joyce8/EMBER2024-capa huggingface dataset:
Function at 0x510ac0
Capabilities:
Allocate or change rwx memory
Find taskbar
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f74
lea eax, [esp + 0x38]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x510cac
push 0
push 0x510cb4
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x510cac
push 0
push 0x510cc4
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x510cac
push 0
push 0x510cd4
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x510cac
push 0
push 0x510ce4
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebp, eax
test ebp, ebp
je 0x510cac
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x510cac
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x510cac
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x510cac
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x510cac
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x510c98
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x510c8e
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x1c]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x510c8e
test byte [esp + 0x1d], 0xd
jne 0x510c8e
mov al, byte [esp + 0x1c]
and al, 8
cmp al, 8
je 0x510c8e
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x510c8e
cmp dword [esp + 0xc], 0
je 0x510c8e
mov eax, dword [0x52b64c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
cmp eax, dword [esp + 0x10]
jne 0x510c8e
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x510c6a
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x510c98
lea eax, [esp + 0x28]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
call fcn.00406730
jmp 0x510c98
cmp ebx, dword [esp + 4]
jl 0x510bce
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x512738
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x52b64c]
mov eax, dword [eax]
call fcn.004654bc
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, esi
jb 0x512743
pop esi
pop ebx
ret
Function at 0x512cb8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.0040916c
test al, al
je 0x512d3f
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00402f74
or esi, 0x100
test esi, esi
jns 0x512cf3
call fcn.004034ac
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404800
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x512d3f
mov dl, 1
mov eax, dword [0x42225c]
call fcn.0042a168
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.0042a574
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x512d3f
mov eax, esp
call fcn.0040e154
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x403e59
pop dword [ebp - 0x50]
mov eax, 0xea869417
add eax, 0x15b9aa42
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x2a257f8e
add dword [ebp - 0x60], 0x242cc5bd
mov dword [ebp - 0x5c], 0x8ad49dd2
add dword [ebp - 0x5c], 0xa75eae73
mov dword [ebp - 0x58], 0x43a2f4e
sub dword [ebp - 0x58], 0xb7edeb20
mov dword [ebp - 0x54], 0x9511cd7c
sub dword [ebp - 0x54], 0x9511cd7c
lea eax, [ebp - 0x60]
push eax
mov eax, 0x352b789
add eax, 0xfcedc903
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x20a5db8d
add dword [ebp - 0x60], 0x53cc8dc9
mov dword [ebp - 0x5c], 0xc9d3fcc6
add dword [ebp - 0x5c], 0x779864af
mov dword [ebp - 0x58], 0xbd120629
sub dword [ebp - 0x58], 0x59a299bd
mov dword [ebp - 0x54], 0x523e58e2
add dword [ebp - 0x54], 0xadc1a71e
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x7a363e60
sub eax, 0x79f5bd8c
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3b2bd
push 0
call eax
mov ecx, 0xde0ac054
add ecx, 0x21f5995e
mov edi, eax
mov edx, 0xc05db593
add edx, 0x3fe35a6d
add edx, dword [ebp - 0x50]
mov esi, 0xb2add38b
add dword [ebp - 0x24], edx
mov ebx, dword [edx]
add dword [ebp - 0x3c], esi
add ebx, esi
add dword [ebp - 0x34], 0xfa838cec
mov dword [edi], ebx
xor dword [ebp - 0xc], 0x6befc0d6
add edi, 4
add edx, 0xfc8e2713
sub edx, 0xfc8e270f
loop 0x403f75
add eax, 0x9a646ad8
sub eax, 0x9a63113d
mov ebx, eax
add eax, 5
mov ecx, 0xa5a9546
add ecx, 0xf5e56aba
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0xa41058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa411a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa4107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa4106a
add dl, dl
jne 0xa41089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa410dc
xor eax, eax
add dl, dl
