 0x10], xmm1
call ebx
mov edi, eax
test edi, edi
je 0x10004419
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [esp + 0xc]
push eax
push edi
mov dword [esp + 0x14], 0x51535457
mov dword [esp + 0x18], 0x79726575
mov dword [esp + 0x1c], 0x73736553
mov dword [esp + 0x20], 0x496e6f69
mov dword [esp + 0x24], 0x726f666e
mov dword [esp + 0x28], 0x6974616d
mov dword [esp + 0x2c], 0x576e6f
call esi
mov dword [0x100165bc], eax
test eax, eax
je 0x10004419
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x45535457
push eax
push edi
mov dword [esp + 0x18], 0x656d756e
mov dword [esp + 0x1c], 0x65746172
mov dword [esp + 0x20], 0x73736553
mov dword [esp + 0x24], 0x736e6f69
mov dword [esp + 0x28], 0x41
call esi
mov dword [0x10016580], eax
test eax, eax
je 0x10004419
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x51535457
push eax
push edi
mov dword [esp + 0x18], 0x79726575
mov dword [esp + 0x1c], 0x72657355
mov dword [esp + 0x20], 0x656b6f54
mov dword [esp + 0x24], 0x6e
call esi
mov dword [0x100165a8], eax
test eax, eax
je 0x10004419
movaps xmm1, xmmword [0x10013ee0]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0xe759cd85
mov dword [esp + 0x10], 0xbb18c48b
mov dword [esp + 0x14], 0xe547ccc0
mov dword [esp + 0x18], 0x892ba8ee
movups xmm0, xmmword [esp + 0xc]
push eax
pxor xmm1, xmm0
movups xmmword [esp + 0x10], xmm1
call ebx
test eax, eax
je 0x10004419
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x43746547
push ecx
push eax
mov dword [esp + 0x18], 0x75706d6f
mov dword [esp + 0x1c], 0x4e726574
mov dword [esp + 0x20], 0x41656d61
mov dword [esp + 0x24], 0
call esi
mov dword [0x10016578], eax
test eax, eax
je 0x10004419
movaps xmm1, xmmword [0x10013ec0]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x65d6e15c
mov dword [esp + 0x10], 0x3693ec4d
mov dword [esp + 0x14], 0x68cce113
mov dword [esp + 0x18], 0x4a0853d
movups xmm0, xmmword [esp + 0xc]
push eax
pxor xmm1, xmm0
movups xmmword [esp + 0x10], xmm1
call ebx
test eax, eax
je 0x10004419
movaps xmm1, xmmword [0x10013ef0]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0xaab1e1d4
mov dword [esp + 0x10], 0xb1b7e1e0
mov dword [esp + 0x14], 0xbea0e9f2
mov dword [esp + 0x18], 0xffc58493
movups xmm0, xmmword [esp + 0xc]
push ecx
push eax
pxor xmm1, xmm0
movups xmmword [esp + 0x14], xmm1
call esi
xor ecx, ecx
mov dword [0x1001657c], eax
test eax, eax
pop edi
setne cl
pop esi
mov eax, ecx
pop ebx
add esp, 0x28
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret
Function at 0x10007180
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x40
push ebx
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x10], edx
xor esi, esi
push ebx
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
cmp dword [esp + 0x54], esi
jle 0x1000728e
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebx + eax*2]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [esp + 0x18], eax
nop dword [eax]
mov eax, dword [esp + 0x54]
movzx eax, word [eax + edi*4]
push dword [eax*4 + 0x10016730]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
call esi
cmp dword [esp + 0x14], 0
je 0x100071f8
cmp eax, 0xffffffff
je 0x100071f0
test al, 0x10
je 0x100071f0
mov eax, 1
jmp 0x100071f2
xor eax, eax
test eax, eax
je 0x1000726e
jmp 0x10007201
cmp eax, 0xffffffff
je 0x1000726e
test al, 0x10
jne 0x1000726e
mov eax, dword [esp + 0x54]
mov dword [esp + 0x10], 1
mov byte [esp + 0x1c], 0
movzx eax, word [eax + edi*4 + 2]
mov esi, dword [eax*4 + 0x10016a10]
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x10007232
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
je 0x1000723e
push esi
lea eax, [esp + 0x20]
push eax
call ebp
lea edx, [esp + 0x1c]
mov ecx, 0x10016608
call fcn.10001370
test eax, eax
jne 0x10007268
push 0x1000f400
lea eax, [esp + 0x20]
push eax
call ebp
lea eax, [esp + 0x1c]
push eax
push 0x10016608
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov eax, dword [esp + 0x18]
xor ecx, ecx
inc edi
mov word [eax], cx
cmp edi, dword [esp + 0x58]
jl 0x100071c0
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x40
ret

Function at 0x100072a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebp
push esi
push edi
mov esi, ecx
xor ebp, ebp
push edx
push esi
mov dword [esp + 0x18], esi
call ebx
push dword [0x10016824]
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
push dword [0x10016838]
mov esi, eax
push dword [esp + 0x14]
call ebx
push dword [0x10016858]
push dword [esp + 0x14]
call ebx
push ecx
push dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
lea edx, [ebp + 1]
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.10007180
add esp, 0x10
test eax, eax
mov eax, 1
cmovne ebp, eax
xor ecx, ecx
mov eax, dword [esp + 0x10]
push dword [0x10016828]
mov word [eax + esi*2], cx
mov esi, eax
push esi
call ebx
push esi
call edi
push dword [0x10016858]
mov edi, eax
push esi
call ebx
mov ebx, dword [esp + 0x10]
mov esi, 0x30
lea edi, [ebx + edi*2]
nop dword [eax + eax]
push ebx
mov word [edi - 2], si
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000737a
test al, 0x10
je 0x1000737a
push ecx
push dword [esp + 0x24]
mov edx, 1
mov ecx, ebx
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.10007180
add esp, 0x10
test eax, eax
mov eax, 1
cmovne ebp, eax
inc esi
cmp si, 0x39
jbe 0x10007340
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x10007390
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x458
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
push eax
push 0
push 0
push 0x1c
push 0
call esi
test eax, eax
jne 0x10007536
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x10]
push eax
call ebx
mov edx, dword [0x1001682c]
mov ebp, eax
push ecx
push dword [0x10016be0]
lea ecx, [esp + 0x18]
push 0x20
push 0x100151c0
call fcn.100072a0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x10
push 0x10016608
call edi
cmp eax, 0xce
jg 0x10007536
mov edx, dword [0x1001688c]
xor eax, eax
push ecx
push dword [0x10016be4]
lea ecx, [esp + 0x18]
mov word [esp + ebp*2 + 0x18], ax
push 9
push 0x10015240
call fcn.100072a0
add esp, 0x10
push 0x10016608
call edi
cmp eax, 0xce
jg 0x10007536
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x1a
push 0
call esi
test eax, eax
jne 0x10007536
push dword [0x100168a4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x14]
push eax
call esi
push dword [0x100168ac]
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0x10]
push eax
call ebx
xor ecx, ecx
lea ebp, [esp + 0x10]
mov dword [ebp + eax*2 - 2], 0x2a005c
lea ebp, [ebp + eax*2]
mov word [esp + eax*2 + 0x12], cx
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
test edi, edi
je 0x10007536
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [esp + 0x218], 0x10
je 0x10007520
cmp word [esp + 0x244], 0x2e
je 0x10007520
xor eax, eax
mov word [ebp], ax
lea eax, [esp + 0x244]
push eax
lea eax, [esp + 0x14]
push eax
call esi
push dword [0x100168c8]
lea eax, [esp + 0x14]
push eax
call esi
push 0x1000f404
lea eax, [esp + 0x14]
push eax
call esi
lea ecx, [esp + 0x10]
call fcn.10001430
test eax, eax
je 0x10007520
push ecx
push dword [0x10016be8]
xor edx, edx
lea ecx, [esp + 0x18]
push 0xb
push 0x10015190
call fcn.10007180
add esp, 0x10
lea eax, [esp + 0x218]
push eax
push edi
call ebx
test eax, eax
jne 0x100074b4
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007720
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push 1
push 0x10007540
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000774a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x10007b00
Capabilities:
Accept command line arguments
Create process on windows
Set environment variable

Disassembly:
sub esp, 0x714
push ebx
push ebp
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x10007ce2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
lea eax, [esp + 0x11c]
push eax
call edi
push 0
push dword [0x100163d8]
lea eax, [esp + 0x1c]
push dword [0x10016a1c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x14]
push 0x1000f40c
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov ebx, dword [0x10016748]
xor eax, eax
mov word [esp + 0x320], ax
lea eax, [esp + 0x118]
push eax
lea eax, [esp + 0x324]
push eax
call edi
push 0x44
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.100010d0
xor eax, eax
mov dword [esp + 0x34], 0x44
add esp, 0xc
mov word [esp + 0x58], ax
mov dword [esp + 0x54], 1
test ebx, ebx
je 0x10007bbb
push ebx
lea eax, [esp + 0xb4]
push eax
call edi
lea eax, [esp + 0xb0]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x340]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10007c85
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10007bfe
push eax
call edi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10007c09
push eax
call edi
push ebx
lea eax, [esp + 0x78]
push 0x1000f2d0
push eax
call fcn.10001220
add esp, 0xc
lea eax, [esp + 0x74]
push dword [0x10016910]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
add edi, edi
cmp dword [0x1001672c], 0
je 0x10007ce2
test esi, esi
je 0x10007ce2
test edi, edi
je 0x10007ce2
mov ecx, edi
call fcn.100011d0
mov ebx, eax
test ebx, ebx
je 0x10007ce2
push edi
lea eax, [esp + 0x78]
push eax
push ebx
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 1], ebx
jmp 0x10007cd1
mov ebx, dword [0x10016908]
test ebx, ebx
je 0x10007ce2
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
add edi, edi
cmp dword [0x1001672c], 0
je 0x10007ce2
test esi, esi
je 0x10007ce2
test edi, edi
je 0x10007ce2
mov ecx, edi
call fcn.100011d0
mov ebp, eax
test ebp, ebp
je 0x10007ce2
push edi
push ebx
push ebp
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 1], ebp
push 0x10016714
mov byte [esi], 6
mov dword [esi + 5], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x714
ret
Function at 0x10008f20
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xb28
push ebx
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0
push eax
push 1
push 0x200
lea edx, [esp + 0x340]
call fcn.10008c70
add esp, 0x10
test eax, eax
je 0x100090ad
push dword [0x1001674c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov word [esp + 0xdc], ax
lea eax, [esp + 0xdc]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x330]
push eax
lea eax, [esp + 0xdc]
push eax
call ebx
push dword [0x10016750]
lea eax, [esp + 0xdc]
push eax
call ebx
mov edi, dword [0x10016748]
xor eax, eax
mov word [esp + 0x730], ax
lea eax, [esp + 0xd8]
push eax
lea eax, [esp + 0x734]
push eax
call esi
push 0x44
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.100010d0
xor eax, eax
mov dword [esp + 0x34], 0x44
add esp, 0xc
mov word [esp + 0x58], ax
mov dword [esp + 0x54], 1
test edi, edi
je 0x10009007
push edi
lea eax, [esp + 0x74]
push eax
call esi
lea eax, [esp + 0x70]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x750]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100090a0
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10009042
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1000904d
push eax
call esi
push dword [0x10016910]
lea eax, [esp + 0x334]
push eax
call ebx
lea eax, [esp + 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, esi
cmp dword [0x1001672c], 0
je 0x1000912b
test esi, esi
je 0x1000912b
mov ecx, esi
call fcn.100011d0
mov edi, eax
test edi, edi
je 0x1000912b
push esi
lea eax, [esp + 0x334]
push eax
jmp 0x100090f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x71
jmp 0x100090b5
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov edx, dword [0x10016908]
push eax
push ecx
lea ecx, [esp + 0x338]
call fcn.100040d0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1000912b
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, esi
cmp dword [0x1001672c], 0
je 0x1000912b
test esi, esi
je 0x1000912b
mov ecx, esi
call fcn.100011d0
mov edi, eax
test edi, edi
je 0x1000912b
push esi
push ebx
push edi
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x10016714
mov byte [0x10016708], 6
mov dword [0x1001670d], esi
mov dword [0x10016709], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
add esp, 0xb28
ret
Function at 0x10009140
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x6bc
push ebx
push ebp
push esi
push edi
push 0x200
push 0
mov esi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x10009392
lea eax, [esp + 0x14]
mov byte [edi], 0
push eax
lea eax, [esp + 0x14]
mov edx, edi
push eax
push 0
push 0x100
mov ecx, esi
call fcn.10008c70
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x10
test eax, eax
je 0x10009316
cmp word [edi], 0
je 0x10009316
push edi
call ebx
mov ecx, eax
test eax, eax
jle 0x100091c0
cmp word [edi + eax*2], 0x5c
je 0x100091cb
dec eax
test eax, eax
jg 0x100091b4
cmp word [edi + eax*2], 0x5c
jne 0x10009316
inc eax
sub ecx, eax
lea eax, [edi + eax*2]
test eax, eax
je 0x10009316
cmp ecx, 8
jbe 0x10009316
cmp word [eax], 0x68
jne 0x10009316
cmp word [eax + 2], 0x6d
jne 0x10009316
cmp word [eax + 4], 0x72
jne 0x10009316
cmp word [eax + 6], 0x5f
jne 0x10009316
push dword [0x10016924]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x74]
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x70]
push edi
push eax
call ebp
push dword [0x10016928]
lea eax, [esp + 0x74]
push eax
call ebp
push dword [0x10016818]
lea eax, [esp + 0x74]
push eax
call ebp
xor eax, eax
mov word [esp + 0x2c8], ax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x2cc]
push eax
call esi
push 0x44
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.100010d0
add esp, 0xc
mov dword [esp + 0x28], 0x44
xor eax, eax
mov dword [esp + 0x54], 1
mov word [esp + 0x58], ax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x2e8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10009309
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100092c4
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x100092cf
push eax
call esi
push dword [0x10016910]
push edi
call ebp
push edi
call ebx
mov esi, eax
add esi, esi
cmp dword [0x1001672c], 0
je 0x1000938b
test esi, esi
je 0x1000938b
mov ecx, esi
call fcn.100011d0
mov ebx, eax
test ebx, ebx
je 0x1000938b
push esi
push edi
jmp 0x10009359
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x72
jmp 0x1000931e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov edx, dword [0x10016908]
push eax
push ecx
mov ecx, edi
call fcn.100040d0
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x1000938b
push ebp
call ebx
mov esi, eax
add esi, esi
cmp dword [0x1001672c], 0
je 0x1000938b
test esi, esi
je 0x1000938b
mov ecx, esi
call fcn.100011d0
mov ebx, eax
test ebx, ebx
je 0x1000938b
push esi
push ebp
push ebx
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x10016714
mov byte [0x10016708], 6
mov dword [0x1001670d], esi
mov dword [0x10016709], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6bc
ret
Function at 0x10009960
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
push ebp
push esi
push edi
xor ebp, ebp
mov dword [esp + 0xc], edx
push ebp
push 2
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000998d
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x230
ret
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100099f2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
cmp dword [esp + 0x1c], edi
je 0x100099d6
lea eax, [esp + 0x14]
push eax
push esi
call ebx
test eax, eax
jne 0x100099b0
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x230
ret
push dword [esp + 0x244]
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ebp, 1
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x230
ret

Function at 0x10009a10
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x230
push ebx
push ebp
push edi
xor edi, edi
mov ebp, ecx
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0xc], ebx
cmp ebx, 0xffffffff
je 0x10009aae
push esi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10009aaa
test ebp, ebp
je 0x10009a9a
push ebp
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10009a9a
push dword [esp + 0x1c]
xor ebx, ebx
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10009a8e
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call esi
jmp 0x10009a94
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
or edi, ebx
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10009a50
push ebx
call esi
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x230
ret
Function at 0x1000b3ff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov ebx, dword [esi + 0x24]
lea eax, [esi + 0x30]
mov dword [ebp - 0x14], ebx
mov edi, dword [esi + 0x34]
mov edx, eax
mov ecx, dword [esi + 0x64]
sub edi, ecx
sub edi, dword [esi + 0x6c]
mov dword [ebp - 0x10], edi
jne 0x1000b438
test ecx, ecx
jne 0x1000b445
cmp dword [esi + 0x6c], ecx
jne 0x1000b445
mov edi, ebx
jmp 0x1000b4c7
cmp edi, 0xffffffff
jne 0x1000b445
push 0xfffffffffffffffe
pop edi
jmp 0x1000b4c7
mov eax, dword [esi + 0x24]
add eax, 0xfffffefa
add eax, ebx
cmp ecx, eax
jb 0x1000b4c7
mov ecx, dword [edx]
push ebx
lea edx, [ecx + ebx]
call fcn.1000d4f4
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], ebx
sub dword [esi + 0x64], ebx
sub dword [esi + 0x54], ebx
pop ecx
mov ecx, dword [esi + 0x44]
mov dword [ebp - 4], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
movzx ecx, bx
movzx eax, word [esi]
mov edx, eax
mov dword [ebp - 0xc], ecx
sub eax, ecx
xor ecx, ecx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
sub dword [ebp - 4], 1
mov word [esi], cx
jne 0x1000b474
mov esi, dword [ebp - 8]
mov edi, ebx
mov eax, dword [esi + 0x38]
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx eax, word [esi]
mov edx, eax
sub eax, dword [ebp - 0xc]
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x1000b4a2
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
add edi, ebx
mov ebx, dword [esi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x1000b562
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x64]
add edx, ecx
cmp eax, edi
mov dword [ebp - 0x10], edx
cmovbe edi, eax
test edi, edi
je 0x1000b51e
sub eax, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
cmp dword [eax + 0x18], 0
jne 0x1000b50a
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.1000d3d7
add esp, 0xc
mov dword [ebx + 0x30], eax
mov edx, dword [ebx]
mov ecx, dword [ebp - 0x10]
push edi
call fcn.1000d4f4
add dword [ebx], edi
add dword [ebx + 8], edi
pop ecx
mov ecx, dword [esi + 0x64]
add edi, dword [esi + 0x6c]
mov dword [esi + 0x6c], edi
cmp edi, 3
jb 0x1000b548
mov eax, dword [esi + 0x30]
movzx edx, byte [eax + ecx]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x40], edx
shl edx, cl
mov ecx, dword [esi + 0x64]
movzx eax, byte [eax + ecx + 1]
xor edx, eax
and edx, dword [esi + 0x4c]
mov dword [esi + 0x40], edx
cmp edi, 0x106
jae 0x1000b562
mov eax, dword [esi]
mov ebx, dword [ebp - 0x14]
cmp dword [eax + 4], 0
lea eax, [esi + 0x30]
jne 0x1000b416
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45b1a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45b1cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45b1cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret