joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4056a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x4056cc
jl 0x4056c0
test ecx, ecx
jne 0x4056cc
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4056e5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x405733
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x405739
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x405739
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x4057a6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x405762
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x405794
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x4057a6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x405770
test edi, edi
je 0x4057a6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x40d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x405b50
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407a22
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x405b8c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x405b8c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407a22
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x405c63
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x405bb4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x405bc0
movsx eax, bl
jmp 0x405bf8
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x405c22
sub eax, 1
je 0x405c22
sub eax, 2
jne 0x405c63
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407a22
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405c40
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x405c63
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407a22
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407a22
mov esp, ebp
pop ebp
ret 4
Function at 0x4061f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x40d040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4062ac
cmp byte [esi + 0x3d], 0
je 0x4062ac
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40629a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x406261
sub eax, 1
je 0x406265
sub eax, 2
jne 0x40629a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407a22
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x406283
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40629a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407a22
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407a22
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00407a22
mov esp, ebp
pop ebp
ret

Function at 0x4083cb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40840a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40840a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40840a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40840a
cmp dword [ecx + 0x74], 0xe
jbe 0x40840a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100464b9
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov byte [esi - 0x1f], cl
mov bh, 0xaa
div byte [edx + 0x4b34df56]
add ebp, dword [ecx]
xor ch, ah
invalid
Function at 0x10320674
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x311bb8
jmp 0x103204f6
cpuid
mov eax, ebx
lea eax, [esi*4]
jmp 0x103204be
jo 0x10320452
not edi
jmp 0x10320454
not edi
mov esi, dword [esp + 0x2c]
bsr bp, bp
jmp 0x10320478
lea eax, [esi*4]
jmp 0x103204be
jae 0x10320425
cpuid
mov eax, ebx
jmp 0x1032045e
jb 0x10320496
jae 0x10320496
and dword [ebp + reloc.WINMM.dll_waveOutUnprepareHeader], ebp
xor dword [esi + reloc.WINMM.dll_waveOutUnprepareHeader], edi
setbe byte [ecx]
rol byte [ebx - 0x3f137ec6], 0
add byte [eax], al
sub esp, 0xc0
mov ebp, esp
xchg al, ch
jmp 0x103204a6
or ebx, 0x70c08682
js 0x103204d1
jns 0x103204d1
jmp 0x391d1d2f
lea edi, [esp]
mov cx, word [esp]
mov ax, 0xecb0
mov eax, 0xff6688b4
inc eax
jmp 0x10320480
mov ebx, esi
mov ch, byte [esp]
bsf eax, esp
jmp 0x10320592
xchg cl, al
rdtsc
lea ecx, [edi*4]
mov dh, bh
bswap edx
jmp 0x1032051a
cpuid
lea esi, reloc.WINMM.dll_waveOutUnprepareHeader
clc
jmp 0x1032043b
rdtsc
mov eax, dword [esp]
jmp 0x10320544
mov dx, word [esp]
xor eax, ecx
je 0x10320504
rdtsc
jmp 0x1032055a
lea ecx, [edi*4]
mov dh, bh
bswap edx
jmp 0x1032051a
rol esi, 0
ja 0x10320575
xor eax, esi
jmp 0x1032055f
mov eax, dword [esp]
jmp 0x10320544
mov cl, dl
mov cl, bh
setle al
jmp 0x103205b6
xor eax, esi
mov cl, dl
mov cl, bh
setle al
bt cx, sp
mov edx, dword [esp]
setbe dl
jmp 0x1032059e
jns 0x103204df
xchg cl, al
rdtsc
jmp 0x10320537
sub esi, 0x3f142520
lea ecx, [esp + 0x5f]
mov cx, sp
bsf ax, cx
jmp 0x103205bc
bt cx, sp
jmp 0x10320582
jbe 0x103205d2
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
jmp 0x103205d8
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
inc esi
mov ecx, ebp
jmp 0x103205f8
lea esp, [esp + 0x20]
pushfd
jmp 0x10320270
sub esp, 0x18
jbe 0x10320648
lea edx, [ebx + ebp]
mov edx, ecx
clc
jmp 0x10320632
mov dword [esp + 0x1c], esi
push esi
pushfd
mov word [esp + 2], si
mov word [esp + 1], sp
mov dword [esp + 0x20], edi
jmp 0x103205ee
clc
call fcn.1032064f
jno 0x10320626
jge 0x1032063f
test dword [esi + 0x61], reloc.WINMM.dll_waveOutUnprepareHeader
insb byte es:[edi], dx
or eax, dword [esi]
mov cl, 0x4f
salc
inc ecx
ret
lea edx, [ebx + ebp]
mov edx, ecx
jmp 0x10320631
mov byte [esp], al
jmp 0x1032061b
Function at 0x103278f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x311bb8
jmp 0x1032799d
call 0x10327933
push word [esp + 3]
jmp 0x10327900
lea esp, [esp + 2]
mov dword [esp + 4], esp
push eax
jmp 0x1032791d
mov dword [esp], esi
mov byte [esp + 2], ah
mov dword [esp], esp
mov dword [esp + 4], ebp
jmp 0x10327951
mov dword [esp], esi
push edi
jmp 0x103279dc
inc bp
neg ax
jmp 0x103279b3
lea edx, reloc.WINMM.dll_waveOutUnprepareHeader
jmp 0x10327970
rcr ebx, cl
jae 0x10327986
lea edx, reloc.WINMM.dll_waveOutUnprepareHeader
inc bp
neg ax
jmp 0x103279b3
mov ebp, dword [esp + 0x2c]
btr ax, dx
jmp 0x103279f8
lea edx, [edx*4]
rdtsc
jmp 0x103279e2
pushfd
jmp 0x103262f1
lea esi, [esp]
push ebx
mov bh, dh
setp al
jmp 0x10327ad6
js 0x103279c1
lea edx, [edx*4]
rdtsc
jmp 0x103279e2
lea esp, [esp + 3]
push eax
call 0x1032796a
sbb ebx, ebx
mov cl, 0x29
call 0x10327a6b
xchg byte [edx + esi*4], bl
aad 0x24
xchg ebx, eax
invalid
sub esp, 0xbc
mov edi, esp
neg bx
jns 0x10327a3f
sbb ebx, ebx
mov cl, 0x29
call fcn.10327abe
and dword ss:[esi - 0x75], esp
sbb al, 0x24
dec ch
xchg dword [esp], esi
mov ch, byte [esp]
bswap ebx
xchg ecx, eax
jmp 0x10327b60
xchg dword [esp], esi
mov eax, dword [esp]
mov eax, 0xb6073d40
call 0x10327b3c
jle 0x10327af8
jo 0x10327b2f
loop 0x10327b70
mov dword [reloc.WINMM.dll_waveOutUnprepareHeader], eax
and al, 5
jmp 0x10327a19
push dword [esp + 8]
ret 0xc
xor al, 0x53
scasb al, byte es:[edi]
adc dword [edi - 0x25], esi
dec ebx
fstp qword cs:[esi + edi*4 - 0x77]
sub byte [esi - 0x137cdbe4], al
add eax, 0x124648d
jmp 0x10327b26
not bx
lea esi, [esi - 0xc9]
lea eax, [ecx*4]
mov bl, byte [esp]
mov ah, 0x9a
xchg bh, ch
jmp 0x10327b04

Function at 0x1032f265
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x10314b67
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x10314b81
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x10314b70
pop esi
jmp 0x10314b8c
ret 4
lea esp, [esp + 4]
jmp 0x10314b5a

Function at 0x1032f394
Capabilities:
Check for trap flag exception

Disassembly:
jmp 0x10315363
pushfd
or dword [esp], reloc.WINMM.dll_waveOutUnprepareHeader
popfd
rdtsc
nop
jmp 0x1031537a
ret
jmp 0x10315358

Function at 0x105164d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, sp
mov ecx, esi
mov cl, byte [esp]
rdtsc
mov ch, cl
xchg cx, ax
jmp 0x1051647a
lea esp, [esp + 9]
rdtsc
setns al
jmp 0x10516490

Function at 0x1051a30c
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x18], ebp
push ecx
pushal
lea esp, [esp + 0xd]
lea esp, [esp + 2]
jmp 0x1051a317
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x1051a2f6
lea esp, [esp + 0x12]
call fcn.1051a38d
Function at 0x1051a320
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
popfd
lea esp, [esp + 4]
call fcn.1051a291
call fcn.1051a27b
push ax
lea esp, [esp + 3]
mov dword [esp + 4], eax
mov dword [esp], ecx
push di
push word [esp]
jmp 0x1051a2b3
mov dx, word [esp + 1]
inc dx
mov dh, 0xdb
lea esp, [esp + 2]
mov edx, dword [esp + 0x20]
lea esp, [esp + 0x24]
jmp 0x1051a23b
lea esp, [esp + 2]
mov byte [esp], dl
lea esp, [esp + 2]
mov dword [esp + 0x18], esp
call fcn.1051a30c
jae 0x1051a31d
mov word [esp + 1], si
mov byte [esp], bl
pushal
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ebx
pushfd
jmp 0x1051a29d
mov word [esp + 1], dx
cmc
mov ecx, dword [esp + 4]
mov dx, word [esp]
sub esp, 0x1a
mov dx, 0xa10a
jmp 0x1051a264
add byte [eax], al
add byte [ecx - 0x14fcdbbc], cl
mov dword [esp + 3], eax
jmp 0x1051a35d
push ecx
rcl dword [ecx + 0x30], 0xc3
and edx, edx
inc edi
xlatb
mov dl, 0x41
cmpsb byte [esi], byte es:[edi]
jp 0x1051a389
les esi, [edi + 0x66]
mov edx, dword [esp]
bswap ecx
mov ch, 0xa3
lea esp, [esp + 1]
inc dl
pushfd
jmp 0x1051a2dc
invalid
invalid
invalid
push esp
Function at 0x10001990
Capabilities:
Check for debugger via api
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
call fcn.100018f0
test eax, eax
jne 0x10001a8f
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 8], 0
jne 0x10001a8f
movaps xmm0, xmmword [0x10019080]
xor eax, eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x3c020305
mov dword [ebp - 0x24], 0x90f031e
mov word [ebp - 0x20], 0x1f1f
mov byte [ebp - 0x1e], 0
mov cl, byte [ebp - 0x38]
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0x19
jb 0x100019f7
push ebx
mov byte [ebp - 0x1c], 0x10
mov al, 0x7e
xor al, byte [ebp - 0x1c]
mov bl, 0x7c
mov ah, bl
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x1c]
mov dl, 0x74
mov bh, ah
mov byte [ebp - 0xd], ah
xor bl, al
mov byte [ebp - 0x12], 0
xor ah, al
mov byte [ebp - 0x1e], 0
xor bh, al
mov byte [ebp - 0x17], ah
mov dh, dl
mov byte [ebp - 0x18], bl
xor dl, al
mov byte [ebp - 0x14], bh
xor dh, al
mov byte [ebp - 0x19], dl
mov cl, 0x64
mov byte [ebp - 0x15], dh
xor cl, al
mov byte [ebp - 0x12], 0
mov ch, 0x3e
mov byte [ebp - 0x1a], cl
xor ch, al
mov al, byte [ebp - 0xd]
xor al, byte [ebp - 0x1c]
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x37]
push eax
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x16], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ebx
test eax, eax
je 0x10001a97
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 7
push 0xffffffffffffffff
call eax
test eax, eax
je 0x10001a97
cmp dword [ebp - 0xc], 0
je 0x10001a97
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010e30
mov esp, ebp
pop ebp
ret

Function at 0x10001ab0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x10019060]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x100a2600
mov dword [ebp - 0x18], 0x1700110b
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x17
jb 0x10001ad5
mov byte [ebp - 0x14], 0
mov cl, 2
mov dword [ebp - 0x10], 0x70676902
xor eax, eax
mov dword [ebp - 0xc], 0x316e676c
mov dword [ebp - 8], 0x6e662c30
mov word [ebp - 4], 0x6e
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x10001b14
mov cl, byte [ebp - 0x10]
jmp 0x10001b05
lea eax, [ebp - 0x2b]
mov byte [ebp - 3], 0
push eax
lea eax, [ebp - 0xf]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10009690
cmp al, 0xe9
jne 0x10001b40
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10001c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str.9zKXMiKVZJJx]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
nop dword [eax]
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xe
jb 0x10001cb0
mov byte [ebp - 0x19], 0
mov cl, 0x50
mov dword [ebp - 0x18], 0x2151b50
xor eax, eax
mov dword [ebp - 0x14], 0x631c151e
mov dword [ebp - 0x10], 0x3c347e62
mov word [ebp - 0xc], 0x3c
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x10001cef
mov cl, byte [ebp - 0x18]
jmp 0x10001ce0
lea eax, [ebp - 0x27]
mov byte [ebp - 0xb], 0
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.10010e30
mov esp, ebp
pop ebp
ret

Function at 0x10001d40
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1001a2c0
push 0x10011cf7
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x1001d018]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001dd9
xor al, al
jmp 0x10001e62
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001e04
xor al, al
jmp 0x10001e62
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001e4f
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10010e30
mov esp, ebp
pop ebp
ret
Function at 0x10003850
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.100074c0
call fcn.100075a0
call fcn.1000c4a0
mov dword [0x1001efbc], eax
test eax, eax
je 0x1000387f
call fcn.1000c690
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x100034b0
push 0
push 0
mov dword [0x1001eee8], eax
mov dword [0x1001eeec], edx
mov dword [0x1001eef0], eax
mov dword [0x1001eef4], edx
call esi
mov ebx, eax
test ebx, ebx
jne 0x100038c0
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0
push 0
push 0
push 0x10003750
push 0
push 0
call esi
mov edi, eax
test edi, edi
jne 0x100038df
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push ebx
call esi
push 0xffffffffffffffff
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100074c0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push esi
push edi
test eax, eax
jne 0x100074de
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, 0xffffffff
je 0x10007581
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x28
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10007581
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
push str.SeSecurityPrivilege
push 0
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10007581
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10007581
push ecx
mov ecx, dword [ebp - 0x18]
mov edx, str.SeDebugPrivilege
call fcn.10007450
add esp, 4
test al, al
je 0x10007581
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010e30
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.10010e30
mov esp, ebp
pop ebp
ret
Function at 0x100075a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000760e
movaps xmm0, xmmword [0x10019130]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x24], 0x75
nop dword [eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x10
jb 0x100075e0
lea eax, [ebp - 0xc]
mov byte [ebp - 0x23], 0
push eax
lea eax, [ebp - 0x33]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x1000761e
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010e30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x20]
test eax, eax
je 0x10007608
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10010e30
mov esp, ebp
pop ebp
ret

Function at 0x10007d80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov edi, ecx
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10007ddc
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
cmp dword [ebp - 0x128], edi
je 0x10007df6
lea eax, [ebp - 0x130]
push eax
push esi
call ebx
test eax, eax
jne 0x10007dc6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010e30
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010e30
mov esp, ebp
pop ebp
ret