joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1001ea91
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov al, 0x45
push ebx
mov byte [esp + 5], al
mov byte [esp + 8], al
mov al, 0x6c
push esi
mov esi, ecx
mov byte [esp + 0x12], al
mov byte [esp + 0x13], al
mov byte [esp + 0x23], al
mov al, 0x65
mov cl, 0x74
mov byte [esp + 0x24], al
mov byte [esp + 0x28], al
mov byte [esp + 0x1b], cl
mov byte [esp + 0x2a], cl
lea eax, [esp + 0x18]
push edi
lea ecx, [esp + 0xc]
xor ebx, ebx
mov dl, 0x69
push eax
push ecx
mov byte [esi + 0x10], bl
mov byte [esp + 0x14], 0x4b
mov byte [esp + 0x16], 0x52
mov byte [esp + 0x17], 0x4e
mov byte [esp + 0x19], 0x4c
mov byte [esp + 0x1a], 0x33
mov byte [esp + 0x1b], 0x32
mov byte [esp + 0x1c], 0x2e
mov byte [esp + 0x1d], 0x64
mov byte [esp + 0x20], bl
mov byte [esp + 0x24], 0x57
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], dl
mov byte [esp + 0x28], 0x46
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], 0x53
mov byte [esp + 0x2c], dl
mov byte [esp + 0x2d], 0x6e
mov byte [esp + 0x2e], 0x67
mov byte [esp + 0x31], 0x4f
mov byte [esp + 0x32], 0x62
mov byte [esp + 0x33], 0x6a
mov byte [esp + 0x35], 0x63
mov byte [esp + 0x37], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
push edx
call eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0xa8]
cmp ecx, ebx
je 0x10010c3d
mov edx, dword [ecx]
push 1
call dword [edx]
mov edi, dword [esp + 0x40]
cmp edi, 3
jne 0x10010c6e
push 0x110
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x40], eax
cmp eax, ebx
mov dword [esp + 0x38], ebx
je 0x10010cc4
push 0x64
push 1
push 4
mov ecx, eax
call fcn.10011590
jmp 0x10010cc6
cmp edi, 7
push 0x110
jne 0x10010c9f
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x40], eax
cmp eax, ebx
mov dword [esp + 0x38], 1
je 0x10010cc4
push 0x64
push 1
push 8
mov ecx, eax
call fcn.10011590
jmp 0x10010cc6
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x40], eax
cmp eax, ebx
mov dword [esp + 0x38], 2
je 0x10010cc4
push 0x64
push ebx
push edi
mov ecx, eax
call fcn.10011590
jmp 0x10010cc6
xor eax, eax
mov dword [esi + 0xa8], eax
mov ecx, dword [esi + 0xa8]
xor eax, eax
mov dword [esp + 0x38], 0xffffffff
mov al, byte [esi + 0x13]
push eax
call fcn.10011d00
mov cl, byte [esi + 0x14]
push ecx
mov ecx, dword [esi + 0xa8]
call fcn.10012050
push 1
push ebx
push ebx
push esi
push 0x10011070
push ebx
push ebx
mov dword [esi + 0x18], edi
mov byte [esi + 0x10], 1
call fcn.10013380
mov ecx, dword [esp + 0x4c]
add esp, 0x1c
mov dword [esi + 0x1c], eax
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret 4
Function at 0x10011a00
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, ecx
je 0x10011bda
cmp dword [esi + 0x1c], edi
je 0x10011bda
call fcn.100120b0
lea ebp, [esi + 4]
push 1
push ebp
mov ecx, esi
mov dword [esi + 0x20], edi
call fcn.10011e90
lea eax, [esp + 0x14]
push eax
call dword [0x10003d4c]
lea ecx, [esp + 0x14]
push 8
push ecx
mov ecx, esi
call fcn.10011e90
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x14
push edx
call dword [0x10003d50]
test eax, eax
je 0x10011abe
cmp dword [esp + 0x20], 1
jne 0x10011abe
mov ecx, dword [esp + 0x24]
lea eax, [esi + 0xcc]
cmp ecx, dword [eax]
je 0x10011a83
inc edi
add eax, 4
cmp edi, 0x10
jl 0x10011a76
push 0x10001bf0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
push 0x10001be0
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esp + 0x24]
push eax
call dword [0x10003d54]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, 0x10
jne 0x10011ab6
or edi, 0xffffffff
mov ebx, dword [esp + 0x34]
mov eax, edi
jmp 0x10011ac1
or eax, 0xffffffff
lea ecx, [esp + 0x13]
push 1
push ecx
mov ecx, esi
mov byte [esp + 0x1b], al
call fcn.10011e90
cmp byte [ebp], 2
jne 0x10011b29
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x44]
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
push edx
mov edx, dword [esi + 0x80]
push eax
push ecx
push edx
mov ecx, esi
call fcn.100120f0
mov eax, dword [esi + 0x68]
mov edx, dword [esi + 0x20]
mov ecx, dword [eax + 0x14]
mov eax, dword [esi + 0x1c]
add edx, eax
mov eax, dword [esi + 0x60]
push ecx
mov ecx, dword [esi + 0x78]
push edx
push eax
push ecx
mov ecx, esi
call fcn.10012160
mov ecx, dword [esi + 0x20]
pop edi
add eax, ecx
mov dword [ebx], eax
mov eax, dword [esi + 0x1c]
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
mov ebp, dword [esp + 0x18]
xor edx, edx
lea eax, [ebp - 0x13]
test eax, eax
setl dl
dec edx
and edx, eax
mov eax, dword [0x100208b8]
cmp ebp, eax
mov edi, edx
je 0x10011b56
push edi
mov ecx, esi
call fcn.10011bf0
test al, al
je 0x10011b56
add edi, 0x13
jmp 0x10011b59
mov edi, dword [esi + 0x30]
cmp edi, dword [esi + 0x2c]
jge 0x10011b77
push edi
mov ecx, esi
call fcn.10011bf0
test al, al
je 0x10011b6d
add edi, 0x13
mov eax, dword [esi + 0x2c]
add edi, 0x13
cmp edi, eax
jl 0x10011b5e
mov eax, dword [esp + 0x18]
mov ecx, 0x13
mov dword [0x100208b8], eax
mov eax, dword [esi + 0x30]
add eax, 3
lea edi, [esi + 0x14]
cdq
idiv ecx
mov dword [esi + 0x30], edx
mov edx, dword [esi + 0x20]
mov dword [ebx], edx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edx, dword [edi]
mov ecx, dword [esi + 0x18]
sub eax, edx
cmp eax, ecx
jae 0x10011bc3
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call ebp
call ebx
mov edx, dword [edi]
mov ecx, dword [esi + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x10011bb2
call ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
Function at 0x100125d0
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x1001eb28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x10003ed4
mov edi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
mov dword [esp + 0x44], 0
call edi
mov eax, dword [0x100208bc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
push 0x10001d18
push eax
call ebx
mov ecx, dword [esi + 0x28]
push 0
mov ebp, eax
push ecx
call ebp
push 0x30
call edi
mov edx, dword [0x100208bc]
add esp, 4
push 0x10001d04
push edx
call ebx
mov ecx, dword [esi + 0x20]
push 0
push ecx
call eax
push 0x30
call edi
mov edx, dword [esi + 0x24]
add esp, 4
push 0
push edx
call ebp
push 0x30
call edi
mov al, 0x45
mov dl, 0x69
mov byte [esp + 0x19], al
mov byte [esp + 0x1c], al
mov al, 0x6c
mov cl, 0x74
mov byte [esp + 0x22], al
mov byte [esp + 0x23], al
mov byte [esp + 0x33], al
mov al, 0x65
add esp, 4
mov byte [esp + 0x14], 0x4b
mov byte [esp + 0x16], 0x52
mov byte [esp + 0x17], 0x4e
mov byte [esp + 0x19], 0x4c
mov byte [esp + 0x1a], 0x33
mov byte [esp + 0x1b], 0x32
mov byte [esp + 0x1c], 0x2e
mov byte [esp + 0x1d], 0x64
mov byte [esp + 0x20], 0
mov byte [esp + 0x24], 0x57
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], dl
mov byte [esp + 0x27], cl
mov byte [esp + 0x28], 0x46
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], 0x53
mov byte [esp + 0x2c], dl
mov byte [esp + 0x2d], 0x6e
mov byte [esp + 0x2e], 0x67
mov byte [esp + 0x30], al
mov byte [esp + 0x31], 0x4f
mov byte [esp + 0x32], 0x62
mov byte [esp + 0x33], 0x6a
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x63
mov byte [esp + 0x36], cl
lea eax, [esp + 0x24]
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x3f], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call ebx
mov edx, dword [esi + 0x2c]
push 0x7d0
push edx
call eax
push 0x30
call edi
mov eax, dword [esi + 0x2c]
add esp, 4
push 0
push eax
call ebp
mov ecx, dword [0x100208bc]
push 0x10001cf0
push ecx
call ebx
mov edi, eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x10012748
push eax
call edi
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10012752
push eax
call edi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1001275c
push eax
call edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10012766
push eax
call edi
mov edx, dword [0x100208bc]
push 0x10001ce4
push edx
call ebx
mov edi, eax
mov eax, dword [esi + 0x10]
push eax
call edi
mov ecx, dword [esi + 0x14]
push ecx
call edi
mov edx, dword [esi + 0x18]
push edx
call edi
mov eax, dword [esi + 0x1c]
push eax
call edi
mov ecx, dword [esi + 0x20]
push ecx
call edi
mov edx, dword [esi + 0x24]
push edx
call edi
mov eax, dword [esi + 0x2c]
push eax
call edi
mov ecx, dword [esi + 0x28]
push ecx
call edi
mov edx, dword [0x100208bc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, esi
mov dword [esp + 0x40], 0xffffffff
call fcn.1000f190
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x10012b80
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
xor esi, esi
test ebx, ebx
mov dword [esp + 0xc], edi
jbe 0x10012bc8
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [esi + ebp]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, ebx
jb 0x10012b99
mov edi, dword [esp + 0x10]
pop ebp
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
call fcn.10012b20
mov ecx, edi
call fcn.10012b50
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x10013380
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x20]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], 0x6e
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], 0x6c
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x33], 0x6c
mov byte [esp + 0x34], 0
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 0x6e
mov byte [esp + 0x22], 0x74
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov edx, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
push 0
mov dword [esp + 0x44], edx
mov dl, byte [esp + 0x84]
push 0
push 0
push 0
mov dword [esp + 0x54], ecx
mov byte [esp + 0x58], dl
call eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x7c]
lea edx, [esp + 0x40]
push eax
mov eax, dword [esp + 0x70]
push ecx
mov ecx, dword [esp + 0x70]
push edx
push 0x10013300
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov ebp, eax
mov byte [esp + 0x30], 0x4b
mov byte [esp + 0x31], 0x45
mov byte [esp + 0x32], 0x52
mov byte [esp + 0x33], 0x4e
mov byte [esp + 0x34], 0x45
mov byte [esp + 0x35], 0x4c
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], 0x6c
mov byte [esp + 0x3c], 0
mov byte [esp + 0x50], 0x57
mov byte [esp + 0x51], 0x61
mov al, 0x69
lea edx, [esp + 0x50]
mov byte [esp + 0x52], al
mov byte [esp + 0x58], al
lea eax, [esp + 0x30]
push edx
push eax
mov byte [esp + 0x5b], 0x74
mov byte [esp + 0x5c], 0x46
mov byte [esp + 0x5d], 0x6f
mov byte [esp + 0x5e], 0x72
mov byte [esp + 0x5f], 0x53
mov byte [esp + 0x61], 0x6e
mov byte [esp + 0x62], 0x67
mov byte [esp + 0x63], 0x6c
mov byte [esp + 0x64], bl
mov byte [esp + 0x65], 0x4f
mov byte [esp + 0x66], 0x62
mov byte [esp + 0x67], 0x6a
mov byte [esp + 0x68], bl
mov byte [esp + 0x69], 0x63
mov byte [esp + 0x6a], 0x74
mov byte [esp + 0x6b], 0
call esi
push eax
call edi
mov ecx, dword [esp + 0x4c]
push 0xffffffffffffffff
push ecx
call eax
mov edx, dword [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x10013700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x4c
mov al, 0x70
push ebx
mov cl, 0x68
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [esp + 0x45], al
mov byte [esp + 0x4b], al
push esi
mov byte [esp + 0x46], cl
mov byte [esp + 0x51], cl
lea eax, [esp + 0x3c]
push edi
lea ecx, [esp + 0x10]
mov bl, 0x6c
mov dl, 0x61
push eax
push ecx
mov byte [esp + 0x18], 0x4b
mov byte [esp + 0x19], 0x45
mov byte [esp + 0x1a], 0x52
mov byte [esp + 0x1b], 0x4e
mov byte [esp + 0x1c], 0x45
mov byte [esp + 0x1d], 0x4c
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0
mov byte [esp + 0x48], 0x43
mov byte [esp + 0x49], 0x72
mov byte [esp + 0x4a], 0x65
mov byte [esp + 0x4b], dl
mov byte [esp + 0x4c], 0x74
mov byte [esp + 0x4d], 0x65
mov byte [esp + 0x4e], 0x54
mov byte [esp + 0x4f], 0x6f
mov byte [esp + 0x50], 0x6f
mov byte [esp + 0x51], bl
mov byte [esp + 0x53], 0x65
mov byte [esp + 0x54], bl
mov byte [esp + 0x56], 0x33
mov byte [esp + 0x57], 0x32
mov byte [esp + 0x58], 0x53
mov byte [esp + 0x59], 0x6e
mov byte [esp + 0x5a], dl
mov byte [esp + 0x5c], 0x73
mov byte [esp + 0x5e], 0x6f
mov byte [esp + 0x5f], 0x74
mov byte [esp + 0x60], 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 2
call eax
push 0x128
mov edi, eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [esi], 0x128
mov byte [esp + 0x20], 0x4b
mov byte [esp + 0x21], 0x45
mov byte [esp + 0x22], 0x52
mov byte [esp + 0x23], 0x4e
mov byte [esp + 0x24], 0x45
mov byte [esp + 0x25], 0x4c
mov byte [esp + 0x26], 0x33
mov byte [esp + 0x27], 0x32
mov byte [esp + 0x28], 0x2e
mov byte [esp + 0x29], 0x64
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0
mov byte [esp + 0x30], 0x50
mov byte [esp + 0x31], 0x72
mov byte [esp + 0x32], 0x6f
mov byte [esp + 0x33], 0x63
mov byte [esp + 0x34], 0x65
lea edx, [esp + 0x30]
lea eax, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x3d], 0x73
mov byte [esp + 0x3e], 0x73
mov byte [esp + 0x3f], 0x33
mov byte [esp + 0x40], 0x32
mov byte [esp + 0x41], 0x46
mov byte [esp + 0x42], 0x69
mov byte [esp + 0x43], 0x72
mov byte [esp + 0x44], 0x73
mov byte [esp + 0x45], 0x74
mov byte [esp + 0x46], 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push edi
call eax
test eax, eax
je 0x100138e1
mov ebp, dword [esp + 0x60]
lea ebx, [esi + 0x24]
push ebp
push ebx
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
jne 0x100138bf
mov eax, dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
push esi
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x100138e1
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100138b4
push esi
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100138ca
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret
Function at 0x100138f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x54
mov al, 0x73
mov cl, 0x69
mov byte [esp + 0x42], al
mov byte [esp + 0x43], al
mov al, 0x6e
push ebx
mov byte [esp + 0x4a], al
mov byte [esp + 0x4c], al
mov byte [esp + 0x55], al
push ebp
mov byte [esp + 0x4c], cl
mov byte [esp + 0x57], cl
lea eax, [esp + 0x40]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp + 0x14]
xor ebx, ebx
push eax
push ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x1c], 0x57
mov byte [esp + 0x1d], 0x54
mov byte [esp + 0x1e], 0x53
mov byte [esp + 0x1f], 0x41
mov byte [esp + 0x20], 0x50
mov byte [esp + 0x21], 0x49
mov byte [esp + 0x22], 0x33
mov byte [esp + 0x23], 0x32
mov byte [esp + 0x24], 0x2e
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x26], 0x6c
mov byte [esp + 0x27], 0x6c
mov byte [esp + 0x28], bl
mov byte [esp + 0x4c], 0x57
mov byte [esp + 0x4d], 0x54
mov byte [esp + 0x4e], 0x53
mov byte [esp + 0x4f], 0x51
mov byte [esp + 0x50], 0x75
mov byte [esp + 0x51], 0x65
mov byte [esp + 0x52], 0x72
mov byte [esp + 0x53], 0x79
mov byte [esp + 0x54], 0x53
mov byte [esp + 0x55], 0x65
mov byte [esp + 0x59], 0x6f
mov byte [esp + 0x5b], 0x49
mov byte [esp + 0x5d], 0x66
mov byte [esp + 0x5e], 0x6f
mov byte [esp + 0x5f], 0x72
mov byte [esp + 0x60], 0x6d
mov byte [esp + 0x61], 0x61
mov byte [esp + 0x62], 0x74
mov byte [esp + 0x64], 0x6f
mov byte [esp + 0x66], 0x41
mov byte [esp + 0x67], bl
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
lea edx, [esp + 0x10]
lea ecx, [esp + 0xc]
push edx
push ecx
push 5
push 0xffffffffffffffff
push ebx
call eax
test eax, eax
je 0x10013abf
push esi
push 0x100
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x30], 0x57
mov byte [esp + 0x31], 0x54
mov byte [esp + 0x32], 0x53
mov byte [esp + 0x33], 0x41
mov byte [esp + 0x34], 0x50
mov byte [esp + 0x35], 0x49
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], 0x6c
mov byte [esp + 0x3c], bl
mov byte [esp + 0x40], 0x57
mov byte [esp + 0x41], 0x54
mov byte [esp + 0x42], 0x53
mov byte [esp + 0x43], 0x46
mov byte [esp + 0x44], 0x72
mov byte [esp + 0x45], 0x65
mov byte [esp + 0x46], 0x65
mov byte [esp + 0x47], 0x4d
mov byte [esp + 0x48], 0x65
mov byte [esp + 0x49], 0x6d
mov byte [esp + 0x4a], 0x6f
mov byte [esp + 0x4b], 0x72
mov byte [esp + 0x4c], 0x79
mov byte [esp + 0x4d], bl
call edi
push eax
call ebp
mov edx, dword [esp + 0x10]
push edx
call eax
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x54
ret
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x54
ret
Function at 0x10013f90
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x10013fda
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
jne 0x10013fda
pop edi
pop esi
add esp, 0x9c
ret
cmp dword [esp + 0xc], 5
jne 0x10013ff7
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10013ff7
call fcn.10013ad0
pop edi
pop esi
add esp, 0x9c
ret
call fcn.100138f0
pop edi
pop esi
add esp, 0x9c
ret
Function at 0x10014330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp + 0x20]
mov bl, 0x72
mov dl, 0x6e
push eax
push ecx
mov dword [esi], 0x10003ef4
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], 0
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], bl
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
push 0x10001ae4
mov ebx, eax
call edi
push 0
push 0
push 0
push 0
mov dword [0x100208d0], eax
call ebx
xor ebx, ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.10014580
test al, al
je 0x10014481
mov al, byte [0x100208cc]
test al, al
jne 0x10014481
mov edx, dword [0x100208d0]
push 0x10001e28
push edx
call ebp
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x80000000
push 0x1001fea0
push 0x10001e20
push ebx
call eax
mov ebx, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
mov dword [esi + 0x10], eax
call ebx
add esp, 4
push 0x10001e10
call edi
mov edi, eax
push 0x10001df8
push edi
call ebp
mov ecx, dword [esi + 0x10]
push 0
push ecx
push 0
push 0
push 0
push 0
push 0x50000000
push 0x10001dec
call eax
push 0x30
mov dword [esi + 0x14], eax
call ebx
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x100146c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
push eax
call dword [0x10003d30]
test eax, eax
je 0x100146e7
mov ecx, dword [esi + 0x14]
push 0
push 0
push 0x43d
push ecx
call dword [0x10003d98]
mov al, 0x45
mov dl, 0x69
mov byte [esp + 5], al
mov byte [esp + 8], al
mov al, 0x6c
mov byte [esp + 0x16], dl
mov byte [esp + 0xe], al
mov byte [esp + 0xf], al
mov byte [esp + 0x1f], al
mov al, 0x65
mov byte [esp + 0x1c], dl
mov byte [esp + 0x20], al
mov byte [esp + 0x24], al
lea edx, [esp + 0x14]
lea eax, [esp + 4]
mov cl, 0x74
push edx
push eax
mov byte [esp + 0xc], 0x4b
mov byte [esp + 0xe], 0x52
mov byte [esp + 0xf], 0x4e
mov byte [esp + 0x11], 0x4c
mov byte [esp + 0x12], 0x33
mov byte [esp + 0x13], 0x32
mov byte [esp + 0x14], 0x2e
mov byte [esp + 0x15], 0x64
mov byte [esp + 0x18], 0
mov byte [esp + 0x1c], 0x57
mov byte [esp + 0x1d], 0x61
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], 0x46
mov byte [esp + 0x21], 0x6f
mov byte [esp + 0x22], 0x72
mov byte [esp + 0x23], 0x53
mov byte [esp + 0x25], 0x6e
mov byte [esp + 0x26], 0x67
mov byte [esp + 0x29], 0x4f
mov byte [esp + 0x2a], 0x62
mov byte [esp + 0x2b], 0x6a
mov byte [esp + 0x2d], 0x63
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esi + 4]
push 0xbb8
push ecx
call eax
test eax, eax
jne 0x100147b9
mov eax, dword [esi + 0xc]
pop esi
add esp, 0x24
ret
xor eax, eax
pop esi
add esp, 0x24
ret