joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100047a5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebx
clc
and byte [ebp - 0x354], 0
and byte [ebp - 0x353], 0
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
inc dword [esi - 0x3a]
test dword [edi + 0x40fffffc], esi
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
mov esi, 0x25fffffc

Function at 0x100047da
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esi, 0x25fffffc
lea eax, [ebp - 0x354]
push eax
call fcn.10003f57
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
jne 0x10004807
call fcn.10003f0c
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
invalid

Function at 0x100047f1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esi, 0x25fffffc
lea eax, [ebp - 0x354]
push eax
call fcn.10003f57
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
jne 0x10004807
call fcn.10003f0c
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
invalid

Function at 0x1000658d
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x1000a194
call fcn.100099f0
sub esp, 0x1c
push esi
push edi
push str.CLSID_
lea ecx, [ebp - 0x1c]
call fcn.10001d9b
push dword [0x1000b9b0]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.10002034
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push str.InprocServer32
call fcn.10001ca1
push dword [eax]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, 0x80000000
push edi
call esi
push dword [ebp - 0x28]
call fcn.10002447
pop ecx
push dword [ebp - 0x1c]
push edi
call esi
call fcn.10006269
test al, al
pop edi
pop esi
je 0x1000662a
lea eax, [ebp - 0x10]
push eax
push 2
push 0
push dword [0x1000b9ac]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000662a
push dword [0x1000b9b0]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x1c]
call fcn.10002447
pop ecx
mov ecx, dword [ebp - 0xc]
push 1
pop eax
mov dword fs:[0], ecx
leave
ret
Function at 0x100092ab
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.10009585
and dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp bx, ax
jne 0x100092e4
movzx ecx, ax
mov eax, ecx
mov edx, edi
shr eax, 0xa
and ecx, 0x3ff
mov dword [esi], eax
call fcn.100092e8
pop edi
pop esi
pop ebx
ret
Function at 0x10001570
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100270ed
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x10034040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x10031070]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x7e64486e
mov dword [ebp - 0x2c], 0x796e7f65
mov byte [ebp - 0x28], 0
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x17
jb 0x100015c8
mov byte [ebp - 0x28], 0
mov dl, 4
mov dword [ebp - 0x20], 0x76616f04
xor ecx, ecx
mov dword [ebp - 0x1c], 0x3768616a
mov dword [ebp - 0x18], 0x68602a36
mov word [ebp - 0x14], 0x68
lea eax, [ebp - 0x1f]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x10001609
mov dl, byte [ebp - 0x20]
jmp 0x100015f8
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x13], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x3f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10009240
cmp al, 0xe9
jne 0x100016c5
movaps xmm0, xmmword [0x10031050]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x5a
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x10001644
xorps xmm0, xmm0
mov byte [ebp - 0x13], 0
lea ecx, [ebp - 0x23]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001670
sub ecx, edx
lea eax, [ebp - 0x23]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.10002470
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.100098f0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x100016c5
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100016bb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100016d7
push ecx
push edx
call fcn.1000e3e6
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1001325f
int3
Function at 0x100016e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002711d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x10034040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dl, 0x69
mov dword [ebp - 0x20], 0x4001d69
mov dword [ebp - 0x1c], 0x1d0c2e0c
xor ecx, ecx
