joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401160
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
xor esi, esi
nop word [eax + eax]
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x99
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x7c
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x95
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x55
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x6d
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xdb
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x99
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xa6
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x68
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x1c
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x90
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 6
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x10
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0xc5
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x21
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xba
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xa9
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xf5
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x29
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x46
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xb6
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x64
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x2f
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x83
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x59
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xa2
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x48
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x10
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x3e
inc esi
cmp esi, 0x2d200
jb 0x401170
pop edi
pop esi
ret
Function at 0x40f310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f33d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f33d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40bb10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x40bb32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40bb39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40bb28
mov eax, 1
add ebx, ebx
jne 0x40bb4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40bb40
jne 0x40bb5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40bb40
xor ecx, ecx
sub eax, 3
jb 0x40bb70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40bbe2
mov ebp, eax
add ebx, ebx
jne 0x40bb7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40bb88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40bbac
inc ecx
add ebx, ebx
jne 0x40bb98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40bb8d
jne 0x40bba9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40bb8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40bbcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40bbbd
jmp 0x40bb2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40bbcc
add edi, ecx
jmp 0x40bb2e
pop esi
mov edi, esi
mov ecx, 0x181
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40bbea
cmp byte [edi], 6
jne 0x40bbea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40bbef
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x40bc67
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb0c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40bc1c
mov ecx, edi
jns 0x40bc4b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb0cc]
or eax, eax
je 0x40bc61
mov dword [ebx], eax
add ebx, 4
jmp 0x40bc39
call dword [esi + 0xb0c8]
mov ebp, dword [esi + 0xb0d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40bc9b
sub esp, 0xffffff80
jmp 0x407184
Function at 0x710c68
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x7109ec
add ecx, eax
add eax, eax
and ecx, eax
call fcn.00710ca6
sub ecx, 0x7386ca34
sub esp, 4
mov dword [esp], ecx
pop ecx
inc ecx
xor dword [edx], edi
push ecx
pop ecx
sub ecx, 0x65e1f809
add ecx, eax
inc edx
add ecx, ecx
dec eax
or eax, ecx
cmp edx, ebx
jne fcn.00710c68
inc eax
dec eax
mov eax, 0xd027b556
ret

Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
mov eax, 1
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
xor ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
mov ecx, edi
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x401210
Capabilities:
Check mutex on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push esi
push 0x416200
push str.dnp.log
call fcn.00403faf
add esp, 8
mov dword [0x41d950], eax
push str.586997F4_D097_4836_A382_F3626FEAE6B5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x4012b3
push eax
call fcn.00403cc5
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], edx
call fcn.00403a4e
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.00403c27
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x18]
push eax
push str.__s_DEBUG:_CloseNetworkProperty:_CreateMutexA_failed___d_n
push dword [0x41d950]
call fcn.004011e0
push dword [0x41d950]
call fcn.00403e95
add esp, 0x14
lea eax, [esi + 1]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401343
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40131e
push 0
call fcn.00403cc5
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], edx
call fcn.00403a4e
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.00403c27
lea eax, [ebp - 0x18]
push eax
push str.__s_DEBUG:_CloseNetworkProperty:_There_is_already_an_instance_of_the_application_running._n
push dword [0x41d950]
call fcn.004011e0
push dword [0x41d950]
call fcn.00403e95
mov ecx, dword [ebp - 4]
add esp, 0x28
xor ecx, ebp
mov eax, 2
pop esi
pop edi
call fcn.00401343
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x4010e0
call esi
push 0x1f4
call edi
jmp 0x401331

Function at 0x40cf9e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040cc5e
Function at 0x467da0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x417015
lea edi, [esi - 0x16015]
push edi
jmp 0x467dba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x467dc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467db0
mov eax, 1
add ebx, ebx
jne 0x467dd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x467de4
jne 0x467e03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467e03
dec eax
add ebx, ebx
jne 0x467df0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x467dc8
add ebx, ebx
jne 0x467dff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x467e55
xor ecx, ecx
sub eax, 3
jb 0x467e1b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x467e8a
sar eax, 1
mov ebp, eax
jmp 0x467e26
add ebx, ebx
jne 0x467e26
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467df4
inc ecx
add ebx, ebx
jne 0x467e34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467df4
add ebx, ebx
jne 0x467e41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x467e36
jne 0x467e52
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x467e36
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x467e74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x467e66
jmp 0x467db6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x467e74
add edi, ecx
jmp 0x467db6
pop esi
mov edi, esi
mov ecx, 5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x467e92
cmp byte [edi], 1
jne 0x467e92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x467e97
mov ebp, dword [esi + 0x676d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x467ef2
sub esp, 0xffffff80
jmp 0x407c28
Function at 0x10001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10006050]
test eax, eax
jne 0x100010d3
mov dl, 0x73
mov al, 0x65
mov cl, 0x6c
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], dl
mov byte [ebp - 0xa], al
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], cl
mov byte [ebp - 3], cl
mov byte [ebp - 2], 0
mov edx, edx
mov byte [ebp - 0x28], 0x43
mov byte [ebp - 0x27], 0x68
mov byte [ebp - 0x26], 0x61
mov byte [ebp - 0x25], 0x6e
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], al
mov byte [ebp - 0x22], 0x57
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6e
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x77
mov byte [ebp - 0x1c], 0x4d
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], dl
mov byte [ebp - 0x19], dl
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x67
mov byte [ebp - 0x16], al
mov byte [ebp - 0x15], 0x46
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], cl
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], al
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x45
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0
mov edx, edx
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10006050], eax
push edx
pop edx
mov eax, dword [0x10006050]
test eax, eax
je 0x100010e3
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push 1
push edx
push ecx
call eax
test esi, esi
mov esp, ebp
pop ebp
ret
Function at 0x100016e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebp
push esi
mov cl, 0x50
mov al, 0x74
push edi
mov byte [esp + 0xc], 0x7a
mov byte [esp + 0xd], 0x62
mov byte [esp + 0xe], 0x63
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x10], 0x65
mov byte [esp + 0x11], 0x66
mov byte [esp + 0x12], 0x67
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], 0x4a
mov byte [esp + 0x15], 0x4b
mov byte [esp + 0x16], 0x4c
mov byte [esp + 0x17], al
mov byte [esp + 0x18], 0x6a
mov byte [esp + 0x19], 0x4f
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], 0x51
mov byte [esp + 0x1c], 0x72
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x76
mov byte [esp + 0x21], 0x77
mov byte [esp + 0x22], 0x78
mov byte [esp + 0x23], 0x79
mov byte [esp + 0x24], 0x5a
mov byte [esp + 0x25], 0x41
mov byte [esp + 0x26], 0x59
mov byte [esp + 0x27], 0x43
mov byte [esp + 0x28], 0x44
mov byte [esp + 0x29], 0x45
mov byte [esp + 0x2a], 0x46
mov byte [esp + 0x2b], 0x47
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov ebp, dword [sym.imp.MSVCRT.dll_rand]
add esp, 4
call ebp
mov esi, eax
and esi, 0x80000007
jns 0x100017ad
dec esi
or esi, 0xfffffff8
inc esi
add esi, 8
xor edi, edi
test esi, esi
jle 0x100017e3
push ebx
mov ebx, dword [esp + 0x34]
call ebp
and eax, 0x8000001f
jns 0x100017c9
dec eax
or eax, 0xffffffe0
inc eax
mov al, byte [esp + eax + 0x10]
inc al
mov byte [edi + ebx], al
inc edi
cmp edi, esi
jl 0x100017bb
mov byte [esi + ebx], 0
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20
ret
mov ecx, dword [esp + 0x30]
pop edi
mov byte [esi + ecx], 0
pop esi
pop ebp
add esp, 0x20
ret

Function at 0x10001fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1000604c]
test eax, eax
jne 0x10002035
mov cl, 0x73
mov al, 0x65
mov dl, 0x6c
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], cl
mov byte [ebp - 0xa], al
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], dl
mov byte [ebp - 3], dl
mov byte [ebp - 2], 0
push eax
pop eax
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x17], al
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], al
mov byte [ebp - 0x13], cl
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x67
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0xd], 0
test bl, bl
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1000604c], eax
mov edi, edi
mov eax, dword [0x1000604c]
test eax, eax
je 0x1000204b
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push ecx
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002180
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x60
test eax, eax
push edi
je 0x100021b4
push 0
push 0
push 0
push 0x10003930
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
add esp, 0x60
ret 8
mov edi, 0x10006074
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x100021ab
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
not eax
push eax
lea eax, [esp + 0x74]
lea ecx, [esp + 0xc]
push eax
push ecx
mov byte [esp + 0x7c], 0x25
mov byte [esp + 0x7d], 0x78
mov byte [esp + 0x7e], 0
mov byte [esp + 0x7f], 0
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0x34]
lea eax, [esp + 0x14]
push edx
push eax
call fcn.100043e0
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x10006074
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
add esp, 0x60
ret 8

Function at 0x10002270
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edx, edx
test eax, 0x7c25
xchg ebx, eax
xchg ebx, eax
test edx, edx
test al, al
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov eax, eax
xor ecx, ecx
mov cx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
mov eax, eax
mov esi, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
cmp esi, edx
jae 0x100022aa
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
xor edi, edi
cmp word [eax + 6], di
jbe 0x100022d1
mov edx, dword [ecx + 0xc]
cmp esi, edx
jb 0x100022c2
mov ebx, dword [ecx + 8]
add ebx, edx
cmp esi, ebx
jb 0x100022d9
add ecx, 0x28
nop
xor edx, edx
inc edi
mov dx, word [eax + 6]
cmp edi, edx
jb 0x100022b2
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
sub eax, edx
pop edi
add eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x10002b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10006174]
push esi
test eax, eax
jne 0x10002c7b
mov cl, 0x74
mov dl, 0x64
mov al, 0x6c
mov byte [ebp - 0xc], 0x6e
mov byte [ebp - 0xb], cl
mov byte [ebp - 0xa], dl
mov byte [ebp - 9], al
mov byte [ebp - 8], al
mov byte [ebp - 7], 0x2e
mov byte [ebp - 6], dl
mov byte [ebp - 5], al
mov byte [ebp - 4], al
mov byte [ebp - 3], 0
test ch, ch
mov dl, 0x69
mov al, 0x65
mov byte [ebp - 0x2c], 0x4e
mov byte [ebp - 0x2b], cl
mov byte [ebp - 0x2a], 0x4d
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x70
mov byte [ebp - 0x27], 0x56
mov byte [ebp - 0x26], dl
mov byte [ebp - 0x25], al
mov byte [ebp - 0x24], 0x77
mov byte [ebp - 0x23], 0x4f
mov byte [ebp - 0x22], 0x66
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x1d], dl
mov byte [ebp - 0x1c], 0x6f
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0
test bh, bh
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov al, al
mov edi, edi
lea edx, [ebp - 0x18]
push 5
lea eax, [ebp - 0xc]
push edx
push eax
push esi
call fcn.10002ac0
add esp, 0x10
test eax, eax
je 0x10002c68
mov byte [ebp - 0x13], 0x68
mov edi, edi
add esi, 5
mov dword [ebp - 0x12], esi
mov bh, bh
push 0x40
push 0x3000
push 0xb
push 0
mov byte [ebp - 0xe], 0xc3
call fcn.10003770
mov dword [0x10006174], eax
mov bh, bh
mov eax, dword [0x10006174]
test eax, eax
je 0x10002c71
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov cx, word [ebp - 0x10]
mov word [eax + 8], cx
mov dl, byte [ebp - 0xe]
mov byte [eax + 0xa], dl
test edx, edx
mov eax, dword [0x10006174]
test eax, eax
jne 0x10002c7b
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0x28
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x10002c8c
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0x28
mov esi, esi
mov edx, dword [ebp + 0x2c]
push edx
mov edx, dword [ebp + 0x28]
push edx
mov edx, dword [ebp + 0x24]
push edx
mov edx, dword [ebp + 0x20]
push edx
mov edx, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
push edx
call eax
pop esi
mov esp, ebp
pop ebp
ret 0x28
Function at 0x10002cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10006178]
push esi
test eax, eax
jne 0x10002de2
mov dl, 0x6e
mov cl, 0x74
mov al, 0x6c
mov byte [ebp - 0xc], dl
mov byte [ebp - 0xb], cl
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], al
mov byte [ebp - 8], al
mov byte [ebp - 7], 0x2e
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], al
mov byte [ebp - 4], al
mov byte [ebp - 3], 0
push ecx
pop ecx
mov al, 0x65
mov byte [ebp - 0x30], 0x4e
mov byte [ebp - 0x2f], cl
mov byte [ebp - 0x2e], 0x55
mov byte [ebp - 0x2d], dl
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x61
mov byte [ebp - 0x2a], 0x70
mov byte [ebp - 0x29], 0x56
mov byte [ebp - 0x28], 0x69
mov byte [ebp - 0x27], al
mov byte [ebp - 0x26], 0x77
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x66
mov byte [ebp - 0x23], 0x53
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], 0x63
mov byte [ebp - 0x20], cl
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], dl
mov byte [ebp - 0x1c], 0
test bl, bl
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov ah, ah
test edx, edx
lea edx, [ebp - 0x18]
push 5
lea eax, [ebp - 0xc]
push edx
push eax
push esi
call fcn.10002ac0
add esp, 0x10
test eax, eax
je 0x10002dcf
mov byte [ebp - 0x13], 0x68
test cl, cl
add esi, 5
mov dword [ebp - 0x12], esi
test al, al
push 0x40
push 0x3000
push 0xb
push 0
mov byte [ebp - 0xe], 0xc3
call fcn.10003770
mov dword [0x10006178], eax
mov ah, ah
mov eax, dword [0x10006178]
test eax, eax
je 0x10002dd8
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov cx, word [ebp - 0x10]
mov word [eax + 8], cx
mov dl, byte [ebp - 0xe]
mov byte [eax + 0xa], dl
push eax
pop eax
mov eax, dword [0x10006178]
test eax, eax
jne 0x10002de2
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x10002df3
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 8
push ecx
pop ecx
mov edx, dword [ebp + 0xc]
push edx
push ecx
call eax
pop esi
mov esp, ebp
pop ebp
ret 8