joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc1ec
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x4dc257
cmp byte [ebx + 0xd7], 0
jne 0x4dc257
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406ed8
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4dc244
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4dc264
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00407130
jmp 0x4dc264
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00407130
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4dda9c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x4ddb0a
mov eax, esi
call fcn.00509d40
test al, al
je 0x4ddb0a
mov eax, dword [ebx + 0x88]
call fcn.0050998c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4ddb0a
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x4ddafe
push 0
mov eax, dword [ebx + 0x88]
call fcn.0050998c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.005007a8
jmp 0x4ddb0a
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.004dd8d4
pop esi
pop ebx
ret
Function at 0x4e2264
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x4e22de
mov eax, dword [ebx + 8]
call fcn.0050998c
mov ecx, eax
mov dl, 1
mov eax, dword [0x47c3b0]
call fcn.00503db0
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.00480a48
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a0], 0x4e1b5c
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0050998c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0050998c
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x4e2354
mov eax, dword [ebx + 8]
call fcn.0050998c
mov ecx, eax
mov dl, 1
mov eax, dword [0x47c3b0]
call fcn.00503db0
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.00480a48
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a0], 0x4e1ba8
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0050998c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0050998c
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x4e23c0
mov eax, dword [ebx + 8]
call fcn.0050998c
mov ecx, eax
mov dl, 1
mov eax, dword [0x47cdec]
call fcn.00503db0
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x278], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0050998c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0050998c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4eac8c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00406d50
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x4eacde
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x4eacd7
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040792c
jmp 0x4eacde
mov eax, esi
call fcn.00406d50
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x4f0480
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f05df
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x521470], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x45a12c]
call fcn.0045b278
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4f05b5
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0045b360
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040792c
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x4f05f8
call fcn.00407adc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0045b5ec
test al, al
je 0x4f059f
lea ecx, [ebp - 4]
mov edx, 0x4f066c
mov eax, dword [ebp - 0xc]
call fcn.0045be74
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00426290
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4f059f
xor edx, edx
push ebp
push 0x4f0598
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4f0684
mov eax, dword [ebp - 8]
push eax
call fcn.0040dd40
test eax, eax
je 0x4f0581
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x4f0581
call fcn.004f040c
test eax, eax
je 0x4f0571
mov eax, dword [ebx + 0x50]
jmp 0x4f0574
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x521470]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f059f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f05bc
mov eax, dword [ebp - 0xc]
call fcn.00404fa4
ret

Function at 0x4f06e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x4f072f
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4f0712
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4f0723
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x4f072f
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4fde0c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x527318], 0
je 0x4fdf4d
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x521990]
mov edx, dword [edx]
xor al, byte [edx + 0xc0]
je 0x4fdf4d
mov eax, dword [0x52731c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x527318]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4fdf1c
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x527318]
call fcn.004442c8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4fdf14
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1f2], 0
je 0x4fdf14
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x68]
test al, al
je 0x4fdf14
mov eax, dword [ebp - 0x14]
call fcn.0050998c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4fdf14
push ebp
call fcn.004fddc8
pop ecx
test al, al
jne 0x4fdf14
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00405300
test al, al
je 0x4fdf14
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00405300
cmp byte [ebp - 1], 0
je 0x4fdf14
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040c48c
test al, al
je 0x4fdf14
mov edx, dword [ebp - 0x14]
mov eax, dword [0x52731c]
call fcn.004fd528
inc edi
dec ebx
jne 0x4fde71
mov eax, dword [0x52731c]
cmp dword [eax + 8], 0
jle 0x4fdf34
mov eax, dword [0x52731c]
call fcn.004fd5e0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4fdf4d
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004fdc30
pop ecx
test al, al
jne 0x4fdf4d
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x506408
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040c474
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.005003b8
test ebx, ebx
jne 0x50645b
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00506284
mov ebx, eax
test ebx, ebx
je 0x506551
cmp esi, ebx
je 0x506484
mov eax, dword [esp]
sub eax, dword [ebx + 0x48]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x4c]
mov dword [esp + 0x118], eax
jmp 0x506499
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x5064d1
add eax, 0xffffff5f
sub eax, 2
jb 0x5064e9
dec eax
sub eax, 2
jb 0x5064fd
dec eax
sub eax, 2
jb 0x5064f3
jmp 0x506507
add eax, 0xfffffdff
sub eax, 2
jb 0x5064e9
dec eax
sub eax, 2
jb 0x5064fd
dec eax
sub eax, 2
jb 0x5064f3
jmp 0x506507
mov byte [esp + 0x120], 0
jmp 0x50650f
mov byte [esp + 0x120], 2
jmp 0x50650f
mov byte [esp + 0x120], 1
jmp 0x50650f
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004d067c
mov esi, eax
call fcn.004fceb8
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00501dcc
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x506553
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x4239f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x423a05
pop dword [ebp - 0x2c]
mov eax, 0x12795c1f
sub eax, 0x1237221a
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x38ab1
push 0
mov eax, 0x27243ec3
sub eax, 0x26e0be93
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x3ffc
mov esi, eax
mov edi, 0xa5d463ac
sub edi, 0xa58f9dac
add edi, dword [ebp - 0x2c]
mov edx, 0xfe42ff51
xor dword [ebp - 0x24], eax
mov ebx, dword [edi]
add dword [ebp - 8], 0xcd3e6666
add ebx, edx
sub dword [ebp - 0x24], ecx
mov dword [esi], ebx
xor dword [ebp - 0x14], eax
add esi, 4
add edi, 0x170f47cd
add edi, 0xe8f0b837
loop 0x423a58
add eax, 0xf2c3
xor ebx, ebx
add ebx, eax
add eax, 0x9e3770c6
sub eax, 0x9e3770c1
mov ecx, 0x7f998f0f
add ecx, 0x80a670f1
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4281f2
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x436de3
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43a908
mov dword [esi + 4], 0x43a8f4
mov dword [esi + 8], 0x438e70
mov dword [esi + 0xc], 0x43a8d8
mov dword [esi + 0x10], 0x43a8c4
mov dword [esi + 0x14], 0x43a8b4
mov dword [esi + 0x18], 0x438e60
mov dword [esi + 0x1c], 0x438e50
mov dword [esi + 0x20], 0x43a8ac
mov dword [esi + 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
or dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
call fcn.004028e9
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.004028e9
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
or dword [esi + 0x9c], 0xffffffff
mov byte [ebp - 4], 7
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0xa0], ebx
mov byte [esi + 0xa4], bl
mov byte [esi + 0xa5], bl
mov byte [esi + 0xa6], bl
mov byte [esi + 0xa7], bl
mov byte [esi + 0xa8], bl
mov byte [esi + 0xa9], bl
mov byte [esi + 0xaa], bl
mov dword [esi + 0xac], ebx
mov dword [esi], 0x43a880
mov dword [esi + 4], 0x43a86c
mov dword [esi + 8], 0x43a854
mov dword [esi + 0xc], 0x43a838
mov dword [esi + 0x10], 0x43a824
mov dword [esi + 0x14], 0x43a814
mov dword [esi + 0x18], 0x43a804
mov dword [esi + 0x1c], 0x43a7f4
mov dword [esi + 0x20], 0x43a7ec
call fcn.0040d4f9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x28], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4034c0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x403529
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00403040
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x4038b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4038ce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4038c3
pop esi
ret
Function at 0x10001510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc94
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
mov edi, ecx
call fcn.10008880
mov eax, 0x43
mov dword [ebp - 0x4e], 0x720075
mov word [ebp - 0x50], ax
mov esi, 0x6f
mov eax, 0x52
mov dword [ebp - 0x66], 0x690057
mov word [ebp - 0x80], ax
mov ecx, 0x72
mov eax, 0x4d
mov word [ebp - 0x4a], cx
mov word [ebp - 0x7a], ax
mov eax, 0x65
mov word [ebp - 0x40], ax
mov eax, 0x72
push 0x7fc
mov word [ebp - 0x20], ax
lea eax, [ebp - 0xc88]
mov word [ebp - 0x74], cx
lea ecx, [esi + 5]
push 0
push eax
mov dword [ebp - 0x78], 0x630069
mov dword [ebp - 0x84], 0x410057
mov dword [ebp - 0x7e], 0x5c0045
mov dword [ebp - 0x8c], 0x4f0053
mov dword [ebp - 0x72], 0x73006f
mov dword [ebp - 0x6e], 0x66006f
mov dword [ebp - 0x3e], 0x730072
mov dword [ebp - 0x88], 0x540046
mov dword [ebp - 0x58], 0x4e0020
mov dword [ebp - 0x48], 0x6e0065
mov dword [ebp - 0x3a], 0x6f0069
mov dword [ebp - 0x6a], 0x5c0074
mov dword [ebp - 0x54], 0x5c0054
mov dword [ebp - 0x44], 0x560074
mov dword [ebp - 0x5c], 0x730077
mov dword [ebp - 0x62], 0x64006e
mov dword [ebp - 0x36], 0x6e
mov word [ebp - 0x5e], si
mov dword [ebp - 0x1e], 0x64006f
mov dword [ebp - 0x1a], 0x630075
mov dword [ebp - 0x24], 0x50006c
mov dword [ebp - 0x28], 0x610074
mov dword [ebp - 0x16], 0x490074
mov dword [ebp - 0x2c], 0x690067
mov dword [ebp - 0x12], 0x64
mov dword [ebp - 0x30], 0x690044
mov dword [ebp - 0xc8c], 0
call fcn.1000b8b0
add esp, 0xc
mov dword [ebp - 0xc90], 0x800
lea eax, [ebp - 0xc94]
lea edx, [ebp - 0x8c]
push eax
push 0x101
push ecx
call fcn.10004ab0
add esp, 0xc
test eax, eax
jne 0x10001749
lea eax, [ebp - 0xc90]
push eax
lea eax, [ebp - 0xc8c]
push eax
push 0
push ecx
mov ecx, dword [ebp - 0xc94]
lea edx, [ebp - 0x30]
call fcn.10007c20
add esp, 0x10
test eax, eax
jne 0x1000173e
push 0x3ff
push eax
mov byte [ebp - 0x48c], al
lea eax, [ebp - 0x48b]
push eax
call fcn.1000b8b0
push dword [ebp - 0xc90]
lea edx, [ebp - 0x48c]
lea ecx, [ebp - 0xc8c]
call fcn.10006b80
add esp, 0x10
mov dword [ebp - 0xc], 0x730025
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x48c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001700
sub eax, edx
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x10001718
xor eax, eax
jmp 0x10001730
lea eax, [esi + esi]
call fcn.10015760
mov ecx, esp
lea edx, [ebp - 0x48c]
push 3
push esi
call fcn.10008270
push eax
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.100090a0
add esp, 0xc
mov ecx, dword [ebp - 0xc94]
call fcn.10004b40
lea esp, [ebp - 0xca0]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100096eb
mov esp, ebp
pop ebp
ret
Function at 0x10002450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x18], eax
xor esi, esi
call fcn.100023d0
mov edi, eax
test edi, edi
je 0x100024b6
lea eax, [ebp - 0x14]
mov dword [ebp - 0xb], 0x41784577
push eax
push edi
mov dword [ebp - 0x14], 0x646e6946
mov dword [ebp - 0x10], 0x646e6957
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100024af
push dword [ebp - 0x18]
push ebx
push esi
push esi
call eax
mov esi, eax
mov ecx, edi
call fcn.10003690
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100096eb
mov esp, ebp
pop ebp
ret

Function at 0x10002540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x14], ecx
xor esi, esi
call fcn.100023d0
mov edi, eax
test edi, edi
je 0x1000259b
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0x646e6957
push eax
push edi
mov word [ebp - 8], 0x776f
mov byte [ebp - 6], 0
mov dword [ebp - 0x10], 0x776f6853
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002594
push ebx
push dword [ebp - 0x14]
call eax
mov esi, eax
mov ecx, edi
call fcn.10003690
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100096eb
mov esp, ebp
pop ebp
ret

Function at 0x10002620
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
call fcn.10007b10
mov edi, eax
test edi, edi
je 0x10002692
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1a], 0x70756b6f
push eax
push edi
mov dword [ebp - 0xc], 0x65756c61
mov word [ebp - 8], 0x41
mov dword [ebp - 0x16], 0x76697250
mov word [ebp - 0x1c], 0x6f4c
mov dword [ebp - 0x10], 0x56656765
mov word [ebp - 0x12], 0x6c69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000268b
push ebx
push str.SeDebugPrivilege
push esi
call eax
mov esi, eax
mov ecx, edi
call fcn.10003690
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100096eb
mov esp, ebp
pop ebp
ret
Function at 0x100026b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0xf], 0x636f7250
push eax
mov esi, ecx
mov dword [ebp - 0x16], 0x6e696d72
mov word [ebp - 0x11], 0x6574
mov dword [ebp - 0xb], 0x737365
mov word [ebp - 0x18], 0x6554
mov byte [ebp - 0x12], 0x61
call fcn.10007ac0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002710
push 0
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100096eb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100096eb
mov esp, ebp
pop ebp
ret

Function at 0x100027b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x626f6c47
push eax
mov esi, ecx
mov word [ebp - 0xb], 0x466c
mov word [ebp - 8], 0x6565
mov byte [ebp - 6], 0
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 9], 0x72
call fcn.10007ac0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002808
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100096eb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100096eb
mov esp, ebp
pop ebp
ret

Function at 0x10002820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x12], 0x63695474
push eax
mov word [ebp - 0xd], 0x6f43
mov word [ebp - 0xa], 0x746e
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 8], 0
mov word [ebp - 0x14], 0x6547
mov byte [ebp - 0xe], 0x6b
call fcn.10007ac0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002879
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100096eb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.100096eb
mov esp, ebp
pop ebp
ret

Function at 0x10002890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.10004840
mov edi, eax
test edi, edi
je 0x100028e8
lea eax, [ebp - 0x10]
mov dword [ebp - 0xd], 0x6e496f54
push eax
push edi
mov word [ebp - 9], 0x4174
mov word [ebp - 0xf], 0x7274
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 7], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100028e1
push ebx
call eax
mov esi, eax
mov ecx, edi
call fcn.10003690
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100096eb
mov esp, ebp
pop ebp
ret