joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008b59
Capabilities:
Create thread

Disassembly:
jae 0x10008b57
jmp 0x10008b52
call fcn.10008b59
jae 0x10008b52
add esp, 4
jmp 0x10008b5e
dec dword [esp]
jno 0x10008b63
jns 0x10008b4e
jp 0x10008b67
add esp, 4
popf
jmp 0x10008b6e
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10008b87
jne 0x10008b87
call 0x1fc0bedb
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10008990
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10008bbb
call fcn.1000a390
clc
jae 0x10008bc0
clc
pop eax
pushf
push 0xa
jae 0x10008bcd
jmp 0x10008bc8
call 0x10008bcf
jae 0x10008bc8
add esp, 4
jmp 0x10008bd4
dec dword [esp]
jno 0x10008bd9
jns 0x10008bc4
jp 0x10008bdd
add esp, 4
popf
jmp 0x10008be4
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10008bfd
jne 0x10008bfd
pop eax
jl 0x10008c02
jmp 0x10008c04
je 0x10008bff
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10008c1e
jne 0x10008c1d
call 0x93047ca5
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10008c2c
jne 0x10008c2c
call 0x6ffcd1bb
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008f00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
push esi
push edi
push 0
push ecx
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov edi, dword [sym.imp.USER32.dll_EndTask]
mov esi, eax
test esi, esi
je 0x10008f38
push 1
push 0
push esi
call edi
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
lea eax, [esp + 8]
push 0
push eax
push 0
push 0
mov dword [esp + 0x18], 0x676e6566
mov dword [esp + 0x1c], 0x657579
call esi
test eax, eax
je 0x10008fa8
mov ecx, 0xc1
xor edx, edx
mov al, byte [edx + 0x1004ad64]
xor al, cl
inc ecx
mov byte [esp + edx + 0x10], al
and ecx, 0x800000ff
jns 0x10008f83
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x1f
jl 0x10008f66
push 5
push 0
push 0
lea eax, [esp + 0x1c]
mov byte [esp + 0x3b], 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.1000a390
push 0
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x646e6957
push eax
push 0
push 0
mov word [esp + 0x1c], 0x776f
mov byte [esp + 0x1e], 0
call esi
mov esi, eax
xor eax, eax
mov dword [esp + 8], eax
mov word [esp + 0xc], ax
mov byte [esp + 0xe], al
test esi, esi
je 0x10008ff0
push eax
push eax
push 0x12
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
push 0
push esi
call edi
mov ecx, 0x1a
xor edx, edx
mov al, byte [edx + str.YtrnqsEvKM_JQdDHYX]
xor al, cl
inc ecx
mov byte [esp + edx + 0x10], al
and ecx, 0x800000ff
jns 0x10009014
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x12
jl 0x10008ff7
push 0
lea eax, [esp + 0x14]
mov byte [esp + 0x26], 0
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
mov word [esp + 0x20], 0
mov byte [esp + 0x22], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
test esi, esi
je 0x1000905e
push 1
push 0
push esi
call edi
push 0
push 0
push 0x12
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a0d0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10009960
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x1000a200
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, dword [0x100500f8]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
mov dword [esp + 0xc], ebx
cmp ebx, 0xffffffff
je 0x1000a301
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
push dword [esp + 0x18]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000a2ed
mov esi, 0x10050b7c
mov ebx, 0xa
lea eax, [esp + 0x138]
push eax
push 7
lea eax, [esp + 0x144]
push eax
push dword [esi - 4]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1000a2d8
cmp dword [esp + 0x138], 7
jne 0x1000a2d8
lea ecx, [esp + 0x13c]
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x1000a2d8
movzx eax, word [ecx + 4]
cmp ax, word [esi + 4]
jne 0x1000a2d8
movzx eax, byte [ecx + 6]
cmp al, byte [esi + 6]
jne 0x1000a2d8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1000a390
add esi, 0xc
sub ebx, 1
jne 0x1000a275
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
mov ebx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1000a250
push ebx
call esi
mov ecx, dword [esp + 0x144]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001a6ea
mov esp, ebp
pop ebp
ret

Function at 0x1000a370
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret
Function at 0x1000a53f
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003cb3b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x604
mov eax, dword [0x100500f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
add byte [ebx - 0x17ff950f], cl
sub al, 0x8d
add dword [eax], eax
add esp, 4
mov dword [ebp - 0x530], eax
lea eax, [ebp - 0x530]
mov dword [ebp - 0x52c], edx
push eax
call fcn.1002356e
movaps xmm0, xmmword [0x1004bc90]
add esp, 4
movups xmm2, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
mov word [ebp - 0x20], 0x20
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [0x1004bca0]
movups xmmword [ebp - 0x30], xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
movd eax, xmm0
movaps xmm0, xmm2
psrldq xmm0, 0xc
add eax, 0x76c
push eax
movd eax, xmm1
inc eax
push eax
movd eax, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
push eax
movd eax, xmm2
psrldq xmm2, 8
push eax
movd eax, xmm0
push eax
movd eax, xmm2
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x528]
push eax
call fcn.10004340
push 0xb0
lea eax, [ebp - 0x5e0]
mov dword [ebp - 0x1c], 0x6e65706f
push 0
push eax
mov byte [ebp - 0x18], 0
call fcn.1001cb10
add esp, 0x2c
mov ecx, 0x1f
xor edx, edx
mov al, byte [edx + str.WS_fnLCV_bSP_]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x5ec], al
and ecx, 0x800000ff
jns 0x1000a623
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1000a603
mov byte [ebp - 0x5e1], 0
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 0x5ec]
lea ecx, [ebp - 0x5e0]
push 8
push eax
call fcn.10006260
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5e0]
xorps xmm0, xmm0
mov dword [ebp - 0x5e4], 0
mov edx, 0x1004af38
movq qword [ebp - 0x5ec], xmm0
call fcn.100073f0
lea edx, [ebp - 0x528]
mov ecx, eax
call fcn.100073f0
mov edx, esi
mov ecx, eax
call fcn.100073f0
lea ecx, [ebp - 0x5dc]
call fcn.10006a10
test eax, eax
jne 0x1000a6c7
mov eax, dword [ebp - 0x5e0]
lea ecx, [ebp - 0x5e0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10004cc0
mov eax, dword [0x10051fd4]
inc eax
mov dword [0x10051fd4], eax
cmp eax, 2
jae 0x1000a726
mov edx, 0x1f
xor eax, eax
nop
mov cl, byte [eax + str.WS_fnLCV_bSP_]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x5ec], cl
and edx, 0x800000ff
jns 0x1000a700
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xb
jl 0x1000a6e0
push 5
push 0
push 0
lea eax, [ebp - 0x5ec]
mov byte [ebp - 0x5e1], 0
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x5e0]
call fcn.10004fc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001a6ea
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1000a760
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
mov esi, dword [eax + 0xc]
mov eax, dword [esi + 0xc]
add esi, 0xc
cmp eax, esi
je 0x1000a785
test eax, eax
je 0x1000a785
mov ecx, dword [eax + 0x18]
cmp edx, ecx
je 0x1000a789
mov eax, dword [eax]
cmp eax, esi
jne 0x1000a774
xor al, al
pop esi
ret
mov edx, dword [0x10052050]
pop esi
mov dword [edx], ecx
mov ecx, dword [eax + 0x1c]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 0x20]
mov dword [edx + 8], ecx
mov ecx, dword [eax + 0x30]
mov dword [edx + 0x18], ecx
movzx ecx, word [eax + 0x2c]
mov word [edx + 0x14], cx
movzx ecx, word [eax + 0x2e]
mov word [edx + 0x16], cx
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x10], ecx
movzx ecx, word [eax + 0x24]
mov word [edx + 0xc], cx
mov ax, word [eax + 0x26]
mov word [edx + 0xe], ax
mov al, 1
ret
Function at 0x1000e570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xe4
xor eax, eax
mov dl, byte [edi + eax - 0x45df1c07]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1000e59e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1000e581
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1000e5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x8f
xor eax, eax
mov dl, byte [edi + eax + 0x1048d96e]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1000e61e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1000e601
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10014bb0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
xor esi, esi
mov edx, dword [eax + 0x3c]
add edx, eax
movzx ecx, word [edx + 0x14]
lea eax, [edx + 0x18]
movzx ebx, word [edx + 6]
add eax, ecx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x10014c19
mov edi, eax
mov eax, edi
mov ecx, 0x1004b680
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10014c08
test dl, dl
je 0x10014c04
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10014c08
add ecx, 2
add eax, 2
test dl, dl
jne 0x10014be8
xor eax, eax
jmp 0x10014c0d
sbb eax, eax
or eax, 1
test eax, eax
je 0x10014c42
inc esi
add edi, 0x28
cmp esi, ebx
jl 0x10014be1
xor eax, eax
cmp byte [0x10051fe9], al
push 0
setne al
push eax
push 0
push str._nText_section_size_can_not_detected__Size_created_as_manual:__p_IsPacked_result:__d_Base:__p
call fcn.1000a340
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 4]
lea eax, [esi + esi*4]
mov esi, dword [edi + eax*8 + 0xc]
mov edi, dword [edi + eax*8 + 0x10]
xor eax, eax
add esi, dword [ebp - 8]
cmp byte [0x10051fe9], al
push esi
setne al
push eax
push edi
push str._nText_section_size_can_not_detected__Size_created_as_manual:__p_IsPacked_result:__d_Base:__p
call fcn.1000a340
add esp, 0x10
test esi, esi
jne 0x10014c9b
xor eax, eax
cmp byte [0x10051fe9], al
setne al
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call esi
push eax
push str._nText_section_base_address_is_null__Base_wrapped_as_module_base:__p_IsPacked_result:__d
call fcn.1000a340
add esp, 0xc
push 0
call esi
mov esi, eax
test edi, edi
jne 0x10014cbf
xor ecx, ecx
mov edi, 0x100000
cmp byte [0x10051fe9], cl
push esi
setne cl
push ecx
push edi
push str._nText_section_size_can_not_detected__Size_created_as_manual:__p_IsPacked_result:__d_Base:__p
call fcn.1000a340
add esp, 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10014cd7
pop edi
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, edi
mov ecx, esi
call fcn.10014a90
pop edi
test eax, eax
mov ecx, 5
pop esi
cmove eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014ec0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x100500f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], ecx
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x38]
xorps xmm0, xmm0
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], ebx
movq qword [ebp - 0x10], xmm0
nop word [eax + eax]
push 0x1c
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test byte [ebp - 0xc], 0xf0
mov edi, dword [ebp - 0x14]
je 0x10014f39
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x4c]
push dword [ebp - 0x48]
mov dword [ebp - 0x50], ecx
lea eax, [edi + ecx]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x4c], eax
call fcn.10014de0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10014f48
push 2
add esi, edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, dword [ebp - 0x54]
jb 0x10014f00
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001a6ea
mov esp, ebp
pop ebp
ret

Function at 0x1001564d
Capabilities:
Create thread

Disassembly:
jae 0x1001564b
jmp 0x10015646
call fcn.1001564d
jae 0x10015646
add esp, 4
jmp 0x10015652
dec dword [esp]
jno 0x10015657
jns 0x10015642
jp 0x1001565b
add esp, 4
popf
jmp 0x10015662
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001567b
jne 0x1001567b
call 0x1fc189cf
wait
rcl byte [edx + 0x33], 0xd0
push eax
Function at 0x10017110
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003d460
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
push ebx
push esi
push edi
mov eax, dword [0x100500f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, 0x90750c5e
push eax
lea ecx, [ebp - 0x98]
call fcn.10017fb0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
call fcn.1000a500
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x98]
call fcn.1000e490
push 0x561bdb02
lea ecx, [ebp - 0x3c]
call fcn.10017ff0
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
call fcn.1000a370
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.1000e4a0
push 0
push 0
push 0
push 0x100170b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
clc
jae 0x100171bf
mov ah, 0x79
pushf
push 0xa

Function at 0x10018180
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10009590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10052004], eax
test eax, eax
jne 0x100181a8
call fcn.1000a390
mov eax, dword [0x10052004]
ret

Function at 0x100181b0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100155f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10052000], eax
test eax, eax
jne 0x100181d8
call fcn.1000a390
mov eax, dword [0x10052000]
ret

Function at 0x100181e0
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
push 0
push 0x1000df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x10018203
call fcn.1000a390
mov eax, esi
pop esi
ret

Function at 0x10018210
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10017f80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1005200c], eax
test eax, eax
jne 0x10018238
call fcn.1000a390
mov eax, dword [0x1005200c]
ret
Function at 0x100182a0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003d558
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
push ebx
push esi
push edi
mov eax, dword [0x100500f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [0x10052000]
call esi
push 0
push dword [0x10052008]
mov edi, eax
call esi
push 0
push dword [0x10052004]
mov dword [ebp - 0x10], eax
call esi
push 0
push dword [0x1005200c]
mov dword [ebp - 0x14], eax
call esi
push dword [0x10052000]
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, eax
call esi
push dword [0x10052008]
mov dword [ebp - 0x18], eax
call esi
push dword [0x10052004]
mov dword [ebp - 0x1c], eax
call esi
push dword [0x1005200c]
mov dword [ebp - 0x20], eax
call esi
mov esi, eax
cmp edi, 0x102
jne 0x1001834a
cmp dword [ebp - 0x10], edi
jne 0x1001834a
cmp dword [ebp - 0x14], edi
jne 0x1001834a
cmp ebx, edi
je 0x10018399
mov ecx, 0x6f
xor edx, edx
mov al, byte [edx + 0x1004bb90]
xor al, cl
inc ecx
mov byte [ebp + edx - 0xd8], al
and ecx, 0x800000ff
jns 0x10018371
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x58
jl 0x10018351
mov byte [ebp - 0x80], 0
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0
call fcn.1000a500
mov dword [ebp - 4], 0xffffffff
call fcn.1000a390
cmp dword [ebp - 0x18], 1
je 0x100183b0
cmp dword [ebp - 0x1c], 1
je 0x100183b0
cmp dword [ebp - 0x20], 1
je 0x100183b0
cmp esi, 1
jne 0x10018409
mov edx, 0xe6
xor eax, eax
mov cl, byte [eax + 0x1004bbf0]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x7c], cl
and edx, 0x800000ff
jns 0x100183d4
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x58
jl 0x100183b7
mov byte [ebp - 0x24], 0
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 1
call fcn.1000a500
push 0x59
lea eax, [ebp - 0x7c]
mov dword [ebp - 4], 0xffffffff
push 0
push eax
call fcn.1001cb10
add esp, 0xc
call fcn.1000a390
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018f70
Capabilities:
Create thread

Disassembly:
jae 0x10018f6e
jmp 0x10018f69
call fcn.10018f70
jae 0x10018f69
add esp, 4
jmp 0x10018f75
dec dword [esp]
jno 0x10018f7a
jns 0x10018f65
jp 0x10018f7e
add esp, 4
popf
jmp 0x10018f85
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10018f9e
jne 0x10018f9e
call 0x1fc1c2f2
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10018f10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
clc
jae 0x10018fcc
pop ss
add byte [esi - 0x64], ah
pushf
push 0xa
jae 0x10018fd9
jmp 0x10018fd4
call 0x10018fdb
jae 0x10018fd4
add esp, 4
jmp 0x10018fe0
dec dword [esp]
jno 0x10018fe5
jns 0x10018fd0
jp 0x10018fe9
add esp, 4
popf
jmp 0x10018ff0
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10019009
jne 0x10019009
add byte [ebx + eax - 0x15], bh
add eax, dword [eax]
jl 0x1001900e
jmp 0x10019010
je 0x1001900b
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001902a
jne 0x10019029
call 0x930580b1
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10019038
jne 0x10019038
call 0x10fe0dbf
cmp dword [ebp - 4], 0
jne 0x10019107
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.1000a390
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018fdb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x10018f6e
jmp 0x10018f69
call fcn.10018f70
jae 0x10018f69
add esp, 4
jmp 0x10018f75
dec dword [esp]
jno 0x10018f7a
jns 0x10018f65
jp 0x10018f7e
add esp, 4
popf
jmp 0x10018f85
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10018f9e
jne 0x10018f9e
call 0x1fc1c2f2
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10018f10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
clc
jae 0x10018fcc
pop ss
add byte [esi - 0x64], ah
pushf
push 0xa
jae 0x10018fd9
jmp 0x10018fd4
call 0x10018fdb
jae 0x10018fd4
add esp, 4
jmp 0x10018fe0
dec dword [esp]
jno 0x10018fe5
jns 0x10018fd0
jp 0x10018fe9
add esp, 4
popf
jmp 0x10018ff0
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10019009
jne 0x10019009
add byte [ebx + eax - 0x15], bh
add eax, dword [eax]
jl 0x1001900e
jmp 0x10019010
je 0x1001900b
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001902a
jne 0x10019029
call 0x930580b1
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10019038
jne 0x10019038
call 0x10fe0dbf
cmp dword [ebp - 4], 0
jne 0x10019107
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.1000a390
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret