joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b1e0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457c6b
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x47706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
push 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x8c], esp
push str.SeDebugPrivilege
call fcn.00403f30
call fcn.004167c0
add esp, 0x1c
mov dword [ebp - 0x78], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.00403b70
mov dword [ebp - 4], 0
push str.trustfixservice.exe
lea ecx, [ebp - 0x28]
call fcn.00404420
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x84]
call fcn.00412390
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404250
push str.trustservice.exe
lea ecx, [ebp - 0x40]
call fcn.00404420
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x84]
call fcn.00412390
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00404250
push str.trustdservice.exe
lea ecx, [ebp - 0x58]
call fcn.00404420
mov byte [ebp - 4], 3
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x84]
call fcn.00412390
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00404250
push str.TrustAgent.exe
lea ecx, [ebp - 0x70]
call fcn.00404420
mov byte [ebp - 4], 4
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x84]
call fcn.00412390
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00404250
lea ecx, [ebp - 0x84]
push ecx
call fcn.00416b50
add esp, 4
mov byte [ebp - 0x71], al
movzx edx, byte [ebp - 0x71]
test edx, edx
jne 0x41b33b
push str.kill_process_failed
push 4
push 0x47b0a0
call fcn.0040db30
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.004125c0
jmp 0x41b35c
mov dword [ebp - 0x78], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.004125c0
xor eax, eax
jne 0x41b237
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f4e5
mov esp, ebp
pop ebp
ret

Function at 0x41bd80
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xffffffff
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xc], esp
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
call fcn.00403ff0
mov ecx, dword [ebp - 4]
call fcn.0041c530
push 4
push 0
push str..._TrustAgent
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 8], 0
xor ecx, ecx
jne 0x41bd90
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x41c4f0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 4
push 0
mov ecx, dword [ebp + 8]
call fcn.00403d00
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x41c51b
mov eax, dword [ebp - 4]
mov byte [eax + 0x54], 1
mov al, 1
jmp 0x41c51d
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x41cc10
Capabilities:
Create process on windows
Print debug messages
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x47706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
push 0x46e770
lea ecx, [ebp - 0x28]
call fcn.00403f30
mov dword [ebp - 4], 0
push 0x46e6f4
lea ecx, [ebp - 0x28]
call fcn.0040b900
mov eax, dword [ebp - 0x2c]
add eax, 0xc
push eax
lea ecx, [ebp - 0x28]
call fcn.0040b920
push 0x46e76c
lea ecx, [ebp - 0x28]
call fcn.0040b900
push 0x44
push 0
lea ecx, [ebp - 0x80]
push ecx
call fcn.004372f0
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x80]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00403d00
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x28]
call fcn.00403d00
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Delete_myself_over..............
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403dd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f4e5
mov esp, ebp
pop ebp
ret

Function at 0x42232a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x44756e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004473ed

Function at 0x44dac9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044d789
Function at 0x1000ecd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x5a375a38
push 0x5a5e
push 0x100eb70c
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xc
push eax
mov dword [ebp - 0xfc], 0x5a3b5a2c
mov dword [ebp - 0xf8], 0x5a315a38
mov dword [ebp - 0xf4], 0x5a705a26
mov dword [ebp - 0xf0], 0x5a265a3b
mov dword [ebp - 0xec], 0x5a5e5a3b
call fcn.10055920
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1001c310
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x1001c341
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1001c330
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1001f3d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d4444
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], 0xffffffff
mov dword [edx + 0x18], 0xf
mov dword [edx + 0x14], 0
mov byte [edx + 4], 0
mov dword [ebp - 4], 0
mov dword [edx + 0x30], 0xf
mov dword [edx + 0x2c], 0
mov byte [edx + 0x1c], 0
mov byte [ebp - 4], 1
lea ecx, [edx + 0x38]
lea eax, [ecx + 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov byte [eax], 0
mov byte [ebp - 4], 3
mov al, byte [ebp + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 6
mov dword [ecx + 0xc], 0
mov byte [ecx + 0x10], al
mov dword [ecx + 0x14], 0x201
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov byte [ebp - 4], 4
mov dword [edx + 0x60], 0xffffffff
mov dword [edx + 0x64], closesocket
mov dword [edx + 0x68], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002bc00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d55f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.100a9c31
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
jne 0x1002bcb4
lea eax, [ebp + 8]
mov dword [ebp + 8], str.bad_locale_name
push eax
lea ecx, [ebp - 0x1c]
call fcn.100ae408
mov byte [ebp - 4], 7
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x1c]
push 0x10125928
push eax
call fcn.100b408b
push eax
push esi
call fcn.100a9b04
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002ede0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d5a88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
cmp edx, 1
jne 0x1002ef35
mov dword [ebp - 4], 0
call fcn.1000f4c0
test al, al
jne 0x1002ee29
call fcn.10056210
test al, al
je 0x1002efce
call fcn.10056210
test al, al
jne 0x1002ef35
mov dword [ebp - 4], 0xffffffff
mov dword [0x100ea554], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x100ea550], eax
mov ecx, edi
call fcn.1002ebd0
call fcn.1002eff0
push eax
lea ecx, [ebp - 0x38]
call fcn.10010c20
mov esi, eax
mov dword [ebp - 4], 2
call fcn.1002f150
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov edx, esi
call fcn.10030430
add esp, 4
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
call fcn.10057bc0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 8
jb 0x1002eeac
push dword [ebp - 0x38]
call fcn.100adaa3
add esp, 4
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
xor eax, eax
mov word [ebp - 0x38], ax
mov ecx, edi
call fcn.100577c0
mov dword [ebp - 4], 4
call fcn.1000f850
test al, al
je 0x1002eedc
call fcn.10047e60
call fcn.1000fa30
test al, al
je 0x1002eeea
call fcn.10047e60
call fcn.1000f990
test al, al
je 0x1002ef4b
call fcn.10055b40
test al, al
jne 0x1002efce
call fcn.10047e60
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x1002e6f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x1002ef35
call fcn.10057c40
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x1002e6f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, eax
lea ecx, [ebp - 0x20]
call fcn.1006f300
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1002ef8a
mov eax, dword [eax]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x1002ef9c
call fcn.10057c40
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.1002e680
jmp 0x1002ef35
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003dac0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d708a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 2
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov byte [ebp - 4], 3
mov dword [ecx + 0x44], 0xf
mov dword [ecx + 0x40], 0
mov byte [ecx + 0x30], 0
mov byte [ebp - 4], 4
mov dword [ecx + 0x5c], 0xf
mov dword [ecx + 0x58], 0
mov byte [ecx + 0x48], 0
mov byte [ebp - 4], 5
mov dword [ecx + 0x74], 0xf
mov dword [ecx + 0x70], 0
mov byte [ecx + 0x60], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10047a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x28622860
push 0x2830
push 0x100ec248
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 8
push eax
mov dword [ebp - 0xfc], 0x2862286f
mov dword [ebp - 0xf8], 0x28512855
mov dword [ebp - 0xf4], 0x28302854
call fcn.10055920
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10047ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x3577356a
push 0x3504
push 0x100ec25c
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xa
push eax
mov dword [ebp - 0xfc], 0x35763574
mov dword [ebp - 0xf8], 0x352a3530
mov dword [ebp - 0xf4], 0x35683560
mov dword [ebp - 0xf0], 0x35043568
call fcn.10055920
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10048650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x68276803
push 0x6854
push 0x100ec2ac
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xb
push eax
mov dword [ebp - 0xfc], 0x680b6866
mov dword [ebp - 0xf8], 0x68666867
mov dword [ebp - 0xf4], 0x6830687a
mov dword [ebp - 0xf0], 0x68386838
mov dword [ebp - 0xec], 0x6854
call fcn.10055920
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x100487c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x757b757f
push 0x7528
push 0x100ec2c4
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 8
push eax
mov dword [ebp - 0xfc], 0x757b7569
mov dword [ebp - 0xf8], 0x7546754d
mov dword [ebp - 0xf4], 0x7528754c
call fcn.10055920
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10055a40
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d9bd0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10001850]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x40]
push eax
movdqu xmmword [ebp - 0x3c], xmm0
movdqu xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x40], 0
jne 0x10055a98
xor al, al
jmp 0x10055b1c
push esi
push 0
xorps xmm0, xmm0
push 0x400
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.1006f300
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0
test eax, eax
je 0x10055acf
mov eax, dword [eax]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x14], 0
sete dl
mov byte [ebp - 0x41], dl
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x10055b1a
or edi, 0xffffffff
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x10055b1a
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x10055b17
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov dl, byte [ebp - 0x41]
mov al, dl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100af3ad
mov esp, ebp
pop ebp
ret