joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10065400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x30], eax
xor eax, eax
push ebx
mov byte [esp + 0x24], al
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov word [esp + 0x31], ax
mov byte [esp + 0x33], al
mov ah, ah
mov dl, 0x65
mov cl, 0x6e
mov bl, 0x74
mov byte [esp + 0x14], 0x47
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], 0x75
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], 0x49
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], al
push edx
pop edx
mov byte [esp + 4], 0x41
mov byte [esp + 5], 0x75
mov byte [esp + 6], bl
mov byte [esp + 7], 0x68
mov byte [esp + 8], dl
mov byte [esp + 9], cl
mov byte [esp + 0xa], bl
mov byte [esp + 0xb], 0x69
mov byte [esp + 0xc], 0x63
mov byte [esp + 0xd], 0x41
mov byte [esp + 0xe], 0x4d
mov byte [esp + 0xf], 0x44
mov byte [esp + 0x10], al
mov ah, ah
mov eax, 0
cpuid
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x14]
lea eax, [esp + 0x24]
pop ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100654e7
test dl, dl
je 0x100654e3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100654e7
add eax, 2
add ecx, 2
test dl, dl
jne 0x100654c7
xor eax, eax
jmp 0x100654ec
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10065504
mov eax, 1
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1010190d
add esp, 0x34
ret
lea ecx, [esp]
lea eax, [esp + 0x20]
jmp 0x10065510
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10065530
test dl, dl
je 0x1006552c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10065530
add eax, 2
add ecx, 2
test dl, dl
jne 0x10065510
xor eax, eax
jmp 0x10065535
sbb eax, eax
sbb eax, 0xffffffff
mov ecx, dword [esp + 0x30]
neg eax
sbb eax, eax
and eax, 0xfffffffe
xor ecx, esp
add eax, 2
call fcn.1010190d
add esp, 0x34
ret

Function at 0x100655d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x800], eax
push 0x7ff
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.10102a00
add esp, 0xc
test dl, dl
push 0x800
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test cl, cl
mov ecx, dword [esp + 0x800]
mov al, byte [esp]
xor ecx, esp
call fcn.1010190d
add esp, 0x804
ret

Function at 0x100657f0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x40
mov al, al
mov dword [esp], 0x40
test eax, 0x6033
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
neg eax
sbb eax, eax
and eax, dword [esp + 4]
add esp, 0x40
ret
Function at 0x10065820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov ch, ch
mov al, 0x6c
mov bl, 0x73
mov byte [esp + 0x1c], 0x6d
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], 0x76
mov byte [esp + 0x1f], 0x63
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x24], al
mov byte [esp + 0x25], al
mov byte [esp + 0x26], 0
test ecx, ecx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
test cl, cl
mov cl, 0x6e
mov al, 0x66
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], 0x70
mov byte [esp + 0x16], 0x72
mov byte [esp + 0x17], 0x69
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], 0x74
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 0
mov cl, cl
mov byte [esp + 0xc], bl
mov byte [esp + 0xd], bl
mov byte [esp + 0xe], 0x63
mov byte [esp + 0xf], 0x61
mov byte [esp + 0x10], cl
mov byte [esp + 0x11], al
mov byte [esp + 0x12], 0
mov ebp, ebp
mov edi, dword [fcn.1016432c]
lea ecx, [esp + 0x14]
push ecx
push esi
call edi
mov dword [fcn.101c1754], eax
mov dh, dh
lea edx, [esp + 0xc]
push edx