mov dword [ebp - 0x18], 0xc04003d
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x1f]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xb
jae 0x10001747
mov dl, byte [ebp - 0x20]
jmp 0x10001736
mov byte [ebp - 0x14], 0
mov dl, 0x1c
mov dword [ebp - 0x38], 0x6e79771c
xor ecx, ecx
mov dword [ebp - 0x34], 0x2f707972
mov dword [ebp - 0x30], 0x7078322e
mov word [ebp - 0x2c], 0x70
nop word [eax + eax]
lea eax, [ebp - 0x37]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x10001781
mov dl, byte [ebp - 0x38]
jmp 0x10001770
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x1f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10009240
cmp al, 0xe9
jne 0x10001845
movaps xmm0, xmmword [0x10030ff0]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x2c], 0x49
nop dword [eax]
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x10
jb 0x100017c0
xorps xmm0, xmm0
mov byte [ebp - 0x2b], 0
lea ecx, [ebp - 0x3b]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100017f0
sub ecx, edx
lea eax, [ebp - 0x3b]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.10002470
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.100098f0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x10001845
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000183b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001857
push ecx
push edx
call fcn.1000e3e6
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1001325f
int3
Function at 0x10001860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002714d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x10034040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dl, 0x17
mov dword [ebp - 0x34], 0x63725017
mov dword [ebp - 0x30], 0x7c747e43
xor ecx, ecx
mov dword [ebp - 0x2c], 0x79627854
mov word [ebp - 0x28], 0x63
lea eax, [ebp - 0x33]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x100018c9
mov dl, byte [ebp - 0x34]
jmp 0x100018b8
mov byte [ebp - 0x27], 0
mov dl, 0x6b
mov dword [ebp - 0x24], 0x190e006b
xor ecx, ecx
mov dword [ebp - 0x20], 0x58070e05
mov dword [ebp - 0x1c], 0x70f4559
mov word [ebp - 0x18], 7
nop dword [eax]
lea eax, [ebp - 0x23]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x10001901
mov dl, byte [ebp - 0x24]
jmp 0x100018f0
lea eax, [ebp - 0x23]
mov byte [ebp - 0x17], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x33]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10009240
cmp al, 0xe9
jne 0x100019f8
mov byte [ebp - 0x24], 0x2c
mov cl, 0x45
xor cl, byte [ebp - 0x24]
mov al, 0x78
xor al, byte [ebp - 0x24]
mov ch, 0x6f
mov byte [ebp - 0x23], al
mov dl, 0x4f
mov byte [ebp - 0x22], cl
mov dh, 0x43
mov cl, byte [ebp - 0x24]
mov ah, 0x47
mov byte [ebp - 0x11], 0x59
xor dl, cl
mov al, byte [ebp - 0x11]
xor ch, cl
xor al, cl
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0x1d], al
xor dh, cl
mov al, byte [ebp - 0x12]
xor ah, cl
xor al, cl
mov byte [ebp - 0x13], 0x58
mov byte [ebp - 0x1c], al
xorps xmm0, xmm0
mov al, byte [ebp - 0x13]
xor al, cl
mov byte [ebp - 0x1f], ch
lea ecx, [ebp - 0x23]
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x21], dl
mov byte [ebp - 0x1e], dh
lea edx, [ecx + 1]
mov byte [ebp - 0x20], ah
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], 0
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100019a3
sub ecx, edx
lea eax, [ebp - 0x23]
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.10002470
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
call fcn.100098f0
mov ecx, dword [ebp - 0x28]
cmp ecx, 0xf
jbe 0x100019f8
mov edx, dword [ebp - 0x3c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100019ee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001a0a
push ecx
push edx
call fcn.1000e3e6
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1001325f
int3

Function at 0x10001cf0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
ret
Function at 0x10001d00
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10032370
push 0x1000f8a0
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x10034040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001d95
xor al, al
jmp 0x10001e1e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001dc0
