joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473282
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4732ba
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00471339
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00471311
jmp 0x4732c6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47497c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4749be
call fcn.0047a6ba
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4749be
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4749b5
xor eax, eax
jmp 0x4749c6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004749cc
pop edi
pop esi
pop ebx
ret 4

Function at 0x47abea
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47ac18
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47ac36
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047ab50
jmp 0x47ac36
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47ac36
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047ab50
test edi, edi
mov eax, edi
jne 0x47ac20
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4065c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4065e7
xor eax, eax
test eax, eax
je 0x4065f9
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4065f9
xor ecx, ecx
jmp 0x4065fc
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4066e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232e4], 0
push esi
jne 0x40671f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066f9
mov dword [ecx*4 + 0x4232e0], eax
inc ecx
cmp ecx, 0x100
jl 0x4066f4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406750
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232e0]
xor eax, esi
inc ecx
dec edx
jne 0x406732
pop edi
not eax
pop esi
ret 0xc

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x10014fe
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001138
call fcn.0100170c
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x1000000], 0x5a4d
jne 0x1001551
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1001551
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1001569
cmp ecx, 0x20b
je 0x1001556
mov dword [ebp - 0x1c], ebx
jmp 0x100157d
cmp dword [eax + 0x84], 0xe
jbe 0x1001551
xor ecx, ecx
cmp dword [eax + 0xf8], ebx
jmp 0x1001577
cmp dword [eax + 0x74], 0xe
jbe 0x1001551
xor ecx, ecx
cmp dword [eax + 0xe8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x1002034], edi
mov dword [0x1002038], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100202c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1002028]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100203c], eax
call fcn.01001706
cmp dword [0x100201c], ebx
jne 0x10015da
push fcn.01001706
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010016f4
push 0x1002010
push 0x100200c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1002024]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1002020]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1002008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x1001665
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x1001645
cmp cl, 0x22
jne 0x1001636
cmp byte [eax], 0x22
jne 0x100164e
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x1001659
cmp cl, 0x20
jbe 0x100164a
test byte [ebp - 0x54], 1
je 0x1001670
movzx ecx, word [ebp - 0x50]
jmp 0x1001673
cmp byte [eax], 0x20
jbe 0x100164e
inc eax
mov dword [ebp - 0x20], eax
jmp 0x1001665
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call fcn.0100131c
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1001691
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x10016cd
mov eax, esi
jmp 0x10016e1
call fcn.01001747
ret
Function at 0x1000e363
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000e3a2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e3a2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e3a2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000e3a2
cmp dword [ecx + 0x74], 0xe
jbe 0x1000e3a2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001101f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100110bc
push ebx
push esi
call fcn.10010fe8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10010f7c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10011069
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100110bb
push edi
push eax
call fcn.10011fda
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10011089
call fcn.1000fac4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100110ba
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10010f7c
add esp, 0x20
test eax, eax
jne 0x100110a8
push edi
call fcn.1000fac4
jmp 0x100110b0
push ebx
call fcn.1000fac4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10011329
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10018888
push 0x10018880
push str.FlsAlloc
push 0x1f
call fcn.10011245
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001135d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10017150]
call esi
jmp 0x10011363
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100113a7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10018898
push 0x10018890
push str.FlsGetValue
push 0x21
call fcn.10011245
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100113de
push dword [ebp + 8]
mov ecx, esi
call dword [0x10017150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100113e6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100188a0
push 0x10018898
push str.FlsSetValue
push 0x22
call fcn.10011245
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011420
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10017150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10016aa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10016acd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10016acd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4017ee
Capabilities:
Persist via run registry key

Disassembly:
push 0x104
push 0x44921c
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov edi, 0x449424
call fcn.004024ff
push 0x449424
call sub.kernel32.dll_lstrlenA
mov edi, 0x449424
add edi, eax
mov al, byte [edi - 1]
cmp al, 0x5c
jne 0x401825
mov byte [edi - 1], 0
push 0x449528
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004056c2
cmp eax, 0
jne 0x4018d2
mov dword [0x44953a], 0x104
push 0x44953a
push 0x449320
push 0
push 0
push str.Desktop
push dword [0x449528]
call fcn.004056c8
cmp eax, 0
jne 0x4018d2
push str.TestMem5.lnk
push 0x449320
call sub.kernel32.dll_lstrcatA
push 0x44953a
push 0x449320
call sub.kernel32.dll_GetCompressedFileSizeA
or eax, eax
jg 0x4018d2
push 0
call fcn.00405804
mov eax, dword [0x4075e8]
or eax, eax
jl 0x4018ad
mov dword [0x40809f], eax
lea eax, str.The_program_checks_the_memory__run_carefully_
call fcn.004023b6
push eax
push 0x449424
push 0x449320
push 0x44921c
call fcn.004018d3
call fcn.0040580a
ret

Function at 0x401d85
Capabilities:
Read file on windows
Write file on windows

Disassembly:
pushal
call fcn.00403ced
mov ecx, eax
push ecx
push 0x40869c
call sub.kernel32.dll_lstrcpyA
push str.binCfg.link
push 0x40869c
call sub.kernel32.dll_lstrcatA
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x40869c
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x401df8
mov ebx, eax
push 0
push 0x4082d8
push 0x200
push 0x4089b8
push ebx
call sub.kernel32.dll_ReadFile
push eax
push ebx
call sub.kernel32.dll_CloseHandle
pop eax
or eax, eax
je 0x401df8
cmp dword [0x4082d8], 5
jl 0x401df8
jmp 0x401e77
call fcn.00403ced
mov ecx, eax
push ecx
push 0x4081d8
call sub.kernel32.dll_lstrcpyA
push 0x4081d8
push 0x4089b8
call sub.kernel32.dll_lstrcpyA
push str.binCfg.link
push 0x4081d8
call sub.kernel32.dll_lstrcatA
push str.binMT.cfg
push 0x4089b8
call sub.kernel32.dll_lstrcatA
push 0
push 0x20
push 2
push 0
push 3
push 0xc0000000
push 0x4081d8
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0x4089b8
call sub.kernel32.dll_lstrlenA
mov edx, eax
push 0
push 0x4082d8
push edx
push 0x4089b8
push ebx
call sub.kernel32.dll_WriteFile
push ebx
call sub.kernel32.dll_CloseHandle
popal
ret
Function at 0x40253a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push 0x3ec
push dword [0x408330]
call sub.user32.dll_GetDlgItem
mov dword [0x448f6c], eax
mov dword [ebp - 0x30], 0xc
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 1
push 0
push 0x80
push 4
lea eax, [ebp - 0x30]
push eax
push 3
push 0xc0000000
push str.Log.txt
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4025f7
mov dword [0x448f70], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x4025df
push 2
push 0
push 0
push dword [0x448f70]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x407b65
push dword [0x448f70]
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x407b65
push dword [0x448f70]
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push 0x27
push str._TestMem5_Log_File__r_n
push dword [0x448f70]
call sub.kernel32.dll_WriteFile
leave
ret

Function at 0x4025f9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
cmp dword [ebp + 0xc], 0x10000
jb 0x402666
cmp dword [ebp + 8], 0
je 0x402666
push dword [ebp + 0xc]
push 0
push 0x180
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
cmp dword [0x448f70], 0
je 0x402660
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrlenA
mov ecx, eax
push 0
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp + 0xc]
push dword [0x448f70]
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x407b65
push dword [0x448f70]
call sub.kernel32.dll_WriteFile
inc dword [0x448f74]
leave
ret 8

Function at 0x4029dc
Capabilities:
Get memory capacity

Disassembly:
pushal
lea eax, [0x449da2]
mov dword [eax], 0x40
push 0x449da2
call sub.kernel32.dll_GlobalMemoryStatusEx
mov eax, dword [0x449daa]
mov esi, dword [0x449dae]
shr eax, 0x10
shl esi, 0x10
or eax, esi
add eax, 0xf
shr eax, 4
cmp al, 0xff
jne 0x402a11
inc eax
mov dword [0x448d04], eax
mov eax, dword [0x449db2]
mov esi, dword [0x449db6]
shr eax, 0x14
shl esi, 0xc
or eax, esi
mov dword [0x448d08], eax
mov eax, dword [0x449dba]
mov edx, dword [0x449dbe]
sub eax, dword [0x449dc2]
sbb edx, dword [0x449dc6]
push 0xf4240
call fcn.0040243b
mov dword [0x448d0c], eax
mov eax, dword [0x449dba]
mov edx, dword [0x449dbe]
push 0xf4240
call fcn.0040243b
mov dword [0x448d10], eax
mov eax, dword [0x449dba]
mov edx, dword [0x449dbe]
push 0x100000
call fcn.0040243b
mov dword [0x448d14], eax
popal
ret

Function at 0x40350a
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
mov esi, dword [0x449d92]
or esi, esi
je 0x403577
lea ebx, [esi + 0x88098]
lea edx, [esi + 0x88094]
mov ecx, 0
cmp ecx, dword [0x448f84]
je 0x403562
pushal
mov eax, dword [edx]
or eax, eax
je 0x40354b
mov dword [edx], 0
push 0
push 0
push 0x10
push eax
call sub.user32.dll_SendMessageA
popal
pushal
mov eax, dword [ebx]
or eax, eax
je 0x403561
mov dword [ebx], 0
push 2
push eax
call sub.kernel32.dll_TerminateProcess
popal
add ebx, 0x80
add edx, 0x80
inc ecx
cmp ecx, dword [0x408488]
jl 0x40352a
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x4035c4
Capabilities:
Create process on windows

Disassembly:
pushal
mov esi, 0x4490e4
mov byte [esi], 0x20
mov byte [esi + 1], 0xd
mov byte [esi + 2], al
mov esi, dword [0x449d92]
mov dword [0x448fa0], 0x44
mov edx, 0x80
mul edx
lea edx, [eax + esi + 0x88098]
push edx
push 0x448fa0
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0x4490e4
push 0x448fe4
call sub.kernel32.dll_CreateProcessA
push 0
call sub.kernel32.dll_Sleep
popal
ret

Function at 0x404db1
Capabilities:
Accept command line arguments
Check os version
Create thread
Get system information on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x40832c], eax
call sub.kernel32.dll_GetVersion
mov dword [0x40845c], eax
mov eax, dword [0x40845c]
cmp al, 5
ja 0x404ddc
inc dword [0x448d9c]
push 0x408460
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [0x408474]
mov dword [0x408484], eax
call fcn.004023d9
mov dword [0x40848c], eax
mov dword [0x4075f4], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x408458], eax
call sub.kernel32.dll_GetVersion
mov dword [0x40845c], eax
mov esi, dword [0x408458]
call fcn.004023ec
je 0x404e45
mov eax, dword [esi]
mov ebx, eax
and ebx, 0xffffffff
and ebx, 0xdfdfdfdf
cmp ebx, 0x454c4449
jne 0x404e37
jmp 0x404e19
cmp al, 0xd
jne 0x404e43
mov al, byte [esi + 1]
mov byte [0x448f84], al
jmp 0x404e19
cmp byte [0x448f84], 0
jne 0x404e69
call fcn.00402bb4
call fcn.004029dc
call fcn.00402409
call fcn.00401b95
call fcn.00401ef9
jmp 0x404e6e
call fcn.00401c7d
mov esi, dword [0x449d92]
mov eax, 0x80
mul dword [0x448f84]
add eax, esi
mov dword [0x449d96], eax
mov eax, 0x880
mul dword [0x448f84]
mov dword [0x449d9e], eax
add eax, esi
mov dword [0x449d9a], eax
cmp eax, esi
je 0x404eea
mov byte [0x407ac3], 0
mov eax, dword [esi + 0x44]
mov dword [0x407588], eax
inc byte [esi + 0x6f]
movzx eax, byte [esi + 0x6f]
inc eax
pushal
mov ebx, dword [esi + 0x88094]
push eax
push 0x407a3b
push 0x408334
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x69
push ebx
call sub.user32.dll_GetDlgItem
push 0x408334
push 0
push 0xc
push eax
call sub.user32.dll_SendMessageA
popal
call fcn.0040436e
mov esi, dword [0x449d92]
mov eax, dword [esi + 0x40]
mov dword [0x408488], eax
mov esi, dword [0x449d92]
mov eax, 0x880
mul dword [0x448f84]
add esi, eax
mov eax, dword [0x449d92]
mov dword [esi + 0xe0], eax
mov ecx, dword [0x407588]
mov dword [esi + 0x160], eax
add esi, 0x80
loop 0x404f21
mov eax, fcn.00403825
push eax
push 0x64
push 0
push 0
call sub.user32.dll_SetTimer
mov esi, dword [0x449d96]
mov dword [esi + 0x880c0], eax
mov eax, 0x404481
push 0x44920c
push 0
push dword [0x448f84]
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread
mov esi, dword [0x449d96]
mov dword [esi + 0x880b8], eax
mov eax, dword [0x44920c]
mov dword [esi + 0x880bc], eax
cmp byte [0x448f84], 0
jne 0x404f9e
push 0xa
push 0
push dword [0x40832c]
call fcn.00404fbb
push 0
call sub.kernel32.dll_ExitThread
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0
push 0
push 0
call fcn.00403825
jmp 0x404f9e
Function at 0x10001160
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
dec eax
jne 0x1000117c
push 0
push 0
push 0
push section..text
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
ret 0xc
Function at 0x10002350
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 0xc]
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x100023a2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
lea edx, [esp + 0x30]
push str.360tray.exe
push edx
mov esi, eax
call ebx
test eax, eax
je 0x100023b6
test esi, esi
jne 0x10002381
call fcn.10001ee0
call fcn.10001ad0
pop edi
pop esi
pop ebx
add esp, 0x128
ret
call fcn.10001ad0
call fcn.10001b50
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x128
ret
Function at 0x10021977
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf130
jmp 0x10021a30
call fcn.10021b6b
sbb dword [esi], 0xffffff8c
jmp 0x10021991
push dword [esp + 3]
je 0x10021961
jne 0x10021961
setge dl
jmp 0x10021988
lea edi, [esp]
xchg al, bh
cpuid
lea edx, [ebp + 0x5c6562ab]
stosd dword es:[edi], eax
bound esp, qword [ebp + 0x5c]
bsr ax, cx
jmp 0x100219b5
mov esi, dword [esp + 0x2c]
mov ebp, 0xafce99ed
sub dl, dl
jno 0x1002197f
setge dl
jmp 0x10021988
ja 0x100219cb
jbe 0x100219cb
mov dword [0x20d1b620], eax
xchg ebx, eax
fistp word [ebp - 0x33]
xchg esp, eax
shr dword [si], 1
aas
push es
mov cl, 0xb0
mov bl, 0x81
in al, dx
rol byte [eax], 0
add byte [ebx - 0x3b60f014], cl
sub esp, 0xc0
mov ebp, esp
setg ah
jmp 0x100219f2
lea ebx, [ecx + ebp]
not ebx
rdtsc
mov ebx, esi
call 0x100219d8
js 0x10021a16
mov ecx, 0xac803c15
sub esp, 0xb
jmp 0x10021a5e
mov ecx, 0xac803c15
sub esp, 0xb
mov dx, word [esp + 0xa]
dec dx
jmp 0x10021a41
mov edx, dword [esp]
mov bp, word [esp]
mov bl, byte [esp]
bswap eax
jmp 0x100219a3
lea edx, [ecx*4]
rdtsc
lea esp, [esp + 3]
jmp 0x10021a6e
mov dx, word [esp + 0xa]
dec dx
lea edx, [ecx*4]
jmp 0x10021a48
ror esi, 0
cmp ecx, edx
jmp 0x10021ab5
mov eax, ecx
mov cx, word [esp]
inc edx
neg dx
ror esi, 0
xchg dh, al
jmp 0x10021ad5
pushfd
jmp 0x1002175a
inc edx
neg dx
jmp 0x10021a83
jp 0x10021a79
mov eax, ecx
mov cx, word [esp]
jmp 0x10021a9f
jmp 0x10021b28
mov edx, eax
lea eax, [eax*4]
mov eax, esp
mov al, 0x1e
neg eax
jnp 0x10021abf
jp 0x10021b28
test al, 0x39
test eax, 0x8a8c3bc8
sbb cl, byte [eax - 0x451e511]
ror byte [ebp - 0x24], cl
das
mov dword [esp + 0x28], esi
push cx
lea esp, [esp + 2]
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x10021a99
mov dl, 0x6b
xchg word [esp], ax
push dword [esp + 2]
jg 0x10021b4d
jle 0x10021b4d
and eax, 0xbc4d2ab4
jge 0x10021b57
mov eax, dword [0x64a35031]
pushal
lea esp, [esp + 8]
inc esi
push edi
mov dx, 0xa856
mov dx, si
jmp 0x10021b0d
neg esi
mov cl, bh
mov ecx, 0xe26b2b2f
mov ecx, 0x5874665d
jmp 0x10021b53
lea esp, [esp + 8]
jmp 0x10021b37
dec esi
mov cx, bx
mov al, byte [esp]
jmp 0x10021cb2
jne 0x10021c52
je 0x10021b76
jmp 0x10021c19
ror dword [ebp + 0x566390c], cl
sbb eax, 0x7e117fa8
popal
jmp 0x10021b76
add esi, dword [edi]
xchg ch, dh
xchg edx, eax
bswap edx
clc
jmp 0x10021b98

Function at 0x10021b6b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x10], ebp
pushal
pop dword [esp + 0xa]
jmp 0x10021af9

Function at 0x1002d7bd
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x100120df
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x100120f9
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x100120e8
pop esi
jmp 0x10012104
ret 4
jmp 0x1002d819
mov word [esp + 1], dx
lea esp, [esp + 4]
jmp 0x100120d2
Function at 0x100c8552
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
setbe bh
neg bl
mov bp, word [esp + 3]
push eax
xchg byte [esp + 9], ah
jmp 0x100c850c
mov edx, dword [esp + 4]
cpuid
std
pushfd
mov ebx, eax
mov bp, word [esp + 0xc]
jmp 0x100c84c7
mov byte [esp + 2], dh
mov cx, 0xe8ab
sub esp, 0xf
mov bp, 0xb01b
jmp 0x100c853a
pop word [esp + 5]
add esp, 0xd
xchg byte [esp], bl
cpuid
lea edi, [edx - 0x3cd4]
sub esp, 0x1f
jmp 0x100c84f6
sub esp, 0xd
mov word [esp + 0x1a], cx
bsr edi, ebx
mov bl, 0xec
dec edi
jmp 0x100c85f3
xchg ch, ah
lea esi, [eax*4]
rdtsc
xchg byte [esp + 0x2a], dl
setg dl
jmp 0x100c8524
xchg dx, cx
not ch
jmp 0x100c84e5
lea esp, [esp + 0x2f]
add esp, 0xa
clc
shr bl, cl
pop ax
mov cx, word [esp]
jmp 0x100c859b
xchg bl, bh
mov ah, byte [esp + 0x1b]
pop word [esp + 0x17]
bsf edx, ecx
mov bp, 0xab67
neg edx
jmp 0x100c8559
sub ebx, 0xf35bbebb
mov byte [esp + 0xa], ah
cmc
lea ecx, [ebx + esi]
dec bp
jmp 0x100c85d6
btr ax, dx
mov dh, al
xchg edi, ecx
lea ebx, [ebx*4]
mov edx, 0xc6996494
sub esp, 0x14
jmp 0x100c8585
xchg dx, ax
bts eax, eax
cpuid
dec cx
mov si, sp
push ebp
jmp 0x100c856f
push dword [esp + 4]
xchg word [esp + 6], cx
lea esi, [ecx + ebp]
xchg word [esp + 4], dx
mov edi, esp
mov ebx, dword [esp + 6]
jmp 0x100c861d
lea ecx, [edi*4]
xchg cx, ax
pop bp
lea esp, [esp + 1]
neg ebp
cld
jmp 0x100c85c7
mov cl, 0x42
inc ax
setb dh
mov ch, 0xe
sete ah
xchg byte [esp], cl
jmp 0x100c862f
cpuid
push dword [esp + 3]
push ecx
add esp, 0x20
neg dx
neg di
jmp 0x100c8607
lea esi, [edi + 0xacf3]
lea esp, [esp]
mov edx, ebx
rdtsc
inc ebp
sbb bh, 0xb7
jmp 0x100c8791
shl bx, 7
not si
mov si, 0x89d5
mov esi, ebp
lea esi, [esi + 0x41]
xchg bh, dh
jmp 0x100c8674
mov edx, eax
rdtsc
pushfd
mov eax, edx
cpuid
setne ah
jmp 0x100c8698
rdtsc
bt ebx, ebx
lea esi, [esi*4]
inc dl
lea esi, [ecx*4]
cpuid
jmp 0x100c8702