joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417570
Capabilities:
Terminate process
Write file on windows

Disassembly:
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x104
sub ebp, 0x182
mov dword [ebp + 0x17e], 1
cmp dword [0x425df4], 0
je 0x4175a6
xor esi, esi
mov dword [ebp + 0x17e], 2
mov dword [0x425df4], esi
push ecx
push ebx
push edx
push eax
push 0x417520
push 0x100
lea eax, [ebp + 0x7e]
push eax
call fcn.00419ec0
add esp, 0x1c
cmp byte [0x42616c], 0
je 0x417716
lea edi, [ebp + 0x7e]
sub ecx, ecx
dec ecx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, 0x15
and cl, 0xfc
call fcn.00415df0
cmp ecx, eax
jae 0x4176eb
lea edi, [ebp + 0x7e]
sub ecx, ecx
dec ecx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, 0x15
and cl, 0xfc
push ecx
lea edi, [ebp + 0x7e]
call fcn.00415e48
sub ecx, ecx
dec ecx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + 0x15]
and al, 0xfc
sub esp, eax
mov edx, esp
mov esi, 0x41755b
mov edi, edx
push edi
mov al, byte [esi]
mov byte [edi], al
cmp al, 0
je 0x41763c
mov al, byte [esi + 1]
add esi, 2
mov byte [edi + 1], al
add edi, 2
cmp al, 0
jne 0x417624
pop edi
mov esi, 0x417558
push edi
sub ecx, ecx
dec ecx
mov al, 0
repne scasb al, byte es:[edi]
dec edi
mov al, byte [esi]
mov byte [edi], al
cmp al, 0
je 0x417663
mov al, byte [esi + 1]
add esi, 2
mov byte [edi + 1], al
add edi, 2
cmp al, 0
jne 0x41764b
pop edi
lea esi, [ebp + 0x7e]
mov ebx, edx
push edi
sub ecx, ecx
dec ecx
mov al, 0
repne scasb al, byte es:[edi]
dec edi
mov al, byte [esi]
mov byte [edi], al
cmp al, 0
je 0x41768a
mov al, byte [esi + 1]
add esi, 2
mov byte [edi + 1], al
add edi, 2
cmp al, 0
jne 0x417672
pop edi
call fcn.00415df0
cmp eax, 0x14
jbe 0x4176f2
push 0x14
call fcn.00415e48
mov eax, 0x14
sub esp, eax
mov edx, esp
mov eax, dword [ebp + 0x17e]
push eax
push 0x417547
push edx
call fcn.00419f20
add esp, 0xc
cmp byte [0x42616c], 0
je 0x4176d8
mov eax, ds
and eax, 0xffff
push eax
push edx
int3
cmp byte [0x42616c], 0
jne 0x4176f6
lea esp, [ebp + 0x182]
pop ebp
pop edi
pop esi
ret
xor edx, edx
jmp 0x41761c
xor edx, edx
jmp 0x4176a5
mov edx, ds
and edx, 0xffff
push edx
push ebx
int3
lea edx, [ebp + 0x7e]
mov eax, 0x41755b
call fcn.00419f60
jmp 0x419fc6
cmp dword [0x426170], 0
je 0x419fd5
call dword [0x426170]
call fcn.00419fda
Function at 0x418ae0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov esi, ebx
mov dword [0x46a2f8], eax
mov dword [0x425e54], edx
call fcn.0041a4b0
xor eax, eax
mov dword [0x46a928], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
mov byte [0x425e39], al
shr eax, 0x10
mov word [0x425e3b], ax
xor eax, eax
mov ax, word [0x425e3b]
and edx, 0xffff
mov dword [0x425e3d], eax
xor eax, eax
sar edx, 8
mov al, byte [0x425e39]
and edx, 0xff
mov dword [0x425e41], eax
xor eax, eax
mov al, dl
mov byte [0x425e3a], dl
mov dword [0x425e45], eax
mov eax, dword [0x425e41]
mov edx, dword [0x425e45]
shl eax, 8
or eax, edx
mov dword [0x425e49], eax
cmp byte [0x425e39], 4
jae 0x418c07
mov eax, 0x418a78
push eax
xor edx, edx
push 0x418aa5
mov dword [0x425e35], edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edx, eax
test eax, eax
je 0x418b9a
call edx
mov dword [0x425e35], eax
push 0x104
push 0x46a2fc
push 0
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x46a400
xor eax, eax
mov dword [0x425e04], 0x46a2fc
call fcn.0041a8f0
mov dword [0x425e10], 0x46a400
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.0041a990
mov edx, eax
mov bl, byte [eax]
mov dword [0x46a2f0], eax
cmp bl, 0x22
je 0x418c11
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4179a1], 2
je 0x418c29
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4179a1], 2
je 0x418c30
inc eax
jmp 0x418bf7
mov eax, 0x418a8e
jmp 0x418b72
inc eax
cmp bl, byte [eax]
je 0x418c21
cmp byte [eax], 0
je 0x418c21
inc eax
cmp byte [eax], 0x22
jne 0x418c16
cmp byte [eax], 0
je 0x418bf7
inc eax
jmp 0x418bf7
test dl, dl
je 0x418bf7
inc eax
jmp 0x418bea
mov dword [0x425e00], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
test eax, eax
je 0x418ca6
call fcn.0041a9d0
mov edx, eax
mov bx, word [eax]
mov dword [0x46a2f4], eax
cmp bx, 0x22
je 0x418c79
xor eax, eax
mov ax, word [edx]
call fcn.0041a9f7
test eax, eax
je 0x418c9b
xor eax, eax
mov ax, word [edx]
call fcn.0041a9f7
test eax, eax
je 0x418cab
add edx, 2
jmp 0x418c66
lea edx, [eax + 2]
cmp bx, word [edx]
je 0x418c90
cmp word [edx], 0
je 0x418c90
add edx, 2
cmp word [edx], 0x22
jne 0x418c81
cmp word [edx], 0
je 0x418c66
add edx, 2
jmp 0x418c66
cmp word [edx], 0
je 0x418c66
add edx, 2
jmp 0x418c58
mov edx, 0x418ab2
mov dword [0x425e0c], edx
test edi, edi
jne 0x418cbe
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x104
push 0x46a608
push esi
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x46a70c
mov eax, esi
mov dword [0x425e08], 0x46a608
call fcn.0041a8f0
mov dword [0x425e14], 0x46a70c
mov eax, 1
pop edi
pop esi
pop ecx
ret
Function at 0x418e30
Capabilities:
Read file on windows

Disassembly:
push ecx
sub esp, 4
test eax, eax
jl 0x418e61
cmp eax, dword [0x4262ac]
jae 0x418e61
push 0
lea ecx, [esp + 4]
push ecx
push ebx
push edx
call fcn.0041a3e0
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x418e78
mov eax, dword [esp]
add esp, 4
pop ecx
ret
call dword [0x425e58]
mov dword [eax + 4], 4
mov eax, 0xffffffff
add esp, 4
pop ecx
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
call fcn.0041a870
cmp edx, 0x6d
jne 0x418e90
cmp dword [esp], 0
je 0x418e59
mov eax, 0xffffffff
add esp, 4
pop ecx
ret

Function at 0x4194b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
push ebp
sub esp, 8
mov esi, eax
mov ebp, edx
mov edi, ebx
test eax, eax
jl 0x419544
cmp eax, dword [0x4262ac]
jae 0x419544
call fcn.0041a3e0
mov edx, eax
mov dword [esp + 4], eax
mov eax, esi
xor ebx, ebx
call fcn.0041b950
test al, 0x80
je 0x419508
mov eax, esi
call dword [0x425f10]
push 2
push 0
push 0
push edx
mov ebx, 1
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
je 0x419558
push 0
lea eax, [esp + 4]
push eax
push edi
push ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x419562
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
cmp ebx, 1
jne 0x419535
mov eax, esi
call dword [0x425f14]
mov eax, edx
call fcn.0041a870
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret
call dword [0x425e58]
mov dword [eax + 4], 4
mov eax, 0xffffffff
jmp 0x41953c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x41952d
cmp edi, dword [esp]
je 0x419574
call dword [0x425e58]
mov dword [eax + 4], 0xc
cmp ebx, 1
jne 0x419581
mov eax, esi
call dword [0x425f14]
mov eax, dword [esp]
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret

Function at 0x419c10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edx
push 0x40
push 0x1000
mov edx, dword [eax]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop edx
pop ecx
ret

Function at 0x419fda
Capabilities:
Terminate process
Write file on windows

Disassembly:
push edx
mov edx, 0xff
mov eax, 0x419fb1
jmp fcn.00417940

Function at 0x41c700
Capabilities:
Terminate process

Disassembly:
push edx
push ebp
mov ebp, esp
mov eax, dword [0x425e20]
add eax, 3
and al, 0xfc
mov edx, dword [0x425e20]
sub esp, eax
mov eax, esp
add eax, edx
mov dword [0x425e24], eax
call fcn.0041d6d0
mov edx, dword [0x46a940]
mov eax, dword [0x46a93c]
call fcn.00407220
jmp fcn.00416c13
Function at 0x41e5f0
Capabilities:
Set environment variable

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
sub esp, 0x18
mov ebp, eax
mov dword [esp], 2
mov edx, 0x3d
mov dword [esp + 4], 1
call fcn.0041e880
mov ebx, eax
test eax, eax
je 0x41e61e
cmp eax, ebp
jne 0x41e62d
mov eax, 0xffffffff
add esp, 0x18
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
sub eax, ebp
mov dword [esp + 0xc], eax
inc eax
call fcn.00417260
mov edx, eax
mov dword [esp + 8], eax
test eax, eax
je 0x41e61e
mov ecx, dword [esp + 0xc]
mov esi, ebp
mov edi, eax
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [esp + 0xc]
lea esi, [ebx + 1]
mov byte [edx + eax], 0
mov eax, esi
call fcn.0041e8e0
mov dword [esp + 0x14], eax
test eax, eax
je 0x41e6f6
inc eax
call fcn.00417260
mov ebx, eax
mov dword [esp + 0x10], eax
test eax, eax
je 0x41e6e0
mov ecx, dword [esp + 0x14]
mov edi, eax
add ebx, dword [esp + 0x14]
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov byte [ebx], 0
mov edi, dword [esp + 0x10]
push edi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
mov edx, eax
mov eax, dword [esp + 8]
call fcn.00417350
mov eax, edi
call fcn.00417350
test edx, edx
jne 0x41e6fc
test edi, edi
jne 0x41e61e
xor eax, eax
add esp, 0x18
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, edx
call fcn.00417350
mov eax, 0xffffffff
add esp, 0x18
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov dword [esp + 0x10], eax
jmp 0x41e6a6
mov eax, ebp
call fcn.0041e910
test eax, eax
jne 0x41e61e
cmp dword [0x46a92c], 0
je 0x41e623
mov eax, ebp
call fcn.0041e8e0
lea ebx, [eax + 1]
mov eax, dword [esp]
imul eax, ebx
call fcn.00417260
mov ecx, eax
test eax, eax
je 0x41e767
imul ebx, dword [esp + 4]
mov edx, ebp
call fcn.0041e9a0
cmp eax, 0xffffffff
jne 0x41e783
mov eax, ecx
call fcn.00417350
call dword [0x425e58]
mov dword [eax + 4], 0xe
mov eax, 0xffffffff
add esp, 0x18
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
call dword [0x425e58]
mov dword [eax + 4], 5
mov eax, 0xffffffff
add esp, 0x18
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, ecx
call fcn.0041ea20
add esp, 0x18
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x10491058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104911a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1049107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1049106a
add dl, dl
jne 0x10491089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104910dc
xor eax, eax
add dl, dl
jne 0x10491096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1049117d
add dl, dl
jne 0x104910a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104910b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104910bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104910c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104910d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10491075
mov eax, 1
add dl, dl
jne 0x104910ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104910f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104910e1
sub eax, ebx
mov ebx, 1
jne 0x10491128
mov ecx, 1
add dl, dl
jne 0x1049110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10491119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10491105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10491075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1049113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1049114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10491136
cmp eax, 0x7d00
jae 0x1049116d
cmp eax, 0x500
jb 0x10491168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10491075
cmp eax, 0x7f
ja 0x10491170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10491075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1049119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10491075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10011270
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1006c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x10126b68]
push esi
mov eax, dword [ecx]
call dword [eax + 0xd0]
cmp byte [0x100b156c], 0
mov dword [0x10126bac], eax
je 0x100113fd
mov eax, dword [eax + 0x18]
test eax, eax
je 0x100112af
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x100112b1
xor eax, eax
mov esi, dword [eax + 0xf0]
mov ecx, 0xad
xor edx, edx
nop
mov al, byte [edx + 0x1005fc64]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x54], al
and ecx, 0x800000ff
jns 0x100112dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x100112c0
push esi
lea eax, [ebp - 0x54]
mov byte [ebp - 0x46], 0
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10004630
mov eax, dword [0x10126bac]
xorps xmm0, xmm0
movq qword [ebp - 0x54], xmm0
add esp, 0xc
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x48], 0
mov byte [ebp - 0x46], 0
mov eax, dword [eax + 0x18]
test eax, eax
je 0x10011324
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x10011326
xor eax, eax
mov eax, dword [eax + 0x13c]
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x6f6d6d41
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x4c], 0x25203a20
push eax
mov word [ebp - 0x48], 0x69
call fcn.10004630
add esp, 0xc
mov dword [ebp - 0x50], 0xc6e0f8cb
mov dword [ebp - 0x4c], 0xfdf7fe
xor ecx, ecx
mov byte [ebp - 0x48], 1
lea eax, [ecx - 0x74]
xor byte [ebp + ecx - 0x50], al
inc ecx
cmp ecx, 7
jb 0x10011365
movss xmm3, dword [0x100674cc]
lea ecx, [ebp - 0x50]
movss xmm2, dword [0x100674d4]
mov edx, 0xff7fff00
movss xmm1, dword [0x100674a4]
movss xmm0, dword [0x10067464]
mov byte [ebp - 0x48], 0
call fcn.1000a8e0
movss xmm3, dword [0x100674cc]
lea ecx, [ebp - 0x24]
movss xmm2, dword [0x100674d4]
mov edx, 0xffff0000
movss xmm1, dword [0x100674b0]
movss xmm0, dword [0x10067464]
call fcn.1000a8e0
movss xmm3, dword [0x100674cc]
lea ecx, [ebp - 0x44]
movss xmm2, dword [0x100674d4]
mov edx, 0xffff0000
movss xmm1, dword [0x100674bc]
movss xmm0, dword [0x10067464]
call fcn.1000a8e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005b824
mov esp, ebp
pop ebp
ret
Function at 0x10015250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005df3d
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x1006c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0xc6
xor edx, edx
mov al, byte [edx + 0x1005ff38]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1001529e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x10015281
mov byte [ebp - 0x11], 0
mov edx, 0x1012699c
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.10046580
cmp byte [0x1012699c], 0
je 0x100152ea
call fcn.1005a420
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1005a8f0
push 0x10013130
push 0x10126b5c
call fcn.10059e80
call fcn.1005a480
movaps xmm0, xmmword [0x10067c20]
xor ecx, ecx
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x30], 0xfbb2f6d4
movaps xmm0, xmmword [0x10067aa0]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0xf3d2dbd5
mov word [ebp - 0x28], 0x100
lea eax, [ecx - 0x70]
xor byte [ebp + ecx - 0x50], al
inc ecx
cmp ecx, 0x28
jb 0x10015316
mov byte [ebp - 0x27], 0
mov ecx, 0xb6
xor edx, edx
nop
mov al, byte [edx + 0x1005ff4c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001534d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10015330
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 1
lea edx, [ebp - 0x50]
xor esi, esi
cmp byte [ebp - 0x50], 0
je 0x10015386
nop dword [eax]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10015375
sub ecx, edi
inc edx
add edx, ecx
inc esi
cmp byte [edx], al
jne 0x10015370
push ecx
push esi
lea eax, [ebp - 0x50]
mov edx, 0x101269a0
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.10047bf0
add esp, 0x10
mov ecx, 0xee
xor edx, edx
mov al, byte [edx + 0x1005ff58]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x100153c1
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x100153a4
mov byte [ebp - 0x11], 0
push ecx
push 0x1005fc7c
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x3e8
push eax
push 0x10073534
mov edx, 4
mov dword [ebp - 0x58], 1
lea ecx, [ebp - 0x1c]
call fcn.10048da0
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b824
mov esp, ebp
pop ebp
ret
Function at 0x10015420
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005df9d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1006c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x100b15ba], 0
je 0x1001564a
movaps xmm0, xmmword [0x10067c30]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x100bcf8
nop dword [eax + eax]
lea eax, [ecx - 0x74]
xor byte [ebp + ecx - 0x34], al
inc ecx
cmp ecx, 0x12
jb 0x10015470
lea eax, [ebp - 0x34]
mov byte [ebp - 0x21], 0
push eax
call fcn.10044e60
add esp, 4
mov ecx, 0x98
xor edx, edx
mov al, byte [edx + 0x1005ffb8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x100154b1
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10015494
mov byte [ebp - 0x11], 0
push ecx
push 0x1005fc7c
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x44], 0x64
push eax
push 0x100b1610
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x48], 1
call fcn.10049990
movaps xmm0, xmmword [0x10067a00]
add esp, 0x14
movups xmmword [ebp - 0x40], xmm0
xor ecx, ecx
mov byte [ebp - 0x20], 1
movaps xmm0, xmmword [0x10067720]
movups xmmword [ebp - 0x30], xmm0
nop word [eax + eax]
lea eax, [ecx - 0x70]
xor byte [ebp + ecx - 0x40], al
inc ecx
cmp ecx, 0x1f
jb 0x10015510
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x50482323
mov dword [ebp - 0x18], 0x63614820
mov word [ebp - 0x14], 0x6b
mov dword [ebp - 4], 1
lea edx, [ebp - 0x40]
xor esi, esi
cmp byte [ebp - 0x40], 0
je 0x10015561
mov eax, edx
lea edi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015550
sub eax, edi
inc edx
add edx, eax
inc esi
cmp byte [edx], cl
jne 0x10015547
push ecx
push esi
lea eax, [ebp - 0x40]
mov edx, 0x100b1614
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.10047bf0
mov dword [ebp - 0x1c], 0x65482323
mov dword [ebp - 0x18], 0x74656d6c
mov byte [ebp - 0x14], 0
add esp, 0xc
mov dword [ebp - 4], 2
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x64
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x44], 1
push 0x1005fc7c
push eax
lea eax, [ebp - 0x44]
push eax
push 0x100b161c
call fcn.10049990
mov dword [ebp - 0x1c], 0x6f472323
mov dword [ebp - 0x18], 0x656c6767
mov byte [ebp - 0x14], 0
add esp, 0x10
mov dword [ebp - 4], 3
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x64
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x44], 1
push 0x1005fc7c
push eax
lea eax, [ebp - 0x44]
push eax
push 0x100b1620
call fcn.10049990
mov dword [ebp - 0x1c], 0x61422323
mov dword [ebp - 0x18], 0x61706b63
mov word [ebp - 0x14], 0x6b63
mov byte [ebp - 0x12], 0
add esp, 0x10
mov dword [ebp - 4], 4
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x64
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x44], 1
push 0x1005fc7c
push eax
lea eax, [ebp - 0x44]
push eax
push 0x100b1618
call fcn.10049990
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b824
mov esp, ebp
pop ebp
ret
Function at 0x10015c10
Capabilities:
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e04d
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x1006c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov ecx, 0x51
mov dword [ebp - 0x18], 0
xor edx, edx
mov al, byte [edx + 0x10060028]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x3c], al
and ecx, 0x800000ff
jns 0x10015c70
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x10015c53
mov byte [ebp - 0x2d], 0
push 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.10045860
add esp, 4
mov dword [ebp - 4], 0xffffffff
test al, al
je 0x10015d7b
mov dword [ebp - 0x2c], 0xece7e2da
xor ecx, ecx
mov dword [ebp - 0x28], 0xf2fad2f5
mov dword [ebp - 0x24], 0xeff3bbe0
mov word [ebp - 0x20], 0xfd
mov byte [ebp - 0x1e], 1
mov al, cl
sub al, 0x74
xor byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0xd
jb 0x10015cc1
push 0
push 2
mov byte [ebp - 0x1e], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10015d7b
lea eax, [ebp - 0x168]
mov dword [ebp - 0x168], 0x128
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10015d78
nop word [eax + eax]
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x144]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10015d40
test dl, dl
je 0x10015d3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10015d40
add eax, 2
add ecx, 2
test dl, dl
jne 0x10015d20
xor eax, eax
jmp 0x10015d45
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10015d66
push dword [ebp - 0x160]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
lea eax, [ebp - 0x168]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10015d10
push edi
call ebx
mov dword [ebp - 0x1c], 0xe6e0f8cb
xor ecx, ecx
mov dword [ebp - 0x18], 0xfdf7fe
mov byte [ebp - 0x14], 1
nop
mov al, cl
sub al, 0x74
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 7
jb 0x10015d90
mov edx, 0x100b156c
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
call fcn.10046580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b824
mov esp, ebp
pop ebp
ret
Function at 0x100162a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x100162c2
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x70]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x100162b0
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret