joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c5430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10195560
push 0x100fb660
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x101b03d4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov al, 0x64
mov byte [ebp - 0x28], al
mov byte [ebp - 0x27], 0x33
mov byte [ebp - 0x26], al
mov byte [ebp - 0x25], 0x39
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], al
mov al, 0x6c
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], al
mov byte [ebp - 0x20], 0
mov esi, esi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov cl, cl
xor esi, esi
cmp eax, esi
je 0x100c552f
mov byte [ebp - 0x3c], 0x44
mov byte [ebp - 0x3b], 0x69
mov bl, 0x72
mov byte [ebp - 0x3a], bl
mov cl, 0x65
mov byte [ebp - 0x39], cl
mov byte [ebp - 0x38], 0x63
mov dl, 0x74
mov byte [ebp - 0x37], dl
mov byte [ebp - 0x36], 0x33
mov byte [ebp - 0x35], 0x44
mov byte [ebp - 0x34], 0x43
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], cl
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], dl
mov byte [ebp - 0x2f], cl
mov byte [ebp - 0x2e], 0x39
mov byte [ebp - 0x2d], 0x45
mov byte [ebp - 0x2c], 0x78
mov byte [ebp - 0x2b], 0
mov dh, dh
lea ecx, [ebp - 0x3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push ebx
pop ebx
cmp eax, esi
je 0x100c552f
mov dword [ebp - 0x40], esi
mov ecx, ecx
mov dword [ebp - 4], esi
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [ebp + 8]
push ecx
call eax
mov dl, dl
cmp eax, esi
jl 0x100c5528
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x40]
jmp 0x100c5531
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100fb12a
mov esp, ebp
pop ebp
ret 4
Function at 0x100c6cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 4], ecx
mov cl, 0x64
mov dword [esp], eax
mov al, 0x31
mov byte [esp + 8], cl
mov dl, 0x33
mov byte [esp + 0xa], cl
mov byte [esp + 0xe], cl
mov cl, 0x6c
push ebp
mov ebp, dword [esp + 0x40]
mov byte [esp + 0xd], dl
mov byte [esp + 0x19], dl
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], cl
mov cl, 0x44
mov byte [esp + 0x1b], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
mov al, 0x65
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0x15], 0x2e
mov byte [esp + 0x19], 0
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1e], cl
mov byte [esp + 0x21], 0x4f
mov byte [esp + 0x22], 0x6e
mov byte [esp + 0x24], 0x32
mov byte [esp + 0x25], 0x43
mov byte [esp + 0x26], 0x72
mov byte [esp + 0x27], al
mov byte [esp + 0x28], 0x61
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], cl
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], 0x76
mov byte [esp + 0x2e], 0x69
mov byte [esp + 0x2f], 0x63
mov byte [esp + 0x30], al
mov byte [esp + 0x31], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
jne 0x100c6d9c
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
jne 0x100c6d9c
mov eax, 0x80004005
pop ebp
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100fb12a
add esp, 0x30
ret 0x18
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x100c6d85
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push edx
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x4c]
push ebx
push edx
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x4c]
push ebp
push edx
push edi
push ecx
push esi
call eax
mov ecx, dword [esp + 0x30]
pop ebp
xor ecx, esp
call fcn.100fb12a
add esp, 0x30
ret 0x18
Function at 0x100cc7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x1c], eax
mov cl, 0x72
mov dl, 0x67
mov al, 0x61
mov byte [esp + 4], 0x50
mov byte [esp + 5], cl
mov byte [esp + 6], 0x6f
mov byte [esp + 7], dl
mov byte [esp + 8], 0x6d
mov byte [esp + 9], al
mov byte [esp + 0xa], 0x6e
mov byte [esp + 0xb], 0
mov ebx, ebx
mov byte [esp + 0xc], 0x50
mov byte [esp + 0xd], cl
mov byte [esp + 0xe], 0x6f
mov byte [esp + 0xf], dl
mov byte [esp + 0x10], cl
mov byte [esp + 0x11], al
mov byte [esp + 0x12], 0x6d
mov byte [esp + 0x13], 0x20
mov byte [esp + 0x14], 0x4d
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], al
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], 0
mov ebp, ebp
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.USER32.dll_FindWindowA]
mov ch, ch
test eax, eax
jne 0x100cc88a
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100fb12a
add esp, 0x20
ret
mov dword [esp], 0
mov al, al
lea edx, [esp]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dl, dl
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp]
xor ecx, esp
call fcn.100fb12a
add esp, 0x20
ret
Function at 0x100cc8c0
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
sub esp, 0x244
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x240], eax
mov cl, 0x73
mov al, 0x65
mov dl, 0x2e
push esi
mov byte [esp + 0x138], cl
mov byte [esp + 0x139], 0x76
mov byte [esp + 0x13a], 0x63
mov byte [esp + 0x13b], 0x68
mov byte [esp + 0x13c], 0x6f
mov byte [esp + 0x13d], cl
mov byte [esp + 0x13e], 0x74
mov byte [esp + 0x13f], dl
mov byte [esp + 0x140], al
mov byte [esp + 0x141], 0x78
mov byte [esp + 0x142], al
mov byte [esp + 0x143], 0
mov esi, esi
mov byte [esp + 0x12e], al
mov al, 0x6c
mov byte [esp + 0x12c], 0x75
mov byte [esp + 0x12d], cl
mov byte [esp + 0x12f], 0x72
mov byte [esp + 0x130], 0x33
mov byte [esp + 0x131], 0x32
mov byte [esp + 0x132], dl
mov byte [esp + 0x133], 0x64
mov byte [esp + 0x134], al
mov byte [esp + 0x135], al
mov byte [esp + 0x136], 0
mov dl, dl
mov edi, edi
push 0x128
lea eax, [esp + 8]
push 0
push eax
call fcn.100fbc20
add esp, 0xc
mov bh, bh
mov dword [esp + 4], 0x128
mov eax, eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
push edx
pop edx
cmp esi, 0xffffffff
je 0x100ccaae
lea ecx, [esp + 4]
push ecx
push esi
call sub.KERNEL32.DLL_Process32First
mov dh, dh
test eax, eax
je 0x100ccaa5
lea esp, [esp]
nop
xor eax, eax
jmp 0x100cc9f0
mov cl, byte [esp + eax + 0x28]
mov byte [esp + eax + 0x144], cl
add eax, 1
test cl, cl
jne 0x100cc9f0
mov ebp, ebp
lea edx, [esp + 0x144]
push edx
call fcn.10040a10
add esp, 4
mov ebp, ebp
lea ecx, [esp + 0x138]
lea eax, [esp + 0x144]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100cca44
test dl, dl
je 0x100cca40
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100cca44
add eax, 2
add ecx, 2
test dl, dl
jne 0x100cca24
xor eax, eax
jmp 0x100cca49
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100cca90
push eax
mov eax, dword [esp + 0x10]
push 1
push eax
push 0
push 0x400
call fcn.10051cc0
add esp, 0x14
nop
test eax, eax
je 0x100cca90
push eax
call fcn.100ac7c0
add esp, 4
nop
mov edx, dword [esp + 0xc]
push 0
push 0
lea ecx, [esp + 0x134]
push ecx
push edx
call fcn.10037540
add esp, 0x10
or eax, edx
jne 0x100ccac6
lea eax, [esp + 4]
push eax
push esi
call sub.KERNEL32.DLL_Process32Next
mov bl, bl
test eax, eax
jne 0x100cc9e0
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov bh, bh
xor eax, eax
pop esi
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.100fb12a
add esp, 0x244
ret
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ah, ah
mov ecx, dword [esp + 0x244]
mov eax, dword [esp + 0xc]
pop esi
xor ecx, esp
call fcn.100fb12a
add esp, 0x244
ret
Function at 0x100d0c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x38]
mov cl, 0x6c
mov al, 0x65
mov dl, 0x72
push edi
mov edi, dword [esp + 0x40]
mov byte [esp + 0xc], 0x4b
mov byte [esp + 0xd], al
mov byte [esp + 0xe], dl
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], al
mov byte [esp + 0x11], cl
mov byte [esp + 0x12], 0x33
mov byte [esp + 0x13], 0x32
mov byte [esp + 0x14], 0x2e
mov byte [esp + 0x15], 0x64
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], cl
mov byte [esp + 0x18], 0
mov ecx, ecx
mov byte [esp + 0x1d], al
mov byte [esp + 0x22], al
mov al, 0x66
mov cl, 0x74
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], al
mov al, 0x69
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1e], cl
mov byte [esp + 0x1f], 0x54
mov byte [esp + 0x20], 0x68
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x24], 0x64
mov byte [esp + 0x25], 0x47
mov byte [esp + 0x26], dl
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], 0x75
mov byte [esp + 0x29], 0x70
mov byte [esp + 0x2a], 0x41
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], 0x6e
mov byte [esp + 0x2f], al
mov byte [esp + 0x30], cl
mov byte [esp + 0x31], 0x79
mov byte [esp + 0x32], 0
mov bh, bh
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ecx, ecx
test eax, eax
je 0x100d0d87
push ebp
push edi
push esi
call eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100fb12a
add esp, 0x2c
ret 0xc
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.100fb12a
add esp, 0x2c
ret 0xc
Function at 0x100d0da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x30], eax
mov cl, 0x6c
mov al, 0x65
mov dl, 0x72
mov byte [esp], 0x4b
mov byte [esp + 1], al
mov byte [esp + 2], dl
mov byte [esp + 3], 0x6e
mov byte [esp + 4], al
mov byte [esp + 5], cl
mov byte [esp + 6], 0x33
mov byte [esp + 7], 0x32
mov byte [esp + 8], 0x2e
mov byte [esp + 9], 0x64
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], cl
mov byte [esp + 0xc], 0
nop
mov byte [esp + 0x11], al
mov byte [esp + 0x18], al
mov byte [esp + 0x1d], al
mov al, 0x73
mov cl, 0x6f
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
mov al, 0x75
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], 0x41
mov byte [esp + 0x14], 0x63
mov byte [esp + 0x15], 0x74
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x17], 0x76
mov byte [esp + 0x19], 0x50
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1c], 0x63
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], 0x47
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], al
mov byte [esp + 0x26], 0x70
mov byte [esp + 0x27], 0x43
mov byte [esp + 0x28], cl
mov byte [esp + 0x29], al
mov byte [esp + 0x2a], 0x6e
mov byte [esp + 0x2b], 0x74
mov byte [esp + 0x2c], 0
mov eax, eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
pop eax
test eax, eax
je 0x100d0ea8
call eax
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100fb12a
add esp, 0x34
ret
mov ecx, dword [esp + 0x30]
xor ecx, esp
xor ax, ax
call fcn.100fb12a
add esp, 0x34
ret
Function at 0x100d0ec0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x38
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x34], eax
mov al, al
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov ecx, ecx
cmp dword [esp + 0x18], 2
jbe 0x100d0fb2
push esi
push 0
call fcn.1004f530
add esp, 4
mov dh, dh
cmp eax, 4
jg 0x100d0f34
mov bh, bh
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea ecx, [esp + 4]
push ecx
push 0x1019dd04
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcessAffinityMask]
push ebx
pop ebx
push 1
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_SetProcessAffinityMask]
mov ebx, ebx
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.100fb12a
add esp, 0x38
ret
push ebp
push edi
call fcn.100d0da0
movzx ebp, ax
push eax
pop eax
xchg ebx, eax
xchg ebx, eax
movzx edi, bp
xor esi, esi
test edi, edi
jle 0x100d0fa6
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push edx
pop edx
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
xchg ebx, eax
xchg ebx, eax
lea eax, [esi + esi*2]
lea eax, [eax*4 + 0x102c68e0]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
nop
mov word [esp + 0x3c], si
mov bh, bh
test esi, esi
jne 0x100d0f8e
mov dword [esp + 0x38], 1
mov bh, bh
push eax
lea edx, [esp + 0x3c]
push edx
call ebx
push eax
call fcn.100d0c80
mov bh, bh
add esi, 1
cmp esi, edi
jl 0x100d0f52
pop ebx
mov word [0x102c6ac8], bp
mov al, al
pop edi
pop ebp
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.100fb12a
add esp, 0x38
ret

Function at 0x100d0fd0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
mov edx, edx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov bl, bl
cmp dword [esp + 0x14], 2
jbe 0x100d105c
push 0
call fcn.1004f530
add esp, 4
mov esi, esi
cmp eax, 4
jg 0x100d1013
mov ecx, dword [0x1019dd04]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_SetProcessAffinityMask]
mov ah, ah
add esp, 0x24
ret
push esi
mov ebp, ebp
xor esi, esi
cmp word [0x102c6ac8], si
jbe 0x100d1050
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push edi
mov edi, 0x102c68e0
mov edi, edi
push 0
push edi
call ebx
push eax
call fcn.100d0c80
mov bl, bl
movzx edx, word [0x102c6ac8]
add esi, 1
add edi, 0xc
cmp esi, edx
jl 0x100d1030
pop edi
pop ebx
mov word [0x102c6ac8], 0
xchg ebx, eax
xchg ebx, eax
pop esi
add esp, 0x24
ret
Function at 0x100d1130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x101611c1
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x2c], eax
push edi
mov eax, dword [0x101b03d4]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov dword [esp + 0x40], 0
mov dword [esp + 0xc], 0
mov dword [esi + 0x10], esi
mov dword [esp + 0x10], esi
mov dword [esi + 0x14], esi
mov dword [esp + 0x40], 1
mov eax, dword [esi + 0x10]
mov byte [eax], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0xc], 1
mov al, al
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.100fdcaf
add esp, 4
mov edi, edi
call fcn.100fdcbc
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x100d11bb
dec eax
or eax, 0xfffffff8
inc eax
add eax, 8
push ebx
pop ebx
mov edi, edi
mov byte [esp + 0x14], 0x61
mov byte [esp + 0x15], 0x62
mov byte [esp + 0x16], 0x63
mov byte [esp + 0x17], 0x64
mov byte [esp + 0x18], 0x65
mov byte [esp + 0x19], 0x66
mov byte [esp + 0x1a], 0x67
mov byte [esp + 0x1b], 0x68
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], 0x6a
mov byte [esp + 0x1e], 0x6b
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], 0x6d
mov byte [esp + 0x21], 0x6e
mov byte [esp + 0x22], 0x6f
mov byte [esp + 0x23], 0x70
mov byte [esp + 0x24], 0x71
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x26], 0x73
mov byte [esp + 0x27], 0x74
mov byte [esp + 0x28], 0x76
mov byte [esp + 0x29], 0x77
mov byte [esp + 0x2a], 0x78
mov byte [esp + 0x2b], 0x79
mov byte [esp + 0x2c], 0x75
mov byte [esp + 0x2d], 0x41
mov byte [esp + 0x2e], 0x42
mov byte [esp + 0x2f], 0x43
mov byte [esp + 0x30], 0x44
mov byte [esp + 0x31], 0x45
mov byte [esp + 0x32], 0x46
mov byte [esp + 0x33], 0x47
mov bl, bl
test eax, eax
jle 0x100d129e
mov edi, eax
lea ebx, [ebx]
call fcn.100fdcbc
and eax, 0x8000001f
jns 0x100d1281
dec eax
or eax, 0xffffffe0
inc eax
mov ch, ch
mov al, byte [esp + eax + 0x14]
mov byte [esp + 8], al
mov ecx, dword [esp + 8]
push ecx
mov ecx, esi
call fcn.1001c9e0
mov ah, ah
sub edi, 1
jne 0x100d1270
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100fb12a
add esp, 0x3c
ret
Function at 0x100d3e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x884
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x880], eax
mov eax, dword [esp + 0x890]
push ebx
push esi
push edi
mov dword [esp + 0x28], eax
xor edi, edi
push edx
pop edx
mov eax, eax
push ebx
pop ebx
mov eax, eax
mov eax, 0x5c
mov word [esp + 0x454], ax
mov word [esp + 0x456], ax
mov word [esp + 0x45a], ax
mov eax, 0x69
mov word [esp + 0x458], 0x2e
mov word [esp + 0x45c], 0x50
mov word [esp + 0x45e], 0x68
mov word [esp + 0x460], 0x79
mov word [esp + 0x462], 0x73
mov word [esp + 0x464], ax
mov word [esp + 0x466], 0x63
mov word [esp + 0x468], 0x61
mov word [esp + 0x46a], 0x6c
mov word [esp + 0x46c], 0x44
mov word [esp + 0x46e], 0x72
mov word [esp + 0x470], ax
mov word [esp + 0x472], 0x76
mov word [esp + 0x474], 0x65
mov word [esp + 0x476], 0x25
mov word [esp + 0x478], 0x64
mov word [esp + 0x47a], di
mov bl, bl
mov ebx, dword [esp + 0x894]
push ebx
lea ecx, [esp + 0x458]
push ecx
lea edx, [esp + 0x484]
push edx
call fcn.10024900
add esp, 0xc
mov ebx, ebx
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
lea eax, [esp + 0x494]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
mov ebp, ebp
cmp esi, 0xffffffff
je 0x100d40c4
mov edx, edx
mov dword [esp + 0xc], edi
push edx
pop edx
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ecx, ecx
push edi
lea ecx, [esp + 0x10]
push ecx
push 0x18
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push 0x74080
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x100d40bb
cmp byte [esp + 0x13], 0
jbe 0x100d40bb
mov al, al
mov al, byte [esp + 0x13]
mov cl, bl
shr al, cl
and al, 0x10
neg al
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [esp + 0x2c], al
mov ch, ch
xor eax, eax
mov dword [esp + 0x430], eax
mov dword [esp + 0x434], eax
mov dword [esp + 0x438], eax
mov dword [esp + 0x43c], eax
mov dword [esp + 0x440], eax
mov dword [esp + 0x444], eax
mov dword [esp + 0x448], eax
mov dword [esp + 0x44c], eax
mov byte [esp + 0x450], al
mov dl, dl
push 0x210
lea ecx, [esp + 0x680]
push edi
push ecx
call fcn.100fbc20
add esp, 0xc
mov ch, ch
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xc]
push edx
push ebx
push eax
lea ecx, [esp + 0x688]
push ecx
lea edx, [esp + 0x440]
push edx
push esi
call fcn.100d3a80
add esp, 0x18
test eax, eax
je 0x100d40bb
mov al, al
mov al, al
push ecx
pop ecx
xor eax, eax
jmp 0x100d4080
movzx ecx, word [esp + eax*2 + 0x68c]
mov dword [esp + eax*4 + 0x30], ecx
push eax
pop eax
add eax, 1
cmp eax, 0x100
jl 0x100d4080
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x898]
push edx
lea eax, [esp + 0x34]
push eax
push ecx
call fcn.100d3b90
add esp, 0xc
mov dl, dl
mov edi, 1
mov al, al
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dl, dl
mov ecx, dword [esp + 0x88c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100fb12a
add esp, 0x884
ret
Function at 0x100d40e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x650
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x64c], eax
mov eax, dword [esp + 0x65c]
push ebp
push edi
mov dword [esp + 0x28], eax
xor ebp, ebp
mov ch, ch
mov bh, bh
mov edi, edi
mov eax, 0x5c
mov word [esp + 0x42c], ax
mov word [esp + 0x42e], ax
mov word [esp + 0x432], ax
mov eax, 0x69
mov word [esp + 0x430], 0x2e
mov word [esp + 0x434], 0x50
mov word [esp + 0x436], 0x68
mov word [esp + 0x438], 0x79
mov word [esp + 0x43a], 0x73
mov word [esp + 0x43c], ax
mov word [esp + 0x43e], 0x63
mov word [esp + 0x440], 0x61
mov word [esp + 0x442], 0x6c
mov word [esp + 0x444], 0x44
mov word [esp + 0x446], 0x72
mov word [esp + 0x448], ax
mov word [esp + 0x44a], 0x76
mov word [esp + 0x44c], 0x65
mov word [esp + 0x44e], 0x25
mov word [esp + 0x450], 0x64
mov word [esp + 0x452], bp
push edx
pop edx
mov ecx, dword [esp + 0x65c]
push ecx
lea edx, [esp + 0x430]
push edx
lea eax, [esp + 0x45c]
push eax
call fcn.10024900
add esp, 0xc
mov dh, dh
push ebp
push ebp
push 3
push ebp
push 7
push 0xc0000000
lea ecx, [esp + 0x46c]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
mov eax, eax
cmp edi, 0xffffffff
je 0x100d4330
push ebx
mov ecx, ecx
mov dword [esp + 0xc], ebp
mov ah, ah
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov edi, edi
mov ebx, dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
push ebp
lea edx, [esp + 0x10]
push edx
push 0x18
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push 0x74080
push edi
call ebx
test eax, eax
je 0x100d4316
push esi
mov esi, esi
push 0x221
call fcn.100fab8c
add esp, 4
mov esi, eax
mov dh, dh
cmp esi, ebp
je 0x100d42f3
mov byte [esi + 0xa], 0xec
mov ecx, ecx
mov dword [esp + 0x14], ebp
push ebx
pop ebx
push ebp
lea ecx, [esp + 0x18]
push ecx
push 0x221
push esi
push 0x21
push esi
push 0x7c088
push edi
call ebx
test eax, eax
je 0x100d42e8
mov edx, edx
mov ecx, ecx
xor eax, eax
lea esp, [esp]
movzx edx, word [esi + eax*2 + 0x10]
mov dword [esp + eax*4 + 0x34], edx
mov ecx, ecx
add eax, 1
cmp eax, 0x100
jl 0x100d42b0
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x668]
push eax
lea ecx, [esp + 0x38]
push ecx
push edx
call fcn.100d3b90
add esp, 0xc
push edx
pop edx
mov ebp, 1
mov edx, edx
push esi
call fcn.100fac4f
add esp, 4
mov edi, edi
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
nop
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x64c]
xor ecx, esp
call fcn.100fb12a
add esp, 0x650
ret
pop ebx
pop edi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x64c]
xor ecx, esp
call fcn.100fb12a
add esp, 0x650
ret
mov ecx, dword [esp + 0x654]
pop edi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.100fb12a
add esp, 0x650
ret
Function at 0x100d49e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10161300
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101b03d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x40
push edi
mov esi, dword [ebp + 8]
push esi
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualProtect]
call ebx
test eax, eax
je 0x100d4a4d
push edi
mov ecx, dword [ebp + 0x10]
push ecx
push esi
call fcn.100fd070
add esp, 0xc
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x18]
push eax
push edi
push esi
call ebx
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret