joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012247
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002dc29
call fcn.10016e01
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.100273b6
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x100122f2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.100273b6
mov ecx, dword [esi]
test al, al
je 0x100122d4
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100273b6
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x100122eb
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.100273b6
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009b23
cmp dword [ebx + 0x24], 0
je 0x10012312
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.100273b6
test al, al
je 0x10012312
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016dca
ret
Function at 0x10013230
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002dcec
call fcn.10016e35
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x1001325b
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x100133e6
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x100304d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001327f
mov eax, 0x80004005
jmp 0x100133e6
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.100273b6
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.100273b6
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.100273b6
test al, al
je 0x100133be
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10019ba0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.100273b6
add esp, 0x14
test eax, eax
jne 0x10013338
push 0x2f
push edi
call fcn.100273b6
pop ecx
pop ecx
test eax, eax
je 0x10013358
add eax, 2
push 0x2e
push eax
call fcn.100273b6
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.100273b6
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x100133b7
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100273b6
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x100133a9
lea eax, [ebp - 0x218]
push eax
call fcn.100273b6
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x100133af
push edi
call fcn.100273b6
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x100133cf
mov esi, 0x80004005
jmp 0x100133d8
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.100273b6
push eax
lea ecx, [ebx + 0x10]
call fcn.100273b6
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016ddf
ret 0xc
Function at 0x10013a90
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002ddab
call fcn.10016e35
mov ebx, ecx
xor ecx, ecx
lea edi, [ebx + 0x40]
mov esi, ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
cmp dword [edi], ecx
je 0x10013bcc
push 0x10
push ecx
lea eax, [ebp - 0x828]
push eax
call fcn.10019ba0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantClear]
push esi
push str.Caption
push dword [edi]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], esi
push eax
push 2
push ebx
call fcn.100273b6
add esp, 0x18
test eax, eax
jne 0x10013b31
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.100273b6
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.user32.dll_FindWindowW]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x818]
push ecx
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x10013b70
cmp dword [ebp - 0x818], 0
jne 0x10013b70
push 0
push str.Quit
push dword [edi]
push 0
push 1
push ebx
call fcn.100273b6
add esp, 0x18
mov esi, eax
mov ecx, edi
call fcn.10009b23
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x10013bcc
cmp dword [ebp - 0x818], 0
jne 0x10013bcc
test esi, esi
jns 0x10013bcc
and dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x814]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
call fcn.10016ddf
ret
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.100273b6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret
Function at 0x401100
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
xor ebp, ebp
xor esi, esi
