joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027a26
Capabilities:
Copy file

Disassembly:
push 0x218
mov eax, 0x1005eb0f
call fcn.1003ef45
mov ebx, ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x220], eax
call fcn.1000ada5
push eax
lea ecx, [ebp - 0x21c]
call fcn.1000a8c4
mov ecx, dword [ebx + 0x58]
lea eax, [ebp - 0x21c]
xor esi, esi
push eax
mov dword [ebp - 4], esi
mov ecx, dword [ecx + 0x54]
call fcn.1001275b
test eax, eax
je 0x10027adc
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.SHLWAPI.dll_PathIsPrefixW]
test eax, eax
jne 0x10027ad9
lea eax, [ebp - 0x218]
push eax
push 0x10064bb8
push dword [ebp - 0x21c]
call fcn.1000f97f
add esp, 0xc
test eax, eax
je 0x10027adc
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10027adc
mov ecx, dword [ebx + 0x58]
lea eax, [ebp - 0x218]
push esi
push dword [ebp - 0x220]
mov ecx, dword [ecx + 0x54]
push eax
push dword [ebp - 0x224]
call fcn.100129dd
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.10009de4
mov eax, esi
call fcn.1003eeef
ret 0xc
Function at 0x10029c84
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x88], ecx
mov ebx, esi
push edi
mov edi, esi
test eax, eax
je 0x10029e1c
test ecx, ecx
je 0x10029e1c
cmp dword [ebp + 0x10], 0x10
jl 0x10029e1c
push dword [ebp + 0x10]
push esi
push ecx
call fcn.10040d30
add esp, 0xc
push esi
push 1
push 3
push esi
push 1
push 1
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x70], eax
test eax, eax
je 0x10029e1c
cmp eax, 0xffffffff
je 0x10029e15
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.100293de
pop ecx
pop ecx
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], esi
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x78], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10029e12
mov eax, dword [ebp - 0x7c]
or eax, dword [ebp - 0x78]
je 0x10029dd9
push esi
push esi
push esi
push 2
push esi
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov dword [ebp - 0x80], edi
test edi, edi
je 0x10029e12
mov eax, dword [ebp - 0x78]
mov edx, esi
mov dword [ebp - 0x74], edx
mov ecx, esi
mov dword [ebp - 0x84], ecx
cmp edx, eax
jg 0x10029dd9
mov edi, dword [ebp - 0x7c]
jl 0x10029d69
cmp ecx, edi
jae 0x10029dd6
sub edi, ecx
sbb eax, edx
js 0x10029d7e
jg 0x10029d79
cmp edi, 0x400000
jb 0x10029d7e
mov edi, 0x400000
push edi
push ecx
push edx
push 4
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x10029dd6
push edi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.1002941c
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x84]
mov ebx, esi
mov edx, dword [ebp - 0x74]
add ecx, 0x400000
mov eax, dword [ebp - 0x78]
adc edx, esi
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x74], edx
cmp edx, eax
jge 0x10029dcf
mov edi, dword [ebp - 0x7c]
jmp 0x10029d69
jg 0x10029dd6
mov edi, dword [ebp - 0x7c]
jmp 0x10029d65
mov edi, dword [ebp - 0x80]
lea eax, [ebp - 0x6c]
push eax
call fcn.10029322
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x88]
call fcn.1000a2b6
xor esi, esi
add esp, 0x14
inc esi
test ebx, ebx
je 0x10029e07
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test edi, edi
je 0x10029e12
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003eec9
leave
ret
Function at 0x10029e9b
Capabilities:
Get file version info

Disassembly:
push 0x20
mov eax, 0x1005ecb9
call fcn.1003ef11
lea eax, [ebp - 0x14]
xor ebx, ebx
and dword [ebp - 0x14], ebx
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
push dword [eax]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1002a039
push esi
call fcn.1003f5d0
mov edi, eax
pop ecx
test edi, edi
je 0x1002a039
mov eax, dword [ebp + 8]
push edi
push esi
push dword [ebp - 0x14]
push dword [eax]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1002a032
call fcn.1002a261
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x10029fe6
call fcn.1002a1e7
test eax, eax
jne 0x10029fe6
and dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10029fe6
xor esi, esi
test dword [ebp + 8], 0xfffffffc
mov dword [ebp - 0x1c], esi
jbe 0x10029fe6
call fcn.1000ada5
push eax
lea ecx, [ebp - 0x18]
call fcn.1000a8c4
mov ecx, dword [ebp - 0x28]
and dword [ebp - 4], 0
movzx eax, word [ecx + esi*4 + 2]
push eax
movzx eax, word [ecx + esi*4]
push eax
lea eax, [ebp - 0x18]
push str.StringFileInfo_04x_04xFileVersion
push eax
call fcn.1000f096
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x20]
and dword [ebp - 0x24], 0
add esp, 0x10
and dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x10029faa
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.10009de4
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
inc esi
shr eax, 2
mov dword [ebp - 0x1c], esi
cmp esi, eax
jb 0x10029f3c
jmp 0x10029fe6
push dword [ebp - 0x20]
mov ecx, ebx
push dword [ebp - 0x24]
call fcn.10009f28
push 0x2e
push 0x2c
mov ecx, ebx
call fcn.1002a33e
push 0x20
mov ecx, ebx
call fcn.1002a2be
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
mov dword [ebp - 0x10], 1
call fcn.10009de4
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jne 0x1002a02f
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x2c]
and dword [ebp - 0x2c], 0
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x1006236c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1002a02f
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push ebx
call fcn.1000f096
xor ebx, ebx
add esp, 0x18
inc ebx
jmp 0x1002a032
mov ebx, dword [ebp - 0x10]
push edi
call fcn.1003f5d9
pop ecx
mov eax, ebx
call fcn.1003eeda
ret
Function at 0x1002a08b
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov esi, eax
test esi, esi
je 0x1002a0cf
push str..exe
push esi
call edi
test eax, eax
je 0x1002a0db
push str..dll
push esi
call edi
test eax, eax
je 0x1002a0db
push str..sys
push esi
call edi
test eax, eax
jne 0x1002a0e3
xor eax, eax
inc eax
jmp 0x1002a183
xor esi, esi
xor eax, eax
push esi
inc eax
push eax
push 3
push esi
push eax
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1002a105
xor eax, eax
jmp 0x1002a183
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x140]
push esi
push eax
push 0x40
lea eax, [ebp - 0x44]
mov dword [ebp - 0x140], esi
push eax
push edi
call ebx
cmp dword [ebp - 0x140], 0x40
jne 0x1002a17a
mov eax, 0x5a4d
cmp word [ebp - 0x44], ax
jne 0x1002a17a
push esi
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1002a17a
push esi
lea eax, [ebp - 0x140]
push eax
push 0xf8
lea eax, [ebp - 0x13c]
push eax
push edi
call ebx
cmp dword [ebp - 0x140], 0xf8
jne 0x1002a17a
cmp dword [ebp - 0x13c], 0x4550
push 1
pop eax
cmove esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003eec9
leave
ret
Function at 0x1002eb10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f1a8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], 0x720054
mov dword [ebp - 0x58], 0x630061
mov dword [ebp - 0x54], 0x6c0065
mov dword [ebp - 0x50], 0x730065
mov dword [ebp - 0x4c], 0x630073
mov dword [ebp - 0x48], 0x610068
mov dword [ebp - 0x44], 0x430074
mov dword [ebp - 0x40], 0x6e006f
mov dword [ebp - 0x3c], 0x690066
mov dword [ebp - 0x38], 0x430067
mov dword [ebp - 0x34], 0x6e0065
mov dword [ebp - 0x30], 0x650074
mov dword [ebp - 0x2c], 0x570072
mov dword [ebp - 0x28], 0x64006e
mov dword [ebp - 0x24], 0x6c0043
mov dword [ebp - 0x20], 0x730061
mov dword [ebp - 0x1c], 0x4e0073
mov dword [ebp - 0x18], 0x6d0061
mov dword [ebp - 0x14], 0x65
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1002ec32
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000ac20
test al, al
jne 0x1002ec12
lea ecx, [ebp - 0x5c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002ebf7
sub ecx, edx
lea eax, [ebp - 0x5c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10009f28
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009af6
int3
Function at 0x1002ed10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f20b
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], 0x740068
mov dword [ebp - 0xbc], 0x700074
mov dword [ebp - 0xb8], 0x2f003a
mov dword [ebp - 0xb4], 0x63002f
mov dword [ebp - 0xb0], 0x6e0064
mov dword [ebp - 0xac], 0x61002d
mov dword [ebp - 0xa8], 0x69006c
mov dword [ebp - 0xa4], 0x66002d
mov dword [ebp - 0xa0], 0x6c0069
mov dword [ebp - 0x9c], 0x2d0065
mov dword [ebp - 0x98], 0x680073
mov dword [ebp - 0x94], 0x2e0063
mov dword [ebp - 0x90], 0x6f0064
mov dword [ebp - 0x8c], 0x70006c
mov dword [ebp - 0x88], 0x690068
mov dword [ebp - 0x84], 0x70006e
mov dword [ebp - 0x80], 0x700061
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x63002e
mov dword [ebp - 0x74], 0x6d006f
mov dword [ebp - 0x70], 0x63002f
mov dword [ebp - 0x6c], 0x73006d
mov dword [ebp - 0x68], 0x70002f
mov dword [ebp - 0x64], 0x6f0072
mov dword [ebp - 0x60], 0x65006a
mov dword [ebp - 0x5c], 0x740063
mov dword [ebp - 0x58], 0x31005f
mov dword [ebp - 0x54], 0x380030
mov dword [ebp - 0x50], 0x63002f
mov dword [ebp - 0x4c], 0x670066
mov dword [ebp - 0x48], 0x63005f
mov dword [ebp - 0x44], 0x6e0065
mov dword [ebp - 0x40], 0x650074
mov dword [ebp - 0x3c], 0x2f0072
mov dword [ebp - 0x38], 0x6f0064
mov dword [ebp - 0x34], 0x70006c
mov dword [ebp - 0x30], 0x690068
mov dword [ebp - 0x2c], 0x5f006e
mov dword [ebp - 0x28], 0x6f006d
mov dword [ebp - 0x24], 0x5f0064
mov dword [ebp - 0x20], 0x69006c
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x6a002e
mov dword [ebp - 0x14], 0x73
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1002ef2e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0xc0]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000ac20
test al, al
jne 0x1002ef0e
lea ecx, [ebp - 0xc0]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002eef0
sub ecx, edx
lea eax, [ebp - 0xc0]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10009f28
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009af6
int3
Function at 0x1002f310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f2bb
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0x6f0043
mov dword [ebp - 0x8c], 0x66006e
mov dword [ebp - 0x88], 0x670069
mov dword [ebp - 0x84], 0x650043
mov dword [ebp - 0x80], 0x74006e
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x690053
mov dword [ebp - 0x74], 0x6c006e
mov dword [ebp - 0x70], 0x650067
mov dword [ebp - 0x6c], 0x6e0049
mov dword [ebp - 0x68], 0x740073
mov dword [ebp - 0x64], 0x6e0061
mov dword [ebp - 0x60], 0x650063
mov dword [ebp - 0x5c], 0x32005f
mov dword [ebp - 0x58], 0x430041
mov dword [ebp - 0x54], 0x350045
mov dword [ebp - 0x50], 0x300043
mov dword [ebp - 0x4c], 0x2d0045
mov dword [ebp - 0x48], 0x440037
mov dword [ebp - 0x44], 0x310046
mov dword [ebp - 0x40], 0x34002d
mov dword [ebp - 0x3c], 0x460038
mov dword [ebp - 0x38], 0x2d0031
mov dword [ebp - 0x34], 0x380042
mov dword [ebp - 0x30], 0x420035
mov dword [ebp - 0x2c], 0x44002d
mov dword [ebp - 0x28], 0x370031
mov dword [ebp - 0x24], 0x460031
mov dword [ebp - 0x20], 0x300030
mov dword [ebp - 0x1c], 0x420031
mov dword [ebp - 0x18], 0x460042
mov dword [ebp - 0x14], 0x43
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1002f4ae
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000ac20
test al, al
jne 0x1002f48e
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002f470
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10009f28
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009af6
int3
Function at 0x1002fa40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f368
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0x740068
mov dword [ebp - 0x64], 0x700074
mov dword [ebp - 0x60], 0x2f003a
mov dword [ebp - 0x5c], 0x6c002f
mov dword [ebp - 0x58], 0x70002e
mov dword [ebp - 0x54], 0x620075
mov dword [ebp - 0x50], 0x69006c
mov dword [ebp - 0x4c], 0x2e0063
mov dword [ebp - 0x48], 0x610068
mov dword [ebp - 0x44], 0x6f006c
mov dword [ebp - 0x40], 0x610070
mov dword [ebp - 0x3c], 0x650070
mov dword [ebp - 0x38], 0x2e0072
mov dword [ebp - 0x34], 0x6e0063
mov dword [ebp - 0x30], 0x70002f
mov dword [ebp - 0x2c], 0x2f0063
mov dword [ebp - 0x28], 0x700075
mov dword [ebp - 0x24], 0x610064
mov dword [ebp - 0x20], 0x610074
mov dword [ebp - 0x1c], 0x64002f
mov dword [ebp - 0x18], 0x6d0075
mov dword [ebp - 0x14], 0x70
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1002fb7b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000ac20
test al, al
jne 0x1002fb5b
lea ecx, [ebp - 0x68]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002fb40
sub ecx, edx
lea eax, [ebp - 0x68]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10009f28
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009af6
int3
Function at 0x1002fc60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f2bb
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0x6f0043
mov dword [ebp - 0x8c], 0x66006e
mov dword [ebp - 0x88], 0x670069
mov dword [ebp - 0x84], 0x650043
mov dword [ebp - 0x80], 0x74006e
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x690053
mov dword [ebp - 0x74], 0x6c006e
mov dword [ebp - 0x70], 0x650067
mov dword [ebp - 0x6c], 0x6e0049
mov dword [ebp - 0x68], 0x740073
mov dword [ebp - 0x64], 0x6e0061
mov dword [ebp - 0x60], 0x650063
mov dword [ebp - 0x5c], 0x34005f
mov dword [ebp - 0x58], 0x310044
mov dword [ebp - 0x54], 0x390041
mov dword [ebp - 0x50], 0x340035
mov dword [ebp - 0x4c], 0x2d0036
mov dword [ebp - 0x48], 0x420032
mov dword [ebp - 0x44], 0x370036
mov dword [ebp - 0x40], 0x34002d
mov dword [ebp - 0x3c], 0x300045
mov dword [ebp - 0x38], 0x2d0034
mov dword [ebp - 0x34], 0x330039
mov dword [ebp - 0x30], 0x410041
mov dword [ebp - 0x2c], 0x31002d
mov dword [ebp - 0x28], 0x390041
mov dword [ebp - 0x24], 0x350041
mov dword [ebp - 0x20], 0x430035
mov dword [ebp - 0x1c], 0x310036
mov dword [ebp - 0x18], 0x410031
mov dword [ebp - 0x14], 0x39
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1002fdfe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000ac20
test al, al
jne 0x1002fdde
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002fdc0
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10009f28
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009af6
int3
Function at 0x1002fe10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f398
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], 0x740068
mov dword [ebp - 0x78], 0x700074
mov dword [ebp - 0x74], 0x2f003a
mov dword [ebp - 0x70], 0x69002f
mov dword [ebp - 0x6c], 0x74006e
mov dword [ebp - 0x68], 0x2d0066
mov dword [ebp - 0x64], 0x630070
mov dword [ebp - 0x60], 0x64002e
mov dword [ebp - 0x5c], 0x6c006f
mov dword [ebp - 0x58], 0x680070
mov dword [ebp - 0x54], 0x6e0069
mov dword [ebp - 0x50], 0x610070
mov dword [ebp - 0x4c], 0x650070
mov dword [ebp - 0x48], 0x2e0072
mov dword [ebp - 0x44], 0x6f0063
mov dword [ebp - 0x40], 0x2f006d
mov dword [ebp - 0x3c], 0x660063
mov dword [ebp - 0x38], 0x2f0067
mov dword [ebp - 0x34], 0x6a0079
mov dword [ebp - 0x30], 0x620068
mov dword [ebp - 0x2c], 0x5f007a
mov dword [ebp - 0x28], 0x650064
mov dword [ebp - 0x24], 0x610074
mov dword [ebp - 0x20], 0x6c0069
mov dword [ebp - 0x1c], 0x70002e
mov dword [ebp - 0x18], 0x700068
mov word [ebp - 0x14], ax
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1002ff6b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000ac20
test al, al
jne 0x1002ff4b
lea ecx, [ebp - 0x7c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002ff30
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10009f28
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009af6
int3
Function at 0x1002ff80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f3cb
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], 0x740068
mov dword [ebp - 0x7c], 0x700074
mov dword [ebp - 0x78], 0x2f003a
mov dword [ebp - 0x74], 0x69002f
mov dword [ebp - 0x70], 0x74006e
mov dword [ebp - 0x6c], 0x2d0066
mov dword [ebp - 0x68], 0x630070
mov dword [ebp - 0x64], 0x77002e
mov dword [ebp - 0x60], 0x610068
mov dword [ebp - 0x5c], 0x65006c
mov dword [ebp - 0x58], 0x720070
mov dword [ebp - 0x54], 0x74006f
mov dword [ebp - 0x50], 0x630065
mov dword [ebp - 0x4c], 0x2e0074
mov dword [ebp - 0x48], 0x6e0063
mov dword [ebp - 0x44], 0x63002f
mov dword [ebp - 0x40], 0x670066
mov dword [ebp - 0x3c], 0x62002f
mov dword [ebp - 0x38], 0x75006c
mov dword [ebp - 0x34], 0x770065
mov dword [ebp - 0x30], 0x610068
mov dword [ebp - 0x2c], 0x65006c
mov dword [ebp - 0x28], 0x64005f
mov dword [ebp - 0x24], 0x740065
mov dword [ebp - 0x20], 0x690061
mov dword [ebp - 0x1c], 0x2e006c
mov dword [ebp - 0x18], 0x680070
mov dword [ebp - 0x14], 0x70
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x100300eb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000ac20
test al, al
jne 0x100300cb
lea ecx, [ebp - 0x80]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100300b0
sub ecx, edx
lea eax, [ebp - 0x80]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10009f28
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009af6
int3
Function at 0x10030100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f2bb
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0x6f0043
mov dword [ebp - 0x8c], 0x66006e
mov dword [ebp - 0x88], 0x670069
mov dword [ebp - 0x84], 0x650043
mov dword [ebp - 0x80], 0x74006e
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x690053
mov dword [ebp - 0x74], 0x6c006e
mov dword [ebp - 0x70], 0x650067
mov dword [ebp - 0x6c], 0x6e0049
mov dword [ebp - 0x68], 0x740073
mov dword [ebp - 0x64], 0x6e0061
mov dword [ebp - 0x60], 0x650063
mov dword [ebp - 0x5c], 0x39005f
mov dword [ebp - 0x58], 0x370042
mov dword [ebp - 0x54], 0x340042
mov dword [ebp - 0x50], 0x360044
mov dword [ebp - 0x4c], 0x2d0032
mov dword [ebp - 0x48], 0x410031
mov dword [ebp - 0x44], 0x370030
mov dword [ebp - 0x40], 0x34002d
mov dword [ebp - 0x3c], 0x330042
mov dword [ebp - 0x38], 0x2d0041
mov dword [ebp - 0x34], 0x430042
mov dword [ebp - 0x30], 0x460037
mov dword [ebp - 0x2c], 0x33002d
mov dword [ebp - 0x28], 0x420034
mov dword [ebp - 0x24], 0x320033
mov dword [ebp - 0x20], 0x410031
mov dword [ebp - 0x1c], 0x300034
mov dword [ebp - 0x18], 0x370039
mov dword [ebp - 0x14], 0x35
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1003029e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000ac20
test al, al
jne 0x1003027e
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10030260
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10009f28
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009af6
int3