joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab500
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
mov eax, dword [0x100d6084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, byte [0x100db43f]
cmp bl, 0x41
je 0x1001c977
mov ecx, 0xd78dd4
xor bh, bh
call fcn.1001c540
mov ecx, eax
call fcn.10001f00
cmp ecx, eax
jne 0x1001c883
mov ecx, 0xd78dd4
call fcn.1001c540
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
je 0x1001c885
mov bh, 1
call fcn.10001f10
cmp dword [0x100db4a8], eax
mov edx, 1
movzx ecx, bh
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, eax
call fcn.10018f60
mov ecx, 0xd78dd4
mov esi, eax
call fcn.1001c540
cmp esi, eax
jne 0x1001c8e3
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, eax
call fcn.10018f60
mov ecx, dword [0x100db4b0]
mov esi, eax
call fcn.10018f60
cmp eax, esi
jne 0x1001c8e3
cmp byte [ebp - 0x14], 0
je 0x1001c977
movaps xmm0, xmmword [0x100c8ed0]
xor ecx, ecx
movups xmmword [ebp - 0x80], xmm0
movzx eax, bl
movaps xmm0, xmmword [0x100c9020]
push eax
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 0x617c7a60
mov word [ebp - 0x5c], 0x62
nop dword [eax]
mov al, byte [ebp - 0x80]
xor byte [ebp + ecx - 0x7f], al
inc ecx
cmp ecx, 0x24
jb 0x1001c910
sub esp, 0x18
mov byte [ebp - 0x5b], 0
lea eax, [ebp - 0x7f]
mov ecx, esp
push eax
call fcn.10002940
lea eax, [ebp - 0x58]
push eax
call fcn.1000f610
add esp, 0x20
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.1001ff90
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x1001c965
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.10002720
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
call fcn.1002b940
test eax, eax
je 0x1001ca0a
movaps xmm0, xmmword [0x100c8cc0]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x5f5a5e
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x12
jb 0x1001c998
cmp byte [ebp - 0x27], 0
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x1001c9c5
xor ecx, ecx
jmp 0x1001c9d9
lea ecx, [ebp - 0x27]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001c9d0
sub ecx, edx
push ecx
lea eax, [ebp - 0x27]
push eax
lea ecx, [ebp - 0x40]
call fcn.10002840
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 1
call fcn.1001ff90
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x1001ca0a
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10002720
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e280
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab586
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.10086a40
add esp, 0xc
lea eax, [ebp - 0x118]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x118], 0
jne 0x1001e2e3
xor ecx, ecx
jmp 0x1001e2f9
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e2f0
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
mov ecx, 0x100df990
push eax
call fcn.10002840
mov cl, 0x46
mov byte [ebp - 0x11a], 0
mov al, 0x1a
mov byte [ebp - 0x11c], cl
xor al, cl
mov byte [ebp - 0x11a], 0
mov byte [ebp - 0x11b], al
jne 0x1001e331
xor ecx, ecx
jmp 0x1001e349
lea ecx, [ebp - 0x11b]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e340
sub ecx, edx
push ecx
push ecx
lea eax, [ebp - 0x11b]
push eax
call fcn.100206f0
push 0xffffffffffffffff
inc eax
mov ecx, 0x100df990
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.100079c0
mov esi, eax
cmp esi, 0x100df990
je 0x1001e3b9
mov ecx, dword [0x100df9a4]
cmp ecx, 0x10
jb 0x1001e393
inc ecx
push ecx
push dword [0x100df990]
mov ecx, 0x100df990
call fcn.10002720
push esi
mov ecx, 0x100df990
mov dword [0x100df9a4], 0xf
mov dword [0x100df9a0], 0
mov byte [0x100df990], 0
call fcn.10005d60
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x12c]
cmp eax, 0x10
jb 0x1001e3de
inc eax
lea ecx, [ebp - 0x140]
push eax
push dword [ebp - 0x140]
call fcn.10002720
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [0x100db4b0], eax
call fcn.10001f10
mov dword [0x100db4a8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1000fb00
call fcn.1000fbe0
call fcn.10002e50
sidt [ebp - 0x124]
mov eax, dword [ebp - 0x122]
and eax, 0xff000000
cmp eax, 0xff000000
jne 0x1001e43a
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.10002ec0
call fcn.10002f70
test al, al
jne 0x1001e423
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x128], 0
rdtsc
mov dword [ebp - 0x124], eax
rdtsc
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
sub eax, dword [ebp - 0x124]
cmp eax, 0x1f4
ja 0x1001e423
call fcn.10003020
call fcn.1002b290
mov dword [0x100db4ac], eax
test eax, eax
je 0x1001e499
mov ecx, eax
call fcn.1002b480
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006e175
mov esp, ebp
pop ebp
ret