mov bl, 0x20
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, eax
cmp byte [edx], 0x22
jne 0x401120
mov bl, 0x22
jmp 0x401120
mov al, byte [edx + 1]
inc edx
cmp al, bl
je 0x40112e
test al, al
jne 0x401120
jmp 0x401147
cmp byte [edx], 0
je 0x401147
mov al, byte [edx + 1]
inc edx
test al, al
je 0x401147
cmp al, 0x20
je 0x401133
cmp al, 9
je 0x401133
test al, al
jne 0x401160
push ebp
push 0x4010e8
push 0x401028
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebp
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp al, 0x2f
jne 0x40117b
mov al, byte [edx + 1]
or al, 0x20
cmp al, 0x77
jne 0x40117b
cmp byte [edx + 2], 0x20
jne 0x40117b
mov esi, 1
add edx, 3
mov al, byte [edx]
test al, al
je 0x401191
cmp al, 0x20
je 0x401189
cmp al, 9
jne 0x401191
mov al, byte [edx + 1]
inc edx
test al, al
jne 0x401181
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
lea eax, [esp + 0x24]
push eax
push ebp
push ebp
push 0x10
push ebp
push ebp
push ebp
push edx
push ebp
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x74], 1
mov word [esp + 0x78], bp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x4011f9
cmp esi, ebp
je 0x4011e3
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
jmp 0x401201
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1000f797
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000f7a6
pop dword [ebp - 0x48]
mov eax, 0x28e80798
sub eax, 0x18e70ff2
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3939e
push 0
mov eax, 0x82e6d5e6
sub eax, 0x72e4e40a
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x3b74
mov edx, eax
mov edi, 0xdd23f708
add edi, 0x32e3eaf8
add edi, dword [ebp - 0x48]
mov esi, 0x5dfba6c5
add esi, 0x33cee542
add dword [ebp - 0x3c], eax
mov ebx, dword [edi]
sub dword [ebp - 0x40], edi
xor ebx, esi
xor dword [ebp - 0x14], 0xbd173140
mov dword [edx], ebx
add dword [ebp - 0x3c], ebx
add edx, 0xf2444c1
add edx, 0xf0dbbb43
add edi, 0x8eae9fd5
sub edi, 0x8eae9fd1
loop 0x1000f7ff
add eax, 0x1ffaf4b7
add eax, 0xe005ebec
mov ebx, eax
add eax, 0x6bcf6ce3
add eax, 0x94309322
mov ecx, 0x786cb9b
add ecx, 0x8793465
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x100068d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101549a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1002a160
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x14]
mov byte [esi + 0x10], al
mov dword [esp + 0x18], ecx
mov dword [ecx], eax
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 2
mov dword [esp + 0x18], ecx
mov dword [ecx], eax
mov dl, byte [esp + 0x18]
mov byte [esp + 0x10], 4
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], dl
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esp + 0x10], 5
mov byte [esi + 0x30], 1
mov byte [esi + 0x31], al
mov byte [esi + 0x34], al
mov dword [esi + 0x38], eax
mov byte [esp + 0x10], 6
mov dword [esi], 0x1016a324
mov dword [esi + 4], 0x1016a320
mov byte [0x1018c272], 0x3e
mov eax, dword [esi + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, 0x49
cdq
idiv dword [0x1018c248]
mov eax, dword [0x1018c244]
mov cl, byte [edx + eax]
mov eax, esi
mov byte [0x1018c272], cl
mov ecx, dword [esp + 8]
mov dword [esp + 0x10], 0xffffffff
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x10006ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10154a44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi - 4], 0x1016a324
mov dword [esi], 0x1016a320
mov bl, byte [0x1018c270]
mov dword [esp + 0x1c], 4
inc bl
mov byte [0x1018c270], bl
mov eax, dword [esi + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov cl, byte [0x1018c272]
xor ebx, ebx
inc cl
mov byte [0x1018c272], cl
mov al, byte [esi + 0x30]
cmp al, bl
mov byte [esp + 0x1c], 3
je 0x10006b50
mov edi, dword [esi + 0x34]
cmp edi, ebx
je 0x10006b50
mov ecx, edi
call fcn.1001ba80
push edi
call fcn.101307a0
add esp, 4
mov ecx, dword [esi + 0x20]
mov byte [esp + 0x1c], 2
cmp ecx, ebx
je 0x10006b7a
mov al, byte [ecx - 1]
cmp al, bl
je 0x10006b6e
cmp al, 0xff
je 0x10006b6e
dec al
mov byte [ecx - 1], al
jmp 0x10006b7a
lea eax, [ecx - 2]
push eax
call fcn.101307a0
add esp, 4
mov al, 1
lea ecx, [esi + 0x14]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov byte [esp + 0x1c], al
mov dword [esp + 0x10], ecx
mov byte [esp + 0x1c], al
call fcn.10020761
lea ecx, [esi + 0x10]
mov byte [esp + 0x1c], bl
mov dword [esp + 0x10], ecx
mov byte [esp + 0x1c], bl
call fcn.10020761
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
call fcn.1002a1f0
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10011340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov al, 0x96
push ebx
mov byte [esp + 0x1c], al
mov byte [esp + 0xf], al
mov al, byte [0x10194c18]
push ebp
push esi
push edi
test al, 1
mov byte [esp + 0x20], 0xe4
mov byte [esp + 0x21], 0x35
mov byte [esp + 0x22], 0x57
mov byte [esp + 0x23], 0x75
mov byte [esp + 0x24], 0xf6
mov byte [esp + 0x25], 0x4a
mov byte [esp + 0x26], 0x27
mov byte [esp + 0x27], 0xa4
mov byte [esp + 0x29], 0x1a
mov byte [esp + 0x2a], 0xf
mov byte [esp + 0x2b], 0xe5
mov byte [esp + 0x14], 0x8f
mov byte [esp + 0x15], 0x50
mov byte [esp + 0x16], 0x25
mov byte [esp + 0x17], 0x1b
mov byte [esp + 0x18], 0x93
mov byte [esp + 0x19], 0x26
mov byte [esp + 0x1a], 0x14
mov byte [esp + 0x1c], 0xb8
mov byte [esp + 0x1d], 0x7e
mov byte [esp + 0x1e], 0x63
mov byte [esp + 0x1f], 0x89
jne 0x10011455
mov bl, al
push 0xd
or bl, 1
mov byte [0x10194c18], bl
call fcn.1013c2df
add esp, 4
mov dword [0x10194c1c], eax
xor edi, edi
mov bl, byte [esp + edi + 0x14]
movsx eax, byte [esp + edi + 0x20]
movsx esi, bl
test esi, esi
jne 0x100113fd
mov esi, 8
cdq
idiv esi
mov ecx, edx
test ecx, ecx
je 0x10011428
mov eax, ecx
cdq
mov ebp, eax
mov eax, esi
xor ebp, edx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ebp
jge 0x1001141d
lea esi, [ebp + 0xc]
mov eax, ecx
cdq
idiv esi
mov ecx, eax
test ecx, ecx
jne 0x1001141d
mov al, byte [esp + edi + 0x20]
xor bl, al
mov eax, dword [0x10194c1c]
or bl, cl
mov byte [edi + eax], bl
inc edi
cmp edi, 0xc
jb 0x100113e8
mov ecx, dword [0x10194c1c]
push 0x10011570
mov byte [ecx + 0xc], 0
call fcn.1013c36b
add esp, 4
mov al, byte [0x10194c20]
mov edx, dword [0x10194c1c]
test al, 1
mov dword [esp + 0x10], edx
mov byte [esp + 0x14], 0xe3
mov byte [esp + 0x15], 0x7c
mov byte [esp + 0x16], 0x17
mov byte [esp + 0x17], 0x79
mov byte [esp + 0x18], 0xee
mov byte [esp + 0x19], 0x56
mov byte [esp + 0x1a], 0x97
mov byte [esp + 0x1b], 0xeb
mov byte [esp + 0x20], 0xb0
mov byte [esp + 0x21], 0x19
mov byte [esp + 0x22], 0x63
mov byte [esp + 0x23], 0x3c
mov byte [esp + 0x24], 0x98
mov byte [esp + 0x25], 0x33
mov byte [esp + 0x26], 0xf9
mov byte [esp + 0x27], 0x9f
jne 0x10011545
mov bl, al
push 9
or bl, 1
mov byte [0x10194c20], bl
call fcn.1013c2df
add esp, 4
mov dword [0x10194c24], eax
xor edi, edi
mov bl, byte [esp + edi + 0x20]
movsx eax, byte [esp + edi + 0x14]
movsx esi, bl
test esi, esi
jne 0x100114ed
mov esi, 8
cdq
idiv esi
mov ecx, edx
test ecx, ecx
je 0x10011518
mov eax, ecx
cdq
mov ebp, eax
mov eax, esi
xor ebp, edx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ebp
jge 0x1001150d
lea esi, [ebp + 0xc]
mov eax, ecx
cdq
idiv esi
mov ecx, eax
test ecx, ecx
jne 0x1001150d
mov al, byte [esp + edi + 0x14]
xor bl, al
mov eax, dword [0x10194c24]
or bl, cl
mov byte [edi + eax], bl
inc edi
cmp edi, 8
jb 0x100114d8
mov ecx, dword [0x10194c24]
push 0x10011580
mov byte [ecx + 8], 0
call fcn.1013c36b
add esp, 4
mov edx, dword [esp + 0x10]
mov esi, dword [0x10194c24]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x30]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x100165b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1015695f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
xor edi, edi
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], 2
lea ecx, [esp + 8]
mov byte [0x1018c3bd], 0x43
mov eax, dword [esi]
push ecx
push esi
mov dword [esp + 0x10], edi
call dword [eax + 0x30]
mov dword [esp + 0x24], edi
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x18], 4
mov dword [esp + 0x24], edi
mov eax, dword [ecx + 0x24]
cmp eax, edi
jne 0x10016613
mov eax, 0x1016a1dc
mov edx, dword [ecx + 0x14]
cmp edx, edi
jne 0x1001661f
mov edx, 0x1016a1dc
mov ecx, dword [ecx + 4]
cmp ecx, edi
jne 0x1001662b
mov ecx, 0x1016a1dc
push ebx
push ebp
mov ebx, dword [esi]
lea ebp, [esp + 0x2c]
push ebp
push edi
push eax
push edx
mov edx, dword [esp + 0x20]
push ecx
push edx
push esi
call dword [ebx + 0xc]
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x28]
mov dword [ecx], eax
mov eax, dword [esp + 0x2c]
mov dword [esi], eax
pop ebp
cmp eax, edi
mov byte [esp + 0x1c], 5
pop ebx
je 0x10016662
mov edx, dword [eax]
push eax
call dword [edx + 4]
mov byte [esp + 0x18], 4
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 2
call fcn.10020761
lea ecx, [esp + 8]
mov dword [esp + 0x18], edi
call fcn.10020761
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100166a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x101569af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
xor edi, edi
push 0x7c
mov dword [esp + 0x44], edi
call fcn.10026370
mov cl, byte [0x1018c3c0]
add esp, 4
dec cl
mov al, 0x2c
mov byte [0x1018c3c0], cl
mov cl, 0x29
mov byte [esp + 0x1d], cl
mov byte [esp + 0x1e], cl
mov cl, 0xec
mov byte [esp + 0x1a], al
mov byte [esp + 0x21], al
mov byte [esp + 0x2b], al
mov byte [esp + 0x33], al
mov al, byte [0x10194af8]
mov byte [esp + 0x24], cl
mov byte [esp + 0x2e], cl
mov dl, 0x22
mov bl, 0x20
mov cl, 0x34
mov byte [esp + 0x18], 0xfd
test al, 1
mov byte [esp + 0x19], 0x2a
mov byte [esp + 0x1b], 0x37
mov byte [esp + 0x1c], 0x26
mov byte [esp + 0x1f], 0x1e
mov byte [esp + 0x20], 0xeb
mov byte [esp + 0x22], 0x2f
mov byte [esp + 0x23], 0x24
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x2a
mov byte [esp + 0x27], 0x1f
mov byte [esp + 0x28], dl
mov byte [esp + 0x29], 0x21
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2c], 0x2a
mov byte [esp + 0x2d], 0x2d
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], 0x26
mov byte [esp + 0x31], 0x2b
mov byte [esp + 0x32], 0x21
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], 0xea
mov byte [esp + 0x36], cl
mov byte [esp + 0x37], 0x1e
mov byte [esp + 0x38], 0x31
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], 0x25
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3c], 0x2f
mov byte [esp + 0x3d], 0xf8
mov byte [esp + 0x3e], 0xee
jne 0x100167fc
mov bl, al
push 0x28
or bl, 1
mov byte [0x10194af8], bl
call fcn.1013c2df
add esp, 4
mov dword [0x10194afc], eax
xor esi, esi
mov bl, byte [esp + esi + 0x18]
push 0x43
movsx eax, bl
push eax
mov ecx, 0x10194afc
call fcn.1002ea10
mov ecx, dword [0x10194afc]
sub bl, al
add bl, 0x43
mov byte [esi + ecx], bl
inc esi
cmp esi, 0x27
jb 0x100167bd
mov edx, dword [0x10194afc]
push 0x100168e0
mov byte [edx + 0x27], 0
call fcn.1013c36b
add esp, 4
mov eax, dword [0x10194afc]
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], edi
lea ecx, [esp + 0x10]
push 0x1016a510
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 1
call fcn.100207f9
mov eax, 0x51
mov dword [esp + 0x4c], 2
cdq
idiv dword [0x1018c3a4]
mov eax, dword [0x1018c3a0]
mov cl, byte [edx + eax]
push ecx
call fcn.10026370
mov cl, al
mov eax, 0x344
cdq
idiv dword [0x1018c3a4]
mov eax, dword [0x1018c3a0]
add esp, 4
mov al, byte [edx + eax]
mov dl, 0x16
imul dl
mov bl, al
sub bl, cl
sub bl, 0x2a
call fcn.100165a0
add bl, al
mov byte [0x1018c3be], bl
mov eax, dword [esi]
test eax, 0x80000000
je 0x1001689d
mov esi, dword [esp + 0x54]
mov dword [esi], edi
mov byte [esp + 0x4c], 2
mov dword [esp + 0x40], 1
jmp 0x100168bd
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x58]
push eax
push ecx
push esi
call fcn.100165b0
add esp, 0x10
mov dword [esp + 0x40], 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], edi
call fcn.10020761
mov ecx, dword [esp + 0x44]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0x1001b9e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10157833
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov ebp, ecx
push edi
push ebp
mov dword [esp + 0x20], ebp
call fcn.1001e860
mov al, byte [esp + 0x17]
mov cl, byte [esp + 0x17]
xor ebx, ebx
lea esi, [ebp + 0x18]
mov dword [esp + 0x30], ebx
push 0x18
mov dword [esp + 0x28], esi
mov byte [esi], al
mov byte [esi + 1], cl
mov byte [esi + 8], bl
call fcn.1013c2df
mov edi, eax
add esp, 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], edi
mov dword [edi + 4], ebx
mov dword [edi + 0x14], 1
call fcn.1013092f
mov eax, dword [0x101915c0]
mov byte [esp + 0x2c], 1
cmp eax, ebx
jne 0x1001b31b
mov dword [0x101915c0], edi
mov dword [edi], ebx
mov edx, dword [0x101915c0]
mov dword [esp + 0x14], ebx
mov dword [edx + 8], ebx
mov edx, dword [0x101915bc]
lea ecx, [esp + 0x18]
inc edx
mov dword [0x101915bc], edx
mov byte [esp + 0x2c], bl
call fcn.101309cb
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x1001b346
push eax
call fcn.101307a0
add esp, 4
mov edi, dword [0x101915c0]
push 0x18
call fcn.1013c2df
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [eax], eax
mov esi, dword [esi + 4]
mov dword [esi + 8], esi
mov al, byte [0x1018c429]
mov byte [esp + 0x30], 3
mov bl, al
push 0xfffffffffffffff8
sub bl, 0x34
inc al
mov byte [0x1018c429], al
mov eax, 0x2f2
cdq
idiv dword [0x1018c40c]
mov eax, dword [0x1018c408]
mov cl, byte [edx + eax]
push ecx
call fcn.1001b3d0
push eax
push ebx
push 0xffffffffffffffa4
push 0xffffffffffffffcf
call fcn.1001b4d0
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov byte [0x1018c424], al
mov eax, ebp
pop edi
pop esi
mov dword [esp + 0x24], 0xffffffff
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ecx, 0x10191590
jmp 0x1001b290
Function at 0x1001cea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101579af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov al, byte [esp + 3]
mov dl, byte [esp + 3]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0xc]
mov dword [esi + 8], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ecx
mov byte [ecx], al
mov byte [ecx + 1], dl
mov byte [ecx + 8], bl
call fcn.1001f900
lea eax, [esi + 0x1c]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x18], eax
mov dword [eax], ebx
lea eax, [esi + 0x20]
mov byte [esp + 0x2c], 3
mov dword [esp + 0x18], eax
mov dword [eax], ebx
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x13]
lea edi, [esi + 0x24]
mov byte [esp + 0x2c], 5
push 0x14
mov dword [esp + 0x24], edi
mov byte [edi], al
mov byte [edi + 1], cl
mov byte [edi + 8], bl
call fcn.1013c2df
mov ebp, eax
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], ebp
mov dword [ebp + 4], ebx
mov dword [ebp + 0x10], 1
call fcn.1013092f
mov eax, dword [0x101915c8]
mov byte [esp + 0x2c], 6
cmp eax, ebx
jne 0x1001cf65
mov dword [0x101915c8], ebp
mov dword [ebp], ebx
mov edx, dword [0x101915c8]
mov dword [esp + 0x14], ebx
mov dword [edx + 8], ebx
mov edx, dword [0x101915c4]
lea ecx, [esp + 0x18]
inc edx
mov dword [0x101915c4], edx
mov byte [esp + 0x2c], 5
call fcn.101309cb
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x1001cf91
push eax
call fcn.101307a0
add esp, 4
mov ebp, dword [0x101915c8]
push 0x14
call fcn.1013c2df
mov dword [eax + 4], ebp
mov dword [eax + 0x10], ebx
mov dword [edi + 4], eax
mov dword [edi + 0xc], ebx
mov dword [eax], eax
mov edi, dword [edi + 4]
mov dword [edi + 8], edi
lea eax, [esi + 0x34]
mov byte [esp + 0x30], 8
push eax
call fcn.1001e860
add esp, 8
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x2c], 9
mov dword [esi], 0x1016a5f0
mov dword [esi + 4], 0x1016a5d8
mov eax, esi
pop edi
pop esi
mov dword [esp + 0x24], 0xffffffff
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret