joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429564
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
sub eax, dword [esp + 0x10]
sar eax, 2
push edi
mov edi, dword [esp + 0x20]
test eax, eax
je 0x42963c
push ebx
xor ebx, ebx
push esi
mov esi, ebx
cmp dword [esp + 0x2c], ebx
jbe 0x42963a
push ebp
mov dword [esp + 0x10], ebx
mov ebp, 0x4817e0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov al, byte [edi + esi]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
push str.Own_head
push ebp
mov byte [edi + esi], al
call fcn.0040146b
push eax
call fcn.004027a6
mov al, byte [edi + esi]
add al, 0x4e
xor al, 0xdc
push str.Earth
push ebp
mov byte [edi + esi], al
call fcn.0040146b
push eax
call fcn.004027a6
mov al, byte [edi + esi]
xor al, 0xac
sub al, 0x65
xor al, 0x22
sub al, 0x73
push 0x42a594
mov byte [edi + esi], al
call fcn.00410dee
add esp, 0x1c
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
push ebx
call fcn.00401b63
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
xor byte [edi + esi], al
mov eax, dword [esp + 0x18]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.00401a43
inc esi
mov dword [esp + 0x18], ebx
pop ecx
pop ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp esi, dword [esp + 0x30]
jb 0x4295a1
pop ebp
pop esi
pop ebx
lea ecx, [esp + 0x14]
call fcn.004058b0
pop edi
add esp, 0xc
ret 0x14

Function at 0x42964c
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x429668
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x401000
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
mov eax, dword [0x403004]
xor eax, esp
mov dword [esp + 0x1a8], eax
push esi
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x403380], eax
mov eax, 2
push str.127.0.0.1
mov word [esp + 0xc], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x7e7
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov esi, dword [sym.imp.WS2_32.dll_connect]
mov word [esp + 0xa], ax
nop dword [eax + eax]
push 0x10
lea eax, [esp + 0xc]
push eax
push dword [0x403380]
call esi
cmp eax, 0xffffffff
je 0x401070
mov ecx, dword [esp + 0x1ac]
pop esi
xor ecx, esp
call fcn.004010bf
mov esp, ebp
pop ebp
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x344c1f95
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x689175e4
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4027c2
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
push 0xffffffffffffffff
mov ebp, esp
push 0x403100
push 0x402780
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x40514c], 0xffffffff
or dword [0x405150], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x405148]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x405144]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
nop
nop
mov eax, dword [eax]
nop
mov dword [0x405154], eax
nop
nop
cmp dword [0x4040b0], ebx
jne 0x402682
push 0x40277c
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0040276a
push 0x40400c
push 0x404008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x405140]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x40513c]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x404004
push section..d
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x402715
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x4026e9
cmp al, 0x22
jne 0x4026db
cmp byte [esi], 0x22
jne 0x4026f2
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x4026fc
cmp al, 0x20
jbe 0x4026ee
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x402720
movzx eax, word [ebp - 0x2c]
jmp 0x402723
cmp byte [esi], 0x20
jbe 0x4026f2
inc esi
mov dword [ebp - 0x74], esi
jmp 0x402715
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.004015d1
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
pushal
call 0x4027c8
pop ebx
mov bx, 0x4010
push 0x24
pop ecx
mov eax, dword [ebx]
xor eax, 0x3c3c3c3c
mov dword [ebx], eax
add ebx, 4
loop 0x4027d0
popal
jmp 0x4025ff

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40181e
Capabilities:
Create directory

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
push str.SHGetSpecialFolderPathW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401842
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x4018cb
push 0
push 0x1c
push ebx
push 0
call eax
test eax, eax
je 0x401834
push esi
push 0x41a7ac
push ebx
call fcn.00404b50
mov dword [esp], 0x41a7ac
lea esi, [eax + 1]
call fcn.00404b50
pop ecx
add eax, esi
push eax
push ebx
call fcn.00404adb
add esp, 0xc
push str.Applet
push ebx
call fcn.00404b50
mov dword [esp], str.Applet
lea esi, [eax + 1]
call fcn.00404b50
pop ecx
add eax, esi
push eax
push ebx
call fcn.00404adb
add esp, 0xc
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
test eax, eax
jne 0x4018bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401834
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call fcn.00404b50
pop ecx
pop edi
pop ebx
ret

Function at 0x4018ce
Capabilities:
Set current directory

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
xor eax, eax
push str.shell32.dll
mov word [edi], ax
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x401933
mov edx, eax
mov ecx, edi
call fcn.0040181e
test eax, eax
je 0x401933
cmp eax, 0x103
ja 0x401933
push esi
mov ecx, edi
call fcn.0040162f
pop ecx
test eax, eax
jne 0x401912
push 2
pop eax
jmp 0x401936
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x40192f
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
call fcn.004011fb
pop ecx
push 3
jmp 0x40190f
xor eax, eax
jmp 0x401936
xor eax, eax
inc eax
pop edi
pop esi
pop ecx
ret
Function at 0x402fb7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4014
call fcn.004135a0
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
lea edi, [esi + 0x10]
cmp ebx, 0x1c
jb 0x40310c
cmp dword [esi], 0x80000001
jne 0x40310c
and dword [ebp - 0x4010], 0
cmp dword [esi + 4], 0
jbe 0x4030fb
mov ecx, dword [edi]
jmp 0x403009
cmp byte [esi + ecx], 0
je 0x403013
inc ecx
mov dword [ebp - 0x400c], ecx
cmp ebx, ecx
ja 0x403002
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
cmp ebx, eax
jb 0x40310c
cmp ebx, ecx
je 0x40310c
xor eax, eax
push 0x2000
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x2004]
push eax
call fcn.00404300
mov eax, dword [edi]
mov ecx, 0x1000
and dword [ebp - 0x4008], 0
add eax, esi
push ecx
push eax
push ecx
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x4008]
push eax
call fcn.00407945
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x4004]
push 0x1000
push eax
call fcn.00404adb
add esp, 0x2c
xor eax, eax
push eax
push 0x8000080
push 2
push eax
push eax
push 0xc0000000
lea eax, [ebp - 0x4004]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x4014], eax
cmp eax, 0xffffffff
je 0x40310c
push 0
lea ecx, [ebp - 0x400c]
push ecx
push dword [edi + 8]
mov ecx, dword [edi + 4]
add ecx, esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403100
mov eax, dword [ebp - 0x400c]
cmp eax, dword [edi + 8]
jne 0x403100
push dword [ebp - 0x4014]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4010]
add edi, 0xc
inc eax
mov dword [ebp - 0x4010], eax
cmp eax, dword [esi + 4]
jb 0x402ffe
xor eax, eax
inc eax
jmp 0x403116
push dword [ebp - 0x4014]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004032a6
mov esp, ebp
pop ebp
ret
Function at 0x10001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x48
mov byte [ebp - 6], 0x61
mov byte [ebp - 5], 0x6e
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0x65
mov byte [ebp - 1], 0
cmp dword [0x100277ec], 0
jne 0x10001054
lea eax, [ebp - 0xc]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100277ec], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x100277ec]
mov esp, ebp
pop ebp
ret 4

Function at 0x10001070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x44
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x79
mov byte [ebp - 5], 0x57
mov byte [ebp - 4], 0
cmp dword [0x100277f0], 0
jne 0x100010d8
lea eax, [ebp - 0x14]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100277f0], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x100277f0]
mov esp, ebp
pop ebp
ret 8

Function at 0x100010f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x61
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x46
mov byte [ebp - 5], 0x69
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x65
mov byte [ebp - 2], 0x57
mov byte [ebp - 1], 0
cmp dword [0x100277f4], 0
jne 0x10001144
lea eax, [ebp - 0xc]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100277f4], eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x100277f4]
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10001170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov byte [ebp - 0x1c], 0x45
mov byte [ebp - 0x1b], 0x78
mov byte [ebp - 0x1a], 0x70
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x45
mov byte [ebp - 0x15], 0x6e
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x6d
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x69
mov byte [ebp - 7], 0x6e
mov byte [ebp - 6], 0x67
mov byte [ebp - 5], 0x73
mov byte [ebp - 4], 0x57
mov byte [ebp - 3], 0
cmp dword [0x10027808], 0
jne 0x100011fc
lea eax, [ebp - 0x1c]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10027808], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x10027808]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10001220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x47
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x4c
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x54
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x6d
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0
cmp dword [0x100277e8], 0
jne 0x10001278
lea eax, [ebp - 0x10]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100277e8], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x100277e8]
mov esp, ebp
pop ebp
ret 4

Function at 0x10001290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x4d
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x54
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x57
mov byte [ebp - 8], 0x69
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x43
mov byte [ebp - 4], 0x68
mov byte [ebp - 3], 0x61
mov byte [ebp - 2], 0x72
mov byte [ebp - 1], 0
cmp dword [0x1002780c], 0
jne 0x10001304
lea eax, [ebp - 0x14]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1002780c], eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x1002780c]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10001330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x41
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x75
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x73
mov byte [ebp - 3], 0x57
mov byte [ebp - 2], 0
cmp dword [0x100277e4], 0
jne 0x100013a0
lea eax, [ebp - 0x14]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100277e4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x100277e4]
mov esp, ebp
pop ebp
ret 8

Function at 0x100013c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x46
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x50
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], 0x74
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0x72
mov byte [ebp - 2], 0
cmp dword [0x100277fc], 0
jne 0x10001420
lea eax, [ebp - 0x10]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100277fc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x100277fc]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10001440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x46
mov byte [ebp - 6], 0x69
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0
cmp dword [0x100277f8], 0
jne 0x1000148c
lea eax, [ebp - 0xc]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100277f8], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x100277f8]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100015c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x4c
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x54
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x41
mov byte [ebp - 6], 0x72
mov byte [ebp - 5], 0x67
mov byte [ebp - 4], 0x76
mov byte [ebp - 3], 0x57
mov byte [ebp - 2], 0
cmp dword [0x1002782c], 0
jne 0x10001630
lea eax, [ebp - 0x14]
push eax
call fcn.10001900
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1002782c], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x1002782c]
mov esp, ebp
pop ebp
ret 8

Function at 0x10001650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 9], 0x75
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x78
mov byte [ebp - 5], 0x57
mov byte [ebp - 4], 0
cmp dword [0x10027824], 0
jne 0x100016a8
lea eax, [ebp - 0x10]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10027824], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x10027824]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100016c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x45
mov byte [ebp - 0xb], 0x78
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x50
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0x63
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0x73
mov byte [ebp - 2], 0x73
mov byte [ebp - 1], 0
cmp dword [0x1002781c], 0
jne 0x10001714
lea eax, [ebp - 0xc]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1002781c], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x1002781c]
mov esp, ebp
pop ebp
ret 4

Function at 0x10001730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x47
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x43
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0xb], 0x6d
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 9], 0x61
mov byte [ebp - 8], 0x6e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x4c
mov byte [ebp - 5], 0x69
mov byte [ebp - 4], 0x6e
mov byte [ebp - 3], 0x65
mov byte [ebp - 2], 0x57
mov byte [ebp - 1], 0
cmp dword [0x10027818], 0
jne 0x10001794
lea eax, [ebp - 0x10]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10027818], eax
call dword [0x10027818]
mov esp, ebp
pop ebp
ret