Function at 0x1001fb10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100c83b0]
xor ecx, ecx
mov eax, dword [0x100db484]
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
movups xmmword [ebp - 0x38], xmm0
mov byte [ebp - 0x28], 0
nop dword [eax]
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0xf
jb 0x1001fb40
sub esp, 0x18
mov byte [ebp - 0x28], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x37], 0
jne 0x1001fb71
xor ecx, ecx
jmp 0x1001fb80
lea ecx, [ebp - 0x37]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001fb77
sub ecx, esi
push ecx
lea eax, [ebp - 0x37]
mov ecx, edx
push eax
call fcn.10002840
lea ecx, [ebp - 0x1c]
call fcn.10069020
mov edi, dword [ebp - 8]
add esp, 0x18
cmp dword [0x100db480], 0
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0
jbe 0x1001fbf9
xor edx, edx
mov dword [ebp - 0x20], edx
cmp edi, 0x10
lea ecx, [ebp - 0x1c]
cmovae ecx, ebx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001fbc0
sub ecx, esi
mov eax, edx
cmp edi, 0x10
lea esi, [ebp - 0x1c]
cmovae esi, ebx
xor edx, edx
div ecx
mov ecx, dword [ebp - 0x20]
mov al, byte [edx + esi]
mov edx, dword [ebp - 0x3c]
xor byte [ecx + edx], al
mov eax, dword [ebp - 0x24]
inc eax
movzx edx, ax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
cmp edx, dword [0x100db480]
jb 0x1001fbb2
cmp edi, 0x10
jb 0x1001fc0b
lea eax, [edi + 1]
push eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.10002720
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006e175
mov esp, ebp
pop ebp
ret
Function at 0x1001fd70
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab730
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x50
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x100db453], 0
je 0x1001ff65
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
sub eax, dword [0x100db4a0]
sbb edx, dword [0x100db4a4]
mov dword [ebp - 0x5c], edx
jne 0x1001fddf
cmp eax, 0xbb8
jb 0x1001ff65
call esi
movaps xmm0, xmmword [0x100c8180]
xor ecx, ecx
mov dword [0x100db4a0], eax
mov dword [0x100db4a4], edx
movups xmmword [ebp - 0x24], xmm0
nop dword [eax]
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xe
jb 0x1001fe00
sub esp, 0x18
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.10002940
lea ecx, [ebp - 0x48]
call fcn.10069020
add esp, 0x18
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
mov byte [ebp - 0x49], 0xa1
mov dword [ebp - 0x30], vtable.ByteBuffer.0
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x1000
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.10012710
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
mov edi, edx
mov ecx, dword [ebp - 0x20]
sub edi, ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], vtable.Packet.0
cmp edi, 0x989680
ja 0x1001feca
lea esi, [eax + 1]
cmp edi, esi
jae 0x1001febd
push esi
lea ecx, [ebp - 0x20]
call fcn.10012650
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dl, byte [ebp - 0x49]
mov byte [ecx + eax], dl
inc eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
sub edx, ecx
mov byte [ebp - 4], 3
mov byte [ebp - 0x49], 0xa5
cmp edx, 0x989680
ja 0x1001fefc
lea esi, [eax + 1]
cmp edx, esi
jae 0x1001fef2
push esi
lea ecx, [ebp - 0x20]
call fcn.10012650
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dl, byte [ebp - 0x49]
mov byte [ecx + eax], dl
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
cmovae eax, dword [ebp - 0x48]
push eax
call fcn.10021c10
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], eax
cmp ecx, 0x4000
ja 0x1001ff41
mov eax, dword [0x100db438]
mov dword [ebp - 0x5c], eax
mov ecx, dword ds:[0x100bfa90]
mov ecx, dword ds:[ecx]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
call dword [ebp - 0x5c]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], vtable.ByteBuffer.0
call fcn.10012810
mov eax, dword [ebp - 0x34]
cmp eax, 0x10
jb 0x1001ff65
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.10002720
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006e175
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10020160
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab7c8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x38], esi
push 0
push 0
push 3
push 0
push 3
push 0
push str..PhysicalDrive0
mov dword [ebp - 0x3c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100201cb
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
jmp 0x10020333
xorps xmm0, xmm0
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x28], fcn.10020360
mov dword [ebp - 0x24], edi
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 8
lea eax, [ebp - 0x30]
movq qword [ebp - 0x20], xmm0
push eax
push 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
push 0x2d1400
push edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10020251
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 0x10
jb 0x10020240
mov eax, dword [esi]
jmp 0x10020242
mov eax, esi
mov byte [eax], 0
mov dword [ebp - 4], 1
jmp 0x10020326
mov eax, dword [ebp - 0x2c]
push eax
mov dword [ebp - 0x38], eax
call fcn.1006e757
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10020276
push dword [ebp - 0x38]
push 0
push ebx
call fcn.10086a40
add esp, 0xc
jmp 0x10020278
xor ebx, ebx
mov dword [ebp - 0x34], ebx
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x38]
lea eax, [ebp - 0x20]
push ebx
push 0xc
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x100202d4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], eax
jb 0x100202b9
mov eax, dword [esi]
jmp 0x100202bb
mov eax, esi
mov byte [eax], 0
test ebx, ebx
je 0x100202cb
push ebx
call fcn.1006e1b9
add esp, 4
mov dword [ebp - 4], 3
jmp 0x10020326
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x1002030c
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], eax
jb 0x100202f5
mov eax, dword [esi]
jmp 0x100202f7
mov eax, esi
push ebx
mov byte [eax], 0
call fcn.1006e1b9
add esp, 4
mov dword [ebp - 4], 4
jmp 0x10020326
add eax, ebx
mov ecx, esi
push eax
call fcn.10002940
push ebx
call fcn.1006e1b9
add esp, 4
mov dword [ebp - 4], 5
test edi, edi
je 0x10020333
push edi
call fcn.10020360
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006e175
mov esp, ebp
pop ebp
ret
Function at 0x10025250
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x100c6e18]
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 0xc], eax
mov esi, ecx
mov ax, word [0x100c6e1c]
push 3
movups xmmword [ebp - 0x34], xmm0
push 0
movups xmm0, xmmword [0x100c6e00]
mov word [ebp - 8], ax
mov eax, 0x30
push 0
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x34]
movups xmmword [ebp - 0x24], xmm0
push 0xc0000000
movq xmm0, qword [0x100c6e10]
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10025320
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x100252e9
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x10025336
inc ax
mov word [ebp - 0xa], ax
jmp 0x100252ff
cmp eax, 0xe7
jne 0x10025336
push 0x2710
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
je 0x10025336
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x100252d0
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e175
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006e175
mov esp, ebp
pop ebp
ret
Function at 0x10027290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, ecx
mov ebx, 1
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
add eax, 0x10
mov dword [ebp + 0xc], eax
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.1006ef70
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
add edi, eax
mov eax, dword [ebp + 0xc]
adc esi, edx
inc ebx
mov dword [eax], edi
mov dword [eax + 4], esi
add eax, 8
mov dword [ebp + 0xc], eax
cmp ebx, 0x138
jl 0x100272b3
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [eax], 0x138
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002b290
Capabilities:
Allocate or change rwx memory
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, 0x4c
mov dword [ebp - 0x2f8], 0x20381e4c
mov dword [ebp - 0x2f4], 0x282d2300
xor eax, eax
mov dword [ebp - 0x2f0], 0x253e381f
mov word [ebp - 0x2ec], 0x2b22
mov byte [ebp - 0x2ea], 0
xor byte [ebp + eax - 0x2f7], cl
inc eax
cmp eax, 0xd
jae 0x1002b2ea
mov cl, byte [ebp - 0x2f8]
jmp 0x1002b2d5
push ebx
mov byte [ebp - 0x2e8], 0xe
mov al, 0x60
xor al, byte [ebp - 0x2e8]
mov bl, 0x62
mov ah, bl
mov byte [ebp - 0x2e7], al
mov al, byte [ebp - 0x2e8]
mov dl, 0x6a
mov bh, ah
mov byte [ebp - 0x2d9], ah
xor bl, al
mov byte [ebp - 0x2de], 0
xor ah, al
mov byte [ebp - 0x2ea], 0
xor bh, al
mov byte [ebp - 0x2e3], ah
mov dh, dl
mov byte [ebp - 0x2e4], bl
xor dl, al
mov byte [ebp - 0x2e0], bh
xor dh, al
mov byte [ebp - 0x2e5], dl
mov cl, 0x7a
mov byte [ebp - 0x2e1], dh
xor cl, al
mov byte [ebp - 0x2de], 0
mov ch, 0x20
mov byte [ebp - 0x2e6], cl
xor ch, al
mov al, byte [ebp - 0x2d9]
xor al, byte [ebp - 0x2e8]
mov byte [ebp - 0x2df], al
lea eax, [ebp - 0x2f7]
push esi
push eax
lea eax, [ebp - 0x2e7]
mov byte [ebp - 0x2e2], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
jne 0x1002b3b1
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e175
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1002b39f
push 0x2cc
lea eax, [ebp - 0x2d8]
push 0
push eax
call fcn.10086a40
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1002b39f
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1002b39f
