joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12ffd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x12ffd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x12ffd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x12ffd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x12ffd94
push eax
push esi
call fcn.0130220b
add esp, 8
pop esi
ret 0x10

Function at 0x12ffda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x12ffe22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x12ffe15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x1318320
push ecx
mov dword [esp + 0x1c], 4
call fcn.01301dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x12ffdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x12ffe30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x12ffec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x12ffeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x1318320
push ecx
mov dword [esp + 0x1c], 4
call fcn.01301dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x12ffeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x12ffe6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x1300000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1300131
push esi
call fcn.01303145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.012f2080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x1300131
push 0
push ebp
call fcn.012f23a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.012f2260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x130008b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.012f22f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1300121
push 0x1318918
push edi
call fcn.013013f0
push eax
push ebx
push esi
call fcn.012fff60
push 0x13188f8
push edi
call fcn.013013f0
push eax
push ebx
push esi
call fcn.012fff60
push 0x13188d8
push edi
call fcn.013013f0
push eax
push ebx
push esi
call fcn.012fff60
push 0x13188c0
push edi
call fcn.013013f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.012fff60
push 0x13188a0
push edi
call fcn.013013f0
push eax
push ebx
push esi
call fcn.012fff60
push 0x1318888
push edi
call fcn.013013f0
push eax
push ebx
push esi
call fcn.012fff60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x13011b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.01301140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.01301140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.01301140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.01301140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x1301bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1301c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x131387c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1301c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1301c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x1003b3b
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
je 0x1003cfe
mov eax, dword [ebp + 0x10]
cmp dword [eax], esi
je 0x1003cfe
cmp byte [0x10072a8], 0
push ebx
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
jne 0x1003b7c
call fcn.0100388f
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1003c33
cmp dword [0x10072a4], esi
je 0x1003c33
mov ebx, 0x100728c
cmp dword [ebp + 8], esi
je 0x1003c38
push ebx
call edi
mov eax, dword [0x10072a4]
mov esi, eax
test eax, eax
je 0x1003bba
push dword [esi + 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1003bc5
mov esi, dword [esi]
test esi, esi
jne 0x1003ba4
push ebx
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
xor esi, esi
jmp 0x1003c38
add esi, 8
mov eax, esi
mov dword [ebp + 8], esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003bd0
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi]
sub eax, edx
sar eax, 1
lea edx, [ecx - 1]
cmp edx, eax
jae 0x1003bee
mov eax, edx
jmp 0x1003c01
mov eax, esi
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1003bf3
sub eax, esi
sar eax, 1
mov esi, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
push ecx
push esi
call fcn.01003ab8
mov eax, dword [edi]
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1003c1d
sub eax, ecx
sar eax, 1
mov dword [edi], eax
push ebx
jmp 0x1003cf6
mov ebx, 0x100728c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010038e6
cmp dword [ebp - 4], esi
jne 0x1003cfc
cmp dword [ebp + 8], esi
je 0x1003cfc
push ebx
call edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
push ebx
call esi
mov edi, eax
pop ecx
test edi, edi
je 0x1003cf1
push dword [ebp + 8]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1003ce9
push 0x34
call esi
mov esi, eax
pop ecx
test esi, esi
je 0x1003ce9
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003c99
sub eax, edx
sar eax, 1
cmp eax, 0x14
jbe 0x1003cb1
push 0x14
pop eax
jmp 0x1003cc5
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003cb7
sub eax, edx
sar eax, 1
push eax
push dword [ebp + 0xc]
lea eax, [esi + 8]
push 0x15
push eax
call fcn.01003ab8
xor eax, eax
mov word [esi + 0x30], ax
mov eax, dword [0x10072a4]
mov dword [esi], eax
mov dword [0x10072a4], esi
jmp 0x1003cf1
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x100728c
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x1004b07
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100725c]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x1004b9c
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1004b25
sub eax, edx
sar eax, 1
mov ecx, 0x104
cmp eax, ecx
ja 0x1004b9c
push esi
push ecx
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcscpy_s
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1004b56
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x20c]
dec eax
dec eax
movzx ecx, word [eax]
cmp cx, 0x5c
je 0x1004b7c
cmp cx, 0x2f
jne 0x1004b83
xor ecx, ecx
mov word [eax], cx
jmp 0x1004b6b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x1004b9e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01005589
leave
ret
Function at 0x1004baf
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0x100725c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push dword [edi + 4]
mov dword [ebp - 0x768], eax
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_wcscpy_s
mov ecx, dword [edi + 4]
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1004bef
sub eax, edx
sar eax, 1
sub ebx, eax
mov eax, ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1004c04
sub eax, ecx
sar eax, 1
push 0x10026bc
lea eax, [ebp + eax*2 - 0x20c]
push ebx
push eax
mov dword [ebp - 0x764], eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x760], eax
cmp eax, 0xffffffff
jne 0x1004c5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x1004dea
mov ecx, 0x10026b8
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004c90
test dx, dx
je 0x1004c8c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004c90
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004c6a
xor eax, eax
jmp 0x1004c95
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1004db0
mov ecx, 0x10026b0
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004cce
test dx, dx
je 0x1004cca
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004cce
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004ca8
xor eax, eax
jmp 0x1004cd3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1004db0
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
push eax
push ebx
push dword [ebp - 0x764]
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [edi + 0xc]
add esp, 0x10
test eax, eax
je 0x1004d14
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push 0x104
lea eax, [ebp - 0x730]
push eax
push dword [edi + 8]
call fcn.0100506e
test eax, eax
je 0x1004db0
cmp dword [edi + 0xc], 0
je 0x1004d8d
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x30c]
push eax
lea edx, [ebp - 0x20c]
call fcn.01004a34
test eax, eax
je 0x1004d8d
test byte [ebp - 0x75c], 0x10
je 0x1004db0
lea esi, [ebp - 0x30c]
call fcn.01004b07
test eax, eax
je 0x1004db0
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
mov eax, esi
push eax
mov eax, dword [ebp + 8]
call fcn.01004879
jmp 0x1004db0
lea esi, [ebp - 0x20c]
call fcn.01004b07
test eax, eax
je 0x1004db0
mov eax, esi
push eax
mov eax, dword [ebp - 0x768]
call fcn.01004952
mov esi, eax
test esi, esi
jne 0x1004dcd
lea eax, [ebp - 0x75c]
push eax
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
test esi, esi
jne 0x1004c5f
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x1004de8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1004de8
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01005589
leave
ret 8
Function at 0x447dc1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x447def
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x447e0d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00447d27
jmp 0x447e0d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x447e0d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00447d27
test edi, edi
mov eax, edi
jne 0x447df7
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001ac0
Capabilities:
Check for debugger via api
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100be084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0xc], 0
call fcn.10001a20
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
jne 0x10001bc8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 8], 0
jne 0x10001bc8
movaps xmm0, xmmword [0x100b2980]
xor eax, eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x605e5f59
mov dword [ebp - 0x24], 0x55535f42
mov word [ebp - 0x20], 0x4343
mov byte [ebp - 0x1e], 0
nop
mov cl, byte [ebp - 0x38]
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0x19
jb 0x10001b30
push ebx
mov byte [ebp - 0x1c], 3
mov al, 0x6d
xor al, byte [ebp - 0x1c]
mov bl, 0x6f
mov ah, bl
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x1c]
mov dl, 0x67
mov bh, ah
mov byte [ebp - 0xd], ah
xor bl, al
mov byte [ebp - 0x12], 0
xor ah, al
mov byte [ebp - 0x1e], 0
xor bh, al
mov byte [ebp - 0x17], ah
mov dh, dl
mov byte [ebp - 0x18], bl
xor dl, al
mov byte [ebp - 0x14], bh
xor dh, al
mov byte [ebp - 0x19], dl
mov cl, 0x77
mov byte [ebp - 0x15], dh
xor cl, al
mov byte [ebp - 0x12], 0
mov ch, 0x2d
mov byte [ebp - 0x1a], cl
xor ch, al
mov al, byte [ebp - 0xd]
xor al, byte [ebp - 0x1c]
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x37]
push eax
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x16], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ebx
test eax, eax
je 0x10001bdb
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 7
push 0xffffffffffffffff
call eax
test eax, eax
je 0x10001bdb
cmp dword [ebp - 0xc], 0
je 0x10001bdb
push 9
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005cea0
mov esp, ebp
pop ebp
ret
Function at 0x10001bf0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x100b2a10]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x5f45694f
mov dword [ebp - 0x18], 0x584f5e44
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x17
jb 0x10001c15
mov byte [ebp - 0x14], 0
mov cl, 0x1b
mov dword [ebp - 0x10], 0x697e701b
xor eax, eax
mov dword [ebp - 0xc], 0x28777e75
mov dword [ebp - 8], 0x777f3529
mov word [ebp - 4], 0x77
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x10001c54
mov cl, byte [ebp - 0x10]
jmp 0x10001c45
lea eax, [ebp - 0x2b]
mov byte [ebp - 3], 0
push eax
lea eax, [ebp - 0xf]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10016290
cmp al, 0xe9
jne 0x10001c8f
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x10001ca0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov cl, 0x73
mov dword [ebp - 0x10], 0x1e1a0773
mov dword [ebp - 0xc], 0x7163416
xor eax, eax
mov dword [ebp - 8], 0x161e1a27
mov byte [ebp - 4], 0
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xb
jae 0x10001cd2
mov cl, byte [ebp - 0x10]
jmp 0x10001cc3
mov byte [ebp - 4], 0
mov cl, 0x4c
mov dword [ebp - 0x20], 0x3e29274c
xor eax, eax
mov dword [ebp - 0x1c], 0x7f202922
mov dword [ebp - 0x18], 0x2028627e
mov word [ebp - 0x14], 0x20
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001d04
mov cl, byte [ebp - 0x20]
jmp 0x10001cf5
lea eax, [ebp - 0xf]
mov byte [ebp - 0x13], 0
push eax
lea eax, [ebp - 0x1f]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10016290
cmp al, 0xe9
jne 0x10001d3f
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10001d50
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov cl, 0x2f
mov dword [ebp - 0x10], 0x5b4a682f
mov dword [ebp - 0xc], 0x444c467b
xor eax, eax
mov dword [ebp - 8], 0x415a406c
mov word [ebp - 4], 0x5b
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x10001d84
mov cl, byte [ebp - 0x10]
jmp 0x10001d75
mov byte [ebp - 3], 0
mov cl, 0x52
mov dword [ebp - 0x20], 0x20373952
xor eax, eax
mov dword [ebp - 0x1c], 0x613e373c
mov dword [ebp - 0x18], 0x3e367c60
mov word [ebp - 0x14], 0x3e
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001db6
mov cl, byte [ebp - 0x20]
jmp 0x10001da7
lea eax, [ebp - 0xf]
mov byte [ebp - 0x13], 0
push eax
lea eax, [ebp - 0x1f]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10016290
cmp al, 0xe9
jne 0x10001df1
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x10001e00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100be084]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str._fW_DQ_uWJF_VVd]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
nop dword [eax]
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xe
jb 0x10001e20
mov byte [ebp - 0x19], 0
mov cl, 5
mov dword [ebp - 0x18], 0x57404e05
xor eax, eax
mov dword [ebp - 0x14], 0x3649404b
mov dword [ebp - 0x10], 0x69612b37
mov word [ebp - 0xc], 0x69
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x10001e5f
mov cl, byte [ebp - 0x18]
jmp 0x10001e50
lea eax, [ebp - 0x27]
mov byte [ebp - 0xb], 0
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.1005cea0
mov esp, ebp
pop ebp
ret
Function at 0x10001eb0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100b6660
push 0x10077c00
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x100be084]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001f49
xor al, al
jmp 0x10001fd2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001f74
xor al, al
jmp 0x10001fd2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001fbf
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cea0
mov esp, ebp
pop ebp
ret

Function at 0x100020f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x100b2e60]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x676d546f
mov dword [ebp - 8], 0x70626f40
mov word [ebp - 4], 0x70
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x18
jb 0x10002117
push 0
lea eax, [ebp - 0x1b]
mov byte [ebp - 3], 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x1000214f
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10002160
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100be084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1000
push 0x40
mov dword [ebp - 8], 0x1000
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
push 0x250000
call dword [sym.imp.MPR.dll_WNetGetProviderNameA]
test eax, eax
jne 0x100021f7
movaps xmm0, xmmword [0x100b2910]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x76105455
mov dword [ebp - 0x10], 0x55545c5f
mov word [ebp - 0xc], 0x4342
mov byte [ebp - 0xa], al
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x19
jb 0x100021c0
lea eax, [ebp - 0x23]
mov byte [ebp - 0xa], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100021f7
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005cea0
mov esp, ebp
pop ebp
ret