jne 0xa41096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa4117d
add dl, dl
jne 0xa410a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa410b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa410bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa410c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa410d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa41075
mov eax, 1
add dl, dl
jne 0xa410ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa410f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa410e1
sub eax, ebx
mov ebx, 1
jne 0xa41128
mov ecx, 1
add dl, dl
jne 0xa4110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa41119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa41105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa41075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa4113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa4114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa41136
cmp eax, 0x7d00
jae 0xa4116d
cmp eax, 0x500
jb 0xa41168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa41075
cmp eax, 0x7f
ja 0xa41170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa41075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa4119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa41075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10001460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x10096380]
xor ecx, ecx
movups xmmword [ebp - 0x1e], xmm0
mov word [ebp - 0xe], 0x5c
mov byte [ebp - 0xc], 1
nop dword [eax]
lea eax, [ecx + 0x2b]
xor byte [ebp + ecx - 0x1e], al
inc ecx
cmp ecx, 0x11
jb 0x10001480
mov byte [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0xb], 0x42495845
mov dword [ebp - 7], 0x5e551e43
mov word [ebp - 3], 0x5f
mov byte [ebp - 1], 1
nop dword [eax + eax]
lea eax, [ecx + 0x2b]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x100014b0
lea eax, [ebp - 0x1e]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0xb]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001581
push 0
push 6
push fcn.10001610
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movaps xmm0, xmmword [str.oNJFbT__PtE_XQoNJFs_QVBcWX]
xor ecx, ecx
movups xmmword [ebp - 0x1f], xmm0
mov dword [ebp - 0xf], 0x1005252
nop dword [eax]
lea eax, [ecx + 0x2b]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x12
jb 0x10001510
mov byte [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0xb], 0x42495845
mov dword [ebp - 7], 0x5e551e43
mov word [ebp - 3], 0x5f
mov byte [ebp - 1], 1
nop dword [eax + eax]
lea eax, [ecx + 0x2b]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x10001540
lea eax, [ebp - 0x1f]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0xb]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001581
push 0
push 6
push fcn.10001610
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esp, ebp
pop ebp
ret

Function at 0x10001610
Capabilities:
Create process on windows

Disassembly:
push 0
lea eax, [ebp - 0x29]
push str.taskkill__im_Conquer.exe__f
push eax
call fcn.100012c0
add esp, 8
mov ecx, eax
call fcn.10001720
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x258
push eax
lea ecx, [ebp - 0xc]
call fcn.100012a0
push eax
call fcn.100013d0
add esp, 4
mov byte [0], 0
int3
Function at 0x10001660
Capabilities:
Check for debugger via api
Check for hardware breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 4
push 0x1000
push 0x2cc
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x100016de
mov eax, 0x2cc
mov ecx, esi
nop dword [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x10001690
push esi
mov dword [esi], 0x10010
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x100016cc
cmp dword [esi + 4], edi
jne 0x100016c7
cmp dword [esi + 8], edi
jne 0x100016c7
cmp dword [esi + 0xc], edi
jne 0x100016c7
cmp dword [esi + 0x10], edi
je 0x100016cc
mov edi, 1
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test edi, edi
jne 0x100016fc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 4], 0
je 0x10001701
call fcn.10001610
cmp dword [0x100d0748], 0
pop edi
pop esi
je 0x1000171b
call fcn.10001460
mov dword [0x100d0748], 1
mov esp, ebp
pop ebp
ret

Function at 0x10001720
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x10001742
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x2b]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x10001730