xor al, al
jmp 0x10001e1e
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001e0b
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000e385
mov esp, ebp
pop ebp
ret
Function at 0x100026b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10027210
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x10034040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xb0], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x98
mov ebx, eax
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.100101d0
add esp, 8
lea ecx, [ebp - 0xa8]
call fcn.100075c0
mov dword [ebp - 4], 0
xor eax, eax
movaps xmm0, xmmword [0x10030fa0]
movups xmmword [ebp - 0xc4], xmm0
mov dword [ebp - 0xb4], 0x304b1f
nop word [eax + eax]
mov cl, byte [ebp - 0xc4]
xor byte [ebp + eax - 0xc3], cl
inc eax
cmp eax, 0x12
jb 0x10002740
lea edx, [ebp - 0xc3]
mov byte [ebp - 0xb1], 0
lea ecx, [ebp - 0xa8]
call fcn.100055e0
mov esi, eax
push 0
push 8
mov eax, dword [esi]
mov eax, dword [eax + 4]
or dword [eax + esi + 0x14], 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0x14]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ecx + esi + 0x14], eax
lea eax, [ebp - 0xd8]
push eax
call fcn.1000af0a
add esp, 0xc
mov ecx, dword [eax]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
push eax
call ecx
mov eax, dword [esi]
add esp, 0xc
mov ecx, esi
mov eax, dword [eax + 4]
push ebx
mov byte [eax + esi + 0x40], 0x30
call fcn.10002c90
mov ecx, eax
mov byte [ebp - 0xaa], 0
mov dl, 0x17
mov byte [ebp - 0xaa], 0
mov al, 0x4a
mov byte [ebp - 0xac], dl
xor al, dl
lea edx, [ebp - 0xab]
mov byte [ebp - 0xab], al
call fcn.100055e0
push edi
lea ecx, [ebp - 0xa8]
call fcn.100051e0
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xa8], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0xac], eax
lea ecx, [ebp - 0xa4]
call fcn.100074f0
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xa8], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xa8]
mov edx, dword [eax + 4]
lea ecx, [edx - 8]
mov dword [ebp + edx - 0xac], ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x58], vtable.std::ios_base.0
call fcn.1000aafe
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000e385
mov esp, ebp
pop ebp
ret
Function at 0x10008e70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movaps xmm0, xmmword [0x100310e0]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
push esi
movaps xmm0, xmmword [0x100310f0]
movups xmmword [ebp - 0x24], xmm0
push edi
movaps xmm0, xmmword [str.Morktyxok_3_]
movups xmmword [ebp - 0x14], xmm0
nop dword [eax + eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x10008ea0
push 0
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], 0
push eax
push 0
push 0x10037760
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10008f8c
push 0x1003775c
push 0
push 0
push 0x8004
push dword [0x10037760]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10008f8c
movaps xmm0, xmmword [0x10031110]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x653d6b6c
movaps xmm0, xmmword [0x10030fe0]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x6f397f4d
movaps xmm0, xmmword [str.ejhMC_RYGoaI9_]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x2c7d7758
mov word [ebp - 4], 0x70
nop
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x10008f30
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], 0
push eax
push dword [0x1003775c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10008f8c
push 0x10037758
push 0x800000
push dword [0x1003775c]
push 0x6801
push dword [0x10037760]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x10008f8c
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10037754], eax
call fcn.1000cfd0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.1000d4a0
push 0x100088a0
push 0x10037764
call fcn.1000cce0
call fcn.1000d030
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push 0x8f5430
call edi
test eax, eax
jne 0x10008ffc
mov dword [0x10037764], 0x8f5430
call fcn.1000cfd0
call esi
push eax
call fcn.1000d4a0
push 0x100088a0
push 0x10037764
call fcn.1000c850
call fcn.1000d030
call fcn.1000cfd0
call esi
push eax
call fcn.1000d4a0
push 0x10008cb0
push 0x10037750
call fcn.1000cce0
call fcn.1000d030
push 4
push 0x450890
call edi
test eax, eax
jne 0x10009055
mov dword [0x10037750], 0x450890
call fcn.1000cfd0
call esi
push eax
call fcn.1000d4a0
push 0x10008cb0
push 0x10037750
call fcn.1000c850
call fcn.1000d030
call fcn.1000cfd0
call esi
push eax
call fcn.1000d4a0
push 0x10008d50
push 0x1003774c
call fcn.1000cce0
call fcn.1000d030
push 4
push 0x4504c0
call edi
test eax, eax
jne 0x100090ae
mov dword [0x1003774c], 0x4504c0
call fcn.1000cfd0
call esi
push eax
call fcn.1000d4a0
push 0x10008d50
push 0x1003774c
call fcn.1000c850
call fcn.1000d030
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100098f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100279cd
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10034040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [0x1003776c], 0
je 0x10009a37
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
sub eax, dword [0x100377e0]
sbb edx, dword [0x100377e4]
mov dword [ebp - 0x34], edx
jne 0x1000994e
cmp eax, 0x3e8
jb 0x10009a4e
call esi
push ecx
lea ecx, [ebp - 0x2c]
mov dword [0x100377e0], eax
mov dword [0x100377e4], edx
call fcn.10007840
mov dword [ebp - 0x2c], vtable.ByteBuffer.0
mov byte [ebp - 0x28], 1
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x34], 0x1000
call fcn.10007a20
mov dword [ebp - 4], 1
mov edi, dword [ebp - 0x18]
mov esi, edi
mov edx, dword [ebp - 0x1c]
sub esi, edx
mov dword [ebp - 0x2c], vtable.Packet.0
cmp esi, 0x989680
ja 0x10009a0a
mov ecx, dword [ebp - 0x20]
inc ecx
cmp esi, ecx
jae 0x10009a00
mov eax, dword [ebp - 0x14]
sub eax, edx
cmp ecx, eax
jbe 0x100099e9
push ecx
push ecx
lea ecx, [ebp - 0x1c]
call fcn.100078a0
jmp 0x100099fd
sub ecx, esi
push ecx
push 0
push edi
lea esi, [edi + ecx]
call fcn.100101d0
add esp, 0xc
mov dword [ebp - 0x18], esi
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov byte [edx + eax], 0xa1
inc dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 2
call fcn.10009d30
push ebx
mov ecx, eax
call fcn.10009d10
lea ecx, [ebp - 0x2c]
call fcn.10009da0
mov edx, dword [ebp - 0x18]
mov ecx, eax
sub edx, dword [ebp - 0x1c]
call fcn.100092b0
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000e385
mov esp, ebp
pop ebp
ret
Function at 0x10009f50
Capabilities:
Allocate or change rwx memory
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x10034040]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, 0xb
mov dword [ebp - 0x2f8], 0x677f590b
mov dword [ebp - 0x2f4], 0x6f6a6447
xor eax, eax
mov dword [ebp - 0x2f0], 0x62797f58
mov word [ebp - 0x2ec], 0x6c65
mov byte [ebp - 0x2ea], 0
xor byte [ebp + eax - 0x2f7], cl
inc eax
cmp eax, 0xd
jae 0x10009faa
mov cl, byte [ebp - 0x2f8]
jmp 0x10009f95
push ebx
mov byte [ebp - 0x2e8], 4
mov al, 0x6a
xor al, byte [ebp - 0x2e8]
mov bl, 0x68
mov ah, bl
mov byte [ebp - 0x2e7], al
mov al, byte [ebp - 0x2e8]
mov dl, 0x60
mov bh, ah
mov byte [ebp - 0x2d9], ah
mov dh, dl
mov byte [ebp - 0x2de], 0
xor dl, al
mov byte [ebp - 0x2ea], 0
xor bl, al
mov byte [ebp - 0x2e5], dl
xor ah, al
mov byte [ebp - 0x2e4], bl
xor dh, al
mov byte [ebp - 0x2e3], ah
xor bh, al
mov byte [ebp - 0x2e1], dh
mov cl, 0x70
mov byte [ebp - 0x2e0], bh
xor cl, al
mov byte [ebp - 0x2de], 0
mov ch, 0x2a
mov byte [ebp - 0x2e6], cl
xor ch, al
mov al, byte [ebp - 0x2d9]
xor al, byte [ebp - 0x2e8]
mov byte [ebp - 0x2df], al
lea eax, [ebp - 0x2e7]
push esi
push eax
mov byte [ebp - 0x2e2], ch
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2f7]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
je 0x1000a122
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000a122
push 0x2c8
lea eax, [ebp - 0x2d4]
push 0
push eax
call fcn.100101d0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1000a122
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1000a122
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1000a122
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x10001e40
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1000a122
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e385
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e385
mov esp, ebp
pop ebp
ret