joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f4267
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [0x70b00c], esi
jne 0x6f42be
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x6f2c6f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x70b00c], eax
cmp eax, esi
je 0x6fe4ec
push 0xffffffffffffffff
push dword [0x70b014]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x70b014]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [0x70b018], esi
jl 0x6fe50a
pop esi
leave
ret

Function at 0x6f4441
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x6f4498
call fcn.006f2712
xor eax, eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x6f4490
cmp ecx, 0xffffffff
je 0x6f4490
and dword [ebp - 4], eax
mov edx, 0x5a4d
cmp word [ecx], dx
jne 0x6f4489
mov edx, dword [ecx + 0x3c]
test edx, edx
jl 0x6f4489
cmp edx, 0x10000000
jae 0x6f4489
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x6fe892
mov dword [ebp - 4], 0xfffffffe
call fcn.006f2757
ret 4

Function at 0x6f681f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x70b004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, ecx
inc eax
cmp dword [esi + 0x2c], 0
jne 0x6f6933
push edi
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x105
push edi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x420], eax
cmp eax, edi
ja 0x6fed16
lea eax, [ebp - 0x41c]
push eax
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.006f21cb
test eax, eax
jl 0x6f6932
mov ecx, dword [ebp - 0x420]
cmp word [ebp + ecx*2 - 0x210], 0x5c
je 0x6f68c3
push 0x6f6994
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.006f2436
test eax, eax
jl 0x6f6932
push 0x6f6980
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.006f2436
test eax, eax
jl 0x6f6932
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x6fed20
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6f6970
push eax
call edi
push 0x6f695c
push dword [esi + 0x2c]
mov dword [esi + 0x30], eax
call edi
push 0x6f6948
push dword [esi + 0x2c]
mov dword [esi + 0x34], eax
call edi
cmp dword [esi + 0x30], 0
mov dword [esi + 0x38], eax
je 0x6f6940
cmp dword [esi + 0x34], 0
je 0x6f6940
test eax, eax
je 0x6f6940
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.006f20d4
leave
ret
mov eax, 0x8007007f
jmp 0x6f6932
Function at 0x6f71f8
Capabilities:
Identify system language via api

Disassembly:
push 0x2c
mov eax, 0x70608c
call fcn.006f39dd
lea ecx, [ebp - 0x34]
call fcn.006f6c55
and dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push eax
push 0
call fcn.006f758b
test eax, eax
jl 0x6f722c
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.006f72a7
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx esi, ax
mov eax, 0x409
mov edi, 0x6f7298
cmp ax, si
jne 0x6fe4b4
and esi, 0x3ff
push esi
push edi
lea eax, [ebp - 0x30]
push 8
push eax
call fcn.006f1451
add esp, 0x10
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.006f758b
mov esi, eax
test esi, esi
jl 0x6f7280
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.006f72a7
mov esi, eax
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
call fcn.006f760b
mov eax, esi
call fcn.006f2b9f
ret

Function at 0x6f791d
Capabilities:
Identify system language via api

Disassembly:
lea eax, [ebp - 0x30]
push eax
call esi
push 8
pop eax
push dword [ebp + 0x10]
mov word [ebp - 0x30], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x6fdc4f
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 0x82
lea edx, [ebp - 0x30]
push edx
push 0x6f7900
push eax
call dword [ecx + 0x10]
mov esi, eax
lea eax, [ebp - 0x30]
push eax
call edi
cmp esi, ebx
jl 0x6f79a8
push 1
lea ecx, [ebp - 0x20]
call fcn.006f79e3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x20]
push edx
push 0x6f78ec
push eax
call dword [ecx + 0x10]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
