joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018980
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100f2040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100e9700]
push esi
mov esi, ecx
mov dword [ebp - 0x38], 0x407a7b7d
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x34], 0x7571667c
xor ecx, ecx
mov word [ebp - 0x30], 0x70
mov al, byte [ebp + ecx - 0x47]
xor al, byte [ebp - 0x48]
mov byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0x18
jb 0x100189b4
mov byte [ebp - 0x2f], 0
mov dl, 0x59
mov dword [ebp - 0x2c], 0x3d2d3759
xor ecx, ecx
mov dword [ebp - 0x28], 0x3d773535
mov word [ebp - 0x24], 0x3535
mov byte [ebp - 0x22], 0
xor byte [ebp + ecx - 0x2b], dl
inc ecx
cmp ecx, 9
jae 0x100189f4
mov dl, byte [ebp - 0x2c]
jmp 0x100189e5
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x22], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x47]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10018a34
push 0
push 0x1c
lea ecx, [ebp - 0x20]
push ecx
push 0
push esi
call eax
test eax, eax
jne 0x10018a34
mov eax, dword [ebp - 0x14]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10089100
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10089100
mov esp, ebp
pop ebp
ret

Function at 0x10018a50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100f2040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100e9950]
push esi
mov esi, ecx
mov dword [ebp - 0x20], 0x5268696f
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0x6763746e
xor ecx, ecx
mov word [ebp - 0x18], 0x62
mov al, byte [ebp + ecx - 0x2f]
xor al, byte [ebp - 0x30]
mov byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x18
jb 0x10018a84
mov byte [ebp - 0x17], 0
mov dl, 0x3b
mov dword [ebp - 0x14], 0x5f4f553b
xor ecx, ecx
mov dword [ebp - 0x10], 0x5f155757
mov word [ebp - 0xc], 0x5757
mov byte [ebp - 0xa], 0
xor byte [ebp + ecx - 0x13], dl
inc ecx
cmp ecx, 9
jae 0x10018ac4
mov dl, byte [ebp - 0x14]
jmp 0x10018ab5
lea eax, [ebp - 0x13]
mov byte [ebp - 0xa], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10018af0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10089100
mov esp, ebp
pop ebp
ret
push 0
push 4
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 9
push esi
call eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.10089100
mov esp, ebp
pop ebp
ret

Function at 0x10018dd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 1
mov dword [0x100f2bf4], edx
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x100f2bf4], edx
inc eax
cmp eax, 0x270
jb 0x10018de1
mov dword [0x100f2bf0], 0x270
pop ebp
ret 8
Function at 0x10019130
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x1001918d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x10019150
mov eax, dword [esi]
jmp 0x1001926b
cmp eax, 0x4e0
jb 0x1001926b
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x100191a6
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x100191f1
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001b130
Capabilities:
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movaps xmm0, xmmword [0x100e8eb0]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
push esi
movaps xmm0, xmmword [str.__i_n_09.__9__E_705]
movups xmmword [ebp - 0x24], xmm0
push edi
movaps xmm0, xmmword [0x100e8ae0]
movups xmmword [ebp - 0x14], xmm0
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x33]
xor al, byte [ebp - 0x34]
mov byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x1001b160
push 0
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], 0
push eax
push 0
push 0x100f5fbc
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1001b252
push 0x100f5fb8
push 0
push 0
push 0x8004
push dword [0x100f5fbc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1001b252
movaps xmm0, xmmword [0x100e9400]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x520a5c5b
movaps xmm0, xmmword [0x100e8c20]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x580e487a
movaps xmm0, xmmword [str.R__ztLwenpLXV]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x1b4a406f
mov word [ebp - 4], 0x47
mov al, byte [ebp + ecx - 0x3f]
xor al, byte [ebp - 0x40]
mov byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x1001b1f2
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], 0
push eax
push dword [0x100f5fb8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1001b252
push 0x100f5fb4
push 0x800000
push dword [0x100f5fb8]
push 0x6801
push dword [0x100f5fbc]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1001b252
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100f5fb0], eax
call fcn.10087d30
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.10088200
push 0x1001aca0
push 0x100f5fc0
call fcn.10087a40
call fcn.10087d90
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push 0x8f5430
call edi
test eax, eax
jne 0x1001b2c2
mov dword [0x100f5fc0], 0x8f5430
call fcn.10087d30
call esi
push eax
call fcn.10088200
push 0x1001aca0
push 0x100f5fc0
call fcn.100875b0
call fcn.10087d90
call fcn.10087d30
call esi
push eax
call fcn.10088200
push 0x1001b080
push 0x100f5fac
call fcn.10087a40
call fcn.10087d90
push 4
push 0x450890
call edi
test eax, eax
jne 0x1001b31b
mov dword [0x100f5fac], 0x450890
call fcn.10087d30
call esi
push eax
call fcn.10088200
push 0x1001b080
push 0x100f5fac
call fcn.100875b0
call fcn.10087d90
call fcn.10087d30
call esi
push eax
call fcn.10088200
push 0x1001b120
push 0x100f5fa8
call fcn.10087a40
call fcn.10087d90
push 4
push 0x4504c0
call edi
test eax, eax
jne 0x1001b374
mov dword [0x100f5fa8], 0x4504c0
call fcn.10087d30
call esi
push eax
call fcn.10088200
push 0x1001b120
push 0x100f5fa8
call fcn.100875b0
call fcn.10087d90
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100233e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100f2040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100e98a0]
xor ecx, ecx
mov eax, dword [0x100f6050]
push ebx
push esi
push edi
mov dword [ebp - 0x2c], eax
movups xmmword [ebp - 0x40], xmm0
mov byte [ebp - 0x30], 0
nop dword [eax]
mov al, byte [ebp + ecx - 0x3f]
xor al, byte [ebp - 0x40]
mov byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0xf
jb 0x10023410
sub esp, 0x1c
mov byte [ebp - 0x30], 0
mov edx, esp
lea ecx, [ebp - 0x3f]
xorps xmm0, xmm0
lea esi, [ecx + 1]
mov dword [edx], 0
movups xmmword [edx + 4], xmm0
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10023450
sub ecx, esi
lea eax, [ebp - 0x3f]
push ecx
push eax
mov ecx, edx
call fcn.10003370
lea ecx, [ebp - 0x20]
call fcn.10083f10
add esp, 0x1c
mov dword [ebp - 0x28], 0
cmp dword [0x100f604c], 0
jbe 0x1002352e
mov esi, dword [ebp - 8]
xor edx, edx
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
nop
cmp esi, 0xf
lea ecx, [ebp - 0x1c]
cmova ecx, edi
lea ebx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100234a0
sub ecx, ebx
mov eax, edx
xor edx, edx
div ecx
mov ebx, edx
cmp ebx, dword [ebp - 0xc]
jbe 0x10023500
push str.string_subscript_out_of_range
push 0x100e0bf8
push 0
push 0x8d0
push 0x100e0da8
push 2
call fcn.10090860
add esp, 0x18
cmp eax, 1
jne 0x100234dc
int3
push 0
push 0x8d0
push str.C:Program_FilesMicrosoft_Visual_Studio2022ProfessionalVCToolsMSVC14.41.34120includexstring
push 0x100e0d34
push str._string_subscript_out_of_range_
call fcn.1008fb80
mov esi, dword [ebp - 8]
add esp, 0x14
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
cmp esi, 0xf
cmova eax, edi
mov al, byte [eax + ebx]
xor byte [ecx + edx], al
mov eax, dword [ebp - 0x28]
inc eax
movzx edx, ax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
cmp edx, dword [0x100f604c]
jb 0x10023490
lea ecx, [ebp - 0x20]
call fcn.10002f50
mov eax, dword [ebp - 0x20]
push 8
push eax
mov dword [ebp - 0x20], 0
call fcn.100891b0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10089100
mov esp, ebp
pop ebp
ret
Function at 0x10023650
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c95dd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x6c
mov eax, dword [0x100f2040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x100f5f62], 0
je 0x1002383a
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
sub eax, dword [0x100f6070]
sbb edx, dword [0x100f6074]
mov dword [ebp - 0x64], edx
jne 0x100236be
cmp eax, 0xbb8
jb 0x1002383a
call esi
movaps xmm0, xmmword [str.yOXPnR_IQTKX]
mov dword [0x100f6070], eax
xor eax, eax
mov dword [0x100f6074], edx
movups xmmword [ebp - 0x78], xmm0
nop dword [eax + eax]
mov cl, byte [ebp + eax - 0x77]
xor cl, byte [ebp - 0x78]
mov byte [ebp + eax - 0x77], cl
inc eax
cmp eax, 0xe
jb 0x100236e0
sub esp, 0x1c
mov byte [ebp - 0x69], 0
mov edx, esp
lea ecx, [ebp - 0x77]
xorps xmm0, xmm0
lea esi, [ecx + 1]
mov dword [edx], 0
movups xmmword [edx + 4], xmm0
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10023720
sub ecx, esi
lea eax, [ebp - 0x77]
push ecx
push eax
mov ecx, edx
call fcn.10003370
lea ecx, [ebp - 0x54]
call fcn.10083f10
add esp, 0x1c
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
xorps xmm0, xmm0
mov byte [ebp - 0x18], 0xa1
push 0x1000
movups xmmword [ebp - 0x38], xmm0
movups xmmword [ebp - 0x28], xmm0
call fcn.1000f000
push 1
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.Packet.0
call fcn.1000f1c0
push 1
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x18], 0xa5
call fcn.1000f1c0
cmp dword [ebp - 0x3c], 0xf
lea esi, [ebp - 0x50]
cmova esi, dword [ebp - 0x50]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100237a2
sub ecx, edx
movzx eax, cx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x58], eax
xor eax, eax
cmp byte [ebp - 0x34], al
setne al
inc eax
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000f1c0
movzx eax, word [ebp - 0x58]
lea ecx, [ebp - 0x38]
push eax
push esi
call fcn.1000f1c0
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
sub esi, dword [ebp - 0x24]
push 0
mov dword [ebp - 0x58], esi
call fcn.1000bb70
mov dword [ebp - 0x5c], eax
cmp esi, 0x4000
ja 0x1002380e
mov eax, dword [0x100f5fec]
mov dword [ebp - 0x64], eax
mov ecx, dword ds:[0x100e1890]
mov ecx, dword ds:[ecx]
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
call dword [ebp - 0x64]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x38], vtable.ByteBuffer.0
call fcn.1000f550
lea ecx, [ebp - 0x54]
call fcn.10002f50
mov eax, dword [ebp - 0x54]
push 8
push eax
mov dword [ebp - 0x54], 0
call fcn.100891b0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10089100
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10023860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c9625
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100f2040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [0x100f5f62], 0
je 0x1002392d
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
sub eax, dword [0x100f6058]
sbb edx, dword [0x100f605c]
jne 0x100238ba
cmp eax, 0x3e8
jb 0x10023944
call esi
push ecx
lea ecx, [ebp - 0x34]
mov dword [0x100f6058], eax
mov dword [0x100f605c], edx
call fcn.1000e760
push 0x1000
mov byte [ebp - 0x14], 0xa1
call fcn.1000f000
push 1
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], vtable.Packet.0
call fcn.1000f1c0
push 0xa4
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 1
call fcn.10026810
push edi
mov ecx, eax
call fcn.10026380
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x34]
sub esi, dword [ebp - 0x20]
call fcn.10026850
mov edx, esi
mov ecx, eax
call fcn.1001e4c0
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10089100
mov esp, ebp
pop ebp
ret
Function at 0x1002a090
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x100f2040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dl, 0x59
mov dword [ebp - 0x2f4], 0x352d0b59
mov dword [ebp - 0x2f0], 0x3d383615
xor ecx, ecx
mov dword [ebp - 0x2ec], 0x302b2d0a
mov word [ebp - 0x2e8], 0x3e37
mov byte [ebp - 0x2e6], 0
xor byte [ebp + ecx - 0x2f3], dl
inc ecx
cmp ecx, 0xd
jae 0x1002a0ea
mov dl, byte [ebp - 0x2f4]
jmp 0x1002a0d5
mov byte [ebp - 0x2e6], 0
mov dl, 0x20
mov dword [ebp - 0x2e4], 0x44544e20
xor ecx, ecx
mov dword [ebp - 0x2e0], 0x440e4c4c
mov word [ebp - 0x2dc], 0x4c4c
mov byte [ebp - 0x2da], 0
nop dword [eax]
xor byte [ebp + ecx - 0x2e3], dl
inc ecx
cmp ecx, 9
jae 0x1002a135
mov dl, byte [ebp - 0x2e4]
jmp 0x1002a120
push esi
lea eax, [ebp - 0x2e3]
mov byte [ebp - 0x2da], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2f3]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
je 0x1002a224
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1002a224
push 0x2c8
lea eax, [ebp - 0x2d4]
push 0
push eax
call fcn.1008c200
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1002a224
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1002a224
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1002a224
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x10002800
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1002a224
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10089100
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10089100
mov esp, ebp
pop ebp
ret
Function at 0x1002a240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0x70607a14
push edi
mov dl, 0x14
mov dword [ebp - 8], 0x703a7878
mov word [ebp - 4], 0x7878
xor ecx, ecx
mov byte [ebp - 2], 0
xor byte [ebp + ecx - 0xb], dl
inc ecx
cmp ecx, 9
jae 0x1002a275
mov dl, byte [ebp - 0xc]
jmp 0x1002a266
lea eax, [ebp - 0xb]
mov byte [ebp - 2], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
je 0x1002a2ea
movaps xmm0, xmmword [0x100e94e0]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x49536f55
mov dword [ebp - 0x10], 0x5f5a5e
mov al, byte [ebp + ecx - 0x23]
xor al, byte [ebp - 0x24]
mov byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x16
jb 0x1002a2a4
lea eax, [ebp - 0x23]
mov byte [ebp - 0xd], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1002a2ea
test esi, esi
jne 0x1002a2d6
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push 0
push 0
push 0x11
push esi
call edi
test eax, eax
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002a300
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1002a33e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1002a342
cmp edx, esi
jne 0x1002a327
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x1002a362
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1002a366
cmp edx, esi
jne 0x1002a34b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x1002a386
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1002a38a
cmp edx, esi
jne 0x1002a36f
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002ca10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c9dad
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push esi
push edi
mov eax, dword [0x100f2040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [0x100f60bc], eax
test edx, edx
je 0x1002cbd0
cmp dword [ebp + 0xc], 1
jne 0x1002cbd0
mov eax, dword [esi + 4]
test eax, eax
je 0x1002cbbb
cmp edx, eax
jne 0x1002cbbb
cmp byte [0x100f6023], 0
sete al
xor ecx, ecx
mov byte [0x100f6023], al
test al, al
je 0x1002caaa
movaps xmm0, xmmword [0x100e9ab0]
movups xmmword [ebp - 0x44], xmm0
mov word [ebp - 0x34], 0x7a
nop
mov al, byte [ebp + ecx - 0x43]
xor al, byte [ebp - 0x44]
mov byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x10
jb 0x1002ca90
mov byte [ebp - 0x33], 0
lea edx, [ebp - 0x43]
jmp 0x1002cad8
movaps xmm0, xmmword [0x100e9280]
movups xmmword [ebp - 0x58], xmm0
mov byte [ebp - 0x48], 0
nop dword [eax]
mov al, byte [ebp + ecx - 0x57]
xor al, byte [ebp - 0x58]
mov byte [ebp + ecx - 0x57], al
inc ecx
cmp ecx, 0xf
jb 0x1002cac0
mov byte [ebp - 0x48], 0
lea edx, [ebp - 0x57]
mov ecx, edx
mov dword [ebp - 0x30], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002cb00
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x30]
call fcn.10003370
mov dword [ebp - 4], 0
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1002cb9e
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002cb9e
cmp dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x2c]
cmova ecx, dword [ebp - 0x2c]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002cb40
sub ecx, edx
mov dword [ebp - 0x10], ecx
lea esi, [ecx + 0x21]
push esi
call fcn.100891d0
push esi
mov edi, eax
push 0
push edi
call fcn.1008c200
cmp dword [ebp - 0x18], 0xf
lea edx, [ebp - 0x2c]
push dword [ebp - 0x10]
cmova edx, dword [ebp - 0x2c]
lea esi, [edi + 0x20]
push edx
push esi
call fcn.1008bc80
mov eax, dword [ebp - 0x10]
add esp, 0x1c
mov ecx, dword [ebp - 0x14]
mov dword [edi + 4], esi
mov dword [edi + 0x14], eax
push edi
mov dword [edi + 0x18], 0x1f
call dword [0x100e6db0]
push edi
call fcn.100891b0
add esp, 4
lea ecx, [ebp - 0x30]
call fcn.10002f50
mov eax, dword [ebp - 0x30]
push 8
push eax
mov dword [ebp - 0x30], 0
call fcn.100891b0
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8