push esi
call edi
mov dword [0x101c1758], eax
mov ecx, ecx
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1010190d
add esp, 0x20
ret
Function at 0x10066e70
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, eax
test edx, edx
push 0x38
lea eax, [esp + 0x18]
push 0
push eax
call fcn.10102a00
add esp, 0xc
mov eax, eax
test eax, 0x4c5b
push edi
xor ebx, ebx
call fcn.1005ef70
mov ebp, dword [sym.imp.USER32.dll_MapVirtualKeyA]
add esp, 4
mov dword [esp + 0x10], eax
jmp 0x10066eb0
lea esi, [ebx*8]
sub esi, ebx
add esi, esi
add esi, esi
mov eax, 1
mov dword [esp + esi + 0x14], eax
test cl, cl
cmp dword [esp + 0x10], 0
je 0x10066ed5
mov dword [esp + esi + 0x1c], eax
test bh, bh
mov word [esp + esi + 0x18], di
mov ecx, ecx
push 0
push edi
call ebp
mov word [esp + esi + 0x1a], ax
test eax, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + esi + 0x20], eax
mov eax, eax
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov dword [esp + esi + 0x24], eax
test ah, ah
cmp ebx, 1
jne 0x10066f0c
or dword [esp + 0x38], 2
test cl, cl
add ebx, 1
cmp ebx, 2
jl 0x10066eb0
mov eax, dword [esp + 0x54]
test eax, eax
mov edi, dword [esp + 0x50]
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, 1
push 0x1c
jne 0x10066fa5
lea edx, [esp + 0x20]
call fcn.10066580
add esp, 0xc
test eax, 0x5f0f
cmp dword [edi + 0x2600], 0
je 0x10066f75
mov esi, dword [edi + 0x2630]
test esi, esi
jle 0x10066f65
call fcn.1010475a
cdq
idiv esi
push edx
pop edx
test bh, bh
mov ecx, esi
sar ecx, 1
sub edx, ecx
add edx, esi
jmp 0x10066f6a
mov edx, 1
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
test ch, ch
jmp 0x10066f84
mov edx, dword [edi + 0x2630]
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c
lea edx, [esp + 0x3c]
mov ecx, 1
call fcn.10066580
add esp, 0xc
mov ebx, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
cmp eax, 1
jne 0x10066fc0
lea edx, [esp + 0x20]
call fcn.10066580
add esp, 0xc
mov ch, ch
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
lea edx, [esp + 0x3c]
call fcn.10066580
add esp, 0xc
mov cl, cl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x100678e0
Capabilities:
Log keystrokes

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x18]
mov dword [esp + 8], eax
test al, al
push esi
call fcn.1005ee40
add esp, 4
test eax, eax
je 0x10067aec
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
cmp edi, 0xa0
je 0x10067916
cmp edi, 0xa1
jne 0x1006791f
mov edi, 0x10
mov bl, bl
jmp 0x1006794f
cmp edi, 0xa4
je 0x1006792f
cmp edi, 0xa5
jne 0x10067938
mov edi, 0x12
push eax
pop eax
jmp 0x1006794f
cmp edi, 0xa2
je 0x10067948
cmp edi, 0xa3
jne 0x1006794f
mov edi, 0x11
test ah, ah
cmp dword [esi + 0x3370], 0
jne 0x10067966
add dword [esi + 0x335c], 1
test eax, 0x3adf
mov ah, ah
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x10067986
push 1
push esi
mov eax, edi
call fcn.10066e70
add esp, 8
test bl, bl
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret
cmp eax, 1
jne 0x10067ac8
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test ebx, ebx
shl eax, 0x10
or eax, 1
mov ebx, eax
nop
mov cl, cl
push edi
call fcn.1005ef70
add esp, 4
test eax, eax
je 0x100679ba
or ebx, 0x1000000
push eax
pop eax
xor ebp, ebp
mov ch, ch
cmp dword [esi + 0x14], ebp
je 0x100679eb
cmp dword [esi + 0x32c4], ebp
jne 0x100679eb
push 0x717be38b
push esi
call fcn.100612a0
add esp, 8
test eax, eax
jne 0x100679eb
or ebx, 0x4000000
nop
mov ebp, 0x4000000
push ecx
pop ecx
cmp edi, 0x12
jne 0x100679f9
mov dword [esi + 0x60], 1
mov edx, edx
cmp dword [esi + 0x60], 0
jne 0x10067a62
cmp edi, 0x79
je 0x10067a62
cmp dword [esi + 0x32a4], 0
je 0x10067a11
mov ebx, ebp
test cl, cl
cmp dword [esi + 0x32a0], 0
je 0x10067a45
mov ecx, dword [esi + 0x32a8]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push ebx
push edi
push 0x100
push edx
call fcn.10064e60
add esp, 0x1c
test ecx, ecx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret
mov eax, dword [esp + 0x14]
push ebx
push edi
push 0x100
push eax
call fcn.10064d20
test bh, bh
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret
or ebx, 0x20000000
push eax
pop eax
cmp dword [esi + 0x32a4], 0
je 0x10067a7a
mov ebx, ebp
test eax, 0x1d28
cmp dword [esi + 0x32a0], 0
je 0x10067aab
mov ecx, dword [esi + 0x32a8]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push ebx
push edi
push 0x104
push edx
call fcn.10064d30
mov edi, edi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret
mov eax, dword [esp + 0x14]
push ebx
push edi
push 0x104
push eax
call fcn.10064d20
mov ch, ch
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret
cmp eax, 2
jne 0x10067ae9
cmp edi, 0x12
jne 0x10067adb
mov dword [esi + 0x60], 1
test esi, esi
push 1
push edi
push esi
call fcn.100bdd20
add esp, 0xc
mov edi, edi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret
Function at 0x10067b00
Capabilities:
Log keystrokes

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x18]
mov dword [esp + 0x10], eax
test cl, cl
mov esi, dword [esp + 0x14]
cmp esi, 0xa0
je 0x10067b24
cmp esi, 0xa1
jne 0x10067b2d
mov esi, 0x10
push eax
pop eax
jmp 0x10067b5d
cmp esi, 0xa4
je 0x10067b3d
cmp esi, 0xa5
jne 0x10067b46
mov esi, 0x12
test dh, dh
jmp 0x10067b5d
cmp esi, 0xa2
je 0x10067b56
cmp esi, 0xa3
jne 0x10067b5d
mov esi, 0x11
test edi, edi
mov eax, dword [edi + 0x3c]
xor ebp, ebp
cmp eax, ebp
jne 0x10067b7c
push 2
push edi
mov eax, esi
call fcn.10066e70
add esp, 8
mov ebp, ebp
pop edi
pop esi
lea eax, [ebp + 1]
pop ebp
ret
cmp eax, 1
jne 0x10067cc5
push ebx
push ebp
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebx
pop ebx
shl eax, 0x10
or eax, 1
mov ebx, eax
test dl, dl
push ebx
pop ebx
push esi
call fcn.1005ef70
add esp, 4
test eax, eax
je 0x10067bb1
or ebx, 0x1000000
mov al, al
push ebx
pop ebx
cmp dword [edi + 0x14], ebp
je 0x10067be1
cmp dword [edi + 0x32c4], ebp
jne 0x10067be1
push 0x717be38b
push edi
call fcn.100612a0
add esp, 8
test eax, eax
jne 0x10067be1
or ebx, 0x4000000
mov dh, dh
mov ebp, 0x4000000
xchg ebx, eax
xchg ebx, eax
cmp esi, 0x12
jne 0x10067bef
mov dword [edi + 0x60], 0
push edx
pop edx
cmp dword [edi + 0x60], 0
jne 0x10067c60
cmp esi, 0x79
je 0x10067c60
or ebx, 0xc0000000
mov al, al
cmp dword [edi + 0x32a4], 0
je 0x10067c0f
mov ebx, ebp
mov dl, dl
cmp dword [edi + 0x32a0], 0
je 0x10067c43
mov ecx, dword [edi + 0x32a8]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push ebx
push esi
push 0x101
push edx
call fcn.10064e60
add esp, 0x1c
test dh, dh
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov eax, dword [esp + 0x14]
push ebx
push esi
push 0x101
push eax
call fcn.10064d20
mov edi, edi
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
test edx, edx
or ebx, 0xe0000000
mov bh, bh
cmp dword [edi + 0x32a4], 0
je 0x10067c77
mov ebx, ebp
test bl, bl
cmp dword [edi + 0x32a0], 0
je 0x10067ca8
mov ecx, dword [edi + 0x32a8]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push ebx
push esi
push 0x105
push edx
call fcn.10064d30
push ecx
pop ecx
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov eax, dword [esp + 0x14]
push ebx
push esi
push 0x105
push eax
call fcn.10064d20
push ebx
pop ebx
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
cmp eax, 2
jne 0x10067c3a
cmp esi, 0x12
jne 0x10067cd8
mov dword [edi + 0x60], ebp
test al, al
push 2
push esi
push edi
call fcn.100bdd20
add esp, 0xc
mov cl, cl
pop edi
pop esi
mov eax, 1
pop ebp
ret

Function at 0x10067cf0
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.1005ff30
test al, al
test eax, eax
jle 0x10067d08
mov dword [esp + 8], eax
jmp fcn.10067490
xor eax, eax
ret

Function at 0x10067d10
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.1005ff30
mov ecx, ecx
test eax, eax
jle 0x10067d28
mov dword [esp + 8], eax
jmp fcn.100678e0
xor eax, eax
ret

Function at 0x10067d30
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.1005ff30
test ebx, ebx
test eax, eax
jle 0x10067d48
mov dword [esp + 8], eax
jmp fcn.10067b00
xor eax, eax
ret
Function at 0x10068d90
Capabilities:
Get keyboard layout

Disassembly:
push 0xffffffffffffffff
push 0x1015e9fb
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
push esi
push edi
mov eax, dword [0x101af0fc]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x230]
push 0
push eax
call fcn.10064d00
test eax, 0x6294
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebp, eax
mov cl, cl
lea ecx, [esp + 0x10]
call fcn.100e1780
mov dword [esp + 0x224], 0
mov ecx, ecx
lea ecx, [esp + 0x10]
call fcn.100e0790
mov esi, eax
mov ebx, ebx
test esi, esi
mov edi, dword [esp + 0x234]
je 0x10068e5f
mov ecx, edi
lea eax, [esi + 0xf]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10068e40
test dl, dl
je 0x10068e3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10068e40
add eax, 2
add ecx, 2
test dl, dl
jne 0x10068e20
xor eax, eax
jmp 0x10068e45
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10068e57
mov esi, dword [esi + 0x90]
test ecx, ecx
test esi, esi
jne 0x10068e17
jmp 0x10068e5f
test esi, esi
jne 0x10068eeb
lea ecx, [esp + 0x10]
call fcn.1011ff40
mov esi, eax
test cl, cl
test esi, esi
je 0x10068eaa
mov ecx, edi
lea eax, [esi + 0xf]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10068e95
test dl, dl
je 0x10068e91
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10068e95
add eax, 2
add ecx, 2
test dl, dl
jne 0x10068e75
xor eax, eax
jmp 0x10068e9a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10068ee7
mov esi, dword [esi + 0x90]
push ebx
pop ebx
test esi, esi
jne 0x10068e70
mov dword [esp + 0x224], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.100e07a0
xor eax, eax
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1010190d
add esp, 0x218
ret
test esi, esi
je 0x10068eaa
push 0xff
lea eax, [esp + 0x11d]
push 0
push eax
mov byte [esp + 0x124], 0
call fcn.10102a00
add esp, 0xc
test eax, 0x315c
push 0xff
lea ecx, [esp + 0x1d]
push 0
push ecx
mov byte [esp + 0x24], 0
call fcn.10102a00
add esp, 0xc
test eax, 0x2ffa
lea edx, [esp + 0x18]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x10068f35
test ah, ah
lea edx, [esp + 0x18]
push edx
call fcn.10156f79
add esp, 4
mov cl, cl
push 0x10
lea eax, [esp + 0x11c]
push eax
push ebp
call fcn.1015701b
add esp, 0xc
test ch, ch
mov bl, bl
lea ecx, [esp + 0x18]
lea eax, [esp + 0x118]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10068f94
test dl, dl
je 0x10068f90
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10068f94
add eax, 2
add ecx, 2
test dl, dl
jne 0x10068f74
xor eax, eax
jmp 0x10068f99
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10068eaa
mov dword [esp + 0x224], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.100e07a0
mov eax, 1
jmp 0x10068ec0
Function at 0x10068fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x68
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x64], eax
call fcn.10062980
test eax, eax
jne 0x10068fe6
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1010190d
add esp, 0x68
ret
push ebx
xor ebx, ebx
cmp dword [0x101b4f9c], ebx
je 0x1006908d
call fcn.10062980
test eax, eax
je 0x1006908d
push 0x3f
lea eax, [esp + 0x2d]
push ebx
push eax
mov byte [esp + 0x34], bl
call fcn.10102a00
add esp, 0xc
test bh, bh
test ah, ah
mov dword [esp + 0x28], 2
mov cl, cl
mov dword [esp + 0x2c], 0x17
xchg ebx, eax
xchg ebx, eax
mov dword [esp + 4], ebx
test ebx, ebx
push eax
pop eax
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x30], ecx
test edi, edi
lea eax, [esp + 4]
cdq
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dl, dl
push ebx
lea edx, [esp + 0xc]
push edx
push ebx
push ebx
lea eax, [esp + 0x38]
push 0x18
push eax
call fcn.10020b00
add esp, 0x18
test edx, edx
cmp eax, ebx
je 0x10069136
cmp dword [esp + 4], ebx
jne 0x10069136
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1010190d
add esp, 0x68
ret
cmp dword [fcn.101c1738], ebx
jne 0x10069148
mov cl, 0x65
mov byte [esp + 0xc], 0x6b
mov byte [esp + 0xd], cl
mov byte [esp + 0xe], 0x72
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], cl
mov byte [esp + 0x11], 0x6c
mov byte [esp + 0x12], 0x33
mov byte [esp + 0x13], 0x32
mov byte [esp + 0x14], bl
nop
mov al, 0x73
mov dl, 0x6f
mov byte [esp + 0x18], 0x49
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0x57
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1c], 0x77
mov byte [esp + 0x1d], 0x36
mov byte [esp + 0x1e], 0x34
mov byte [esp + 0x1f], 0x50
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], 0x63
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], al
mov byte [esp + 0x25], al
mov byte [esp + 0x26], bl
mov ah, ah
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [fcn.1016432c]
mov dword [fcn.101c1738], eax
mov al, al
cmp dword [fcn.101c1738], ebx
jne 0x10069148
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1010190d
add esp, 0x68
ret
push esi
test cl, cl
mov dword [esp + 8], ebx
mov edi, edi
mov eax, dword [esp + 0x74]
push ebx
push ebx
push eax
push ebx
push 0x400
call fcn.100648d0
add esp, 0x14
mov esi, eax
test ebx, ebx
cmp esi, ebx
jne 0x10069181
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1010190d
add esp, 0x68
ret
lea ecx, [esp + 8]
push ecx
push esi
call dword [fcn.101c1738]
mov esi, esi
push esi
call fcn.100486c0
add esp, 4
push ebx
pop ebx
mov ecx, dword [esp + 0x6c]
xor eax, eax
cmp dword [esp + 8], ebx
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.1010190d
add esp, 0x68
ret
Function at 0x100696c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x1c], eax
mov cl, 0x6c
mov al, 0x65
mov dl, 0x64
push esi
mov byte [esp + 0x10], 0x6b
mov byte [esp + 0x11], al
mov byte [esp + 0x12], 0x72
mov byte [esp + 0x13], 0x6e
mov byte [esp + 0x14], al
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x33
mov byte [esp + 0x17], 0x32
mov byte [esp + 0x18], 0x2e
mov byte [esp + 0x19], dl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1c], 0
test al, al
mov byte [esp + 4], 0x4f
mov byte [esp + 5], 0x70
mov byte [esp + 6], al
mov byte [esp + 7], 0x6e
mov byte [esp + 8], 0x54
mov byte [esp + 9], 0x68
mov byte [esp + 0xa], 0x72
mov byte [esp + 0xb], al
mov byte [esp + 0xc], 0x61
mov byte [esp + 0xd], dl
mov byte [esp + 0xe], 0
mov bl, bl
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [fcn.1016432c]
mov esi, eax
test edi, edi
test esi, esi
jne 0x10069777
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1010190d
add esp, 0x20
ret
push ebp
push edi
call fcn.1003c870
mov edi, eax
test esi, esi
mov ebp, dword [esp + 0x34]
push ebp
push 0
push 0x1f03ff
call esi
mov esi, eax
mov dh, dh
push edi
call fcn.1003c940
add esp, 4
push ebx
pop ebx
test esi, esi
jne 0x100697b7
pop edi
pop ebp
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1010190d
add esp, 0x20
ret
push 0
push 0
push 0xbb8
push ebp
call fcn.10064d50
mov al, al
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov edx, edx
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, edi
mov ecx, dword [esp + 0x28]
pop edi
pop ebp
pop esi
xor ecx, esp
mov eax, 1
call fcn.1010190d
add esp, 0x20
ret
Function at 0x1006fe90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1015f039
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov eax, dword [0x101af0fc]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov al, 0x32
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
mov al, 0x31
mov dword [esp + 0x10], esi
mov byte [esp + 0x14], 0x37
mov byte [esp + 0x15], 0x2e
mov byte [esp + 0x18], al
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0
test eax, eax
lea eax, [esp + 0xb]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.100085d0
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], 1
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1010190d
add esp, 0x24
ret

Function at 0x10072b70
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1015f1a2
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push esi
mov eax, dword [0x101af0fc]
xor eax, esp
push eax
lea eax, [esp + 0x81c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x82c]
xor ebx, ebx
push 0x7ff
lea eax, [esp + 0x1d]
push ebx
mov dword [esp + 0x18], ebx
push eax
mov dword [esp + 0x20], esi
mov byte [esp + 0x24], bl
call fcn.10102a00
add esp, 0xc
mov bl, bl
mov eax, dword [esp + 0x834]
cmp eax, ebx
jne 0x10072bf5
lea ecx, [esp + 0x18]
push ecx
push 0x800
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
mov dl, dl
jmp 0x10072c9c
cmp eax, 1
jne 0x10072c11
push 0x800
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
jmp 0x10072c9c
cmp eax, 2
jne 0x10072c2a
push 0x800
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
test edi, edi
jmp 0x10072c9c
cmp eax, 3
jne 0x10072c43
lea ecx, [esp + 0x18]
push ecx
push 0x800
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov al, al
jmp 0x10072c9c
cmp eax, 4
jne 0x10072c9c
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x101b2068]
mov byte [esp + eax + 0x18], cl
add eax, 1
cmp cl, bl
jne 0x10072c50
mov eax, eax
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10072c70
sub eax, edx
add eax, 0xffffffff
mov ah, ah
cmp eax, ebx
jl 0x10072c9c
mov cl, 0x5c
cmp byte [esp + eax + 0x18], cl
je 0x10072c96
sub eax, 1
nop
cmp eax, ebx
jge 0x10072c86
jmp 0x10072c9c
mov byte [esp + eax + 0x18], bl
mov ch, ch
lea edx, [esp + 0xf]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.100085d0
mov dword [esp + 0x824], ebx
mov dword [esp + 0x10], 1
mov eax, esi
mov ecx, dword [esp + 0x81c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.1010190d
add esp, 0x81c
ret