call edi
push eax
call fcn.006f71e0
cmp esi, ebx
jl 0x6f79a8
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push 3
movzx eax, ax
pop ecx
mov word [ebp - 0x20], cx
mov dword [ebp - 0x18], eax
jmp 0x6f7992
push 0x24
mov eax, 0x705c85
call fcn.006f26dd
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x20]
push eax
call esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
mov dword [ebp - 0x10], ebx
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp + 0xc], ebx
je 0x6f7854
push 1
lea ecx, [ebp - 0x20]
call fcn.006f79e3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x20]
push edx
push 0x6f3984
push eax
call dword [ecx + 0x10]
cmp eax, ebx
jl 0x6f79a6
push 3
pop eax
mov word [ebp - 0x20], ax
mov dword [ebp - 0x18], 0x409
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x20]
push edx
push 0x6f79d0
push eax
call dword [ecx + 0x10]
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.006f7455
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x20]
push eax
call edi
push eax
call fcn.006f71e0
mov eax, esi
call fcn.006f1390
ret 0xc
Function at 0x6f7b05
Capabilities:
Identify system language via api

Disassembly:
push 0x50
mov eax, 0x705fc0
call fcn.006f39dd
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor esi, esi
push esi
mov dword [ebp - 0x5c], ecx
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x54], esi
call fcn.006f7c2b
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x58]
mov ebx, eax
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x6f7b34
sub eax, ecx
sar eax, 1
mov edi, eax
je 0x6f7b63
movzx eax, word [ebx + esi*2]
push eax
call dword [sym.imp.msvcrt.dll_iswxdigit]
pop ecx
test eax, eax
je 0x6f7b5b
inc esi
cmp esi, edi
jb 0x6f7b46
cmp esi, edi
jb 0x6f7c0e
xor eax, eax
mov edx, ebx
test edi, edi
jbe 0x6f7c0e
cmp word [edx], 0x30
jne 0x6f7b7c
inc eax
inc edx
inc edx
cmp eax, edi
jb 0x6f7b6f
cmp eax, edi
jae 0x6f7c0e
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x6f7b89
sub eax, esi
sar eax, 1
cmp eax, 3
ja 0x6f7c0e
push 0x10
push 0
push edx
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
cmp cx, si
jne 0x6f7c03
movzx eax, ax
movzx eax, ax
push eax
push 0x6f7c18
lea eax, [ebp - 0x50]
push 0x20
push eax
call fcn.006f1451
mov ecx, dword [ebp - 0x5c]
add esp, 0x10
lea eax, [ebp - 0x50]
push eax
call fcn.006f6c60
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x58]
lea ecx, [ebp - 0x58]
call fcn.006f760b
mov eax, dword [ebp - 0x54]
call fcn.006f2b9f
ret 8
or esi, 0x400
movzx eax, si
jmp 0x6f7bc6
mov dword [ebp - 0x54], 0x80041001
jmp 0x6f7be9
Function at 0x6f7f3e
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x706a7d
call fcn.006f1350
mov dword [ebp - 0x1c], ecx
xor esi, esi
mov ebx, 0x8007000e
mov dword [ebp - 0x14], esi
cmp dword [ebp + 8], esi
je 0x6f8046
push 1
call fcn.006f227c
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x6f803c
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call esi
push dword [ebp + 8]
mov edi, eax
call esi
lea esi, [eax + edi + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.006f13e0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x6f7fcd
push dword [ebp - 0x18]
inc edi
push edi
push eax
call fcn.006f21cb
mov ebx, eax
test ebx, ebx
jl 0x6f8024
push dword [ebp + 8]
push esi
push dword [ebp - 0x14]
call fcn.006f2436
mov ebx, eax
test ebx, ebx
jl 0x6f8024
xor ebx, ebx
inc ebx
test ebx, ebx
jl 0x6f8024
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x6f7ff6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x6ff33c
xor ebx, ebx
inc ebx
test ebx, ebx
jl 0x6f8024
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x44], eax
cmp eax, 0xffffffff
je 0x6ff353
cmp dword [ebp - 0x14], 0
je 0x6f8033
push dword [ebp - 0x14]
call fcn.006f13c0
pop ecx
push dword [ebp - 0x18]
call fcn.006f13c0
pop ecx
mov eax, ebx
call fcn.006f1390
ret 4
mov ebx, 0x80070057
jmp 0x6f803c

Function at 0x6f85f1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x70b004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x44]
test eax, eax
je 0x6f8684
cmp eax, 0xffffffff
je 0x6f8684
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x6f8684
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
and dword [ebp - 0xc], 0
push ebx
call esi
push ebx
mov dword [ebp - 0x10], eax
call esi
lea esi, [eax + eax + 2]
mov eax, esi
call fcn.006f85b5
mov eax, esp
push esi
push ebx
push eax
call fcn.006f8692
mov esi, dword [ebp - 0x10]
mov edi, dword [edi + 0x44]
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x6ff2da
cmp esi, dword [ebp - 0xc]
jne 0x6ff2f6
mov eax, dword [ebp - 8]
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f20d4
leave
ret 4
mov dword [ebp - 8], 0x80070057
jmp 0x6f866d
Function at 0x6f88ef
Capabilities:
Get geographical location

Disassembly:
push 0x210
mov eax, 0x706be9
call fcn.006f20e6
xor eax, eax
push 0x1fe
mov word [ebp - 0x214], ax
xor ebx, ebx
lea eax, [ebp - 0x212]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
push 0x100
lea eax, [ebp - 0x214]
push eax
push 0x1001
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x214]
and esi, 0x3ff
push eax
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, 7
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.006f13e0
mov edi, eax
pop ecx
cmp edi, ebx
je 0x6f8999
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x21c]
push 0x6f89a4
push esi
push edi
call fcn.006f1451
add esp, 0x14
mov eax, edi
call fcn.006f2126
ret 4
Function at 0x700d7d
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [ecx + eax + 0x18]
test esi, esi
jbe 0x700dba
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x700db2
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x700dbc
inc edx
add eax, 0x28
cmp edx, esi
jb 0x700da2
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10004350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [ebp + 8]
mov word [ebp - 6], 0x7274
mov dword [ebp - 0xb], 0x20657479
mov byte [ebp - 4], 0
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x70
mov word [ebp - 0x15], 0x2064
mov word [ebp - 0x12], 0x7274
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x10], 0
mov word [ebp - 0x17], 0x726f
mov byte [ebp - 0x18], 0x77
mov dword [ebp - 0x22], 0x2064726f
mov word [ebp - 0x1d], 0x7274
mov byte [ebp - 0x1b], 0
mov word [ebp - 0x24], 0x7764
mov byte [ebp - 0x1e], 0x70
mov dword [ebp - 0x41], 0x727470
mov word [ebp - 0x44], 0x6574
mov word [ebp - 0x47], 0x625f
mov byte [ebp - 0x42], 0x20
mov byte [ebp - 0x48], 0x36
mov byte [ebp - 0x45], 0x79
mov word [ebp - 0x2a], 0x7470
mov word [ebp - 0x2d], 0x6472
mov word [ebp - 0x30], 0x7771
mov word [ebp - 0x28], 0x72
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2e], 0x6f
mov dword [ebp - 0x51], 0x65747962
mov dword [ebp - 0x4d], 0x72747020
mov word [ebp - 0x53], 0x5f30
mov byte [ebp - 0x49], 0
mov byte [ebp - 0x54], 0x31
mov word [ebp - 0x5a], 0x2044
mov dword [ebp - 0x60], 0x41564e49
mov word [ebp - 0x57], 0x5254
mov byte [ebp - 0x55], 0
mov word [ebp - 0x5c], 0x494c
mov byte [ebp - 0x58], 0x50
mov dword [ebp - 0x66], 0x54502044
mov dword [ebp - 0x6c], 0x41564e49
mov word [ebp - 0x68], 0x494c
mov word [ebp - 0x62], 0x52
mov dword [ebp - 0x36], 0x727470
mov word [ebp - 0x3b], 0x6f77
mov word [ebp - 0x38], 0x2064
mov byte [ebp - 0x3c], 0x6f
mov byte [ebp - 0x39], 0x72
cmp eax, 8
ja case.default.0x10004461
jmp dword [eax*4 + 0x100044a8]
lea eax, [ebp - 0xc]
jmp 0x10004493
lea eax, [ebp - 0x18]
jmp 0x10004493
lea eax, [ebp - 0x24]
jmp 0x10004493
lea eax, [ebp - 0x48]
jmp 0x10004493
lea eax, [ebp - 0x30]
jmp 0x10004493
lea eax, [ebp - 0x54]
jmp 0x10004493
lea eax, [ebp - 0x60]
jmp 0x10004493
lea eax, [ebp - 0x6c]
jmp 0x10004493
lea eax, [ebp - 0x3c]
push eax
push 0x104
push dword [ebp + 0xc]
call fcn.1000ef23
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x100044d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov word [ebp - 3], 0x73
mov byte [ebp - 4], 0x65
mov word [ebp - 8], 0x7363
mov byte [ebp - 6], 0
mov word [ebp - 0xc], 0x7373
mov byte [ebp - 0xa], 0
mov word [ebp - 0x10], 0x7364
mov byte [ebp - 0xe], 0
mov word [ebp - 0x13], 0x73
mov byte [ebp - 0x14], 0x66
mov word [ebp - 0x17], 0x73
mov byte [ebp - 0x18], 0x67
mov word [ebp - 0x1d], 0x524f
mov word [ebp - 0x20], 0x5245
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1b], 0
mov dword [ebp - 0x26], 0x524f52
mov word [ebp - 0x28], 0x5245
cmp eax, 7
ja case.default.0x1000453b
jmp dword [eax*4 + 0x10004580]
lea eax, [ebp - 4]
jmp 0x10004568
lea eax, [ebp - 8]
jmp 0x10004568
lea eax, [ebp - 0xc]
jmp 0x10004568
lea eax, [ebp - 0x10]
jmp 0x10004568
lea eax, [ebp - 0x14]
jmp 0x10004568
lea eax, [ebp - 0x18]
jmp 0x10004568
lea eax, [ebp - 0x20]
jmp 0x10004568
lea eax, [ebp - 0x28]
push eax
push 0x104
push dword [ebp + 0xc]
call fcn.1000ef23
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1000a060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x506c6175
push eax
mov dword [ebp - 0x14], 0x74726956
mov dword [ebp - 0xb], 0x6365746f
mov byte [ebp - 0xc], 0x72
mov dword [ebp - 7], 0x784574
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a0af
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov word [ebp - 0x10], 0x6956
push eax
mov dword [ebp - 0xd], 0x6c617574
mov dword [ebp - 7], 0x797265
mov word [ebp - 9], 0x7551
mov byte [ebp - 0xe], 0x72
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a107
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.100095f0
test eax, eax
je 0x1000a186
lea ecx, [ebp - 0x14]
mov dword [ebp - 6], 0x6f646e69
push ecx
push eax
mov dword [ebp - 0x14], 0x46746553
mov word [ebp - 2], 0x77
mov dword [ebp - 0xc], 0x6e756f72
mov dword [ebp - 0x10], 0x6765726f
mov word [ebp - 8], 0x5764
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.100095f0
test eax, eax
je 0x1000a793
lea ecx, [ebp - 0x14]
mov word [ebp - 0xb], 0x776f
push ecx
push eax
mov dword [ebp - 0x10], 0x6e695767
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 9], 0x6f546f54
mov word [ebp - 5], 0x70
mov byte [ebp - 0xc], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a7a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.100095f0
test eax, eax
je 0x1000a7e1
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xa], 0x57657669
push ecx
push eax
mov dword [ebp - 0x10], 0x41746553
mov dword [ebp - 5], 0x776f646e
mov word [ebp - 0xc], 0x7463
mov byte [ebp - 6], 0x69
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.100095f0
test eax, eax
je 0x1000a833
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xb], 0x776f646e
push ecx
push eax
mov word [ebp - 0x10], 0x6553
mov word [ebp - 6], 0x736f
mov word [ebp - 0xd], 0x6957
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 4], 0
mov byte [ebp - 7], 0x50
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1001bac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 0x104
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x10], 0
push 0
push eax
call fcn.1000c570
lea eax, [ebp - 0x28]
mov word [ebp - 2], 0x73
push eax
mov dword [ebp - 0xb], 0x5754464f
mov dword [ebp - 7], 0x5c455241
mov byte [ebp - 3], 0x25
mov byte [ebp - 0xc], 0x53
call fcn.1000ae90
add esp, 0x10
mov ecx, eax
call fcn.1000b4c0
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x12c]
push 0x104
push eax
call fcn.1000b650
add esp, 0x14
lea ecx, [ebp - 0x28]
call fcn.1000ae70
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x12c]
push eax
call fcn.1000ae40
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x1001bb50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x114
cmp eax, 1
jne 0x1001bc15
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call fcn.10009990
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x70707573
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0xd], 0x746e6174
push eax
mov dword [ebp - 4], 0x74726f
mov byte [ebp - 9], 0x20
mov word [ebp - 0x10], 0x6e69
mov byte [ebp - 0xe], 0x73
call fcn.10009e60
add esp, 0x14
test eax, eax
jne 0x1001bc44
push sym.drvhlp.dll_iw5ey9
push 0x1004a064
call fcn.1000a960
add esp, 8
test eax, eax
je 0x1001bc44
push sym.drvhlp.dll_lvkopa
push 0x1004a02c
call fcn.1000a960
add esp, 8
test eax, eax
je 0x1001bc44
push sym.drvhlp.dll_vhgw2s
push 0x1004a054
call fcn.1000a960
add esp, 8
test eax, eax
je 0x1001bc44
push sym.drvhlp.dll_t8p4ao
push 0x1004a050
call fcn.1000a960
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1001bc44
push 0x1004a064
call fcn.1001bec0
push 0x1004a02c
call fcn.1001bec0
push 0x1004a054
call fcn.1001bec0
push 0x1004a050
call fcn.1001bec0
add esp, 0x10
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100240af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x100240be
pop dword [ebp - 4]
mov eax, 0xa88f5564
sub eax, 0x988d14a6
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x19b88e98
sub dword [ebp - 0x14], 0xcb66494d
mov dword [ebp - 0x10], 0x133025c9
add dword [ebp - 0x10], 0x1f03267c
mov dword [ebp - 0xc], 0x838f6f64
add dword [ebp - 0xc], 0xc8bcd4ca
mov dword [ebp - 8], 0xd962cac7
sub dword [ebp - 8], 0xd962cac7
lea eax, [ebp - 0x14]
push eax
mov eax, 0x827a194c
sub eax, 0x727a0830
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x5a1d0f6a
sub dword [ebp - 0x14], 0xe5aaa614
mov dword [ebp - 0x10], 0x8a53d8c9
sub dword [ebp - 0x10], 0x48e77754
mov dword [ebp - 0xc], 0xb1c81e88
sub dword [ebp - 0xc], 0x4e58b21c
mov dword [ebp - 8], 0xf3e672eb
sub dword [ebp - 8], 0xf3e672eb
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x71c1d904
sub eax, 0x61c1c804
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3c894
push 0
call eax
mov ecx, 0xc28d0f9f
sub ecx, 0xc28cd59b
xor edx, edx
add edx, eax
mov esi, 0x10036a00
add esi, dword [ebp - 4]
mov ebx, 0xffe209f8
add ebx, 0x292d98c7
mov edi, dword [esi]
xor edi, ebx
mov dword [edx], edi
add edx, 4
add esi, 0xcebe2f22
add esi, 0x3141d0e2
loop 0x100241dc
add eax, 0xdae3
xor ebx, ebx
add ebx, eax
add eax, 0xbe6bca79
add eax, 0x4194358c
mov ecx, 0x1cc3092
sub ecx, 0xf1cc3092
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x1002e08f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100075dc]
jne 0x1002e6f5
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10032ca0], eax
mov dword [0x10032c9c], ecx
mov dword [0x10032c98], edx
mov dword [0x10032c94], ebx
mov dword [0x10032c90], esi
mov dword [0x10032c8c], edi
mov word [0x10032cb8], ss
mov word [0x10032cac], cs
mov word [0x10032c88], ds
mov word [0x10032c84], es
mov word [0x10032c80], fs
mov word [0x10032c7c], gs
pushfd
pop dword [0x10032cb0]
mov eax, dword [ebp]
mov dword [0x10032ca4], eax
mov eax, dword [ebp + 4]
mov dword [0x10032ca8], eax
lea eax, [ebp + 8]
mov dword [0x10032cb4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10032bf0], 0x10001
mov eax, dword [0x10032ca8]
mov dword [0x10032ba4], eax
mov dword [0x10032b98], 0xc0000409
mov dword [0x10032b9c], 1
mov eax, dword [0x100075dc]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10032ad8]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10032be8], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100075ec
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10032be8], 0
jne 0x1002e7e1
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret