joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411190
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x417a66
mov eax, dword fs:[0]
push eax
sub esp, 0x650
mov eax, dword [0x6945d4]
xor eax, esp
mov dword [esp + 0x64c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6945d4]
xor eax, esp
push eax
lea eax, [esp + 0x664]
mov dword fs:[0], eax
mov eax, dword [esp + 0x678]
mov ecx, dword [0x41c188]
mov dx, word [0x41c18c]
mov ebp, dword [esp + 0x674]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x260]
push eax
push 0x3ff
mov dword [esp + 0x58], ecx
mov word [esp + 0x5c], dx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4112e5
lea ebx, [esp + 0x260]
xor edi, edi
jmp 0x411220
mov cx, word [ebx]
push 0x104
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x58]
push eax
mov word [esp + 0x5c], cx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4112d1
xor ecx, ecx
mov eax, ebp
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], cx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x411260
sub eax, edx
sar eax, 1
push eax
push ebp
lea ecx, [esp + 0x20]
call fcn.00410b50
lea eax, [esp + 0x58]
mov dword [esp + 0x66c], edi
lea edx, [eax + 2]
jmp 0x411290
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x411290
sub eax, edx
sar eax, 1
push eax
push edi
lea edx, [esp + 0x60]
push edx
lea ecx, [esp + 0x24]
call fcn.00410720
mov esi, eax
cmp esi, 0xffffffff
jne 0x41130f
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x66c], eax
jb 0x4112d1
mov eax, dword [esp + 0x18]
push eax
call sub.QL_CR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov cx, word [ebx]
add ebx, 2
test cx, cx
jne 0x4112d1
cmp word [ebx], di
jne 0x411220
xor al, al
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64c]
xor ecx, esp
call fcn.00414820
add esp, 0x65c
ret
xor edx, edx
lea eax, [esp + 0x58]
mov word [esp + 0x34], dx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x411330
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x3c]
call fcn.00410b50
mov eax, ebx
mov byte [esp + 0x66c], 1
lea edx, [eax + 2]
jmp 0x411360
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x411360
mov ecx, dword [esp + 0x44]
sub eax, edx
sar eax, 1
push eax
push ebx
inc ecx
push ecx
push esi
lea ecx, [esp + 0x28]
call fcn.00410fb0
mov esi, 8
cmp dword [esp + 0x48], esi
jb 0x411399
mov edx, dword [esp + 0x34]
push edx
call sub.QL_CR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], esi
jae 0x4113a7
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x680]
push eax
push ecx
call dword [sym.imp.QL_CR100.dll_wcscpy_s]
add esp, 0xc
cmp dword [esp + 0x2c], esi
jb 0x4113d1
mov edx, dword [esp + 0x18]
push edx
call sub.QL_CR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
jmp 0x4112e7
Function at 0x414820
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6945d4]
jne 0x41482a
repz ret
jmp fcn.00414c8e

Function at 0x4151f0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push edi
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jne 0x41521a
or eax, 0xffffffff
pop edi
add esp, 0x14
ret 0x10
mov eax, dword [esp + 4]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
seto cl
push ebx
push esi
neg ecx
or ecx, eax
push ecx
call fcn.0041530c
mov esi, eax
mov eax, dword [esp + 0x10]
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 0
test eax, eax
jle 0x4152bb
mov eax, edi
sub eax, esi
push ebp
mov dword [esp + 0x18], eax
jmp 0x415264
mov eax, dword [esp + 0x18]
mov edi, dword [eax + esi]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
push ebx
call fcn.0041530c
add esp, 4
push 0
push 0
push ebx
mov ebp, eax
push ebp
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x14]
mov dword [esi], ebp
mov eax, dword [esp + 0x10]
inc ecx
add esi, 4
mov dword [esp + 0x14], ecx
cmp ecx, eax
jl 0x415260
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
pop ebp
push edi
mov dword [esi + eax*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0xc]
push esi
push eax
call fcn.00401140
xor edi, edi
add esp, 8
mov ebx, eax
cmp dword [esp + 0xc], edi
jle 0x4152f8
mov eax, dword [esi + edi*4]
test eax, eax
je 0x4152f8
push eax
call sub.QL_CR100.dll_void___cdecl_operator_delete___void__
inc edi
add esp, 4
cmp edi, dword [esp + 0xc]
jl 0x4152e1
push esi
call sub.QL_CR100.dll_void___cdecl_operator_delete___void__
add esp, 4
pop esi
mov eax, ebx
pop ebx
pop edi
add esp, 0x14
ret 0x10
Function at 0x14ab058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14ab1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x14ab07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x14ab06a
add dl, dl
jne 0x14ab089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x14ab0dc
xor eax, eax
add dl, dl
jne 0x14ab096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x14ab17d
add dl, dl
jne 0x14ab0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14ab0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14ab0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14ab0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x14ab0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x14ab075
mov eax, 1
add dl, dl
jne 0x14ab0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14ab0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x14ab0e1
sub eax, ebx
mov ebx, 1
jne 0x14ab128
mov ecx, 1
add dl, dl
jne 0x14ab10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14ab119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x14ab105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x14ab075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14ab13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14ab14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x14ab136
cmp eax, 0x7d00
jae 0x14ab16d
cmp eax, 0x500
jb 0x14ab168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x14ab075
cmp eax, 0x7f
ja 0x14ab170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x14ab075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x14ab19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x14ab075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x14eda20
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf65c1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], 1
test eax, eax
je 0x14edbe4
dec eax
mov dword [ebp + 8], eax
mov al, byte [edx]
inc edx
mov byte [ebp + esi - 0x14], al
inc esi
mov ah, byte [ebp - 0x12]
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 0xf], ah
mov byte [ebp - 0xd], ch
mov byte [ebp - 0xe], cl
cmp esi, 3
jne 0x14edb25
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
and ah, 0x3f
mov cl, ch
shr al, 6
and cl, 0xf
mov byte [ebp - 0x15], ah
shl cl, 2
add cl, al
xor esi, esi
mov byte [ebp - 0x16], cl
nop dword [eax + eax]
cmp dword [0xfa8b70], 0x10
mov ecx, 0xfa8b5c
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0xfa8b5c]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.014ee110
inc esi
cmp esi, 4
jl 0x14edaf0
mov edx, dword [ebp - 0x1c]
xor esi, esi
mov ch, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x14eda90
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x14edbe4
mov eax, 3
sub eax, esi
mov dword [ebp + 8], eax
cmp esi, 3
jge 0x14edb66
push eax
lea eax, [ebp - 0x14]
add eax, esi
push 0
push eax
call fcn.015bd6e0
mov dl, byte [ebp - 0x12]
add esp, 0xc
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
jmp 0x14edb69
mov dl, byte [ebp - 0xf]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shr al, 4
and ch, 0xf
shl cl, 4
add cl, al
shl ch, 2
mov al, dl
mov byte [ebp - 0x17], cl
shr al, 6
and dl, 0x3f
add ch, al
mov byte [ebp - 0x15], dl
lea eax, [esi + 1]
mov byte [ebp - 0x16], ch
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x14edbd0
xor esi, esi
cmp dword [0xfa8b70], 0x10
mov ecx, 0xfa8b5c
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0xfa8b5c]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.014ee110
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x14edba3
mov esi, dword [ebp - 0x1c]
cmp esi, 3
jge 0x14edbe4
push 0x3d
mov ecx, edi
call fcn.014ee110
sub dword [ebp + 8], 1
jne 0x14edbd5
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x14ef180
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf65e8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.015a3dfd
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x14ef226
push eax
push esi
call fcn.015a413e
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push 0xf904a0
call fcn.015a36e0
int3

Function at 0x14f5c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movaps xmm0, xmmword [0xf96640]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
movups xmmword [ebp - 0x2f], xmm0
mov dword [ebp - 0x1f], 0x2b273825
mov dword [ebp - 0x1b], 0x2425233e
mov byte [ebp - 0x17], 0
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x2f]
push eax
call fcn.0154bea0
mov byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x18
jb 0x14f5c90
mov dword [ebp - 0x16], 0x262e3e24
xor ecx, ecx
mov dword [ebp - 0x12], 0x262e6426
mov word [ebp - 0xe], 0x26
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x16]
push eax
call fcn.0154bea0
mov byte [ebp + ecx - 0x16], al
inc ecx
cmp ecx, 9
jb 0x14f5cc0
push ebx
push esi
push edi
lea eax, [ebp - 0x16]
push eax
push esi
call fcn.01710027
lea ecx, [ebp - 0x2f]
push ecx
push eax
call dword [0xf750cc]
mov ebx, eax
xor edi, edi
mov dword [ebp - 8], ebx
call fcn.016fa2a5
ret
Function at 0x14f5ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf6741d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 0
xor edx, edx
movaps xmm0, xmmword [0xf96500]
movups xmmword [ebp - 0x92], xmm0
mov word [ebp - 0x82], 0x3e
nop dword [eax]
nop dword [eax + eax]
movzx eax, byte [ebp + edx - 0x92]
push eax
call fcn.0154bea0
mov byte [ebp + edx - 0x92], al
inc edx
cmp edx, 0x11
jb 0x14f5f10
mov dword [ebp - 0x22], 0x262e3e24
xor ecx, ecx
mov dword [ebp - 0x1e], 0x262e6426
mov word [ebp - 0x1a], 0x26
movzx eax, byte [ebp + ecx - 0x22]
push eax
call fcn.0154bea0
mov byte [ebp + ecx - 0x22], al
inc ecx
cmp ecx, 9
jb 0x14f5f41
push esi
pop esi
call fcn.01773ef7
lea eax, [ebp - 0x22]
push edi
push eax
call esi
mov edi, dword [0xf750cc]
lea ecx, [ebp - 0x92]
push ecx
push eax
call edi
mov dword [ebp - 0x58], eax
xor ecx, ecx
mov dword [ebp - 0x3e], 0x3f1b3e04
mov dword [ebp - 0x3a], 0x533382f
mov dword [ebp - 0x36], 0x292f2028
mov word [ebp - 0x32], 0x3e
movzx eax, byte [ebp + ecx - 0x3e]
push eax
call fcn.0154bea0
mov byte [ebp + ecx - 0x3e], al
inc ecx
cmp ecx, 0xd
jb 0x14f5f94
mov dword [ebp - 0x2c], 0x262e3e24
xor ecx, ecx
mov dword [ebp - 0x28], 0x262e6426
mov word [ebp - 0x24], 0x26
nop
movzx eax, byte [ebp + ecx - 0x2c]
push eax
call fcn.0154bea0
mov byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 9
jb 0x14f5fc0
lea eax, [ebp - 0x2c]
push eax
call esi
lea ecx, [ebp - 0x3e]
push ecx
push eax
call edi
push dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
push 0
push 0x40
call fcn.0173550c
ret
Function at 0x14f6cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf67516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x18], 1
xor ecx, ecx
mov word [ebp - 0xf], 0x2838
mov byte [ebp - 0xd], 0
nop
movzx eax, byte [ebp + ecx - 0xf]
push eax
call fcn.0154bea0
mov byte [ebp + ecx - 0xf], al
inc ecx
cmp ecx, 2
jb 0x14f6d30
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xf]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.015c1550
mov edi, eax
add esp, 8
test edi, edi
je 0x14f6dcc
push 2
push 0
push edi
call fcn.015c5326
push edi
call fcn.015c10db
push 0
push 0
push edi
mov dword [ebp - 0x14], eax
call fcn.015c5326
mov ecx, dword [esi + 0x10]
add esp, 0x1c
mov eax, dword [ebp - 0x14]
cmp eax, ecx
ja 0x14f6da0
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x14f6d97
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov byte [ecx + eax], 0
jmp 0x14f6daf
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0154d100
mov eax, dword [ebp - 0x14]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x14f6db9
mov ecx, dword [esi]
push edi
push eax
push 1
push ecx
call fcn.015c9dcf
push edi
call fcn.015c4dd8
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.014ee090
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1500090
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call fcn.01738a1e

Function at 0x1500210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x10]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x10], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov ebx, dword [ebp - 8]
shr ebx, 0x1f
and bl, 1
mov dword [ebp - 0xd], 0x24382f21
mov dword [ebp - 9], 0x7879262f
xor ecx, ecx
mov dword [ebp - 5], 0x26262e64
mov byte [ebp - 1], 0
nop
movzx eax, byte [ebp + ecx - 0xd]
push eax
call fcn.0154bea0
mov byte [ebp + ecx - 0xd], al
inc ecx
cmp ecx, 0xc
jb 0x1500260
lea eax, [ebp - 0xd]
push eax
call fcn.016accda
ret
Function at 0x151e7b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0xf6c4d5
push eax
mov eax, 0x1468
mov dword fs:[0], esp
call fcn.015a6210
push esi
mov esi, ecx
push edi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 4], 1
lea ecx, [esi + 8]
push 0
mov byte [esi], 0
call fcn.0154c460
mov byte [ebp - 4], 1
sub esp, 8
mov dword [ebp - 0x5c], 1
mov eax, esp
lea ecx, [ebp - 0x6c]
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.01548ac0
add esp, 8
mov byte [ebp - 4], 3
xor ecx, ecx
mov dword [ebp - 0x28], 0x253e3f2b
mov dword [ebp - 0x24], 0x2626232c
mov byte [ebp - 0x20], 0
nop
movzx eax, byte [ebp + ecx - 0x28]
push eax
call fcn.0154bea0
mov byte [ebp + ecx - 0x28], al
inc ecx
cmp ecx, 8
jb 0x151e840
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0154f1b0
mov edi, eax
mov byte [ebp - 4], 4
mov dl, byte [edi]
mov cl, byte [ebp - 0x6c]
mov byte [edi], cl
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x60]
mov byte [ebp - 0x6c], dl
mov edx, dword [edi + 8]
mov esi, dword [edi + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
push dword [ebp - 0x6c]
call fcn.0154c140
push 0x104
lea eax, [ebp - 0x474]
push 0
push eax
call fcn.015bd6e0
add esp, 0xc
lea eax, [ebp - 0x474]
push eax
push 0
push 0
push 0x1a
push 0
call dword [0xf752e4]
lea eax, [ebp + 8]
push eax
lea edx, [ebp - 0x474]
lea ecx, [ebp - 0x1ac]
call fcn.0154ef10
add esp, 4
mov byte [ebp - 4], 5
xor ecx, ecx
mov dword [ebp - 0x44], 0x25383a16
mov dword [ebp - 0x40], 0x2f26232c
mov dword [ebp - 0x3c], 0x24236439
mov word [ebp - 0x38], 0x23
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x44]
push eax
call fcn.0154bea0
mov byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0xd
jb 0x151e900
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x1ac]
lea ecx, [ebp - 0x17c]
call fcn.0154ede0
add esp, 4
mov byte [ebp - 4], 6
lea eax, [ebp - 0x17c]
cmp dword [ebp - 0x168], 0x10
cmovae eax, dword [ebp - 0x17c]
push eax
push 0x1000
lea eax, [ebp - 0x1474]
push eax
call fcn.0179316e
Function at 0x151f460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0xf6c6f0
push eax
mov eax, 0x14f0
mov dword fs:[0], esp
call fcn.015a6210
push esi
mov esi, ecx
push edi
mov dword [ebp - 0xe8], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
lea ecx, [esi + 8]
push 0
mov byte [esi], 0
call fcn.0154c460
mov byte [ebp - 4], 1
sub esp, 8
mov dword [ebp - 0x14], 1
mov eax, esp
lea ecx, [ebp - 0x7c]
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.01548ac0
add esp, 8
mov byte [ebp - 4], 3
xor ecx, ecx
movaps xmm0, xmmword [0xf96890]
movups xmmword [ebp - 0xdc], xmm0
mov byte [ebp - 0xcc], 0
movzx eax, byte [ebp + ecx - 0xdc]
push eax
call fcn.0154bea0
mov byte [ebp + ecx - 0xdc], al
inc ecx
cmp ecx, 0x10
jb 0x151f4f1
lea eax, [ebp - 0xdc]
mov ecx, esi
push eax
call fcn.0154f1b0
mov edi, eax
mov byte [ebp - 4], 4
mov dl, byte [edi]
mov cl, byte [ebp - 0x7c]
mov byte [edi], cl
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
mov byte [ebp - 0x7c], dl
mov edx, dword [edi + 8]
mov esi, dword [edi + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x70], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
push dword [ebp - 0x7c]
call fcn.0154c140
push 0x104
lea eax, [ebp - 0x4fc]
push 0
push eax
call fcn.015bd6e0
add esp, 0xc
lea eax, [ebp - 0x4fc]
push eax
push 0
push 0
push 0x1a
push 0
call dword [0xf752e4]
lea eax, [ebp + 8]
push eax
lea edx, [ebp - 0x4fc]
lea ecx, [ebp - 0x27c]
call fcn.0154ef10
add esp, 4
mov byte [ebp - 4], 5
xor ecx, ecx
mov dword [ebp - 0x40], 0x25383a16
mov dword [ebp - 0x3c], 0x2f26232c
mov dword [ebp - 0x38], 0x24236439
mov word [ebp - 0x34], 0x23
movzx eax, byte [ebp + ecx - 0x40]
push eax
call fcn.0154bea0
mov byte [ebp + ecx - 0x40], al
inc ecx
cmp ecx, 0xd
jb 0x151f5b5
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x27c]
lea ecx, [ebp - 0x208]
call fcn.0154ede0
add esp, 4
mov byte [ebp - 4], 6
lea eax, [ebp - 0x208]
cmp dword [ebp - 0x1f4], 0x10
cmovae eax, dword [ebp - 0x208]
push eax
push 0x1000
lea eax, [ebp - 0x14fc]
push eax
call fcn.016eea88
ret
Function at 0x154bec0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf70d80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov byte [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov byte [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov byte [ecx + 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x154c9e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf70e7d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0x10], eax
call fcn.0154de80
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea esi, [eax + 8]
mov dword [eax + 0x2c], edx
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea edi, [eax + 0x14]
mov dword [eax], 0xf75d94
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], 0
mov eax, dword [0xfab510]
mov ecx, dword [0xfab514]
mov dword [edx + 0x40], eax
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret