joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x2c], eax
mov esi, 1
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push edi
push eax
mov dword [ebp - 0x13], 0x70617664
mov dword [ebp - 0xd], 0x6c642e32
mov word [ebp - 9], 0x6c
mov word [ebp - 0xf], 0x3369
mov byte [ebp - 0x14], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10006b25
lea eax, [ebp - 0x24]
mov word [ebp - 0x1c], 0x7965
push eax
push edi
mov word [ebp - 0x19], 0x5778
mov word [ebp - 0x1f], 0x6e65
mov byte [ebp - 0x17], 0
mov dword [ebp - 0x24], 0x4f676552
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x1a], 0x45
mov byte [ebp - 0x1d], 0x4b
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006b1e
push dword [ebp - 0x28]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x2c]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a678
mov esp, ebp
pop ebp
ret

Function at 0x10006b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x2c], eax
xor esi, esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x13], 0x70617664
push eax
mov dword [ebp - 0xd], 0x6c642e32
mov word [ebp - 9], 0x6c
mov word [ebp - 0xf], 0x3369
mov byte [ebp - 0x14], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10006bd9
lea eax, [ebp - 0x28]
mov word [ebp - 0x21], 0x6563
push eax
push edi
mov dword [ebp - 0x1e], 0x6b6f5473
mov dword [ebp - 0x25], 0x6f72506e
mov byte [ebp - 0x1f], 0x73
mov word [ebp - 0x1a], 0x6e65
mov word [ebp - 0x27], 0x6570
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x28], 0x4f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006bd2
push dword [ebp - 0x2c]
push dword [ebp + 0xc]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a678
mov esp, ebp
pop ebp
ret
Function at 0x10006d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x34], eax
xor esi, esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x14]
push edi
push eax
mov dword [ebp - 0x13], 0x70617664
mov dword [ebp - 0xd], 0x6c642e32
mov word [ebp - 9], 0x6c
mov word [ebp - 0xf], 0x3369
mov byte [ebp - 0x14], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10006e08
lea eax, [ebp - 0x2c]
mov word [ebp - 0x21], 0x656c
push eax
push edi
mov dword [ebp - 0x26], 0x76697250
mov word [ebp - 0x1b], 0x756c
mov dword [ebp - 0x2c], 0x6b6f6f4c
mov word [ebp - 0x18], 0x41
mov dword [ebp - 0x1f], 0x61566567
mov byte [ebp - 0x22], 0x69
mov byte [ebp - 0x19], 0x65
mov word [ebp - 0x28], 0x7075
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006e01
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a678
mov esp, ebp
pop ebp
ret

Function at 0x10006e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov word [ebp - 0x1d], 0x3233
mov dword [ebp - 0x22], 0x7365636f
mov dword [ebp - 0x1b], 0x7478654e
mov word [ebp - 0x24], 0x7250
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x1e], 0x73
mov word [ebp - 0xa], 0x6c6c
mov word [ebp - 0x14], 0x654b
mov dword [ebp - 0xf], 0x2e32336c
mov word [ebp - 0x11], 0x656e
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 8], 0
mov byte [ebp - 0xb], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006eac
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a678
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1000a678
mov esp, ebp
pop ebp
ret
Function at 0x10006ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov word [ebp - 0x17], 0x74
mov dword [ebp - 0x1c], 0x72694632
mov dword [ebp - 0x22], 0x7365636f
mov word [ebp - 0x1e], 0x3373
mov word [ebp - 0x24], 0x7250
mov byte [ebp - 0x18], 0x73
mov word [ebp - 0xa], 0x6c6c
mov word [ebp - 0x14], 0x654b
mov dword [ebp - 0xf], 0x2e32336c
mov word [ebp - 0x11], 0x656e
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 8], 0
mov byte [ebp - 0xb], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006f4e
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a678
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1000a678
mov esp, ebp
pop ebp
ret

Function at 0x10006f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov word [ebp - 0x27], 0x6e69
mov dword [ebp - 0x1d], 0x656d756c
mov byte [ebp - 0x28], 0x46
mov word [ebp - 0x19], 0x57
mov dword [ebp - 0x24], 0x73726946
mov word [ebp - 0x20], 0x5674
mov byte [ebp - 0x25], 0x64
mov byte [ebp - 0x1e], 0x6f
mov word [ebp - 0xa], 0x6c6c
mov word [ebp - 0x14], 0x654b
mov dword [ebp - 0xf], 0x2e32336c
mov word [ebp - 0x11], 0x656e
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 8], 0
mov byte [ebp - 0xb], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006ff6
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a678
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.1000a678
mov esp, ebp
pop ebp
ret
Function at 0x10007010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x28], eax
xor esi, esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
push edi
push eax
mov dword [ebp - 0xa], 0x6c6c642e
mov dword [ebp - 0xf], 0x33726573
mov byte [ebp - 6], 0
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0x10], 0x55
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100070aa
lea eax, [ebp - 0x20]
mov dword [ebp - 0x16], 0x417845
push eax
push edi
mov word [ebp - 0x1b], 0x6e69
mov dword [ebp - 0x20], 0x646e6946
mov word [ebp - 0x18], 0x776f
mov byte [ebp - 0x1c], 0x57
mov byte [ebp - 0x19], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100070a3
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a678
mov esp, ebp
pop ebp
ret

Function at 0x100070c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x30], eax
mov esi, 1
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x14]
push edi
push eax
mov dword [ebp - 0x13], 0x70617664
mov dword [ebp - 0xd], 0x6c642e32
mov word [ebp - 9], 0x6c
mov word [ebp - 0xf], 0x3369
mov byte [ebp - 0x14], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000717d
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1f], 0x65756c61
push eax
push edi
mov word [ebp - 0x25], 0x7551
mov word [ebp - 0x22], 0x7972
mov dword [ebp - 0x1b], 0x577845
mov word [ebp - 0x27], 0x6765
mov byte [ebp - 0x28], 0x52
mov byte [ebp - 0x20], 0x56
mov byte [ebp - 0x23], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10007176
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a678
mov esp, ebp
pop ebp
ret
Function at 0x10007190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
mov word [ebp - 9], 0x646e
mov word [ebp - 6], 0x65
mov dword [ebp - 0xe], 0x4865736f
mov word [ebp - 0x10], 0x6c43
mov byte [ebp - 7], 0x6c
mov byte [ebp - 0xa], 0x61
mov word [ebp - 0x16], 0x6c6c
mov word [ebp - 0x20], 0x654b
mov dword [ebp - 0x1b], 0x2e32336c
mov word [ebp - 0x1d], 0x656e
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x17], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10007215
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a678
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1000a678
mov esp, ebp
pop ebp
ret

Function at 0x10007230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x30], 0x61657243
mov word [ebp - 0x1e], 0x7061
mov dword [ebp - 0x2c], 0x6f546574
mov dword [ebp - 0x25], 0x33706c65
mov word [ebp - 0x21], 0x5332
mov byte [ebp - 0x1f], 0x6e
mov word [ebp - 0x27], 0x686c
mov dword [ebp - 0x1c], 0x746f6873
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x28], 0x6f
mov word [ebp - 0xa], 0x6c6c
mov word [ebp - 0x14], 0x654b
mov dword [ebp - 0xf], 0x2e32336c
mov word [ebp - 0x11], 0x656e
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 8], 0
mov byte [ebp - 0xb], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100072d4
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a678
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.1000a678
mov esp, ebp
pop ebp
ret
Function at 0x100072f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x20], eax
xor esi, esi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xa], 0x6c6c642e
push eax
mov dword [ebp - 0xf], 0x33726573
mov byte [ebp - 6], 0
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0x10], 0x55
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10007372
lea eax, [ebp - 0x1c]
mov word [ebp - 0x17], 0x6e69
push eax
push edi
mov dword [ebp - 0x1c], 0x646e6946
mov byte [ebp - 0x18], 0x57
mov dword [ebp - 0x15], 0x41776f64
mov byte [ebp - 0x11], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000736b
push dword [ebp - 0x20]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a678
mov esp, ebp
pop ebp
ret

Function at 0x10007390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push esi
push edi
push eax
mov esi, 1
mov dword [ebp - 0x1f], 0x70617664
mov dword [ebp - 0x19], 0x6c642e32
mov word [ebp - 0x15], 0x6c
mov word [ebp - 0x1b], 0x3369
mov byte [ebp - 0x20], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000740e
lea eax, [ebp - 0x10]
mov dword [ebp - 0xa], 0x654b6573
push eax
push edi
mov word [ebp - 6], 0x79
mov dword [ebp - 0x10], 0x43676552
mov word [ebp - 0xc], 0x6f6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10007407
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a678
mov esp, ebp
pop ebp
ret

Function at 0x10007430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x24], 0x74616e69
mov dword [ebp - 0x1b], 0x737365
mov dword [ebp - 0x28], 0x6d726554
mov word [ebp - 0x1d], 0x636f
mov word [ebp - 0x20], 0x5065
mov byte [ebp - 0x1e], 0x72
mov word [ebp - 0xa], 0x6c6c
mov word [ebp - 0x14], 0x654b
mov dword [ebp - 0xf], 0x2e32336c
mov word [ebp - 0x11], 0x656e
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 8], 0
mov byte [ebp - 0xb], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100074bc
push dword [ebp + 0xc]
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a678
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1000a678
mov esp, ebp
pop ebp
ret
Function at 0x100074d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push esi
push edi
push eax
xor esi, esi
mov dword [ebp - 0x10], 0x33696447
mov word [ebp - 9], 0x6c6c
mov word [ebp - 0xc], 0x2e32
mov byte [ebp - 7], 0
mov byte [ebp - 0xa], 0x64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000755d
lea eax, [ebp - 0x24]
mov dword [ebp - 0x22], 0x65766f6d
push eax
push edi
mov dword [ebp - 0x16], 0x65637275
mov dword [ebp - 0x1e], 0x746e6f46
mov word [ebp - 0x19], 0x7365
mov word [ebp - 0x12], 0x41
mov word [ebp - 0x24], 0x6552
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x1a], 0x52
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10007556
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a678
mov esp, ebp
pop ebp
ret

Function at 0x10007570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0xc], 0x41797063
mov dword [ebp - 0x10], 0x7274736c
mov byte [ebp - 8], 0
mov word [ebp - 0x16], 0x6c6c
mov word [ebp - 0x20], 0x654b
mov dword [ebp - 0x1b], 0x2e32336c
mov word [ebp - 0x1d], 0x656e
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x17], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100075ec
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a678
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1000a678
mov esp, ebp
pop ebp
ret
Function at 0x10007600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov word [ebp - 0xd], 0x506e
mov word [ebp - 7], 0x7373
mov word [ebp - 0x10], 0x704f
mov word [ebp - 0xa], 0x636f
mov byte [ebp - 5], 0
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 8], 0x65
mov word [ebp - 0x16], 0x6c6c
mov word [ebp - 0x20], 0x654b
mov dword [ebp - 0x1b], 0x2e32336c
mov word [ebp - 0x1d], 0x656e
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x17], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10007698
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a678
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a678
mov esp, ebp
pop ebp
ret
Function at 0x1000fda0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0x83c]
mov edi, dword [ebx + 0xc]
cmp dword [eax + 0x54], 1
jne 0x1000fe1a
cmp dword [edi + 0x4c], 0
jne 0x1000febb
xor esi, esi
mov dword [ebp + 8], esi
cmp dword [edi + 0x48], esi
jle 0x1000fe1a
movzx edx, word [edi + 0x24]
xor ecx, ecx
test edx, edx
je 0x1000fe11
mov eax, dword [eax + 0x28]
mov esi, dword [eax + esi*4]
nop dword [eax]
cmp byte [esi + ecx], 2
je 0x1000fe03
mov eax, dword [ebx + 0x83c]
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + edx*4]
movzx edx, word [edi + 0x24]
cmp dword [eax + ecx*4], 0
je 0x1000febb
inc ecx
cmp ecx, edx
jl 0x1000fde0
mov eax, dword [ebx + 0x83c]
mov esi, dword [ebp + 8]
inc esi
mov dword [ebp + 8], esi
cmp esi, dword [edi + 0x48]
jl 0x1000fdd0
cmp dword [ebx + 0x105c], 0
je 0x1000fe8f
xor edx, edx
cmp dword [edi + 0x48], edx
jle 0x1000fe82
movzx esi, word [edi + 0x24]
nop
xor eax, eax
xor ecx, ecx
cmp ax, si
jae 0x1000fe7c
nop dword [eax]
mov eax, dword [ebx + 0x83c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + edx*4]
mov dword [eax + ecx*4], 1
mov eax, dword [ebx + 0x83c]
mov eax, dword [eax + 0x20]
mov eax, dword [eax + edx*4]
mov byte [ecx + eax], 0
mov eax, dword [ebx + 0x83c]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + edx*4]
mov byte [ecx + eax], 0
inc ecx
movzx esi, word [edi + 0x24]
cmp ecx, esi
jl 0x1000fe40
inc edx
cmp edx, dword [edi + 0x48]
jl 0x1000fe30
mov eax, dword [ebx + 0x83c]
mov dword [eax + 0x54], 0
xor eax, eax
xor esi, esi
cmp ax, word [edi + 0x24]
jae 0x1000fed7
nop dword [eax]
mov eax, dword [ebx + 0x83c]
mov edx, dword [edi + 0x28]
mov eax, dword [eax + 0x38]
mov cl, byte [edx + esi]
cmp dword [eax + esi*4], 0
je 0x1000fec5
test cl, cl
jle 0x1000fece
jmp 0x1000fec9
pop edi
pop esi
mov eax, 0xffffffdd
pop ebx
pop ebp
ret
test cl, cl
jns 0x1000fece
neg cl
mov byte [edx + esi], cl
movzx eax, word [edi + 0x24]
inc esi
cmp esi, eax
jl 0x1000fea0
xor edx, edx
mov dword [ebp + 8], edx
cmp dword [edi + 0x48], edx
jle 0x1000ff33
xor eax, eax
xor ecx, ecx
cmp ax, word [edi + 0x24]
jae 0x1000ff2a
nop dword [eax + eax]
mov eax, dword [ebx + 0x83c]
mov eax, dword [eax + 8]
cmp dword [eax + edx*4], 1
lea esi, [eax + edx*4]
jbe 0x1000ff2a
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x28]
mov al, byte [ecx + eax]
cbw
mov dl, al
xor dl, ah
sub dl, ah
cmp dl, 1
jne 0x1000ff1e
mov dword [esi], 1
movzx eax, word [edi + 0x24]
inc ecx
mov edx, dword [ebp + 8]
cmp ecx, eax
jl 0x1000fef0
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [edi + 0x48]
jl 0x1000fee1
push ebx
call fcn.10016730
add esp, 4
test eax, eax
jne 0x1000ff49
push ebx
call fcn.10011320
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10039eb0
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 4]
mov dword [ebp + 0x10], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
mov edi, 0xc6ef3720
mov dword [ebp + 8], edx
mov dword [ebp - 8], ecx
mov edx, esi
shr edx, 5
add edx, ecx
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp + 8]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
sub eax, edx
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [ebp + 0x10]
shl ecx, 4
add ecx, dword [ebp - 4]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
lea edi, [edi + 0x61c88647]
mov ecx, dword [ebp - 8]
sub esi, edx
sub ebx, 1
jne 0x10039ee5
mov ecx, dword [ebp + 0xc]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10060ce9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100608e2

Function at 0x1006c1cb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006b9a5

Function at 0x1006c1d6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006bbe0

Function at 0x10079339
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100790c0