joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014f60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movaps xmm0, xmmword [0x100af9a0]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
push esi
movaps xmm0, xmmword [0x100af920]
movups xmmword [ebp - 0x24], xmm0
movaps xmm0, xmmword [0x100ae960]
movups xmmword [ebp - 0x14], xmm0
nop word [eax + eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x10014f90
push 0
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], 0
push eax
push 0
push 0x100baa38
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1001507c
push 0x100baa34
push 0
push 0
push 0x8004
push dword [0x100baa38]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1001507c
movaps xmm0, xmmword [0x100afa70]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x7d257374
movaps xmm0, xmmword [0x100af170]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x77216755
movaps xmm0, xmmword [0x100af440]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x34656f40
mov word [ebp - 4], 0x68
nop
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x10015020
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], 0
push eax
push dword [0x100baa34]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1001507c
push 0x100baa30
push 0x800000
push dword [0x100baa34]
push 0x6801
push dword [0x100baa38]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1001507c
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100baa2c], eax
call fcn.1007e630
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.1007eb00
push 0x10014db0
push 0x100baa28
call fcn.1007e340
call fcn.1007e690
push 4
push 0x450890
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100150ea
mov dword [0x100baa28], 0x450890
call fcn.1007e630
call esi
push eax
call fcn.1007eb00
push 0x10014db0
push 0x100baa28
call fcn.1007deb0
call fcn.1007e690
call fcn.1007e630
call esi
push eax
call fcn.1007eb00
push 0x10014e50
push 0x100baa24
call fcn.1007e340
call fcn.1007e690
push 4
push 0x4504c0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10015147
mov dword [0x100baa24], 0x4504c0
call fcn.1007e630
call esi
push eax
call fcn.1007eb00
push 0x10014e50
push 0x100baa24
call fcn.1007deb0
call fcn.1007e690
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10016a60
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
cmp ecx, 0x100b8f60
je 0x10016a88
cmp dword [ecx + 0x14], 0xf
mov eax, dword [ecx + 0x10]
jbe 0x10016a7c
mov ecx, dword [ecx]
push eax
push ecx
mov ecx, 0x100b8f60
call fcn.10006300
cmp dword [0x100b8f70], 0
jbe 0x10016bd4
cmp dword [0x100b8f74], 0xf
mov eax, 0x100b8f60
cmova eax, dword [0x100b8f60]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
mov esi, dword [0x100b8f70]
cmp esi, 1
jbe 0x10016bd4
mov edi, dword [0x100b8f74]
mov eax, 0x100b8f60
cmp edi, 0xf
cmova eax, dword [0x100b8f60]
cmp byte [esi + eax - 1], 0x5c
je 0x10016af2
push 0x5c
mov ecx, 0x100b8f60
call fcn.100098f0
mov edi, dword [0x100b8f74]
mov esi, dword [0x100b8f70]
mov byte [ebp - 0x10], 0x36
mov cl, 0x44
xor cl, byte [ebp - 0x10]
mov al, 0x72
xor al, byte [ebp - 0x10]
mov ch, 0x65
mov byte [ebp - 0xf], al
mov dl, 0x53
mov byte [ebp - 0xe], cl
mov dh, 0x59
mov cl, byte [ebp - 0x10]
mov bl, 0x57
mov byte [ebp - 1], 0x42
xor dl, cl
mov al, byte [ebp - 1]
xor ch, cl
xor al, cl
mov byte [ebp - 2], 0x6a
xor dh, cl
mov byte [ebp - 7], al
mov al, byte [ebp - 2]
mov ah, 0x5b
mov bh, 0x50
mov byte [ebp - 0xa], ch
xor bl, cl
mov byte [ebp - 5], 0
xor ah, cl
mov byte [ebp - 0xd], dl
xor bh, cl
mov byte [ebp - 9], dh
xor al, cl
mov byte [ebp - 0xc], bl
lea ecx, [ebp - 0xf]
mov byte [ebp - 0xb], ah
mov byte [ebp - 8], bh
lea edx, [ecx + 1]
mov byte [ebp - 6], al
mov byte [ebp - 5], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10016b60
mov eax, 0x7fffffff
sub ecx, edx
sub eax, esi
cmp eax, ecx
jb 0x10016bdb
push ecx
lea ecx, [ebp - 0xf]
cmp edi, 0xf
push ecx
push esi
mov eax, 0x100b8f60
cmova eax, dword [0x100b8f60]
push eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
call fcn.1000f860
lea eax, [ebp - 0x2c]
mov ecx, 0x100b8f78
push eax
call fcn.10005c60
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x10016bd4
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016bca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016be0
push ecx
push edx
call fcn.1007fa46
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10002380
call fcn.10084bdf
int3
Function at 0x1001d6c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009d9e5
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100b7040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [0x100ba9eb], 0
je 0x1001d7ca
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
sub eax, dword [0x100baab8]
sbb edx, dword [0x100baabc]
jne 0x1001d71b
cmp eax, 0x3e8
jb 0x1001d7e1
call esi
push ecx
lea ecx, [ebp - 0x2c]
mov dword [0x100baab8], eax
mov dword [0x100baabc], edx
call fcn.1000b9b0
push 0x1000
call fcn.1000c0b0
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov esi, edi
mov edx, dword [ebp - 0x1c]
sub esi, edx
mov dword [ebp - 0x2c], vtable.Packet.0
cmp esi, 0x989680
ja 0x1001d799
mov ecx, dword [ebp - 0x20]
inc ecx
cmp esi, ecx
jae 0x1001d78f
mov eax, dword [ebp - 0x14]
sub eax, edx
cmp ecx, eax
jbe 0x1001d778
push ecx
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1000c160
jmp 0x1001d78c
sub ecx, esi
push ecx
push 0
push edi
lea esi, [edi + ecx]
call fcn.10081b50
add esp, 0xc
mov dword [ebp - 0x18], esi
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov byte [edx + eax], 0xa1
inc dword [ebp - 0x20]
push 0xa4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.1001f730
push ebx
mov ecx, eax
call fcn.1001f550
lea ecx, [ebp - 0x2c]
call fcn.1001f8d0
mov edx, dword [ebp - 0x18]
mov ecx, eax
sub edx, dword [ebp - 0x1c]
call fcn.100185a0
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f9e5
mov esp, ebp
pop ebp
ret
Function at 0x10023130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x100b7040]
xor eax, esp
mov dword [esp + 0x34], eax
movaps xmm0, xmmword [0x100aee20]
push esi
mov esi, ecx
mov dword [esp + 0x14], 0x4080245
push edi
movups xmmword [esp + 8], xmm0
mov byte [esp + 0x1c], 0
xor ecx, ecx
mov al, byte [esp + 8]
xor byte [esp + ecx + 9], al
inc ecx
cmp ecx, 0x13
jb 0x10023163
mov edx, dword [0x100b8f88]
lea ecx, [esp + 9]
mov byte [esp + 0x1c], 0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10023183
mov eax, 0x7fffffff
sub ecx, edi
sub eax, edx
cmp eax, ecx
jb 0x10023259
cmp dword [0x100b8f8c], 0xf
mov eax, 0x100b8f78
push ecx
cmova eax, dword [0x100b8f78]
lea ecx, [esp + 0xd]
push ecx
push edx
push eax
push ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x3c]
call fcn.1000f860
mov eax, dword [esi + 0x1fc]
test eax, eax
je 0x100231d5
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [esp + 0x38], 0xf
lea eax, [esp + 0x24]
push 0x8010
cmova eax, dword [esp + 0x28]
push 0
push 0
push 1
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esi + 0x1fc], eax
test eax, eax
je 0x10023216
cmp byte [esi + 0x200], 0
mov dword [esi + 0x14], eax
je 0x10023216
push esi
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov ecx, dword [esp + 0x38]
cmp ecx, 0xf
jbe 0x10023248
mov edx, dword [esp + 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002323e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002325e
push ecx
push edx
call fcn.1007fa46
add esp, 8
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1007f9e5
mov esp, ebp
pop ebp
ret
call fcn.10002380
call fcn.10084bdf
int3
Function at 0x10023270
Capabilities:
Allocate or change rwx memory
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x100b7040]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, 0x6c
mov dword [ebp - 0x2f8], 0x183e6c
mov dword [ebp - 0x2f4], 0x80d0320
xor eax, eax
mov dword [ebp - 0x2f0], 0x51e183f
mov word [ebp - 0x2ec], 0xb02
mov byte [ebp - 0x2ea], 0
xor byte [ebp + eax - 0x2f7], cl
inc eax
cmp eax, 0xd
jae 0x100232ca
mov cl, byte [ebp - 0x2f8]
jmp 0x100232b5
push ebx
mov byte [ebp - 0x2e8], 0x6b
mov al, 5
xor al, byte [ebp - 0x2e8]
mov bl, 7
mov ah, bl
mov byte [ebp - 0x2e7], al
mov al, byte [ebp - 0x2e8]
mov dl, 0xf
mov bh, ah
mov byte [ebp - 0x2d9], ah
mov dh, dl
mov byte [ebp - 0x2de], 0
xor dl, al
mov byte [ebp - 0x2ea], 0
xor bl, al
mov byte [ebp - 0x2e5], dl
xor ah, al
mov byte [ebp - 0x2e4], bl
xor dh, al
mov byte [ebp - 0x2e3], ah
xor bh, al
mov byte [ebp - 0x2e1], dh
mov cl, 0x1f
mov byte [ebp - 0x2e0], bh
xor cl, al
mov byte [ebp - 0x2de], 0
mov ch, 0x45
mov byte [ebp - 0x2e6], cl
xor ch, al
mov al, byte [ebp - 0x2d9]
xor al, byte [ebp - 0x2e8]
mov byte [ebp - 0x2df], al
lea eax, [ebp - 0x2e7]
push esi
push eax
mov byte [ebp - 0x2e2], ch
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2f7]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
je 0x10023442
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10023442
push 0x2c8
lea eax, [ebp - 0x2d4]
push 0
push eax
call fcn.10081b50
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10023442
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10023442
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10023442
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x10001e70
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x10023442
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f9e5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1007f9e5
mov esp, ebp
pop ebp
ret
Function at 0x10023460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov byte [ebp - 0x10], 0x36
mov al, 0x58
xor al, byte [ebp - 0x10]
mov bl, 0x5a
mov ah, bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x10]
mov dl, 0x52
push esi
mov esi, ecx
mov byte [ebp - 1], ah
mov bh, ah
mov byte [ebp - 6], 0
mov dh, dl
mov byte [ebp - 6], 0
xor dl, al
xor bl, al
xor ah, al
mov byte [ebp - 0xd], dl
xor dh, al
mov byte [ebp - 0xb], ah
xor bh, al
mov byte [ebp - 0xc], bl
mov cl, 0x42
mov byte [ebp - 9], dh
xor cl, al
mov byte [ebp - 8], bh
mov ch, 0x18
mov byte [ebp - 0xe], cl
xor ch, al
mov al, byte [ebp - 1]
xor al, byte [ebp - 0x10]
mov byte [ebp - 7], al
lea eax, [ebp - 0xf]
push edi
push eax
mov byte [ebp - 0xa], ch
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
je 0x10023533
movaps xmm0, xmmword [0x100afa10]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x7d675b61
mov dword [ebp - 0x14], 0x6b6e6a
nop word [eax + eax]
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0x16
jb 0x100234f0
lea eax, [ebp - 0x27]
mov byte [ebp - 0x11], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10023533
test esi, esi
jne 0x1002351e
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push 0
push 0
push 0x11
push esi
call edi
test eax, eax
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10023540
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1002357e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10023582
cmp edx, esi
jne 0x10023567
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x100235a2
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100235a6
cmp edx, esi
jne 0x1002358b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x100235c6
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100235ca
cmp edx, esi
jne 0x100235af
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100261b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009dfed
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
push edi
mov eax, dword [0x100b7040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [0x100bab24], eax
test edx, edx
je 0x10026368
cmp dword [ebp + 0xc], 1
jne 0x10026368
mov eax, dword [esi + 4]
test eax, eax
je 0x10026353
cmp edx, eax
jne 0x10026353
cmp byte [0x100baa72], 0
sete al
xor ecx, ecx
mov byte [0x100baa72], al
test al, al
je 0x10026246
movaps xmm0, xmmword [0x100af6d0]
movups xmmword [ebp - 0x40], xmm0
mov word [ebp - 0x30], 0x4c
nop
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x10
jb 0x10026230
mov byte [ebp - 0x2f], 0
lea edx, [ebp - 0x3f]
jmp 0x10026269
movaps xmm0, xmmword [0x100af1e0]
movups xmmword [ebp - 0x54], xmm0
mov byte [ebp - 0x44], 0
mov al, byte [ebp - 0x54]
xor byte [ebp + ecx - 0x53], al
inc ecx
cmp ecx, 0xf
jb 0x10026255
mov byte [ebp - 0x44], 0
lea edx, [ebp - 0x53]
mov ecx, edx
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10026283
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.10002540
mov dword [ebp - 4], 0
mov eax, dword [esi]
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10026324
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10026324
cmp dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x2c]
cmova ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100262c3
sub ecx, edx
mov dword [ebp - 0x10], ecx
lea esi, [ecx + 0x21]
push esi
call fcn.1007fa59
push esi
mov edi, eax
push 0
push edi
call fcn.10081b50
cmp dword [ebp - 0x18], 0xf
lea edx, [ebp - 0x2c]
push dword [ebp - 0x10]
cmova edx, dword [ebp - 0x2c]
lea esi, [edi + 0x20]
push edx
push esi
call fcn.100815d0
mov eax, dword [ebp - 0x10]
add esp, 0x1c
mov ecx, dword [ebp - 0x14]
mov dword [edi + 4], esi
mov dword [edi + 0x14], eax
push edi
mov dword [edi + 0x18], 0x1f
call dword [0x100ae5a8]
push edi
call fcn.1007fa54
mov esi, dword [ebp - 0x2c]
add esp, 4
mov eax, dword [ebp - 0x18]
cmp eax, 0xf
jbe 0x10026353
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x10026349
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002637d
push ecx
push esi
call fcn.1007fa46
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.10084bdf
int3
Function at 0x10026640
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009e01d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100b7040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
or eax, 0xffffffff
mov dword [ebp - 0x14], 0
mov dword [edi + 0x38], eax
lea ecx, [ebp - 0x34]
mov word [edi + 0x3c], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
movq qword [ebp - 0x1c], xmm0
sub eax, ecx
mov dword [edi + 0x14], 0
mov dword [ebp - 0x20], eax
sar eax, 2
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], 0
mov dword [ebp - 0x34], 0x350
mov dword [ebp - 0x30], 0x140
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], eax
test eax, eax
je 0x10026747
push eax
lea ecx, [ebp - 0x1c]
call fcn.100245f0
push dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
push eax
push esi
call fcn.100815d0
mov eax, dword [ebp - 0x24]
add esp, 0xc
lea eax, [esi + eax*4]
mov dword [ebp - 0x18], eax
sub esp, 0xc
mov dword [ebp - 4], 0
mov esi, esp
mov dword [ebp - 0x24], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
sar eax, 2
test eax, eax
je 0x100267a3
push eax
mov ecx, esi
call fcn.100245f0
mov edi, dword [esi]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sub esi, eax
push esi
push eax
push edi
call fcn.100815d0
mov ecx, dword [ebp - 0x24]
add esp, 0xc
sar esi, 2
lea eax, [edi + esi*4]
mov edi, dword [ebp - 0x28]
mov dword [ecx + 4], eax
mov ecx, 0xd78d54
call fcn.100184e0
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add esp, 0xc
mov dword [edi], eax
push 4
push 0x4de1e6
call esi
test eax, eax
jne 0x100267d4
mov edx, 0x100290d0
mov ecx, 0x4de1e6
call fcn.1001d3e0
mov eax, dword [edi]
test eax, eax
je 0x1002683c
push 4
push eax
call esi
test eax, eax
jne 0x1002683c
mov ecx, edi
call fcn.10026870
cmp dword [0x100bab34], 0
jne 0x10026842
mov eax, dword [edi]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1002681e
push 4
push eax
call esi
test eax, eax
jne 0x1002681e
mov eax, dword [ebp - 0x20]
push 4
add eax, 0x64
push eax
call esi
test eax, eax
jne 0x1002681e
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
add esi, 0x64
jmp 0x10026820
xor esi, esi
mov eax, dword [esi]
push 4
push eax
mov dword [0x100bab34], eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10026842
mov dword [esi], 0x10029100
jmp 0x10026842
mov dword [edi], 0
lea ecx, [ebp - 0x1c]
call fcn.1000d920
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f9e5
mov esp, ebp
pop ebp
ret
Function at 0x10036320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
movaps xmm0, xmmword [0x100aef80]
push esi
mov esi, ecx
mov dword [esp + 0x18], 0x218340e
push edi
mov dword [esp + 8], esi
xor ecx, ecx
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x20], 0x1f0a1e1f
mov dword [esp + 0x24], 0x50402
mov al, byte [esp + 0xc]
xor byte [esp + ecx + 0xd], al
inc ecx
cmp ecx, 0x1a
jb 0x10036357
xorps xmm0, xmm0
mov byte [esp + 0x27], 0
lea ecx, [esp + 0xd]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
lea edx, [ecx + 1]
mov dword [esp + 0x44], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10036390
sub ecx, edx
lea eax, [esp + 0xd]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002540
cmp dword [esp + 0x40], 0
mov edi, dword [esi]
mov dword [esp + 0x28], edi
je 0x1003642c
test edi, edi
je 0x1003642c
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1003642c
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x2c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x10036428
cmp esi, dword [edi + 0xc4]
jne 0x100363e3
call fcn.10084bcf
mov edi, dword [esi + 8]
test edi, edi
je 0x1003640f
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x100363f5
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1003645b
mov edi, dword [esp + 0x28]
cmp esi, dword [edi + 0xc4]
jne 0x10036420
call fcn.10084bcf
mov esi, dword [esi]
cmp esi, dword [esp + 0x2c]
jne 0x100363d6
mov esi, dword [esp + 8]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 4], edi
cmp ecx, 0xf
jbe 0x1003646b
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10036461
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003648e
jmp 0x10036461
mov esi, dword [esp + 8]
jmp 0x1003642e
push ecx
push edx
call fcn.1007fa46
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x10036488
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10036488
push 0x14
mov ecx, esi
call dword [0x100ae558]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10084bdf
int3
Function at 0x1003b9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
movaps xmm0, xmmword [0x100ae9d0]
xor edx, edx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], edi
movups xmmword [esp + 0x20], xmm0
nop
mov al, byte [esp + 0x20]
xor byte [esp + edx + 0x21], al
inc edx
cmp edx, 0xe
jb 0x1003b9e0
xorps xmm0, xmm0
mov byte [esp + 0x2f], 0
lea ecx, [esp + 0x21]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
lea edx, [ecx + 1]
mov dword [esp + 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003ba12
sub ecx, edx
lea eax, [esp + 0x21]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002540
cmp dword [esp + 0x40], 0
mov edi, dword [edi]
mov dword [esp + 0x14], edi
je 0x1003baaa
test edi, edi
je 0x1003baaa
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1003baaa
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x18], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1003baaa
cmp esi, dword [edi + 0xc4]
jne 0x1003ba65
call fcn.10084bcf
mov edi, dword [esi + 8]
test edi, edi
je 0x1003ba91
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1003ba77
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1003baac
mov edi, dword [esp + 0x14]
cmp esi, dword [edi + 0xc4]
jne 0x1003baa2
call fcn.10084bcf
mov esi, dword [esi]
cmp esi, dword [esp + 0x18]
jne 0x1003ba58
xor edi, edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [eax + 4], edi
cmp ecx, 0xf
jbe 0x1003bae5
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003badb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003baeb
push ecx
push edx
call fcn.1007fa46
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10084bdf
int3