joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100014c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xc
push 0x1004ed98
call fcn.1003d350
and dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 2]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
jmp 0x10001501
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10001511
Capabilities:
Check for debugger via api
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10054040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
call fcn.100014c0
test eax, eax
jne 0x100015e1
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 8], ebx
jne 0x100015e1
movaps xmm0, xmmword [0x1004d5c0]
mov ecx, ebx
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x417f7e78
mov dword [ebp - 0x20], 0x74727e63
mov word [ebp - 0x1c], 0x6262
mov byte [ebp - 0x1a], bl
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x19
jb 0x10001575
mov byte [ebp - 0x1a], bl
mov cl, 0x4b
mov dword [ebp - 0x18], 0x2f3f254b
mov eax, ebx
mov dword [ebp - 0x14], 0x2f652727
mov word [ebp - 0x10], 0x2727
mov byte [ebp - 0xe], bl
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 9
jae 0x100015af
mov cl, byte [ebp - 0x18]
jmp 0x100015a0
lea eax, [ebp - 0x17]
mov byte [ebp - 0xe], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x33]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100015e9
push ebx
push 4
lea ecx, [ebp - 0xc]
push ecx
push 7
push 0xffffffffffffffff
call eax
test eax, eax
je 0x100015e9
cmp dword [ebp - 0xc], ebx
je 0x100015e9
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1003c3f4
leave
ret

Function at 0x100015f6
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x1004cd80]
xor edx, edx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x302a0620
mov ecx, edx
mov dword [ebp - 0x18], 0x3720312b
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x17
jb 0x1000161c
mov byte [ebp - 0x14], dl
mov cl, 0x52
mov dword [ebp - 0x10], 0x20373952
mov eax, edx
mov dword [ebp - 0xc], 0x613e373c
mov dword [ebp - 8], 0x3e367c60
mov word [ebp - 4], 0x3e
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x1000165a
mov cl, byte [ebp - 0x10]
jmp 0x1000164b
lea eax, [ebp - 0xf]
mov byte [ebp - 3], dl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2b]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000d264
cmp al, 0xe9
jne 0x10001685
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
leave
ret
Function at 0x10001687
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
mov dword [ebp - 0x10], 0x4a4e5327
mov cl, 0x27
mov dword [ebp - 0xc], 0x53426042
mov dword [ebp - 8], 0x424a4e73
mov eax, edx
mov byte [ebp - 4], dl
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xb
jae 0x100016ba
mov cl, byte [ebp - 0x10]
jmp 0x100016ab
mov byte [ebp - 4], dl
mov cl, 9
mov dword [ebp - 0x20], 0x7b6c6209
mov eax, edx
mov dword [ebp - 0x1c], 0x3a656c67
mov dword [ebp - 0x18], 0x656d273b
mov word [ebp - 0x14], 0x65
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x100016eb
mov cl, byte [ebp - 0x20]
jmp 0x100016dc
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x13], dl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0xf]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000d264
cmp al, 0xe9
jne 0x10001716
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
leave
ret

Function at 0x10001718
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
mov dword [ebp - 0x20], 0x67765413
mov cl, 0x13
mov dword [ebp - 0x1c], 0x78707a47
mov dword [ebp - 0x18], 0x7d667c50
mov eax, edx
mov word [ebp - 0x14], 0x67
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x1000174e
mov cl, byte [ebp - 0x20]
jmp 0x1000173f
mov byte [ebp - 0x13], dl
mov cl, 0x24
mov dword [ebp - 0x10], 0x56414f24
mov eax, edx
mov dword [ebp - 0xc], 0x1748414a
mov dword [ebp - 8], 0x48400a16
mov word [ebp - 4], 0x48
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x1000177f
mov cl, byte [ebp - 0x10]
jmp 0x10001770
lea eax, [ebp - 0xf]
mov byte [ebp - 3], dl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x1f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000d264
cmp al, 0xe9
jne 0x100017aa
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
leave
ret
Function at 0x100017ac
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10054040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str._MZKZoMPZLL]
push ebx
xor ebx, ebx
movups xmmword [ebp - 0x28], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0xe
jb 0x100017cc
mov byte [ebp - 0x19], bl
mov cl, 5
mov dword [ebp - 0x18], 0x57404e05
mov eax, ebx
mov dword [ebp - 0x14], 0x3649404b
mov dword [ebp - 0x10], 0x69612b37
mov word [ebp - 0xc], 0x69
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x1000180a
mov cl, byte [ebp - 0x18]
jmp 0x100017fb
lea eax, [ebp - 0x17]
mov byte [ebp - 0xb], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x27]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop ebx
call fcn.1003c3f4
leave
ret