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
ret
Function at 0x100017b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [0x100d0758], 0
je 0x100018f6
push 0x7042a2
push 0
push 0x107d4a08
call fcn.100494c0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push 0x7042a2
push dword [0x100b50a8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x7042a2
push 0x107d4a08
push dword [0x100b50a8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 4], 0x7042a2
jne 0x1000185d
push 0x7042a2
push 0x107d4a08
call fcn.10001b00
add esp, 8
xor eax, eax
nop dword [eax]
mov cl, byte [eax + 0x107d4a08]
cmp cl, byte [eax + 0x100d0760]
jne 0x1000184a
inc eax
cmp eax, 0x7042a2
jb 0x10001830
mov esp, ebp
pop ebp
ret
push 0x10096390
push 0xe
call fcn.100083c0
add esp, 8
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [str._MEDY_]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x4c58494a
mov dword [ebp - 0x14], 0x27392511
mov dword [ebp - 0x10], 0x236b63
mov byte [ebp - 0xc], 1
lea eax, [ecx + 0x2b]
xor byte [ebp + ecx - 0x28], al
inc ecx
cmp ecx, 0x1b
jb 0x10001883
push esi
push 0
lea eax, [ebp - 0x28]
mov byte [ebp - 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.10009214
add eax, 0x5b8d80
push 0
push 0x64
adc edx, 0
push edx
push eax
call fcn.100274a0
push 0
push 0x3b9aca00
mov esi, eax
push edx
push esi
call fcn.100273f0
mov dword [ebp - 0x1c], eax
imul eax, eax, 0x3b9aca00
mov dword [ebp - 0x18], edx
sub esi, eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], esi
movups xmm0, xmmword [ebp - 0x1c]
push eax
movups xmmword [ebp - 0x1c], xmm0
call fcn.10009543
add esp, 4
mov byte [0], 0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001ae0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push fcn.10001900
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x10001b00
Capabilities:
Contain obfuscated stackstrings
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0xc], 0x58524d41
mov dword [ebp - 8], 0x49444f43
mov word [ebp - 4], 0x474e
test esi, esi
jle 0x10001b50
push edi
mov edi, dword [ebp + 8]
nop dword [eax + eax]
mov eax, 0xcccccccd
mul ecx
mov eax, ecx
shr edx, 3
lea edx, [edx + edx*4]
add edx, edx
sub eax, edx
mov al, byte [ebp + eax - 0xc]
xor byte [ecx + edi], al
inc ecx
cmp ecx, esi
jl 0x10001b30
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor bl, bl
mov dword [ebp - 0x40], 0x4295115a
mov dword [ebp - 0x3c], 0x46fbffdb
mov dword [ebp - 0x38], 0x7712c4a6
mov dword [ebp - 0x34], 0x50c85635
mov dword [ebp - 0x30], 0x2e89eea3
mov dword [ebp - 0x2c], 0x649e380a
mov dword [ebp - 0x28], 0xcf581a40
mov dword [ebp - 0x24], 0x587ba7ef
mov dword [ebp - 0x20], 0x8af6fe58
mov dword [ebp - 0x1c], 0x9c40e27e
mov dword [ebp - 0x18], 0x1c5a598c
mov dword [ebp - 0x14], 0x3e1cc46c
mov dword [ebp - 0x10], 0xc05ca117
mov dword [ebp - 0xc], 0x4ac2fd5e
mov dword [ebp - 8], 0xab58e08a
mov dword [ebp - 4], 0xb3d91ae9
test esi, esi
jle 0x10001c0b
push edi
mov edi, dword [ebp + 8]
xor edx, edx
lea eax, [edx + edx*2]
inc bl
lea ecx, [edx + edx*2]
and eax, 0x1f
shl ecx, 2
and ecx, 0x1c
mov al, byte [ebp + eax - 0x20]
xor al, byte [ebp + ecx - 0x40]
xor byte [edx + edi], al
movzx edx, bl
cmp edx, esi
jl 0x10001be7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001d80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push eax
mov esi, dword [esi + 4]
push 0x40
push 5
push edi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [ebx + 5]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [edi]
cmp eax, dword [ebx]
jne 0x10001de1
movzx eax, byte [edi + 4]
cmp al, byte [ebx + 4]
jne 0x10001de1
mov esi, 0xb
jmp 0x10001df6
mov eax, dword [edi]
cmp eax, dword [ebx + 5]
jne 0x10001df6
movzx eax, byte [edi + 4]
cmp al, byte [ebx + 9]
jne 0x10001df6
mov esi, 5
mov ebx, dword [ebp + 0x10]
lea eax, [esi + 5]
push eax
mov dword [ebx + 4], esi
call fcn.10027512
mov ecx, dword [ebx + 4]
add esp, 4
mov esi, eax
add ecx, 5
lea eax, [ebp + 8]
push eax
push 0x40
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebx + 4]
push edi
push esi
call fcn.10049d20
mov eax, dword [ebx + 4]
mov ecx, edi
sub ecx, esi
mov byte [ebp - 8], 0xe9
sub ecx, 5
add esp, 0xc
mov byte [esi + eax], 0xe9
mov eax, dword [ebx + 4]
mov dword [esi + eax + 1], ecx
mov eax, dword [ebp + 0xc]
sub eax, edi
sub eax, 5
