joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100236a3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100565ae
call fcn.1005557c
sub esp, 0x18
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
je 0x10023724
mov dword [ebp - 0x14], 0x16b2
cmp dword [ebp - 0x14], 0x10ac
jge 0x100236fb
lea eax, [ebp - 0x18]
mov ecx, 0x1006f7a8
push eax
call fcn.1001e0ee
mov esi, dword [ebp - 0x18]
inc esi
mov ecx, esi
call fcn.1002364c
test al, al
je 0x100236e2
push esi
call fcn.1001e24b
push eax
call fcn.10007349
pop ecx
mov eax, dword [ebp + 0x24]
mov edx, dword [eax]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
cmp eax, dword [ecx + edx*4]
jle 0x1002382b
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
jmp 0x1002382b
mov edi, dword [ebp + 8]
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 2
mov ecx, dword [edi + 4]
sub ecx, dword [edi]
sar ecx, 2
cmp eax, ecx
jbe 0x10023800
mov dword [ebp - 0x14], 0x5490
cmp dword [ebp - 0x14], 0x5728
jle 0x10023789
xor ebx, ebx
xor edi, edi
xor esi, esi
mov eax, esi
mov ecx, 0x1006f688
xor eax, edi
xor eax, ebx
cdq
push edx
push eax
call fcn.10002383
inc esi
cmp esi, 0x725d
jl 0x10023755
inc edi
cmp edi, 0x7567
jl 0x10023753
inc ebx
cmp ebx, 0x4b00
jl 0x10023751
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 4]
sub eax, dword [esi]
mov esi, dword [ebp + 0x18]
and dword [ebp - 4], 0
sar eax, 2
cmp dword [ebp - 0x14], 0x5397
mov dword [esi], eax
jge 0x100237d4
mov edx, str.lgceni_gsjx_ufrxqtxw_syyn_tgvlxf_zpfqttz_zucaagx_echnvdod_uzoljxkq_dlqfyx_dufazqan
mov ecx, 0x1006f688
call fcn.10003d52
jmp 0x100237d4
or dword [ebp - 4], 0xffffffff
mov eax, dword [edi + 4]
sub eax, dword [edi]
mov ebx, dword [ebp + 0x10]
sar eax, 2
mov dword [ebx], eax
jmp 0x100237fa
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
call fcn.10025207
inc dword [ebx]
mov eax, dword [ebx]
cmp eax, dword [esi]
jl 0x100237e7
jmp 0x1002382b
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x10]
mov dword [ebx], ecx
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 2
mov dword [edi], eax
jmp 0x10023827
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.10025207
inc dword [edi]
mov eax, dword [edi]
cmp eax, dword [ebx]
jl 0x10023814
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023bd5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
cmp byte [ebp + 0x18], 0
push ebx
push esi
mov ebx, ecx
mov byte [esp + 0xc], dl
push edi
mov dword [esp + 0x24], ebx
je 0x10023ccb
test dl, dl
je 0x10023cc0
mov dword [esp + 0x20], 0x2d6a
cmp dword [esp + 0x20], 0x2fd3
jle 0x10023c9c
xor esi, esi
mov dword [esp + 0x1c], esi
xor ebx, ebx
mov dword [esp + 0x18], 0x6d8a
mov dword [esp + 0x14], ebx
xor edi, edi
lea esi, [ebx + edi]
mov ebx, 0x2748
mov eax, esi
lea ecx, [esp + 0x28]
cdq
push edx
push eax
call fcn.100042e3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10023c49
mov eax, dword [eax]
push eax
call fcn.10039f30
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.10002764
inc esi
dec ebx
jne 0x10023c31
mov ebx, dword [esp + 0x14]
inc edi
cmp edi, 0x21fe
jl 0x10023c29
mov esi, dword [esp + 0x1c]
add ebx, esi
dec dword [esp + 0x18]
mov dword [esp + 0x14], ebx
jne 0x10023c27
inc esi
mov dword [esp + 0x1c], esi
cmp esi, 0xe9
jl 0x10023c19
push 0x26ac
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, dword [esp + 0x24]
cmp dword [esp + 0x20], 0x2be2
jge 0x10023cb1
push str.cmnjgwo_asvxos_mui_sbukqumvo_gkmjrqz_lgfaxkaxi_oqkvmayxm_cqlu_axepajih
call fcn.10039f30
pop ecx
movzx eax, word [ebx]
push eax
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.10020df9
jmp 0x10023ce8
mov eax, dword [ebp + 8]
mov dword [eax], 0x9febb674
jmp 0x10023ce8
cmp byte [ebp + 0xc], 0
je 0x10023cd9
mov eax, dword [ebp + 0x10]
or dword [eax], 0xffffffff
jmp 0x10023ce8
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024cad
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005669b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push esi
push ecx
mov edx, 0x3d70
lea ecx, [esp + 0x40]
call fcn.10020de0
pop ecx
xor esi, esi
lea ecx, [esp + 0x6c]
push eax
mov dword [esp + 0x98], esi
call fcn.100259e9
xor ebx, ebx
mov byte [esp + 0x94], 2
push esi
inc ebx
lea ecx, [esp + 0x40]
push ebx
call fcn.10006c15
push ecx
push ebx
lea eax, [esp + 0x74]
push eax
push 0x43c3
push ecx
push ecx
call fcn.100249c6
add esp, 0x14
lea ecx, [esp + 0x28]
mov edx, 0x3c73
call fcn.10020de0
mov edx, 0x3c74
mov byte [esp + 0x98], 3
lea ecx, [esp + 0x40]
call fcn.10020de0
pop ecx
mov edx, eax
mov byte [esp + 0x94], 4
lea ecx, [esp + 0x18]
call fcn.10022121
push esi
push ebx
lea ecx, [esp + 0x44]
mov byte [esp + 0x9c], 6
call fcn.10006c15
push ecx
mov edx, 0x3c75
lea ecx, [esp + 0x58]
call fcn.10020de0
pop ecx
mov edx, eax
mov byte [esp + 0x94], 7
lea ecx, [esp + 0xc]
call fcn.10022121
push esi
push ebx
lea ecx, [esp + 0x5c]
mov byte [esp + 0x9c], 9
call fcn.10006c15
push ecx
lea eax, [esp + 0x10]
mov dl, bl
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x30]
push eax
push ecx
mov ecx, 0x6de9
call fcn.10024bb6
add esp, 0x14
lea ecx, [esp + 0xc]
call fcn.10025504
lea ecx, [esp + 0x18]
call fcn.10025504
push esi
push ebx
lea ecx, [esp + 0x2c]
call fcn.10006c15
or dword [esp + 0x94], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.10027455
mov ecx, dword [esp + 0x8c]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029c88
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100567b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10029dd2
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10029db6
mov dword [ebp - 0x20], 0xf90
mov dword [ebp - 0x28], str.zjz_ollfcw_uwlo_hack_agnpd_gjm
cmp dword [ebp - 0x20], 0x1080
jle 0x10029d4c
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and dword [ebp - 0x18], 0
jmp 0x10029cf6
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x774e
jge 0x10029d36
and dword [ebp - 0x1c], 0
jmp 0x10029d0c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x704b
jge 0x10029d34
mov eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
mov ecx, 0x1006f688
call fcn.10002383
jmp 0x10029d05
jmp 0x10029cef
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0xc04
push 0x30d
push 0x2453
push 0xe45
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xc80
jge 0x10029d8e
mov edx, dword [ebp - 0x28]
mov ecx, 0x1006f688
call fcn.10003d52
jmp 0x10029daa
or dword [ebp - 4], 0xffffffff
jmp 0x10029db4
jmp 0x10029dd0
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10029dd0
push 0x2630
push 0
call fcn.10029eb4
pop ecx
pop ecx
jmp 0x10029dea
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push 0x41c9
push dword [ebp - 0x2c]
push 0
call fcn.10029fad
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002a67b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002a6b1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x69ad
push 0x3b0c
push 0x3032
push dword [ebp - 4]
push 0x42fc
push 0
call fcn.1002d2a0
add esp, 0x18
jmp 0x1002a6d9
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002a6cd
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1002a6d9
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
mov esp, ebp
pop ebp
ret
Function at 0x1002a868
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100567c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002a9a9
mov dword [ebp - 0x1c], 0x189a
mov dword [ebp - 0x24], str.cftiq_wxa_shchbc_kqftr_fwqkaa
cmp dword [ebp - 0x1c], 0x19d8
jle 0x1002a914
and dword [ebp - 0x14], 0
jmp 0x1002a8ba
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfb7
jge 0x1002a914
and dword [ebp - 0x18], 0
jmp 0x1002a8d0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3478
jge 0x1002a912
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.100042e3
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call fcn.10002363
push eax
call fcn.10039f30
pop ecx
lea ecx, [ebp - 0x64]
call fcn.10002359
jmp 0x1002a8c9
jmp 0x1002a8b3
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x155c
jge 0x1002a930
push dword [ebp - 0x24]
call fcn.10039f30
pop ecx
jmp 0x1002a94c
or dword [ebp - 4], 0xffffffff
jmp 0x1002a956
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1002a995
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1002a993
push 0x933
push 0
push 1
call fcn.1002a67b
add esp, 0xc
jmp 0x1002a9a7
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
and dword [eax], 0
jmp 0x1002a9d2
lea eax, [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x1002a9ca
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x1002a9d2
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001740
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1009a078]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1008e3a0]
push ebx
xor ebx, ebx
movups xmmword [ebp - 0x28], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0xe
jb 0x10001760
mov byte [ebp - 0x19], bl
mov cl, 4
mov dword [ebp - 0x18], 0x56414f04
mov eax, ebx
mov dword [ebp - 0x14], 0x3748414a
mov dword [ebp - 0x10], 0x68602a36
mov word [ebp - 0xc], 0x68
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x1000179e
mov cl, byte [ebp - 0x18]
jmp 0x1000178f
lea eax, [ebp - 0x27]
mov byte [ebp - 0xb], bl
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop ebx
call fcn.100454d5
mov esp, ebp
pop ebp
ret

Function at 0x10001889
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10092718
push 0x100600b0
mov eax, dword fs:[0]
push eax
push ecx
push ecx
sub esp, 0x38
mov eax, dword [0x1009a078]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
and dword [ebp - 0x50], 0
and dword [ebp - 0x48], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
and dword [ebp - 0x20], 0
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
push dword [ebp - 0x44]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001907
xor al, al
jmp 0x10001987
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov byte [eax], 0xc3
lea eax, [ebp - 0x20]
push eax
push 0x140
push dword [ebp - 0x44]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001930
xor al, al
jmp 0x10001987
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001975
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100454d5
mov esp, ebp
pop ebp
ret
Function at 0x10002227
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1009a078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], 0x52425836
mov cl, 0x36
mov dword [ebp - 0x10], 0x52185a5a
mov word [ebp - 0xc], 0x5a5a
mov eax, ebx
mov byte [ebp - 0xa], bl
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 9
jae 0x10002264
mov cl, byte [ebp - 0x14]
jmp 0x10002255
lea eax, [ebp - 0x13]
mov byte [ebp - 0xa], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movaps xmm0, xmmword [0x1008ea10]
mov edx, eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x3208000c
mov ecx, ebx
mov word [ebp - 0x18], 0x38
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x14
jb 0x1000228d
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x17], bl
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ecx
mov edx, 0x10001f99
mov ecx, eax
call fcn.10040a09
pop ecx
lea ecx, [ebp - 8]
mov dword [0x1009e6e8], eax
push ecx
push 0x40
push 5
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100454d5
mov esp, ebp
pop ebp
ret

Function at 0x10002340
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1009a078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x1000
push eax
push 0x40
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
push 0x250000
call dword [sym.imp.MPR.dll_WNetGetProviderNameA]
test eax, eax
jne 0x100023d3
movaps xmm0, xmmword [0x1008e890]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x2c4a0e0f
mov dword [ebp - 0x10], 0xf0e0605
mov word [ebp - 0xc], 0x1918
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x19
jb 0x1000239c
lea eax, [ebp - 0x23]
mov byte [ebp - 0xa], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100023d3
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100454d5
mov esp, ebp
pop ebp
ret
Function at 0x1000248a
Capabilities:
Encode data using xor

Disassembly:
push 0xcc
mov eax, 0x10075abe
call fcn.1004605f
mov edi, ecx
mov dword [ebp - 0xc4], edi
and dword [ebp - 0xc8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x98
mov ebx, eax
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.1005ddd0
pop ecx
lea ecx, [ebp - 0xa8]
call fcn.10005b8d
xor edx, edx
mov cl, 0x75
mov dword [ebp - 4], edx
mov al, 0x28
movaps xmm0, xmmword [0x1008ec80]
xor al, cl
mov byte [ebp - 0xac], cl
mov ecx, edx
mov byte [ebp - 0xab], al
mov byte [ebp - 0xaa], dl
movups xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0xb0], 0x17a2e
mov al, byte [ebp - 0xc0]
xor byte [ebp + ecx - 0xbf], al
inc ecx
cmp ecx, 0x12
jb 0x10002506
mov byte [ebp - 0xad], dl
lea ecx, [ebp - 0xa8]
lea edx, [ebp - 0xbf]
call fcn.100041b3
mov esi, eax
test esi, esi
je 0x1000253d
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
or dword [eax + 0x14], 4
test esi, esi
jne 0x10002549
xor ecx, ecx
jmp 0x10002550
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [ecx + 0x14]
and eax, 0xfffff9ff
or eax, 0x800
push 0
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0xd8]
push 8
push eax
call fcn.10041481
add esp, 0xc
mov edx, eax
mov ecx, esi
call fcn.10003f7e
mov ecx, eax
push ebx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov byte [eax + ecx + 0x40], 0x30
call fcn.10002954
lea edx, [ebp - 0xab]
mov ecx, eax
call fcn.100041b3
push edi
lea ecx, [ebp - 0xa8]
call fcn.10003f62
lea ecx, [ebp - 0xa8]
call fcn.10004390
mov eax, edi
call fcn.10046009
ret
Function at 0x100027bb
Capabilities:
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
push 0x174
mov eax, 0x10075aee
call fcn.1004605f
push 0
push 2
xor bl, bl
mov dword [ebp - 0x16c], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x16c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x100028b6
lea eax, [ebp - 0x16c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x100028b6
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x44]
call fcn.10001f6a
movaps xmm0, xmmword [0x1008eef0]
xor ecx, ecx
movups xmmword [ebp - 0x180], xmm0
mov word [ebp - 0x170], 0x55
mov al, byte [ebp - 0x180]
xor byte [ebp + ecx - 0x17f], al
inc ecx
cmp ecx, 0x10
jb 0x10002838
lea eax, [ebp - 0x17f]
mov byte [ebp - 0x16f], 0
push eax
call fcn.10001f4d
pop ecx
push eax
push ecx
lea eax, [ebp - 0x17f]
push eax
lea ecx, [ebp - 0x44]
call fcn.10003e2a
cmp eax, 0xffffffff
je 0x10002877
inc bl
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.10001e1f
lea eax, [ebp - 0x16c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x10002810
cmp bl, 3
jbe 0x100028b6
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x2c]
call fcn.1000248a
xor ebx, ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x1c]
cmovae ecx, dword [ebp - 0x2c]
inc eax
push eax
push ecx
push 0xaf7b50
call fcn.1005e370
add esp, 0xc
call fcn.1000e18f
call fcn.10012e55
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push ebx
push ebx
push ebx
push 0x100025ba
push ebx
push ebx
mov dword [0x1009e6f8], eax
mov dword [0x1009e6fc], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001e1f
call fcn.10046009
ret
Function at 0x10005c14
Capabilities:
Create process on windows

Disassembly:
push 0x44
mov eax, 0x10075fe4
call fcn.1004605f
mov edi, ecx
call fcn.1000678f
movzx eax, al
sub eax, 0xa3
je 0x10005dea
sub eax, 3
je 0x10005de1
sub eax, 4
jne 0x10005e50
and dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], al
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.100066b6
mov ecx, 0x3e8
movzx eax, ax
cmp ax, cx
cmova eax, ecx
xor ecx, ecx
cmp cx, ax
jae 0x10005ddd
movzx eax, ax
mov dword [ebp - 0x48], eax
mov ecx, edi
call fcn.100066b6
movzx eax, ax
mov ecx, edi
mov dword [ebp - 0x38], eax
call fcn.1000678f
mov bl, al
mov ecx, edi
lea eax, [ebp - 0x2c]
push eax
call fcn.100066dc
mov esi, eax
mov ecx, esi
call fcn.1000678f
mov ecx, esi
mov byte [ebp - 0x44], al
call fcn.1000678f
mov ecx, esi
mov byte [ebp - 0x40], al
call fcn.1000678f
mov esi, dword [ebp - 0x38]
mov byte [ebp - 0x3c], al
cmp bl, 1
jne 0x10005d73
movzx eax, si
mov edx, eax
mov dword [ebp - 0x38], eax
call fcn.10005ec4
test eax, eax
jne 0x10005dd3
push 0x1c
call fcn.100454e6
mov esi, eax
pop ecx
mov dword [ebp - 0x50], esi
push dword [ebp - 0x3c]
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push dword [ebp - 0x40]
push dword [ebp - 0x44]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10004ca6
mov ecx, esi
call fcn.10006648
push 0x1c
mov ebx, eax
mov byte [ebp - 4], 1
call fcn.100454e6
mov esi, eax
pop ecx
mov dword [ebp - 0x4c], esi
push dword [ebp - 0x3c]
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push dword [ebp - 0x40]
push dword [ebp - 0x44]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10004ca6
mov ecx, esi
call fcn.10006648
mov edx, dword [ebp - 0x38]
push eax
mov byte [ebp - 4], 1
call fcn.10005f1a
test al, al
jne 0x10005dd3
test ebx, ebx
je 0x10005dd3
push 0
push 1
mov ecx, ebx
call fcn.10001e1f
push 0x1c
push ebx
call fcn.10045519
pop ecx
pop ecx
jmp 0x10005dd3
movzx ebx, si
mov edx, ebx
call fcn.10005ec4
test eax, eax
je 0x10005dd3
mov ecx, eax
call fcn.1000662a
mov edx, ebx
mov ecx, 0x1009ec1c
call fcn.10005e56
mov ecx, esi
call fcn.100178eb
mov esi, eax
test esi, esi
je 0x10005dd3
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10005dd3
cmp dword [esi + 0x760], eax
je 0x10005dd3
and dword [esi + 0x760], eax
mov ecx, dword [esi + 0x3a8]
test ecx, ecx
je 0x10005dd3
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [esi + 0x3a8], 0
sub dword [ebp - 0x48], 1
jne 0x10005c81
push 0
jmp 0x10005e46
mov ecx, edi
call fcn.10006962
jmp 0x10005e50
xor ebx, ebx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.100066dc
cmp dword [ebp - 0x18], 0x10
lea edx, [ebp - 0x2c]
mov cl, 0x77
mov dword [ebp - 0x34], 0x12071877
cmovae edx, dword [ebp - 0x2c]
mov eax, ebx
mov word [ebp - 0x30], 0x19
xor byte [ebp + eax - 0x33], cl
inc eax
cmp eax, 4
jae 0x10005e32
mov cl, byte [ebp - 0x34]
jmp 0x10005e23
push 1
push ebx
push ebx
push edx
lea eax, [ebp - 0x33]
mov byte [ebp - 0x2f], bl
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001e1f
call fcn.10046009
ret