joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009d900
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp ebx, eax
je 0x1009da71
mov eax, dword [edx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.1009eb40
push 0x2c
push edi
call fcn.10128808
mov edx, dword [ebp - 0x10]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x18]
je 0x1009d9cd
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1009d980
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1009da67
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x1009d9e1
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edi], eax
jmp 0x1009d9e4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x1009da67
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x1c]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.1009eb40
push 0x2c
push edi
call fcn.10128808
mov edx, dword [ebp - 0x10]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x18]
je 0x1009da78
cmp esi, eax
jne 0x1009da37
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x1009d9f0
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1009dc00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012ba8d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1016c008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov dword [ebp - 0x28], 0
mov ebx, 0xf
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov dword [ebp - 0x2c], eax
cmp esi, eax
je 0x1009dcfe
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x1009dc85
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1009dc70
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.10011990
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x14]
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x1009dc9e
cmp ebx, 0x10
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmovae eax, edi
mov byte [eax + ecx], 0
jmp 0x1009dcaa
push ecx
sub ecx, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.10020040
cmp dword [ebp - 0x14], 0x10
lea ebx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edi, 0x811c9dc5
mov edx, dword [ebp - 0x18]
cmovae ebx, eax
xor ecx, ecx
test edx, edx
je 0x1009dcd9
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, edx
jb 0x1009dcc5
mov eax, dword [ebp - 0x28]
cmp edi, dword [ebp + 8]
jne 0x1009dce9
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x1009dcf9
dec ecx
mov dword [ebp - 0x30], ecx
add esi, 0x1c
cmp esi, dword [ebp - 0x2c]
je 0x1009dd01
mov ebx, dword [ebp - 0x14]
jmp 0x1009dc5c
mov esi, dword [esi + 0x18]
jmp 0x1009dd03
mov eax, dword [ebp - 0x28]
xor esi, esi
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x1009dd36
inc ecx
mov edx, eax
cmp ecx, 0x1000
jb 0x1009dd2c
mov eax, dword [eax - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x2c], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1009dd56
mov eax, dword [ebp - 0x2c]
push ecx
push eax
call fcn.10128808
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1012838d
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1009dd60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012ba8d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1016c008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov dword [ebp - 0x28], 0
mov ebx, 0xf
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov dword [ebp - 0x2c], eax
cmp esi, eax
je 0x1009de5e
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x1009dde5
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1009ddd0
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.10011990
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x14]
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x1009ddfe
cmp ebx, 0x10
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmovae eax, edi
mov byte [eax + ecx], 0
jmp 0x1009de0a
push ecx
sub ecx, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.10020040
cmp dword [ebp - 0x14], 0x10
lea ebx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edi, 0x811c9dc5
mov edx, dword [ebp - 0x18]
cmovae ebx, eax
xor ecx, ecx
test edx, edx
je 0x1009de39
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, edx
jb 0x1009de25
mov eax, dword [ebp - 0x28]
cmp edi, dword [ebp + 8]
jne 0x1009de49
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x1009de59
dec ecx
mov dword [ebp - 0x30], ecx
add esi, 0x1c
cmp esi, dword [ebp - 0x2c]
je 0x1009de61
mov ebx, dword [ebp - 0x14]
jmp 0x1009ddbc
mov esi, dword [esi + 0x18]
jmp 0x1009de63
mov eax, dword [ebp - 0x28]
xor esi, esi
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x1009de96
inc ecx
mov edx, eax
cmp ecx, 0x1000
jb 0x1009de8c
mov eax, dword [eax - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x2c], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1009deb6
mov eax, dword [ebp - 0x2c]
push ecx
push eax
call fcn.10128808
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1012838d
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1009e940
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
jbe 0x1009e971
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, 1
mov dword [ebp - 4], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10013730
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x1009ea84
nop word [eax + eax]
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
mov dword [ebp + 8], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x1009ea04
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1009ea77
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x1009ea3e
mov eax, dword [eax]
mov dword [ebp + 8], eax
cmp eax, ecx
je 0x1009ea36
mov ebx, dword [ecx + 4]
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 4]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x1009ea77
mov edi, eax
cmp dword [ebp + 8], eax
je 0x1009ea54
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x1009ea8d
cmp dword [ebp + 8], eax
jne 0x1009ea45
mov eax, dword [ecx + 4]
mov dword [ebp + 8], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp + 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x1009e9b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 4]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x1009ea77

Function at 0x1009f2a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1009f2cb
push 0
push 0
push 0
push 0x1001c600
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1009f2cb
mov eax, 1
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x100a9fd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012a75b
mov eax, dword fs:[0]
push eax
sub esp, 0xa5c
mov eax, dword [0x1016c008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x9e8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0xa5c], 0
movups xmmword [ebp - 0xa44], xmm0
mov dword [ebp - 0x9f4], 0
movups xmmword [ebp - 0xa34], xmm0
mov dword [ebp - 0x9d8], 0
movups xmmword [ebp - 0xa24], xmm0
mov dword [ebp - 0x9d4], 0xf
movups xmmword [ebp - 0xa14], xmm0
mov byte [ebp - 0x9e8], 0
movups xmmword [ebp - 0xa04], xmm0
push fcn.100112c0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x62c]
push 0x100113a0
push 0x41
push 0x18
push eax
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x694], 0
mov dword [ebp - 0x690], 0
mov byte [ebp - 0x680], 0
mov dword [ebp - 0x67c], 0
mov byte [ebp - 0x678], 0
movups xmmword [ebp - 0x674], xmm0
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x660], 0
mov byte [ebp - 0x638], 0
mov byte [ebp - 0x636], 0
call fcn.10128839
lea eax, [ebp - 0xa68]
mov dword [ebp - 4], 1
push eax
lea ecx, [esi + 0x30]
call fcn.100063b0
mov dword [ebp - 4], 2
mov ecx, dword [0x101f4718]
push dword [ebp - 0x67c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
call eax
push fcn.100112c0
push 0x41
push 0x18
lea eax, [ebp - 0x62c]
push eax
call fcn.101283d9
mov edx, dword [ebp - 0x9d4]
cmp edx, 0x10
jb 0x100aa16b
mov ecx, dword [ebp - 0x9e8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100aa161
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100aa161
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10128808
add esp, 8
lea ecx, [esi + 8]
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.10011610
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x20], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1012838d
mov esp, ebp
pop ebp
ret
Function at 0x100b7630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, edx
lea eax, [ecx - 1]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
mov esi, edi
sar eax, 1
mov dword [ebp - 8], eax
cmp edi, eax
jge 0x100b76ad
add esi, esi
lea edx, [ebx + 0x20]
lea ecx, [ebx + 0x3c]
lea eax, [esi*8]
sub eax, esi
lea edx, [edx + eax*4]
lea ecx, [ecx + eax*4]
call fcn.100611d0
movzx eax, al
xor eax, 1
inc eax
add esi, eax
lea eax, [esi*8]
sub eax, esi
lea edx, [ebx + eax*4]
lea eax, [edi*8]
sub eax, edi
lea ecx, [ebx + eax*4]
mov eax, dword [edx]
mov dword [ecx], eax
lea eax, [edx + 4]
push eax
add ecx, 4
call fcn.1001fbe0
mov eax, dword [ebp - 8]
mov edi, esi
cmp esi, eax
jl 0x100b7654
mov ecx, dword [ebp + 8]
cmp esi, eax
jne 0x100b76e2
test cl, 1
jne 0x100b76e2
lea eax, [ecx*8]
sub eax, ecx
lea edx, [ebx + eax*4]
lea eax, [edi*8]
sub eax, edi
lea ecx, [ebx + eax*4]
mov eax, dword [edx - 0x1c]
mov dword [ecx], eax
lea eax, [edx - 0x18]
push eax
add ecx, 4
call fcn.1001fbe0
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 4], edi
jge 0x100b773f
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 8], ecx
lea esi, [edi - 1]
mov edx, ecx
sar esi, 1
lea eax, [esi*8]
sub eax, esi
lea eax, [ebx + eax*4]
mov dword [ebp + 8], eax
add eax, 4
mov ecx, eax
mov dword [ebp - 0xc], eax
call fcn.100611d0
test al, al
je 0x100b773f
push dword [ebp - 0xc]
lea eax, [edi*8]
sub eax, edi
lea ecx, [ebx + eax*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ecx], eax
add ecx, 4
call fcn.1001fbe0
mov edi, esi
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], esi
jl 0x100b76f0
mov edx, dword [ebp + 0xc]
lea eax, [edi*8]
sub eax, edi
lea ecx, [ebx + eax*4]
mov eax, dword [edx]
mov dword [ecx], eax
lea eax, [edx + 4]
push eax
add ecx, 4
call fcn.1001fbe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100bd3c0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012bbcd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x1016c008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x101f470c]
mov edi, dword [esi + 0x174]
test edi, edi
setg byte [ebp - 0x54]
cmp dword [0x101dff3c], 4
jne 0x100bd43d
mov edx, dword [esi + 0x4cb0]
add edx, dword [esi + 0x4cac]
mov ecx, dword [0x101f46ac]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push dword [ebp - 0x54]
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x1021e414], 0
jne 0x100bd579
movaps xmm0, xmmword [0x10163500]
xor eax, eax
movaps xmm2, xmmword [0x10163740]
movups xmmword [ebp - 0x50], xmm0
mov word [ebp - 0x30], 0x282d
movaps xmm0, xmmword [0x101632f0]
movups xmmword [ebp - 0x40], xmm0
mov byte [ebp - 0x2e], 0x6b
movups xmm0, xmmword [ebp + eax - 0x50]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x50], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100bd473
cmp eax, 0x23
jae 0x100bd49c
xor byte [ebp + eax - 0x50], 0x6b
inc eax
cmp eax, 0x23
jb 0x100bd491
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100bd4c0
sub ecx, edx
lea eax, [ebp - 0x50]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.10011990
mov dword [ebp - 4], 0
mov edx, dword [0x101f4658]
test edx, edx
je 0x100bd4ec
mov edx, dword [edx + 0x50]
jmp 0x100bd4ee
xor edx, edx
mov eax, dword [0x101f4650]
test eax, eax
je 0x100bd4fc
mov eax, dword [eax + 0x18]
jmp 0x100bd4fe
xor eax, eax
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.10005a30
mov edi, dword [ebp - 0x58]
add esp, 8
mov edx, dword [ebp - 0x18]
inc edi
cmp edx, 0x10
jb 0x100bd548
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100bd53e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100bd53e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10128808
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x54]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x54], 0
call esi
lea eax, [ebp - 0x54]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x54]
push 4
push edi
call esi
mov byte [0x1021e414], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1012838d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100c08c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1016c008]
xor eax, ebp
mov dword [ebp - 4], eax
movss dword [ebp - 0x24], xmm1
xor eax, eax
mov dword [ebp - 0x1c], 0xf050a39
mov dword [ebp - 0x18], 0x72d0604
mov dword [ebp - 0x14], 0x6b1f0a04
nop dword [eax]
xor byte [ebp + eax - 0x1c], 0x6b
inc eax
cmp eax, 0xc
jb 0x100c08f0
mov dword [ebp - 0x10], 0xf1f181d
xor eax, eax
mov dword [ebp - 0xc], 0x45090207
mov dword [ebp - 8], 0x6b07070f
xor byte [ebp + eax - 0x10], 0x6b
inc eax
cmp eax, 0xc
jb 0x100c0912
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
movss xmm0, dword [ebp - 0x24]
sub esp, 8
mov dword [ebp - 0x20], eax
movss dword [esp + 4], xmm0
mov dword [esp], 0
call dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
add esp, 8
fstp dword [ebp - 0x20]
movss xmm0, dword [ebp - 0x20]
xor ecx, ebp
call fcn.1012838d
mov esp, ebp
pop ebp
ret
Function at 0x100d1cd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x100d1d2e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x100d1cf0
mov eax, dword [edi]
jmp 0x100d1e19
cmp eax, 0x4e0
jb 0x100d1e19
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x100d1d50
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x100d1da0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401581
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x431440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
push 5
call fcn.00402fb2
xor esi, esi
add esp, 0xc
inc esi
cmp eax, esi
jge 0x4015b6
push 3
pop eax
jmp 0x40179e
push ebx
push edi
push 0x431fc0
push 0x431db8
push str.__s___s
mov ebx, 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00403cbc
lea eax, [ebp - 0x20c]
mov edi, 0x4327e0
push eax
push str.Executing:__s
push ebx
push edi
call fcn.00403cbc
mov eax, dword [0x432c00]
add esp, 0x24
test eax, eax
je 0x40160c
push edi
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push str.REALUSER
call fcn.00409015
pop ecx
cmp eax, esi
jne 0x401622
push esi
call fcn.00408090
pop ecx
and dword [ebp - 0x260], 0
lea eax, [ebp - 0x25c]
push 0x3c
push 0
push eax
mov dword [ebp - 0x264], 0x44
call fcn.0040e980
movsx eax, byte [0x4323d0]
push eax
call fcn.004112cd
add esp, 0x10
cmp eax, 0x48
jne 0x401667
xor eax, eax
mov dword [ebp - 0x238], esi
mov word [ebp - 0x234], ax
xor eax, eax
lea edi, [ebp - 0x220]
stosd dword es:[edi], eax
xor edx, edx
xor ecx, ecx
mov ebx, edx
cmp byte [0x4321c8], cl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x264]
push eax
mov eax, 0x4321c8
cmove eax, ecx
push eax
push edx
push 0x20
push edx
push edx
push edx
lea eax, [ebp - 0x20c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, esi
jne 0x40176b
mov edi, 0x103
mov dword [ebp - 0x210], edi
cmp byte [0x433a64], bl
jne 0x401705
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, esi
jne 0x4016fb
mov eax, dword [ebp - 0x210]
cmp eax, edi
jne 0x401718
call fcn.00405ab0
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x433a64], bl
je 0x4016c5
mov eax, dword [ebp - 0x210]
cmp eax, edi
jne 0x401718
push edi
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x40173e
push eax
push str._08x
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.00403cbc
add esp, 0x10
lea eax, [ebp - 0x20c]
jmp 0x401743
mov eax, 0x4266e8
push eax
push str.LASTERROR
call fcn.00408de7
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
pop ecx
push dword [ebp - 0x220]
call esi
push dword [ebp - 0x21c]
call esi
xor esi, esi
inc esi
jmp 0x401783
push str.SILENT
push 0x4325d8
call fcn.00411399
neg eax
pop ecx
sbb ebx, ebx
pop ecx
and ebx, 0x1b
push str.REALUSER
call fcn.00409015
pop ecx
cmp eax, esi
jne 0x40179a
push 0
call fcn.00408090
pop ecx
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040d5ca
leave
ret