mov dword [ebp - 7], eax
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov al, byte [ebp - 4]
mov byte [edi + 4], al
pop edi
mov dword [ebx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10002270
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10001fb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x10003880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10090900
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100274d4
mov edi, eax
add esp, 4
test edi, edi
je 0x100038c8
push 1
mov dword [ebp - 4], 0
call fcn.1000a31d
add esp, 4
mov dword [edi + 4], eax
jmp 0x100038ca
xor edi, edi
lea eax, [esi + 4]
mov dword [esi + 0x34], edi
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003bb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100909aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.1000966d
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x10003c3d
push eax
push esi
call fcn.1000a424
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
lea ecx, [ebp - 0x1c]
call fcn.10003fb0
push 0x100accf0
lea eax, [ebp - 0x1c]
push eax
call fcn.1004a8e3
int3
Function at 0x10006cc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x10006cdb
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x10006cf7
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10006ce6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x10006d30
cmp eax, edi
jne 0x10006d28
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x10006d38
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10006d38
cmp eax, edi
jne 0x10006d3b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
lea ecx, [edx + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.10005f90
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100078c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
push ebx
push esi
push edi
mov dword [ebp - 0x84], 0x10096800
xor edi, edi
mov dword [ebp - 0x80], str.ProcessHacker.exe
mov dword [ebp - 0x7c], str.tcpview.exe
mov dword [ebp - 0x78], str.autoruns.exe
mov dword [ebp - 0x74], str.autorunsc.exe
mov dword [ebp - 0x70], str.filemon.exe
mov dword [ebp - 0x6c], str.procmon.exe
mov dword [ebp - 0x68], str.regmon.exe
mov dword [ebp - 0x64], str.procexp.exe
mov dword [ebp - 0x60], str.idaq.exe
mov dword [ebp - 0x5c], str.idaq64.exe
mov dword [ebp - 0x58], str.ImmunityDebugger.exe
mov dword [ebp - 0x54], str.Wireshark.exe
mov dword [ebp - 0x50], str.dumpcap.exe
mov dword [ebp - 0x4c], str.HookExplorer.exe
mov dword [ebp - 0x48], str.ImportREC.exe
mov dword [ebp - 0x44], str.PETools.exe
mov dword [ebp - 0x40], str.LordPE.exe
mov dword [ebp - 0x3c], str.SysInspector.exe
mov dword [ebp - 0x38], str.proc_analyzer.exe
mov dword [ebp - 0x34], str.sysAnalyzer.exe
mov dword [ebp - 0x30], str.sniff_hit.exe
mov dword [ebp - 0x2c], str.windbg.exe
mov dword [ebp - 0x28], str.joeboxcontrol.exe
mov dword [ebp - 0x24], str.joeboxserver.exe
mov dword [ebp - 0x20], str.joeboxserver.exe
mov dword [ebp - 0x1c], str.ResourceHacker.exe
mov dword [ebp - 0x18], str.x32dbg.exe
mov dword [ebp - 0x14], str.x64dbg.exe
mov dword [ebp - 0x10], str.Fiddler.exe
mov dword [ebp - 0xc], str.httpdebugger.exe
mov dword [ebp - 8], str.cheatengine_x86_64.exe
mov dword [ebp - 4], str.cheatengine_i386.exe
nop dword [eax + eax]
mov ebx, dword [ebp + edi*4 - 0x84]
lea eax, [ebp - 0x1ac]
mov ecx, 0x128
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x100079d2
push ecx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10007a8d
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x1ac], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x10007a14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10007a8d
lea eax, [ebp - 0x188]
push ebx
push eax
call fcn.1007537b
add esp, 8
test eax, eax
je 0x10007a6e
lea eax, [ebp - 0x1ac]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10007a65
nop dword [eax]
lea eax, [ebp - 0x188]
push ebx
push eax
call fcn.1007537b
add esp, 8
test eax, eax
je 0x10007a6e
lea eax, [ebp - 0x1ac]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10007a40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10007a8d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1a4], 0
je 0x10007a8d
push 0x10096390
push 0xe
call fcn.100083c0
add esp, 8
inc edi
cmp edi, 0x21
jl 0x100079c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret