joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100243ff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], 0x636f7250
mov dword [ebp - 7], 0x73726946
mov dword [ebp - 0xb], 0x32337373
mov word [ebp - 3], 0x74
mov byte [ebp - 0xc], 0x65
call fcn.100242a7
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024447
push esi
push edi
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x1002444e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
mov esi, edx
mov edi, ecx
mov word [ebp - 0x10], 0x7250
mov dword [ebp - 0xd], 0x73736563
mov dword [ebp - 9], 0x654e3233
mov word [ebp - 5], 0x7478
mov byte [ebp - 3], bl
mov byte [ebp - 0xe], 0x6f
call fcn.100242a7
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024498
push esi
push edi
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x100244da
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov esi, ecx
call fcn.100241cc
mov edi, eax
test edi, edi
je 0x1002453a
lea eax, [ebp - 0x14]
push eax
push edi
mov word [ebp - 5], 0x4165
mov word [ebp - 8], 0x614e
mov dword [ebp - 0xd], 0x6c694664
mov byte [ebp - 9], 0x65
mov dword [ebp - 0x12], 0x69466874
mov word [ebp - 0x14], 0x6150
mov byte [ebp - 6], 0x6d
mov byte [ebp - 3], 0
mov byte [ebp - 0xe], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024533
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x10024540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.100242d9
mov esi, eax
test esi, esi
je 0x10024590
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0xc], 0x646e6957
mov word [ebp - 8], 0x776f
mov byte [ebp - 6], bl
mov dword [ebp - 0x10], 0x776f6853
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024589
push edi
push dword [ebp - 4]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10024597
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 0x14]
push eax
mov edi, ecx
or esi, 0xffffffff
mov word [ebp - 0x11], 0x4664
mov word [ebp - 5], 0x57
mov dword [ebp - 0xa], 0x6d756c6f
mov word [ebp - 0x14], 0x6946
mov dword [ebp - 0xf], 0x74737269
mov byte [ebp - 6], 0x65
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0xb], 0x56
call fcn.100242a7
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100245ee
push 0x104
push edi
call eax
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x1002467c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 0xc]
push eax
xor ebx, ebx
mov word [ebp - 0xc], 0x704f
mov dword [ebp - 6], 0x7365636f
mov word [ebp - 9], 0x506e
mov byte [ebp - 0xa], 0x65
mov word [ebp - 2], 0x73
mov byte [ebp - 7], 0x72
call fcn.100242a7
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100246c4
push dword [ebp + 8]
push ebx
push 1
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x100246c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.100241cc
mov esi, eax
test esi, esi
je 0x10024716
lea eax, [ebp - 0xc]
push eax
push esi
mov dword [ebp - 9], 0x6e496f54
mov word [ebp - 5], 0x4174
mov word [ebp - 0xb], 0x7274
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 3], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002470f
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x1002471d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.100242d9
mov esi, eax
test esi, esi
je 0x1002479c
lea eax, [ebp - 0x20]
push eax
push esi
mov word [ebp - 0x1a], 0x6f64
mov word [ebp - 0xc], 0x7373
mov dword [ebp - 0x17], 0x65726854
mov dword [ebp - 0x11], 0x636f7250
mov word [ebp - 0x20], 0x6547
mov word [ebp - 0x1d], 0x6957
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x1b], 0x6e
mov word [ebp - 0x13], 0x6461
mov word [ebp - 9], 0x64
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x18], 0x77
mov byte [ebp - 0xa], 0x49
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024795
push edi
push dword [ebp - 4]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x100247f9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
push eax
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov word [ebp - 0x11], 0x656d
mov dword [ebp - 8], 0x6e6f6974
mov dword [ebp - 0x16], 0x6c6f5674
mov dword [ebp - 0xe], 0x726f666e
mov word [ebp - 0xa], 0x616d
mov word [ebp - 0x18], 0x6547
mov word [ebp - 4], 0x57
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xf], 0x49
call fcn.100242a7
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002486a
mov ecx, 0x105
push ecx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
push esi
push edi
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x10024871
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
mov dword [ebp - 0xe], 0x63695474
mov word [ebp - 9], 0x6f43
mov word [ebp - 6], 0x746e
mov byte [ebp - 7], 0x75
mov byte [ebp - 4], bl
mov word [ebp - 0x10], 0x6547
mov byte [ebp - 0xa], 0x6b
call fcn.100242a7
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100248b6
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x100248bb
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
call fcn.10024250
mov esi, eax
test esi, esi
je 0x10024921
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 0x16], 0x70756b6f
mov dword [ebp - 8], 0x65756c61
mov word [ebp - 4], 0x41
mov dword [ebp - 0x12], 0x76697250
mov word [ebp - 0x18], 0x6f4c
mov dword [ebp - 0xc], 0x56656765
mov word [ebp - 0xe], 0x6c69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002491a
push dword [ebp + 8]
push str.SeDebugPrivilege
push ebx
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10024927
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 0xc]
push eax
mov esi, ecx
mov dword [ebp - 0xc], 0x626f6c47
mov word [ebp - 7], 0x466c
mov word [ebp - 4], 0x6565
mov byte [ebp - 2], 0
mov byte [ebp - 8], 0x61
mov byte [ebp - 5], 0x72
call fcn.100242a7
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024968
push esi
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret

Function at 0x100249c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 0x14]
push eax
mov esi, edx
xor ebx, ebx
mov word [ebp - 0x11], 0x6f4d
mov dword [ebp - 0xe], 0x46656c75
mov dword [ebp - 5], 0x41656d
mov word [ebp - 0x14], 0x6547
mov dword [ebp - 9], 0x614e656c
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xa], 0x69
call fcn.100242a7
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024a21
push 0x104
push esi
push ebx
call eax
mov ebx, eax
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10024a27
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov ebx, edx
inc edi
call fcn.10024250
mov esi, eax
test esi, esi
je 0x10024a8a
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 8], 0x78457965
mov dword [ebp - 0xd], 0x6e65704f
mov word [ebp - 4], 0x57
mov word [ebp - 0x10], 0x6552
mov byte [ebp - 9], 0x4b
mov byte [ebp - 0xe], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024a83
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push ebx
push 0x80000002
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10024a91
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.10024250
mov esi, eax
test esi, esi
je 0x10024aee
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0x10], 0x636f7250
mov dword [ebp - 0x14], 0x6e65704f
mov dword [ebp - 9], 0x656b6f54
mov word [ebp - 0xc], 0x7365
mov word [ebp - 5], 0x6e
mov byte [ebp - 0xa], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024ae7
push dword [ebp + 8]
push 0x20
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10024b41
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
call fcn.100242d9
mov esi, eax
test esi, esi
je 0x10024b94
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 7], 0x41784577
mov dword [ebp - 0x10], 0x646e6946
mov dword [ebp - 0xc], 0x646e6957
mov byte [ebp - 8], 0x6f
mov byte [ebp - 3], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024b8d
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push ebx
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10024b9a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.100241fa
mov esi, eax
test esi, esi
je 0x10024bfd
lea eax, [ebp - 0x14]
push eax
push esi
mov word [ebp - 3], 0x4165
mov dword [ebp - 8], 0x72756f73
mov dword [ebp - 0xf], 0x6e6f4665
mov word [ebp - 0xb], 0x5274
mov dword [ebp - 0x13], 0x766f6d65
mov byte [ebp - 1], bl
mov byte [ebp - 4], 0x63
mov byte [ebp - 0x14], 0x52
mov byte [ebp - 9], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024bf6
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10024c04
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
call fcn.10024280
mov esi, eax
test esi, esi
je 0x10024c72
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 8], 0x61507265
mov word [ebp - 0xe], 0x6c61
mov dword [ebp - 0x13], 0x63657053
mov dword [ebp - 0xc], 0x646c6f46
mov dword [ebp - 0x18], 0x65474853
mov word [ebp - 3], 0x5768
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 1], bl
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 4], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024c6b
push ebx
push 0x25
push edi
push ebx
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x10024c79
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.100242d9
mov esi, eax
test esi, esi
je 0x10024cce
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0xb], 0x6f646e69
mov word [ebp - 6], 0x41
mov dword [ebp - 0x10], 0x646e6946
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 7], 0x77
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024cc7
push edi
push dword [ebp - 4]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10024cd5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
mov esi, edx
mov dword [ebp - 8], 0x6c416c61
mov word [ebp - 3], 0x636f
mov word [ebp - 0xb], 0x6f6c
mov byte [ebp - 4], 0x6c
mov byte [ebp - 0xc], 0x47
mov byte [ebp - 1], bl
mov byte [ebp - 9], 0x62
call fcn.100242a7
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024d1e
push esi
push 0x40
call eax
mov ebx, eax
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10024d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
mov ebx, edx
mov dword [ebp - 4], ecx
inc edi
call fcn.10024250
mov esi, eax
test esi, esi
je 0x10024df1
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 0xb], 0x577845
mov word [ebp - 0x15], 0x7551
mov word [ebp - 0x12], 0x7972
mov word [ebp - 0x17], 0x6765
mov dword [ebp - 0xf], 0x65756c61
mov byte [ebp - 0x18], 0x52
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x10], 0x56
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024dea
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push ebx
push dword [ebp - 4]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10024df8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x14]
push eax
or esi, 0xffffffff
mov word [ebp - 0x14], 0x6547
mov dword [ebp - 0xd], 0x50746e65
mov word [ebp - 9], 0x6f72
mov dword [ebp - 6], 0x737365
mov dword [ebp - 0x11], 0x72727543
mov byte [ebp - 7], 0x63
mov byte [ebp - 0x12], 0x74
call fcn.100242a7
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024e43
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x10024e77
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.100242d9
mov esi, eax
test esi, esi
je 0x10024ed3
lea eax, [ebp - 0x10]
push eax
push esi
mov word [ebp - 0x10], 0x7349
mov dword [ebp - 0xa], 0x6956776f
mov word [ebp - 0xd], 0x6e69
mov dword [ebp - 5], 0x656c6269
mov byte [ebp - 0xe], 0x57
mov byte [ebp - 6], 0x73
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024ecc
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10024eda
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.10024250
mov esi, eax
test esi, esi
je 0x10024f4b
lea eax, [ebp - 0x18]
push eax
push esi
mov word [ebp - 8], 0x656c
mov dword [ebp - 0x17], 0x73756a64
mov dword [ebp - 0xf], 0x72506e65
mov byte [ebp - 0x18], 0x41
mov word [ebp - 5], 0x7365
mov byte [ebp - 6], 0x67
mov word [ebp - 0xb], 0x7669
mov dword [ebp - 0x13], 0x6b6f5474
mov byte [ebp - 3], bl
mov byte [ebp - 9], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024f44
push ebx
push ebx
push 0x10
push dword [ebp + 8]
push ebx
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10024f52
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 0x1c]
push eax
or esi, 0xffffffff
mov dword [ebp - 8], 0x746f6873
mov dword [ebp - 0x15], 0x686c6f6f
mov dword [ebp - 0x1c], 0x61657243
mov word [ebp - 0x10], 0x706c
mov word [ebp - 0xd], 0x5332
mov word [ebp - 0xa], 0x7061
mov word [ebp - 0x18], 0x6574
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 4], 0
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0x16], 0x54
call fcn.100242a7
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024fb9
push 0
push 2
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret

Function at 0x10025007
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
call fcn.10024250
mov esi, eax
test esi, esi
je 0x1002505c
lea eax, [ebp - 0xc]
push eax
push esi
mov word [ebp - 0xc], 0x444d
mov word [ebp - 6], 0x7461
mov word [ebp - 9], 0x7055
mov byte [ebp - 0xa], 0x35
mov byte [ebp - 7], 0x64
mov word [ebp - 4], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10025055
push dword [ebp + 8]
push edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10025208
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
and dword [ebp - 8], 0
push ebx
push esi
mov eax, ecx
push edi
lea ebx, [eax + 0x4c]
push 8
pop ecx
mov esi, ebx
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [ebp - 0x1b], 0x34333231
mov word [ebp - 0x17], 0x3635
mov dword [ebp - 0xf], 0x666564
mov word [ebp - 0x14], 0x3938
mov word [ebp - 0x11], 0x6362
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x15], 0x37
call fcn.10025323
xor edx, edx
push 0xf
xor esi, esi
pop edi
mov ecx, dword [ebx]
mov eax, ecx
shr eax, 0x1c
lea edx, [edx + 8]
mov al, byte [ebp + eax - 0x1c]
mov byte [ebp + edx - 0x8c], al
mov eax, ecx
shr eax, 0x18
and eax, edi
mov al, byte [ebp + eax - 0x1c]
mov byte [ebp + edx - 0x8b], al
mov eax, ecx
shr eax, 0x14
and eax, edi
mov al, byte [ebp + eax - 0x1c]
mov byte [ebp + edx - 0x8a], al
mov eax, ecx
shr eax, 0x10
and eax, edi
mov al, byte [ebp + eax - 0x1c]
mov byte [ebp + edx - 0x89], al
mov eax, ecx
shr eax, 0xc
and eax, edi
mov al, byte [ebp + eax - 0x1c]
mov byte [ebp + edx - 0x88], al
mov eax, ecx
shr eax, 8
and eax, edi
mov al, byte [ebp + eax - 0x1c]
mov byte [ebp + edx - 0x87], al
mov eax, ecx
shr eax, 4
and eax, edi
and ecx, edi
mov al, byte [ebp + eax - 0x1c]
mov byte [ebp + edx - 0x86], al
mov al, byte [ebp + ecx - 0x1c]
mov byte [ebp + edx - 0x85], al
mov eax, dword [ebp + esi*4 - 0x3c]
inc esi
mov dword [ebx], eax
lea ebx, [ebx + 4]
cmp esi, 8
jl 0x10025261
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x84]
push eax
mov byte [ebp + edx - 0x84], 0
call fcn.10001413
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x5b821b88
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x10
mov esi, edx
mov dword [ebp - 4], ecx
call sym.mpclient.dll_MpAllocMemory
mov ebx, eax
test ebx, ebx
jne 0x5b821bd9
mov esi, 0x8007000e
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b821d37
test byte [eax + 0x1c], 1
je 0x5b821d37
push dword [eax + 0x14]
mov edx, 0x5b80b640
push dword [eax + 0x10]
push 0x26
pop ecx
call fcn.5b81ae17
jmp 0x5b821d37
xor eax, eax
lea ecx, [ebx + 4]
mov edi, ebx
mov edx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 4]
mov dword [ebx], edi
call fcn.5b8281d8
mov esi, eax
test esi, esi
jns 0x5b821c21
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b821d2c
test byte [eax + 0x1c], 1
je 0x5b821d2c
push esi
lfence
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x27
jmp 0x5b821d21
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 8], eax
test eax, eax
jne 0x5b821c64
call fcn.5b86f6c1
mov esi, eax
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b821d2c
test byte [eax + 0x1c], 1
je 0x5b821d2c
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x28
jmp 0x5b821d21
push ebx
lea ecx, [ebx + 0xc]
mov edx, 0x5b821b40
lfence
call fcn.5b827f43
mov esi, eax
test esi, esi
jns 0x5b821ca3
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b821d2c
test byte [eax + 0x1c], 1
je 0x5b821d2c
push esi
lfence
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x29
jmp 0x5b821d21
cmp dword [ebp + 8], 0
lfence
je 0x5b821cf5
mov eax, dword [edi + 0x24]
add eax, 4
push eax
xor eax, eax
push eax
push ebx
push fcn.5b822410
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [edi + 0x24]
mov dword [ecx], eax
mov eax, dword [edi + 0x24]
cmp dword [eax], 0
jne 0x5b821d37
call fcn.5b86f6c1
mov esi, eax
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b821d2c
test byte [eax + 0x1c], 1
je 0x5b821d2c
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2a
jmp 0x5b821d21
push ebx
call fcn.5b822410
mov esi, eax
xor ebx, ebx
test esi, esi
jns 0x5b821d37
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b821d37
test byte [eax + 0x1c], 1
je 0x5b821d37
push esi
lfence
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2b
mov edx, 0x5b80b640
pop ecx
call fcn.5b81ae33
test ebx, ebx
je 0x5b821d37
mov ecx, ebx
call fcn.5b821b53
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x5b82cb20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edx, 0x3801
call fcn.5b871db4
test eax, eax
js 0x5b82cb3a
mov eax, 0x80004001
pop ebp
ret 4
pop ebp
jmp sym.mpclient.dll_MpWDEnable
Function at 0x5b8356b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [edi], 0x5b801510
cmp dword [edi + 0x10], esi
je 0x5b835782
cmp byte [edi + 0x3d], 0
jne 0x5b83570d
cmp dword [edi + 0x28], esi
je 0x5b835790
cmp dword [edi + 0x1c], esi
je 0x5b835782
lea ecx, [edi + 0x20]
call fcn.5b835627
mov edx, dword [edi + 0x1c]
lea ecx, [edi + 0x20]
mov dword [edx + 0xb8], eax
mov edx, dword [edi + 0x1c]
push dword [edi + 0x24]
mov eax, dword [edx + 0x98]
add eax, edx
push eax
call fcn.5b8355ea
jmp 0x5b835782
cmp dword [edi + 0x18], esi
je 0x5b83571e
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [edi + 0x18], esi
cmp dword [edi + 0x14], esi
je 0x5b83572f
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x14], esi
cmp dword [edi + 0x10], 0xffffffff
je 0x5b835742
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi + 0x10], 0xffffffff
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x5b835782
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b835782
test byte [eax + 0x1c], 1
je 0x5b835782
call fcn.5b86f6c1
push eax
push dword [edi + 0xc]
mov eax, dword [0x5b89602c]
mov edx, 0x5b80c428
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.5b81ae55
cmp dword [edi + 0x28], esi
je 0x5b835790
push dword [edi + 0x28]
call fcn.5b884351
pop ecx
cmp dword [edi + 0x18], esi
je 0x5b83579e
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [edi + 0x14], esi
je 0x5b8357ac
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 0x10], 0xffffffff
je 0x5b8357bb
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 0xc], esi
je 0x5b8357c9
push dword [edi + 0xc]
call fcn.5b884351
pop ecx
lea ecx, [edi + 8]
call fcn.5b8276f4
mov dword [edi], 0x5b801234
pop edi
pop esi
mov esp, ebp
pop ebp
ret