joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cc93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebx + 0x70]
mov eax, esi
call fcn.1000cb83
test eax, eax
jne 0x1000cdd3
imul esi, esi, 0x68
push edi
mov edi, dword [esi + 0x1003c7c0]
push dword [esi + 0x1003c7c4]
mov dword [ebp - 8], edi
call fcn.10014ae9
push edi
mov dword [ebp - 4], eax
call fcn.10014ae9
cmp dword [ebp - 4], 0
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
je 0x1000cdc4
test edi, edi
je 0x1000cdbb
push edi
push ebx
call dword [esi + 0x1003c814]
mov edi, eax
xor eax, eax
pop ecx
pop ecx
cmp edi, eax
jne 0x1000cd99
cmp dword [esi + 0x1003c7c4], eax
jbe 0x1000cd1f
mov ecx, dword [ebx + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 4]
xor cl, 0x5c
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x1003c7c4]
jb 0x1000cd04
push ebx
call dword [esi + 0x1003c80c]
mov edi, eax
pop ecx
test edi, edi
jne 0x1000cd99
push dword [esi + 0x1003c7c4]
push dword [ebp - 4]
push ebx
call dword [esi + 0x1003c810]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000cd99
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [esi + 0x1003c810]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000cd99
push dword [ebp - 4]
push ebx
call dword [esi + 0x1003c814]
pop ecx
pop ecx
mov edi, eax
xor ecx, ecx
cmp edi, ecx
jne 0x1000cd99
cmp dword [ebp - 8], ecx
jbe 0x1000cd92
mov esi, dword [ebp - 4]
sub esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x1000cd92
mov eax, dword [ebp + 8]
add eax, ecx
mov dl, byte [esi + eax]
inc ecx
mov byte [eax], dl
cmp ecx, dword [ebp - 8]
jb 0x1000cd7b
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor edi, edi
push dword [ebx + 0xe8]
call fcn.10014a0c
push dword [ebp - 0xc]
call fcn.10014a0c
push dword [ebp - 4]
call fcn.10014a0c
add esp, 0xc
mov eax, edi
jmp 0x1000cdd2
push dword [ebp - 4]
call fcn.10014a0c
pop ecx
test edi, edi
je 0x1000cdcf
push edi
call fcn.10014a0c
pop ecx
push 0xd
pop eax
pop edi
pop esi
leave
ret
Function at 0x1000cdd6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
call fcn.1000cb83
test eax, eax
jne 0x1000ce11
push esi
mov esi, ebx
imul esi, esi, 0x68
mov dword [edi + 0x70], ebx
mov eax, dword [esi + 0x1003c7c0]
push dword [esi + 0x1003c7c4]
mov dword [ebp - 4], eax
call fcn.10014ae9
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x1000ce14
push 0xd
pop eax
pop esi
pop ebx
leave
ret
push dword [esi + 0x1003c7c4]
call fcn.10014ae9
pop ecx
mov dword [edi + 0xe8], eax
test eax, eax
jne 0x1000ce3a
push 0xd
pop ebx
push dword [ebp - 8]
call fcn.10014a0c
pop ecx
mov eax, ebx
jmp 0x1000ce10
mov ecx, dword [esi + 0x1003c7c4]
cmp ecx, 0x10
jae 0x1000ce82
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x10
push 0x1003b078
mov eax, ebx
call fcn.1000be99
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1000cf02
mov eax, dword [esi + 0x1003c7c4]
cmp dword [ebp - 4], eax
jae 0x1000ceb2
sub eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0xe8]
add eax, dword [ebp - 4]
jmp 0x1000ceaa
push 0x10
push 0x1003b078
push eax
call fcn.10016510
mov eax, dword [esi + 0x1003c7c4]
add esp, 0xc
cmp eax, 0x10
jbe 0x1000ceb2
add eax, 0xfffffff0
push eax
mov eax, dword [edi + 0xe8]
add eax, 0x10
push eax
call fcn.1000cb50
pop ecx
pop ecx
xor eax, eax
cmp dword [esi + 0x1003c7c4], eax
jbe 0x1000ced7
mov ecx, dword [edi + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 8]
xor cl, 0x36
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x1003c7c4]
jb 0x1000cebc
push edi
call dword [esi + 0x1003c80c]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1000cf02
push dword [esi + 0x1003c7c4]
push dword [ebp - 8]
push edi
call dword [esi + 0x1003c810]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1000ce2d
push dword [edi + 0xe8]
call fcn.10014a0c
pop ecx
jmp 0x1000ce2d
Function at 0x100149fd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002f010]
jne 0x10014a07
repz ret
jmp fcn.100181ca

Function at 0x1001fb85
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1001a3eb
and dword [ebp - 4], 0
cmp dword [0x10031c58], 0
mov ebx, eax
jne 0x1001fc36
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001fce7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001fce7
push eax
call fcn.1001a379
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10031c58], eax
call esi
push eax
call fcn.1001a379
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10031c5c], eax
call esi
push eax
call fcn.1001a379
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10031c60], eax
call esi
push eax
call fcn.1001a379
pop ecx
mov dword [0x10031c68], eax
test eax, eax
je 0x1001fc36
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001a379
pop ecx
mov dword [0x10031c64], eax
mov eax, dword [0x10031c64]
cmp eax, ebx
je 0x1001fc8e
cmp dword [0x10031c68], ebx
je 0x1001fc8e
push eax
call fcn.1001a3f4
push dword [0x10031c68]
mov esi, eax
call fcn.1001a3f4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001fc8e
test edi, edi
je 0x1001fc8e
call esi
test eax, eax
je 0x1001fc85
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001fc85
test byte [ebp - 0xc], 1
jne 0x1001fc8e
or dword [ebp + 0x10], 0x200000
jmp 0x1001fcc7
mov eax, dword [0x10031c5c]
cmp eax, ebx
je 0x1001fcc7
push eax
call fcn.1001a3f4
pop ecx
test eax, eax
je 0x1001fcc7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001fcc7
mov eax, dword [0x10031c60]
cmp eax, ebx
je 0x1001fcc7
push eax
call fcn.1001a3f4
pop ecx
test eax, eax
je 0x1001fcc7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10031c58]
call fcn.1001a3f4
pop ecx
test eax, eax
je 0x1001fce7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001fce9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xdd9600
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x74d000]
push edi
or ebp, 0xffffffff
jmp 0xdd9622
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xdd9629
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdd9618
mov eax, 1
add ebx, ebx
jne 0xdd963b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xdd964c
jne 0xdd966b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdd966b
dec eax
add ebx, ebx
jne 0xdd9658
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xdd9630
add ebx, ebx
jne 0xdd9667
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xdd96bd
xor ecx, ecx
sub eax, 3
jb 0xdd9683
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xdd96f2
sar eax, 1
mov ebp, eax
jmp 0xdd968e
add ebx, ebx
jne 0xdd968e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdd965c
inc ecx
add ebx, ebx
jne 0xdd969c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdd965c
add ebx, ebx
jne 0xdd96a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xdd969e
jne 0xdd96ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xdd969e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xdd96dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xdd96ce
jmp 0xdd961e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xdd96dc
add edi, ecx
jmp 0xdd961e
pop esi
mov edi, esi
mov ecx, 0x25d19
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xdd96fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xdd96ff
lea edi, [esi + 0x9d5000]
mov eax, dword [edi]
or eax, eax
je 0xdd9767
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9e7764]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9e787c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xdd9725
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9e7880]
or eax, eax
je 0xdd9761
mov dword [ebx], eax
add ebx, 4
jmp 0xdd9742
call dword [esi + 0x9e7890]
mov ebp, dword [esi + 0x9e7884]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xdd979b
sub esp, 0xffffff80
jmp 0xb379b4
Function at 0x10006762
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1005f070]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10060d58], 0
jne 0x10006812
and dword [ebp - 0x6c], 0
lea eax, [ebp - 0x6c]
push esi
push eax
push 0x20019
push ecx
mov edx, str.SOFTWAREMicrosoftInternet_Explorer
mov dword [ebp - 0x70], 0x64
mov ecx, 0x80000002
call fcn.10008623
xor esi, esi
inc esi
test eax, eax
jne 0x100067fc
movzx eax, byte [ebp - 0x68]
xor ecx, ecx
cmp dword [ebp - 0x74], esi
cmove eax, ecx
mov byte [ebp - 0x68], al
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x74]
push eax
push ecx
push str.Version
push dword [ebp - 0x6c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x100067fc
cmp word [ebp - 0x68], ax
je 0x100067fc
push 0xa
pop edx
lea ecx, [ebp - 0x68]
call fcn.10008623
mov ecx, dword [0x10060d54]
cmp eax, 4
cmova ecx, esi
mov dword [0x10060d54], ecx
cmp dword [ebp - 0x6c], 0
mov dword [0x10060d58], esi
pop esi
je 0x10006812
push dword [ebp - 0x6c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [0x10060d54]
xor ecx, ebp
call fcn.1002f764
leave
ret
Function at 0x10008623
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10008632
pop dword [ebp - 0x30]
mov eax, 0xf03fe511
add eax, 0x1fc0a121
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xd04e535c
add dword [ebp - 0x40], 0x7e03f1ef
mov dword [ebp - 0x3c], 0x11957963
sub dword [ebp - 0x3c], 0xdf622d1e
mov dword [ebp - 0x38], 0x5efe7eda
sub dword [ebp - 0x38], 0x12b23aac
mov dword [ebp - 0x34], 0x61c320e5
add dword [ebp - 0x34], 0x9e3cdf1b
lea eax, [ebp - 0x40]
push eax
mov eax, 0x9c3585f
sub eax, 0xf9c017bb
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x444cb608
add dword [ebp - 0x40], 0x3025b34e
mov dword [ebp - 0x3c], 0xffac61e5
sub dword [ebp - 0x3c], 0xbe400070
mov dword [ebp - 0x38], 0x23b966d0
add dword [ebp - 0x38], 0x3fb6059c
mov dword [ebp - 0x34], 0x9cd991bf
sub dword [ebp - 0x34], 0x9cd991bf
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x91920940
sub eax, 0x818ec8bc
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3f533
push 0
call eax
mov ecx, 0x6697996b
add ecx, 0x9968a669
xor edi, edi
add edi, eax
mov esi, 0x10068800
add esi, dword [ebp - 0x30]
mov ebx, 0x7f817762
sub ebx, 0x93c54601
mov dword [ebp - 0x2c], 0x42efaec2
mov edx, dword [esi]
sub dword [ebp - 0x28], 0xdc9ecba9
add edx, ebx
sub dword [ebp - 0x20], ebx
mov dword [edi], edx
xor dword [ebp - 0x2c], 0x8a3a80c7
add edi, 0xdd340714
sub edi, 0xdd340710
add esi, 4
loop 0x10008750
add eax, 0xa5492335
sub eax, 0xa5483112
xor ebx, ebx
add ebx, eax
add eax, 0xa585a674
add eax, 0x5a7a5991
mov ecx, 0x15abd330
sub ecx, 0x5abd330
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10009b64
Capabilities:
Delete registry value

Disassembly:
push 0x1c
mov eax, 0x10031761
call fcn.10030d83
mov ebx, edx
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov edi, eax
mov byte [ebp - 4], 5
lea eax, [ebp - 0x18]
mov edx, str.SOFTWARE
push eax
lea eax, [ebp - 0x28]
push eax
sub esp, 0x14
call fcn.10008623
test eax, eax
jne 0x10009c8d
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
mov edx, 0x10036e08
push eax
sub esp, 0x14
call fcn.10008623
test eax, eax
jne 0x10009c8d
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
mov edx, str.Internet_Explorer
push eax
sub esp, 0x14
call fcn.10008623
test eax, eax
jne 0x10009c8d
cmp dword [ebp + 8], edi
mov eax, str.Default_HTML_Editor
mov ecx, dword [ebp - 0x14]
mov esi, str.Default_MHTML_Editor
cmove esi, eax
mov edx, esi
call fcn.1000b7bc
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov edx, esi
push eax
sub esp, 0x14
call fcn.10008623
test eax, eax
jne 0x10009c8d
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
mov edx, 0x10036e40
push eax
sub esp, 0x14
call fcn.10008623
test eax, eax
jne 0x10009c8d
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
mov edx, 0x100364c0
push eax
sub esp, 0x14
call fcn.10008623
test eax, eax
jne 0x10009c8d
push str.Description
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x1c]
xor esi, esi
push esi
mov ecx, ebx
call fcn.10008623
call fcn.10006762
test eax, eax
je 0x10009c8a
push esi
push esi
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
xor edi, edi
inc edi
cmp dword [ebp - 0x1c], 0
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
je 0x10009c9e
push dword [ebp - 0x1c]
call esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x20], ebx
je 0x10009cad
push dword [ebp - 0x20]
call esi
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x10], ebx
je 0x10009cba
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x10009cc7
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x24], ebx
je 0x10009cd4
push dword [ebp - 0x24]
call esi
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x28], ebx
je 0x10009ce1
push dword [ebp - 0x28]
call esi
mov eax, edi
call fcn.10030d61
ret 4
Function at 0x1000eae7
Capabilities:
Create process on windows

Disassembly:
push 0x90
mov eax, 0x10031b12
call fcn.10030db7
mov edi, edx
mov eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x68], eax
xor esi, esi
mov eax, dword [ebp + 0x24]
mov ebx, esi
mov dword [ebp - 0x64], eax
call fcn.10008623
push eax
push ecx
push dword [0x10038130]
lea ecx, [ebp - 0x7c]
call fcn.10008623
push 7
mov dword [ebp - 4], esi
xor eax, eax
pop ecx
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], ecx
mov word [ebp - 0x60], ax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ecx
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 2
call fcn.10021463
test al, al
je 0x1000ebb9
call fcn.10008623
test al, al
jne 0x1000ebb9
test edi, edi
je 0x1000ec68
cmp word [edi], si
je 0x1000ec68
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1000eb68
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x48]
call fcn.10008623
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x28]
call fcn.10008623
push eax
lea ecx, [ebp - 0x60]
call fcn.10008623
lea ecx, [ebp - 0x28]
call fcn.1000ccca
cmp dword [ebp - 0x50], 0
je 0x1000ebb9
cmp dword [ebp - 0x4c], 8
lea ebx, [ebp - 0x60]
lea edi, [ebp - 0x48]
cmovae ebx, dword [ebp - 0x60]
cmp dword [ebp - 0x34], 8
cmovae edi, dword [ebp - 0x48]
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push esi
push esi
push 0x400
push esi
push esi
push esi
push edi
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x1000ec36
lea ecx, [ebp - 0x9c]
call fcn.10008623
push eax
push ecx
push dword [0x1003812c]
lea ecx, [ebp - 0x24]
call fcn.10008623
cmp byte [ebp - 0x24], 0
je 0x1000ec36
mov ecx, dword [ebp - 0x14]
call fcn.10008623
mov edi, eax
test edi, edi
je 0x1000ec36
cmp byte [ebp - 0x1c], 0
je 0x1000ec22
mov ecx, dword [ebp - 0x14]
call fcn.10008623
test eax, eax
je 0x1000ec22
mov ecx, dword [ebp - 0x18]
mov edx, eax
call fcn.10008623
push dword [ebp - 0x14]
xor cl, cl
call fcn.10008623
mov ecx, dword [ebp - 0x20]
mov edx, edi
call fcn.10008623
xor eax, eax
mov dword [ebp - 0x20], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov word [ebp - 0x14], ax
mov edx, 0x851
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], str.Param
push eax
push str.HevCreateProcess_
push ecx
push 0x64
mov ecx, 0x170b0c5
mov dword [ebp - 0x18], esi
call fcn.10008623
lea ecx, [ebp - 0x48]
call fcn.1000ccca
lea ecx, [ebp - 0x60]
call fcn.1000ccca
cmp byte [ebp - 0x7c], 0
je 0x1000ecbc
mov ecx, dword [ebp - 0x6c]
call fcn.10008623
mov edi, eax
test edi, edi
je 0x1000ecbc
cmp byte [ebp - 0x74], 0
je 0x1000eca8
mov ecx, dword [ebp - 0x6c]
call fcn.10008623
test eax, eax
je 0x1000eca8
mov ecx, dword [ebp - 0x70]
mov edx, eax
call fcn.10008623
push dword [ebp - 0x6c]
xor cl, cl
call fcn.10008623
mov ecx, dword [ebp - 0x78]
mov edx, edi
call fcn.10008623
mov eax, esi
call fcn.10030d76
ret 0x20
Function at 0x1001d0a2
Capabilities:
Get thread local storage value

Disassembly:
push 8
mov eax, 0x100323df
call fcn.10030d83
cmp byte [0x100604ac], 0
push dword [0x100604a8]
je 0x1001d0c5
call dword [sym.imp.kernel32.dll_FlsGetValue]
jmp 0x1001d0cb
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001d114
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x1001d11c
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
push 8
pop ecx
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call fcn.1000ccf7
mov dword [esi], eax
push esi
mov dword [eax], edi
mov dword [eax + 4], edi
mov ecx, dword [esi]
mov dword [ecx], esi
mov ecx, 0x100604a8
call fcn.10008623
mov eax, esi
call fcn.10030d61
ret
call fcn.10008623
int3
Function at 0x100032a0
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x100032cd
push esi
lea esp, [esp]
movzx ecx, cl
movzx ecx, byte [ecx + 0x1005c828]
lea esi, [eax*8]
xor ecx, esi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x100032b0
pop esi
ret

Function at 0x10006750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
clc
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10006772
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
invalid
inc ebp
invalid

Function at 0x100067f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call 0xf95df045
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10006494
push eax
push esi
push dword [ebp + 8]
call fcn.10006449
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6

Function at 0x10006860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10006494

Function at 0x10006890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push esi
push dword [ebp + 8]
call fcn.10006449
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
invalid
pop ebp

Function at 0x10006cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [esi - 0x3a]
test dword [ecx + 0x56fffffc], edi
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.10006494
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
Function at 0x10006d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
inc dword [eax]
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
invalid
jmp [eax]
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
invalid

Function at 0x10007160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ss
cmp dword [ebp - 0x398], 0
je 0x10007342
cmp dword [ebp + 0xc], 1
je 0x10007342
cmp dword [ebp + 0xc], 8
invalid
invalid
mov byte [ecx], al

Function at 0x10007190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
invalid
invalid

Function at 0x1000e7f0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 0
push 0x14
mov dword [ebp], 0
call fcn.1000dee0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000e81b
lea eax, [esi + 7]
pop esi
pop ebp
pop ebx
ret
cmp dword [0x10066004], 0
je 0x1000e849
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x10001fe0
push 0
push 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x1000e859
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x1000e871
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call ebx
add esp, 4
mov dword [esi + 0x10], eax
mov dword [ebp], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret