joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018d10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab2a8
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [ebp - 4], 0
push 2
mov dword [ebp - 0x150], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10018e31
sub esp, 0x18
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x12c], 0
jne 0x10018d94
xor eax, eax
jmp 0x10018da9
lea eax, [ebp - 0x12c]
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10018da0
sub eax, esi
push eax
lea eax, [ebp - 0x12c]
mov ecx, edx
push eax
call fcn.10002840
lea ecx, [ebp - 0x28]
call fcn.10018b30
mov esi, dword [ebp - 0x14]
lea ecx, [ebp + 8]
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x28]
add esp, 0x18
cmp dword [ebp + 0x1c], 0x10
cmovae ecx, dword [ebp + 8]
cmp esi, 0x10
cmovae eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10018e00
test dl, dl
je 0x10018dfc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10018e00
add eax, 2
add ecx, 2
test dl, dl
jne 0x10018de0
xor eax, eax
jmp 0x10018e05
sbb eax, eax
or eax, 1
test eax, eax
je 0x10018e6d
cmp esi, 0x10
jb 0x10018e1b
lea eax, [esi + 1]
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.10002720
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10018d71
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x10018e4f
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.10002720
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006e1c5
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x148]
cmp eax, 0x10
jb 0x10018e3a
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10002720
jmp 0x10018e3a
Function at 0x10018ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100c8900]
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x3c], 0xf353432
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x38], 0x3a3e2933
mov word [ebp - 0x34], 0x3f
mov cl, byte [ebp - 0x4c]
xor byte [ebp + eax - 0x4b], cl
inc eax
cmp eax, 0x18
jb 0x10018ed4
push ebx
mov byte [ebp - 0x30], 0x47
mov al, 0x29
xor al, byte [ebp - 0x30]
mov bl, 0x2b
mov ah, bl
mov byte [ebp - 0x2f], al
mov al, byte [ebp - 0x30]
mov dl, 0x23
mov bh, ah
mov byte [ebp - 0x21], ah
xor bl, al
mov byte [ebp - 0x26], 0
xor ah, al
mov byte [ebp - 0x33], 0
xor bh, al
mov byte [ebp - 0x2b], ah
mov dh, dl
mov byte [ebp - 0x2c], bl
xor dl, al
mov byte [ebp - 0x28], bh
xor dh, al
mov byte [ebp - 0x2d], dl
mov cl, 0x33
mov byte [ebp - 0x29], dh
xor cl, al
mov byte [ebp - 0x26], 0
mov ch, 0x69
mov byte [ebp - 0x2e], cl
xor ch, al
mov al, byte [ebp - 0x21]
xor al, byte [ebp - 0x30]
mov byte [ebp - 0x27], al
lea eax, [ebp - 0x4b]
push eax
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x2a], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ebx
test eax, eax
jne 0x10018f63
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e1c5
mov esp, ebp
pop ebp
ret
push 0
push 0x1c
lea ecx, [ebp - 0x20]
push ecx
push 0
push esi
call eax
mov ecx, dword [ebp - 0x14]
xor edx, edx
test eax, eax
pop esi
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e1c5
mov esp, ebp
pop ebp
ret
Function at 0x10018f90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100c8d00]
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x24], 0x68525355
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x20], 0x5d594e54
mov word [ebp - 0x1c], 0x58
mov cl, byte [ebp - 0x34]
xor byte [ebp + eax - 0x33], cl
inc eax
cmp eax, 0x18
jb 0x10018fc4
push ebx
mov byte [ebp - 0x18], 0x69
mov al, 7
xor al, byte [ebp - 0x18]
mov bl, 5
mov ah, bl
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x18]
mov dl, 0xd
mov bh, ah
mov byte [ebp - 9], ah
xor bl, al
mov byte [ebp - 0xe], 0
xor ah, al
mov byte [ebp - 0x1b], 0
xor bh, al
mov byte [ebp - 0x13], ah
mov dh, dl
mov byte [ebp - 0x14], bl
xor dl, al
mov byte [ebp - 0x10], bh
xor dh, al
mov byte [ebp - 0x15], dl
mov cl, 0x1d
mov byte [ebp - 0x11], dh
xor cl, al
mov byte [ebp - 0xe], 0
mov ch, 0x47
mov byte [ebp - 0x16], cl
xor ch, al
mov al, byte [ebp - 9]
xor al, byte [ebp - 0x18]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0x33]
push eax
lea eax, [ebp - 0x17]
mov byte [ebp - 0x12], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ebx
test eax, eax
jne 0x10019053
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e1c5
mov esp, ebp
pop ebp
ret
push 0
push 4
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 9
push esi
call eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.1006e1c5
mov esp, ebp
pop ebp
ret

Function at 0x100191f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x100d6084]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
push 2
mov edi, ecx
mov dword [esp + 0x18], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10019252
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax]
cmp dword [esp + 0x18], edi
je 0x10019270
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
jne 0x10019240
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.1006e1c5
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1006e1c5
mov esp, ebp
pop ebp
ret

Function at 0x100193c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 1
mov dword [0x100d6ba4], edx
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x100d6ba4], edx
inc eax
cmp eax, 0x270
jl 0x100193d1
mov dword [0x100d6ba0], 0x270
pop ebp
ret 8
Function at 0x100194f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
nop dword [eax]
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x10019500
pop esi
ret

Function at 0x10019540
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0xe3
push esi
push edi
lea edi, [ebx + 0x9c4]
mov edx, dword [edi + 4]
lea edi, [edi + 4]
xor edx, dword [edi - 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, edx
mov dword [edi - 0x9c4], eax
sub ecx, 1
jne 0x10019550
lea esi, [ebx + 0xd50]
mov edi, 0x18c
mov ecx, dword [esi + 4]
lea esi, [esi + 4]
xor ecx, dword [esi - 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub edi, 1
jne 0x10019592
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret
Function at 0x10019fb0
Capabilities:
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push 0x100db414
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1001a090
push 0x100db410
push 0
push 0
push 0x8004
push dword [0x100db414]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1001a090
movaps xmm0, xmmword [0x100c8d70]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x560e585f
movaps xmm0, xmmword [str.nhxYhM]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x5c0a4c7e
movaps xmm0, xmmword [str.VY_pHsajtHRz_n]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x1f4e446b
mov word [ebp - 4], 0x43
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x1001a034
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], 0
push eax
push dword [0x100db410]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1001a090
push 0x100db40c
push 0x800000
push dword [0x100db410]
push 0x6801
push dword [0x100db414]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1001a090
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100db408], eax
call fcn.1006ce10
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.1006d2e0
push 0x10019e10
push 0x100db404
call fcn.1006cb20
call fcn.1006ce70
push 4
push 0x450890
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1001a0ff
mov dword [0x100db404], 0x450890
call fcn.1006ce10
call esi
push eax
call fcn.1006d2e0
push 0x10019e10
push 0x100db404
call fcn.1006c690
call fcn.1006ce70
call fcn.1006ce10
call esi
push eax
call fcn.1006d2e0
push 0x10019eb0
push 0x100db400
call fcn.1006cb20
call fcn.1006ce70
push 4
push 0x4504c0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1001a15c
mov dword [0x100db400], 0x4504c0
call fcn.1006ce10
call esi
push eax
call fcn.1006d2e0
push 0x10019eb0
push 0x100db400
call fcn.1006c690
call fcn.1006ce70
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001a640
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.10086ac0
add esp, 0xc
mov eax, 0x100df8c0
cmp dword [0x100df8d4], 0x10
cmovae eax, dword [0x100df8c0]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Option.Ini
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [ebp - 0x110], 0
mov dword [ebp - 0x114], 0xf
mov dword [ebp - 0x118], 0
mov byte [ebp - 0x128], 0
jne 0x1001a6c6
xor eax, eax
jmp 0x1001a6d9
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001a6d0
sub eax, edx
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x128]
call fcn.10002840
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x110]
push eax
push 1
push str.LootWeapon
push str.PetLooting
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
mov edi, 1
push eax
push edi
push str.LootArmor
cmova ecx, edi
push str.PetLooting
mov byte [0x100df948], cl
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
push edi
push str.LootAccessory
cmova ecx, edi
push str.PetLooting
mov byte [0x100df949], cl
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
push edi
push str.LootNormal
cmova ecx, edi
push str.PetLooting
mov byte [0x100df94a], cl
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
push edi
push str.LootMagic
cmova ecx, edi
push str.PetLooting
mov byte [0x100df94b], cl
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
push edi
push str.LootRare
cmova ecx, edi
push str.PetLooting
mov byte [0x100df94c], cl
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
push edi
push str.LootUpgrade
cmova ecx, edi
push str.PetLooting
mov byte [0x100df94d], cl
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
cmova ecx, edi
push edi
mov byte [0x100df94e], cl
push str.LootUnique
push str.PetLooting
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
push edi
push str.LootCraft
cmova ecx, edi
push str.PetLooting
mov byte [0x100df94f], cl
call esi
cmp al, 1
movzx ecx, al
mov eax, dword [ebp - 0x114]
cmova ecx, edi
mov byte [0x100df950], cl
cmp eax, 0x10
jb 0x1001a848
inc eax
lea ecx, [ebp - 0x128]
push eax
push dword [ebp - 0x128]
call fcn.10002720
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1006e1c5
mov esp, ebp
pop ebp
ret
Function at 0x1001a990
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10112669], 0
jne 0x1001a9d8
push 0x10112690
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp eax, 1
jne 0x1001a9c8
push 0x10112698
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov al, 1
mov byte [0x10112668], al
mov byte [0x10112669], al
jmp 0x1001a9dd
xor al, al
mov byte [0x10112669], 1
mov byte [0x10112668], al
jmp 0x1001a9dd
mov al, byte [0x10112668]
test al, al
je 0x1001aa24
push 0x10112690
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [0x10112694]
mov ecx, dword [0x10112690]
call fcn.100a94f0
mov edx, dword [0x1011269c]
mov ecx, dword [0x10112698]
movsd qword [ebp - 8], xmm0
call fcn.100a94f0
movsd xmm1, qword [ebp - 8]
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WINMM.dll_timeGetTime]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c8bf0]
cvtpd2ps xmm0, xmm0
mov esp, ebp
pop ebp
ret
Function at 0x1001aea0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1fc
lea eax, [ebp - 0x200]
mov esi, ecx
push 0
push eax
call fcn.10086ac0
add esp, 0xc
mov dword [ebp - 0x200], 0x1fc
lea eax, [ebp - 0x200]
mov dword [ebp - 0x1fc], esi
mov dword [ebp - 0x1f8], 1
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov byte [0x100db41c], 0
mov byte [0x100db3bb], 0
pop esi
call fcn.1006e1c5
mov esp, ebp
pop ebp
ret
Function at 0x1001c770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab530
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
mov eax, dword [0x100d6084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, byte [0x100db43d]
cmp bl, 0x41
je 0x1001c8c7
mov ecx, 0xd78dd4
xor bh, bh
call fcn.1001c490
mov ecx, eax
call fcn.10001f00
cmp ecx, eax
jne 0x1001c7d3
mov ecx, 0xd78dd4
call fcn.1001c490
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
je 0x1001c7d5
mov bh, 1
call fcn.10001f10
cmp dword [0x100db4a8], eax
mov edx, 1
movzx ecx, bh
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, eax
call fcn.10018ea0
mov ecx, 0xd78dd4
mov esi, eax
call fcn.1001c490
cmp esi, eax
jne 0x1001c833
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, eax
call fcn.10018ea0
mov ecx, dword [0x100db42c]
mov esi, eax
call fcn.10018ea0
cmp eax, esi
jne 0x1001c833
cmp byte [ebp - 0x14], 0
je 0x1001c8c7
movaps xmm0, xmmword [0x100c86b0]
xor ecx, ecx
movups xmmword [ebp - 0x80], xmm0
movzx eax, bl
movaps xmm0, xmmword [0x100c87c0]
push eax
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 0x28353329
mov word [ebp - 0x5c], 0x2b
nop dword [eax]
mov al, byte [ebp - 0x80]
xor byte [ebp + ecx - 0x7f], al
inc ecx
cmp ecx, 0x24
jb 0x1001c860
sub esp, 0x18
mov byte [ebp - 0x5b], 0
lea eax, [ebp - 0x7f]
mov ecx, esp
push eax
call fcn.10002940
lea eax, [ebp - 0x58]
push eax
call fcn.1000f620
add esp, 0x20
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.1001fe90
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x1001c8b5
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.10002720
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
call fcn.1002b870
test eax, eax
je 0x1001c95a
movaps xmm0, xmmword [0x100c8810]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x3f3a3e
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x12
jb 0x1001c8e8
cmp byte [ebp - 0x27], 0
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x1001c915
xor ecx, ecx
jmp 0x1001c929
lea ecx, [ebp - 0x27]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001c920
sub ecx, edx
push ecx
lea eax, [ebp - 0x27]
push eax
lea ecx, [ebp - 0x40]
call fcn.10002840
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 1
call fcn.1001fe90
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x1001c95a
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10002720
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e1f0
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab5b6
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.10086ac0
add esp, 0xc
lea eax, [ebp - 0x118]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x118], 0
jne 0x1001e253
xor ecx, ecx
jmp 0x1001e269
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e260
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
mov ecx, 0x100df97c
push eax
call fcn.10002840
mov cl, 0x6a
mov byte [ebp - 0x11a], 0
mov al, 0x36
mov byte [ebp - 0x11c], cl
xor al, cl
mov byte [ebp - 0x11a], 0
mov byte [ebp - 0x11b], al
jne 0x1001e2a1
xor ecx, ecx
jmp 0x1001e2b9
lea ecx, [ebp - 0x11b]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e2b0
sub ecx, edx
push ecx
push ecx
lea eax, [ebp - 0x11b]
push eax
call fcn.100205f0
push 0xffffffffffffffff
inc eax
mov ecx, 0x100df97c
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.10006b70
mov esi, eax
cmp esi, 0x100df97c
je 0x1001e329
mov ecx, dword [0x100df990]
cmp ecx, 0x10
jb 0x1001e303
inc ecx
push ecx
push dword [0x100df97c]
mov ecx, 0x100df97c
call fcn.10002720
push esi
mov ecx, 0x100df97c
mov dword [0x100df990], 0xf
mov dword [0x100df98c], 0
mov byte [0x100df97c], 0
call fcn.10005dd0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x12c]
cmp eax, 0x10
jb 0x1001e34e
inc eax
lea ecx, [ebp - 0x140]
push eax
push dword [ebp - 0x140]
call fcn.10002720
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [0x100db42c], eax
call fcn.10001f10
mov dword [0x100db4a8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1000fb10
call fcn.1000fbf0
call fcn.10002e50
sidt [ebp - 0x124]
mov eax, dword [ebp - 0x122]
and eax, 0xff000000
cmp eax, 0xff000000
jne 0x1001e3aa
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.10002ec0
call fcn.10002f70
test al, al
jne 0x1001e393
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x128], 0
rdtsc
mov dword [ebp - 0x124], eax
rdtsc
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
sub eax, dword [ebp - 0x124]
cmp eax, 0x1f4
ja 0x1001e393
call fcn.10003020
call fcn.1002b200
mov dword [0x100db4ac], eax
test eax, eax
je 0x1001e409
mov ecx, eax
call fcn.1002b3b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006e1c5
mov esp, ebp
pop ebp
ret
Function at 0x1001fa10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100c8ca0]
xor ecx, ecx
mov eax, dword [0x100db484]
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
movups xmmword [ebp - 0x38], xmm0
mov byte [ebp - 0x28], 0
nop dword [eax]
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0xf
jb 0x1001fa40
sub esp, 0x18
mov byte [ebp - 0x28], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x37], 0
jne 0x1001fa71
xor ecx, ecx
jmp 0x1001fa80
lea ecx, [ebp - 0x37]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001fa77
sub ecx, esi
push ecx
lea eax, [ebp - 0x37]
mov ecx, edx
push eax
call fcn.10002840
lea ecx, [ebp - 0x1c]
call fcn.10069070
mov edi, dword [ebp - 8]
add esp, 0x18
cmp dword [0x100db480], 0
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0
jbe 0x1001faf9
xor edx, edx
mov dword [ebp - 0x20], edx
cmp edi, 0x10
lea ecx, [ebp - 0x1c]
cmovae ecx, ebx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001fac0
sub ecx, esi
mov eax, edx
cmp edi, 0x10
lea esi, [ebp - 0x1c]
cmovae esi, ebx
xor edx, edx
div ecx
mov ecx, dword [ebp - 0x20]
mov al, byte [edx + esi]
mov edx, dword [ebp - 0x3c]
xor byte [ecx + edx], al
mov eax, dword [ebp - 0x24]
inc eax
movzx edx, ax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
cmp edx, dword [0x100db480]
jb 0x1001fab2
cmp edi, 0x10
jb 0x1001fb0b
lea eax, [edi + 1]
push eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.10002720
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006e1c5
mov esp, ebp
pop ebp
ret