Function at 0x100018d5
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1004edb8
push 0x1003c3c5
mov eax, dword fs:[0]
push eax
push ecx
push ecx
sub esp, 0x38
mov eax, dword [0x10054040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
and dword [ebp - 0x50], 0
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
and dword [ebp - 0x20], 0
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
push dword [ebp - 0x44]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1000194f
xor al, al
jmp 0x100019cf
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov byte [eax], 0xc3
lea eax, [ebp - 0x20]
push eax
push 0x140
push dword [ebp - 0x44]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001978
xor al, al
jmp 0x100019cf
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x100019bd
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003c3f4
leave
ret
Function at 0x10001e9a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x1004cde0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x303e
mov byte [ebp - 2], 0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0x11
jb 0x10001eb7
lea eax, [ebp - 0x13]
mov byte [ebp - 2], 0
push eax
call fcn.10002204
cmp eax, 0xba2d38a3
jne 0x10001f09
movaps xmm0, xmmword [0x1004c820]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x10001ee5
lea eax, [ebp - 0x13]
mov byte [ebp - 5], 0
push eax
call fcn.10002204
cmp eax, 0x27b35bb1
sete al
leave
ret
xor al, al
leave
ret
Function at 0x10002152
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
push 0x3fc
xor esi, esi
push esi
push 0x10057464
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edi, 0x10057460
push 8
push esi
call fcn.100021cf
mov edx, eax
push 8
shl edx, 0x18
pop ebx
mov ecx, edx
lea eax, [edx + edx]
sar ecx, 0x1f
and ecx, 0x4c11db7
mov edx, ecx
xor edx, eax
sub ebx, 1
jne 0x1000217f
push 0x20
push edx
call fcn.100021cf
mov dword [edi], eax
inc esi
add edi, 4
cmp edi, 0x1005785c
jle 0x1000216f
pop edi
pop esi
pop ebx
call fcn.10001a38
test al, al
je 0x100021cc
call fcn.10001e9a
test al, al
je 0x100021cc
call fcn.10001f0e
test al, al
setne al
ret
xor al, al
ret

Function at 0x10002204
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x10054040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x408], 0
push esi
push 0x10042854
push eax
lea eax, [ebp - 0x408]
or esi, 0xffffffff
push eax
mov dword [ebp - 0x40c], esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x100022b7
cmp dword [ebp - 0x408], eax
je 0x100022b7
push ebx
push dword [ebp - 0x408]
mov ebx, 0x400
lea eax, [ebp - 0x404]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x100022a7
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.100022c8
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10002270
mov esi, dword [ebp - 0x40c]
push dword [ebp - 0x408]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
not esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1003c3f4
leave
ret 4

Function at 0x100022c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x100022f9
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebx]
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10057460]
inc edi
mov dword [ebx], edx
sub esi, 1
jne 0x100022db
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x10002f1d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x14
mov eax, 0x1003dbcd
call fcn.1003d7ae
mov esi, ecx
xor ebx, ebx
inc ebx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x10042857
call fcn.10003d9a
xor edx, edx
mov dword [ebp - 4], edx
mov al, byte [esi + 2]
mov dword [ebp - 0x10], ebx
cmp al, 0xff
je 0x1000307e
cmp al, bl
jne 0x10002f83
mov cl, 0x43
mov dword [ebp - 0x1c], 0x6e727343
mov dword [ebp - 0x18], 0x272f2c24
mov eax, edx
mov byte [ebp - 0x14], dl
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 7
jae 0x10002f7b
mov cl, byte [ebp - 0x1c]
jmp 0x10002f6c
lea eax, [ebp - 0x1b]
jmp 0x10003073
jle 0x1000307e
cmp al, 5
jge 0x10002fc2
mov cl, 0x32
mov dword [ebp - 0x20], 0x1f000232
mov dword [ebp - 0x1c], 0x445e5b41
mov eax, edx
mov word [ebp - 0x18], 0x4057
mov byte [ebp - 0x16], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 9
jae 0x10002fb7
mov cl, byte [ebp - 0x20]
jmp 0x10002fa8
mov byte [ebp - 0x16], dl
lea eax, [ebp - 0x1f]
jmp 0x10003076
cmp al, 0xa
jge 0x10002ff0
mov cl, 0x11
mov dword [ebp - 0x20], 0x3c222111
mov dword [ebp - 0x1c], 0x7063787c
mov eax, edx
mov word [ebp - 0x18], 0x7476
mov byte [ebp - 0x16], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 9
jae 0x10002fb7
mov cl, byte [ebp - 0x20]
jmp 0x10002fe1
cmp al, 0x1a
jge 0x1000301e
mov cl, 0x5b
mov dword [ebp - 0x20], 0x766f6b5b
mov dword [ebp - 0x1c], 0x3f3a3328
mov eax, edx
mov word [ebp - 0x18], 0x2c34
mov byte [ebp - 0x16], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 9
jae 0x10002fb7
mov cl, byte [ebp - 0x20]
jmp 0x1000300f
cmp al, 0x65
mov byte [ebp - 0x14], dl
mov eax, edx
jge 0x1000304a
mov cl, 0x4a
mov dword [ebp - 0x1c], 0x677f7a4a
mov dword [ebp - 0x18], 0x3e392327
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 7
jae 0x10002f7b
mov cl, byte [ebp - 0x1c]
jmp 0x10003037
mov cl, 9
mov dword [ebp - 0x20], 0x243f3909
mov dword [ebp - 0x1c], 0x60687b7d
mov dword [ebp - 0x18], 0x6e676067
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xb
jae 0x10003070
mov cl, byte [ebp - 0x20]
jmp 0x10003061
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x14], dl
push eax
mov ecx, edi
call fcn.10003b4a
mov eax, edi
call fcn.1003d78b
ret 4
Function at 0x10003088
Capabilities:
Encode data using xor

Disassembly:
push 0x1c
mov eax, 0x1003dc43
call fcn.1003d7ae
mov esi, ecx
xor ebx, ebx
inc ebx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x10042857
call fcn.10003d9a
xor edx, edx
mov dword [ebp - 4], edx
mov al, byte [esi + 2]
mov dword [ebp - 0x10], ebx
cmp al, 0xff
je 0x100031d3
cmp al, bl
jne 0x100030ed
movaps xmm0, xmmword [0x1004cc50]
mov ecx, edx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x1018
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x11
jb 0x100030d8
lea eax, [ebp - 0x23]
jmp 0x100031c8
jle 0x100031d3
mov ecx, edx
cmp al, 5
jge 0x10003126
movaps xmm0, xmmword [0x1004d890]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x66716278
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x13
jb 0x1000310e
mov byte [ebp - 0x14], dl
lea eax, [ebp - 0x27]
jmp 0x100031cb
cmp al, 0xa
jge 0x1000314e
movaps xmm0, xmmword [0x1004d030]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x35373122
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x13
jb 0x1000313f
jmp 0x1000311b
cmp al, 0x1a
jge 0x10003176
movaps xmm0, xmmword [0x1004d430]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x48505b5e
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x13
jb 0x10003167
jmp 0x1000311b
mov byte [ebp - 0x12], dl
cmp al, 0x65
jge 0x100031a0
movaps xmm0, xmmword [0x1004d600]
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x7a7d
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x11
jb 0x1000318e
jmp 0x100030e5
movaps xmm0, xmmword [0x1004cee0]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x2a2d2a22
mov word [ebp - 0x14], 0x242d
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x15
jb 0x100031b8
lea eax, [ebp - 0x27]
mov byte [ebp - 0x12], dl
push eax
mov ecx, edi
call fcn.10003b4a
mov eax, edi
call fcn.1003d78b
ret 4
Function at 0x10004c91
Capabilities:
Create thread
Terminate process

Disassembly:
call fcn.10002152
test al, al
jne 0x10004d30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.100075ed
call fcn.1000767c
call fcn.10010d15
mov dword [0x10057954], eax
test eax, eax
je 0x10004cc5
mov ecx, eax
call fcn.10010e9b
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
xor edi, edi
push edi
push edi
push edi
push 0x10004910
push edi
push edi
mov dword [0x10057870], eax
mov dword [0x10057874], edx
mov dword [0x10057878], eax
mov dword [0x1005787c], edx
call esi
mov ebx, eax
test ebx, ebx
je 0x10004d30
push edi
push edi
push edi
push 0x10004ab2
push edi
push edi
call esi
mov edi, eax
test edi, edi
je 0x10004d30
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push ebx
call esi
push 0x64
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
pop edi
pop esi
pop ebx
ret
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x100075ed
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x10054040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
test eax, eax
jne 0x10007608
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000766d
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x28
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000766d
push ecx
mov ecx, dword [ebp - 8]
mov edx, str.SeSecurityPrivilege
call fcn.10007593
pop ecx
test al, al
je 0x1000766d
push ecx
mov ecx, dword [ebp - 8]
mov edx, str.SeDebugPrivilege
call fcn.10007593
pop ecx
test al, al
je 0x1000766d
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1000766f
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1003c3f4
leave
ret
Function at 0x1000767c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10054040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000772f
movaps xmm0, xmmword [0x1004cea0]
push ebx
xor ebx, ebx
mov word [ebp - 0x24], 0x2e
movups xmmword [ebp - 0x34], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x10
jb 0x100076c0
lea eax, [ebp - 0xc]
mov byte [ebp - 0x23], bl
push eax
lea eax, [ebp - 0x33]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x100076f0
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1000772e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
push ebx
push ebx
push 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10007723
xor ebx, ebx
inc ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c3f4
leave
ret
Function at 0x100088fa
Capabilities:
Encode data using xor

Disassembly:
push 0x16c
mov eax, 0x1003e709
call fcn.1003d7e1
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x178], esi
lea eax, [ebp - 0x157]
mov dword [ebp - 0x158], 1
xor ebx, ebx
mov word [ebp - 0x158], 0x3f
push eax
mov byte [ebp - 0x157], bl
call fcn.10003d9a
mov dword [ebp - 4], ebx
mov dword [ebp - 0x158], 1
test edi, edi
je 0x10008a32
movaps xmm0, xmmword [0x1004d290]
mov ecx, ebx
movups xmmword [ebp - 0x174], xmm0
mov dword [ebp - 0x164], 0x454d0d45
mov dword [ebp - 0x160], 0x28454004
mov dword [ebp - 0x15c], 0x2d455a
mov al, byte [ebp - 0x174]
xor byte [ebp + ecx - 0x173], al
inc ecx
cmp ecx, 0x1a
jb 0x10008983
lea eax, [ebp - 0x173]
mov byte [ebp - 0x159], bl
push eax
lea ecx, [ebp - 0x130]
call fcn.10003d9a
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x154]
mov dword [ebp - 0x118], edi
push eax
mov dword [ebp - 0x114], ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
cmp dword [ebp - 0x11c], 0xf
lea ecx, [ebp - 0x154]
push ecx
lea eax, [ebp - 0x130]
cmova eax, dword [ebp - 0x130]
push eax
lea eax, [ebp - 0x110]
push 0x100
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea ecx, [ebp - 0x110]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008a0f
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
mov ecx, esi
call fcn.10003b05
lea ecx, [ebp - 0x130]
call fcn.10003b98
mov eax, esi
call fcn.1003d79f
ret

Function at 0x1000ab3a
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x10054040]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x10], 0x128
push ebx
push 2
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x1000ab8e
cmp dword [esp + 0x18], edi
je 0x1000abb0
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1000ab7c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c3f4
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor ebx, ebx
test eax, eax
setne bl
test eax, eax
je 0x1000ab99
push eax
call esi
jmp 0x1000ab99

Function at 0x1000ac98
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x100540ec], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x100540ec], ecx
inc edx
cmp edx, esi
jb 0x1000acad
mov dword [0x100540e8], esi
pop esi
pop ebp
ret 8
Function at 0x1000acd3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x1000ad1b
lea edx, [esi + 8]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x1000ace3
jmp 0x1000ad28
cmp dword [esi], 0x4e0
jb 0x1000ad28
call fcn.1000ad62
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret

Function at 0x1000ad62
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
lea edi, [esi + 0x9c4]
mov esi, 0xe3
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ecx, eax
lea edi, [edx + 4]
mov ebx, dword [edi]
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x1000ad7b
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ecx, eax
lea edi, [edx + 4]
mov ebx, dword [edi]
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x1000adc5
mov esi, dword [ebp - 4]
pop edi
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
and dword [esi], 0
mov dword [esi + 0x9c0], eax
pop esi
pop ebx
leave
ret