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1002b39f
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x10002080
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1002b39f
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.1006e175
mov esp, ebp
pop ebp
ret
Function at 0x1002b480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x100c8370]
xor eax, eax
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x18], 0x110b370d
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0x70206
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0x16
jb 0x1002b4a6
xor al, al
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 6], al
mov bl, 2
xor al, byte [ebp - 0x10]
mov ah, bl
mov byte [ebp - 0xf], al
mov dl, 0xa
mov al, byte [ebp - 0x10]
mov bh, ah
mov byte [ebp - 1], ah
xor bl, al
xor ah, al
mov byte [ebp - 0x11], 0
xor bh, al
mov byte [ebp - 0xb], ah
mov dh, dl
mov byte [ebp - 0xc], bl
xor dl, al
mov byte [ebp - 8], bh
xor dh, al
mov byte [ebp - 0xd], dl
mov cl, 0x1a
mov byte [ebp - 9], dh
xor cl, al
mov byte [ebp - 6], 0
mov ch, 0x40
mov byte [ebp - 0xe], cl
xor ch, al
mov al, byte [ebp - 1]
xor al, byte [ebp - 0x10]
mov byte [ebp - 7], al
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0xf]
mov byte [ebp - 0xa], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x1002b52e
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x11
test esi, esi
jne 0x1002b54d
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
test eax, eax
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call edi
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002b560
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1002b59e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1002b5a2
cmp edx, esi
jne 0x1002b587
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x1002b5c2
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1002b5c6
cmp edx, esi
jne 0x1002b5ab
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x1002b5e6
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1002b5ea
cmp edx, esi
jne 0x1002b5cf
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002bfb0
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov byte [ebp - 0x18], 0x25
mov al, 0x4b
xor al, byte [ebp - 0x18]
mov bl, 0x49
mov ah, bl
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x18]
mov dl, 0x41
mov bh, ah
mov byte [ebp - 9], ah
mov dh, dl
mov byte [ebp - 0xe], 0
xor dl, al
mov byte [ebp - 0xe], 0
xor bl, al
mov byte [ebp - 0x15], dl
xor ah, al
mov byte [ebp - 0x14], bl
xor dh, al
mov byte [ebp - 0x13], ah
xor bh, al
mov byte [ebp - 0x11], dh
mov cl, 0x51
mov byte [ebp - 0x10], bh
xor cl, al
mov ch, 0xb
xor ch, al
mov byte [ebp - 0x16], cl
mov al, byte [ebp - 9]
xor al, byte [ebp - 0x18]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0x17]
push eax
mov byte [ebp - 0x12], ch
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movaps xmm0, xmmword [0x100c8870]
mov edx, eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x2e2b30
xor ecx, ecx
pop ebx
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x12
jb 0x1002c036
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x19], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ecx
mov edx, 0x1002ba40
mov ecx, eax
call fcn.100690f0
add esp, 4
mov dword [0x100df514], eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 0x40
push 5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e175
mov esp, ebp
pop ebp
ret
Function at 0x1002d680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac1b8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
mov eax, dword [0x100d6084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [0x100df534], eax
test edx, edx
je 0x1002d76f
cmp dword [ebp + 0xc], 1
jne 0x1002d76f
mov eax, dword [esi + 4]
test eax, eax
je 0x1002d75b
cmp edx, eax
jne 0x1002d75b
cmp byte [0x100db463], 0
sete al
xor ecx, ecx
mov byte [0x100db463], al
test al, al
je 0x1002d716
movaps xmm0, xmmword [0x100c8840]
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x24], 0x2c
nop
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x10
jb 0x1002d700
mov byte [ebp - 0x23], 0
lea eax, [ebp - 0x33]
jmp 0x1002d739
movaps xmm0, xmmword [0x100c9350]
movups xmmword [ebp - 0x20], xmm0
mov byte [ebp - 0x10], 0
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0xf
jb 0x1002d725
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x1f]
push eax
lea ecx, [ebp - 0x4c]
call fcn.10002940
mov dword [ebp - 4], 0
lea edx, [ebp - 0x4c]
mov ecx, dword [esi]
call fcn.1001c270
lea ecx, [ebp - 0x4c]
call fcn.100022f0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8