joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10027ef8]
push esi
test eax, eax
jne 0x1000b295
mov al, 0x65
mov dl, 0x61
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], dl
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], dl
mov byte [ebp - 0x13], al
mov byte [ebp - 0x10], al
mov cl, 0x72
mov dl, 0x64
mov al, 0x6c
push ebx
push edi
mov byte [ebp - 0x24], 0x43
mov byte [ebp - 0x23], cl
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x1e], 0x54
mov byte [ebp - 0x1d], 0x68
mov byte [ebp - 0x1c], cl
mov byte [ebp - 0x19], dl
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x14], 0x4b
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], dl
mov byte [ebp - 0xa], al
mov byte [ebp - 9], al
mov byte [ebp - 8], 0
push eax
sbb eax, esi
sbb eax, edx
add eax, esi
mov eax, 0xe4cbb4
pop eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x14]
push eax
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x1000b262
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000b262
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x14]
push eax
push ecx
call edi
push eax
call ebx
mov esi, eax
mov dword [ebp - 4], 0
push edi
sbb edi, esi
add edi, esp
sbb edi, edx
sbb edi, eax
add edi, esi
sbb edi, esp
pop edi
pop edi
pop ebx
test esi, esi
je 0x1000b295
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0x1000b9e0
push 0
push 0
call esi
mov dword [0x10027ef8], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push esi
test eax, eax
push edi
je 0x1000b395
mov cl, 0x6e
mov al, 0x6f
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x16], al
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], al
mov dl, 0x64
mov cl, 0x73
mov al, 0x6c
mov byte [ebp - 0x20], 0x55
mov byte [ebp - 0x1e], 0x68
mov byte [ebp - 0x1b], 0x6b
mov byte [ebp - 0x1a], 0x57
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x15], 0x77
mov byte [ebp - 0x14], cl
mov byte [ebp - 0x13], 0x48
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x45
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], cl
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], dl
mov byte [ebp - 4], al
mov byte [ebp - 3], al
mov byte [ebp - 2], 0
push edx
mov edx, 0xcf9863af
xor edx, esi
add edx, esp
nop
pop edx
push eax
mov eax, 0x8334e69b
mov eax, 0x2ed47d28
nop
pop eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0xc]
push eax
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
jne 0x1000b389
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000b381
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0xc]
push eax
push ecx
call esi
push eax
call edi
test eax, eax
jne 0x1000b389
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov al, 0x65
mov cl, 0x73
mov byte [ebp - 0x19], al
mov byte [ebp - 0x15], al
mov byte [ebp - 0x10], al
mov byte [ebp - 0xa], al
mov dl, 0x64
mov al, 0x6c
push esi
push edi
mov byte [ebp - 0x20], 0x50
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x16], 0x4d
mov byte [ebp - 0x14], cl
mov byte [ebp - 0x13], cl
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x11], 0x67
mov byte [ebp - 0xf], 0x41
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], cl
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], dl
mov byte [ebp - 4], al
mov byte [ebp - 3], al
mov byte [ebp - 2], 0
push ebx
add ebx, esp
add ebx, edx
xor ebx, eax
add ebx, esi
add ebx, esp
nop
pop ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0xc]
push eax
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
jne 0x1000b4d5
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000b4fd
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0xc]
push eax
push ecx
call esi
push eax
call edi
test eax, eax
je 0x1000b4fd
push ecx
xor ecx, esp
mov ecx, 0x1786f76b
mov ecx, 0x86dd43e
add ecx, edx
pop ecx
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push ecx
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ede0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov cl, 0x74
push ebx
mov byte [ebp - 0x3a], cl
mov byte [ebp - 0x33], cl
mov al, 0x72
mov byte [ebp - 0x2e], cl
push esi
mov cl, 0x6f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov byte [ebp - 0x31], al
mov byte [ebp - 0x2c], al
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x23], cl
mov byte [ebp - 0x22], cl
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x28]
mov dl, 0x65
mov bl, 0x6e
push eax
push ecx
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x3c], 0x47
mov byte [ebp - 0x3b], dl
mov byte [ebp - 0x39], 0x44
mov byte [ebp - 0x38], dl
mov byte [ebp - 0x37], 0x66
mov byte [ebp - 0x36], 0x61
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x6c
mov byte [ebp - 0x32], 0x50
mov byte [ebp - 0x30], 0x69
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2d], dl
mov byte [ebp - 0x2b], 0x41
mov byte [ebp - 0x2a], 0
mov byte [ebp - 0x28], 0x77
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], 0x73
mov byte [ebp - 0x24], 0x70
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0x2e
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1d], 0x76
mov byte [ebp - 0x1c], 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x1000b614
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x1000b693
push eax
xor eax, eax
sbb eax, esi
xor eax, esp
xor eax, edx
sbb eax, eax
xor eax, esi
pop eax
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push eax
push ecx
call edi
push eax
call ebx
mov edx, dword [ebp - 0x14]
mov esi, eax
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x1000b693
mov al, byte [0x10027989]
mov dword [ebp - 0x14], 0x104
test al, al
je 0x1000b629
call fcn.1000c550
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push ecx
mov dword [ebp - 4], 0
call esi
mov esi, eax
jmp 0x1000b647
push ecx
mov ecx, 0xd9eb009c
sbb ecx, eax
add ecx, esp
sbb ecx, eax
sbb ecx, esp
add ecx, eax
pop ecx
mov al, byte [0x10027989]
test al, al
je 0x1000b680
mov eax, 0xffffffdd
cdq
xor eax, edx
sub eax, edx
cmp eax, 3
jne 0x1000b67a
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowRect]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b6b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov al, 0x61
mov cl, 0x65
mov byte [ebp - 0x27], al
mov byte [ebp - 0x23], cl
mov byte [ebp - 0x22], al
mov byte [ebp - 0x20], cl
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x19], cl
mov byte [ebp - 0xc], al
mov dl, 0x70
mov cl, 0x41
mov al, 0x6c
push esi
push edi
mov byte [ebp - 0x28], 0x63
mov byte [ebp - 0x26], dl
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x1f], 0x43
mov byte [ebp - 0x1d], dl
mov byte [ebp - 0x1c], 0x74
mov byte [ebp - 0x1b], 0x75
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x77
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], cl
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xb], dl
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], al
mov byte [ebp - 5], al
mov byte [ebp - 4], 0
push eax
sbb eax, esp
add eax, edx
sbb eax, eax
sbb eax, esi
add eax, esp
nop
pop eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x10]
push eax
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
jne 0x1000b791
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000b7b9
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x10]
push eax
push ecx
call esi
push eax
call edi
test eax, eax
je 0x1000b7b9
mov edx, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
push edx
mov edx, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push ecx
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b7d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov bl, 0x74
mov al, 0x72
mov dl, 0x69
mov cl, 0x6e
push esi
push edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], bl
mov byte [ebp - 0x11], 0x50
mov byte [ebp - 0x10], al
mov byte [ebp - 0xf], dl
mov byte [ebp - 0xe], cl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], al
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0
push eax
mov eax, 0x6ff57e09
sub eax, ecx
nop
pop eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov byte [ebp - 0x22], cl
mov cl, 0x6f
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x1e], cl
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x24]
push eax
push ecx
mov byte [ebp - 0x24], 0x77
mov byte [ebp - 0x23], dl
mov byte [ebp - 0x21], 0x73
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x19], 0x76
mov byte [ebp - 0x18], 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x1000b8a1
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp - 8], eax
je 0x1000b8d5
push edi
mov edi, 0x8131e296
sbb edi, esi
sbb edi, edx
sub edi, edi
nop
pop edi
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x24]
push eax
push ecx
call edi
push eax
call ebx
mov edx, dword [ebp - 8]
mov esi, eax
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x1000b8d5
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 2
push ecx
call esi
test eax, eax
jne 0x1000b8d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
push eax
mov eax, 0x56779abf
mov eax, 0x4f667f9a
add eax, esp
sbb eax, eax
nop
pop eax
cmp eax, 0x7a
mov eax, ecx
jne 0x1000b8da
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b8f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov al, 0x65
mov dl, 0x61
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x1d], dl
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x17], al
mov byte [ebp - 0x16], dl
mov byte [ebp - 0xf], al
mov byte [ebp - 0xc], al
mov cl, 0x72
mov dl, 0x64
mov al, 0x6c
push esi
push edi
mov byte [ebp - 0x20], 0x43
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x1c], 0x74
mov byte [ebp - 0x1a], 0x54
mov byte [ebp - 0x19], 0x68
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x15], dl
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x10], 0x4b
mov byte [ebp - 0xe], cl
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xb], al
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], dl
mov byte [ebp - 6], al
mov byte [ebp - 5], al
mov byte [ebp - 4], 0
push ebx
mov ebx, 0xe4c8ae96
sbb ebx, esi
xor ebx, eax
xor ebx, edx
pop ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x10]
push eax
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
jne 0x1000b9a4
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000b9d2
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x10]
push eax
push ecx
call esi
push eax
call edi
test eax, eax
je 0x1000b9d2
push ebx
mov ebx, 0x1b6cbf15
xor ebx, esp
sbb ebx, edx
xor ebx, eax
nop
pop ebx
mov edx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push ecx
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov al, 0x6c
push ebx
mov byte [ebp - 6], al
mov byte [ebp - 5], al
mov eax, 0xfffffffd
mov bl, 0x73
cdq
xor eax, edx
push esi
sub eax, edx
push edi
cmp eax, 3
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 4], 0
jne 0x1000c497
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dl, 0x54
mov al, 0x65
mov cl, 0x72
mov byte [ebp - 0x24], 0x57
mov byte [ebp - 0x23], dl
mov byte [ebp - 0x22], 0x53
mov byte [ebp - 0x21], 0x51
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x1d], 0x79
mov byte [ebp - 0x1c], 0x55
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x19], cl
mov byte [ebp - 0x18], dl
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x6b
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0
push esi
mov esi, 0xc014e9c1
mov esi, 0xbb85511f
pop esi
push edi
add edi, esp
sbb edi, esp
sbb edi, esp
mov edi, 0xb36315c8
pop edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x10]
push eax
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x1000c532
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000c532
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x10]
push eax
push ecx
call edi
push eax
call ebx
mov esi, eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000da90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ee50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x134
xor eax, eax
mov dl, 0x6c
push ebx
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x1b], dl
mov byte [ebp - 0x16], dl
mov byte [ebp - 0x15], dl
push edi
mov al, 0x65
mov cl, 0x72
mov dl, 0x74
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], 1
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x38], 0x43
mov byte [ebp - 0x37], cl
mov byte [ebp - 0x36], al
mov byte [ebp - 0x35], 0x61
mov byte [ebp - 0x34], dl
mov byte [ebp - 0x33], al
mov byte [ebp - 0x32], 0x44
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], cl
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x2e], 0x63
mov byte [ebp - 0x2d], dl
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x2b], cl
mov byte [ebp - 0x2a], 0x79
mov byte [ebp - 0x29], 0x41
mov byte [ebp - 0x28], 0
push eax
mov eax, 0xbc44cd59
mov eax, 0xb533b234
nop
pop eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x20]
push eax
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebx, eax
test ebx, ebx
jne 0x1000db7e
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000db7e
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x20]
push eax
push ecx
call esi
push eax
call edi
mov ebx, eax
push ecx
mov ecx, 0xc9beb5ae
sbb ecx, eax
sbb ecx, esp
pop ecx
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x1000dc35
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov al, byte [edx + esi]
cmp al, 0x5c
jne 0x1000dbfa
mov eax, 0xffffffcc
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x17
jne 0x1000dbba
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x140]
lea edx, [ebp - 0x140]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x24]
lea edi, [ebp - 0x140]
mov eax, ecx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov byte [ebp + ecx - 0x140], 0
call ebx
inc dword [ebp - 0x24]
jmp 0x1000db89
test al, al
jne 0x1000dbf5
mov dword [ebp - 0x3c], 0
push ebp
mov ebp, 0x2309f0da
add ebp, edx
nop
pop ebp
push 0
push esi
call ebx
inc dword [ebp - 0x24]
jmp 0x1000db89
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x412008]
xor eax, esp
mov dword [esp + 0x9c], eax
push 0x98
lea eax, [esp + 8]
push 0
push eax
call fcn.00406b00
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x9c
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
jne 0x401053
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004033e4
add esp, 0xa0
ret
mov eax, dword [esp + 4]
cmp eax, 6
jne 0x4010e1
mov eax, dword [esp + 8]
test eax, eax
jne 0x40108c
cmp byte [esp + 0x9a], 1
setne al
lea eax, [eax + eax + 4]
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004033e4
add esp, 0xa0
ret
cmp eax, 1
jne 0x4010b7
xor eax, eax
cmp byte [esp + 0x9a], 1
setne al
lea eax, [eax + eax + 5]
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004033e4
add esp, 0xa0
ret
cmp eax, 2
jne 0x401131
xor eax, eax
cmp byte [esp + 0x9a], 1
setne al
add eax, 8
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004033e4
add esp, 0xa0
ret
cmp eax, 5
jne 0x401131
mov eax, dword [esp + 8]
cmp eax, 2
jne 0x401109
mov eax, 3
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004033e4
add esp, 0xa0
ret
cmp eax, 1
jne 0x401128
mov eax, 2
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004033e4
add esp, 0xa0
ret
test eax, eax
jne 0x401131
mov eax, 1
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004033e4
add esp, 0xa0
ret

Function at 0x401170
Capabilities:
Get disk information

Disassembly:
sub esp, 0x810
mov eax, dword [0x412008]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
xor ebx, ebx
push 0x3ff
lea eax, [esp + 0x415]
push ebx
push eax
mov byte [esp + 0x41c], bl
call fcn.00406b00
push 0x3ff
lea ecx, [esp + 0x21]
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x28], bl
call fcn.00406b00
add esp, 0x18
push 0x400
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x400
lea eax, [esp + 0x428]
push eax
push 0x410470
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
mov ecx, dword [esp + 0x810]
neg eax
sbb eax, eax
and eax, dword [esp + 4]
pop ebx
xor ecx, esp
call fcn.004033e4
add esp, 0x810
ret
Function at 0x4012e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x412008]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.00406b00
add esp, 0xc
push 0x104
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x40133a
xor al, al
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004033e4
add esp, 0x108
ret
mov cl, 0x5c
lea esp, [esp]
dec eax
cmp byte [esp + eax], cl
jne 0x401340
mov byte [esp + eax + 1], 0
lea eax, [esp]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401350
mov edx, dword [str.rss.tmp]
mov ecx, dword [0x41047c]
push edi
mov dword [eax], edx
lea edx, [esp + 4]
push 0x410480
push edx
mov dword [eax + 4], ecx
call fcn.00403c7d
mov edi, eax
add esp, 8
test edi, edi
jne 0x40139a
xor al, al
pop edi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004033e4
add esp, 0x108
ret
push ebx
push ebp
push esi
push 2
push 0
push edi
call fcn.004043ca
push edi
call fcn.004042d2
push 0
push 0
push edi
mov ebp, eax
call fcn.004043ca
lea ebx, [ebp + 0x1a4]
push ebx
call fcn.00403aef
mov esi, eax
add esp, 0x20
mov dword [0x414760], esi
test esi, esi
jne 0x4013d8
xor al, al
jmp 0x401403
push ebp
push 0
push esi
call fcn.00406b00
push edi
push 1
push ebp
push esi
call fcn.00403f34
push edi
call fcn.004044c6
mov edx, dword [0x414760]
add esp, 0x20
mov esi, ebx
call fcn.00401150
mov al, 1
mov ecx, dword [esp + 0x114]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
call fcn.004033e4
add esp, 0x108
ret