joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41063d
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x417554
call fcn.00417000
sub esp, 0x55c
push ebx
push esi
push edi
lea eax, [ebp - 0x568]
mov dword [ebp - 0x10], esp
push 0
push 0x103
push eax
push dword [0x42b378]
mov dword [ebp - 0x18], ecx
call fcn.0040da2e
mov esi, dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x568]
mov ebx, 0x104
push 0x404c44
push eax
push 0x404ccc
lea eax, [ebp - 0x360]
push ebx
push eax
call esi
and byte [ebp - 0x25d], 0
and dword [ebp - 4], 0
add esp, 0x14
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x4106c9
xor eax, eax
jmp 0x4107af
lea eax, [ebp - 0x230]
push 0x404c40
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x41077f
lea eax, [ebp - 0x230]
push 0x404c3c
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x41077f
test byte [ebp - 0x25c], 0x10
je 0x41077f
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x568]
push eax
push 0x404cb4
lea eax, [ebp - 0x11c]
push ebx
push eax
call esi
and byte [ebp - 0x464], 0
add esp, 0x14
xor eax, eax
lea edi, [ebp - 0x463]
push 0x40
and byte [ebp - 0x19], 0
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x464]
push 0x103
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.0040e6be
pop ecx
test eax, eax
pop ecx
je 0x41077f
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x11c]
push eax
call fcn.00410947
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4106c9
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.00410f1a
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x414b8f
Capabilities:
Get common file path
Get program files directory

Disassembly:
xor eax, eax
push esi
mov esi, dword [esp + 8]
push eax
push 0x26
push esi
push eax
mov byte [esi], al
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x4057c8
push esi
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
pop esi
ret

Function at 0x414bb2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
lea eax, [ebp - 0x208]
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x208]
push 0x4057f4
push eax
call sub.MSVCRT.dll_strcat
mov ax, word [0x4057f0]
add esp, 0x10
mov word [ebp - 0x104], ax
xor eax, eax
push 0x40
lea edi, [ebp - 0x102]
pop ecx
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
rep stosd dword es:[edi], eax
push 5
push 0x404040
mov ebx, 0x417d04
push 1
push ebx
push dword [ebp + 8]
stosw word es:[edi], ax
mov edi, 0x80000000
push edi
call esi
cmp dword [ebp + 0xc], 0
je 0x414c76
cmp dword [ebp + 0x10], 0
je 0x414c3c
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
jmp 0x414c54
lea eax, [ebp - 0x103]
push 0x103
push eax
push dword [0x42b378]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push 0x4057e8
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0xc
jmp 0x414ca7
lea eax, [ebp - 0x103]
push 0x104
push eax
call fcn.00414b8f
lea eax, [ebp - 0x104]
push 0x4057e8
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x14
push eax
lea eax, [ebp - 0x104]
push eax
push 1
lea eax, [ebp - 0x208]
push ebx
push eax
push edi
call esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414cc4
Capabilities:
Delete registry key
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x414e31
and byte [ebp - 0x208], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push 6
stosb byte es:[edi], al
push 0x405790
mov edi, 0x417d04
push 1
push edi
mov esi, 0x80000000
push 0x405798
push esi
call ebx
push 6
push 0x405790
push 1
push edi
push 0x40591c
push esi
call ebx
lea eax, [ebp - 0x208]
push 0x4057f0
push eax
call sub.MSVCRT.dll_strcat
push dword [ebp + 0x10]
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x208]
push 0x4057e8
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x1c
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push edi
push 0x405900
push esi
call ebx
lea eax, [ebp - 0x208]
push 0x208
push eax
call fcn.00414b8f
lea eax, [ebp - 0x208]
push 0x4058fc
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
call fcn.0040d90a
test eax, eax
lea eax, [ebp - 0x208]
push eax
je 0x414e19
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push edi
push 0x4058b0
push esi
call ebx
lea eax, [ebp - 0x208]
push 0x4058a8
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0xc
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push edi
push 0x405894
push esi
call ebx
push 0x40586c
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push 0x40586c
push 1
push edi
push 0x405850
push esi
call ebx
jmp 0x414e7b
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push edi
push 0x405894
jmp 0x414e14
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push 8
push 0x405844
mov edi, 0x417d04
push 1
push edi
mov esi, 0x80000000
push 0x405798
push esi
call ebx
push 8
push 0x405844
push 1
push edi
push 0x40591c
push esi
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0x405790
push esi
call edi
push 0x405804
push esi
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414e80
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x110], 0
push ebx
push ebp
push esi
push edi
je 0x414eca
mov ebx, 0x80000002
push 0x405a2c
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esi, 0x417d04
mov edi, 0x405a08
push esi
push edi
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push 0xc
push 0x404a08
push 1
push esi
push edi
push ebx
jmp 0x414f02
lea eax, [esp + 0x14]
push 0x104
push eax
call fcn.00414b8f
pop ecx
mov esi, 0x417d04
pop ecx
mov edi, 0x405a08
push esi
push edi
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push 0xc
push 0x4059f8
push 1
push esi
push edi
push 0x80000002
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
call edi
mov ebp, 0x405844
push 8
push ebp
push 1
push esi
mov ebx, 0x80000000
push 0x40591c
push ebx
call edi
push 8
push ebp
push 1
push esi
push 0x405798
push ebx
call edi
push 8
push ebp
push 1
push esi
push 0x4059f0
push ebx
call edi
push 8
push ebp
push 1
push esi
push 0x4059e8
push ebx
call edi
push 4
push 0x404040
push 1
push esi
push 0x4059d8
push ebx
call edi
mov ebp, dword [esp + 0x124]
push ebp
push dword [esp + 0x124]
push 0x4059d8
call fcn.00414bb2
add esp, 0xc
push 0x10
push 0x4059c4
push 1
push esi
push 0x4059bc
push ebx
call edi
push ebp
push dword [esp + 0x124]
push 0x4059a4
call fcn.00414bb2
add esp, 0xc
push 9
push 0x405998
push 1
push esi
push 0x405990
push ebx
call edi
push 9
push 0x405998
push 1
push esi
push 0x405988
push ebx
call edi
mov esi, dword [esp + 0x120]
push ebp
push esi
push 0x405978
call fcn.00414bb2
push ebp
push esi
push 0x40596c
call fcn.00414bb2
push ebp
push esi
push 0x405960
call fcn.00414bb2
push ebp
push esi
push 0x405954
call fcn.00414bb2
push ebp
push esi
push 0x405948
call fcn.00414bb2
add esp, 0x3c
lea eax, [esp + 0x10]
push eax
push 0xa
push 2
push 0x405924
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x416b41
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi + 0x10c], ebx
je 0x416c41
push edi
push 0
push ebx
push 0x130c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 4], eax
mov eax, ebx
shl eax, 4
lea edi, [eax + esi]
mov eax, dword [eax + esi + 0x14]
test eax, eax
je 0x416b97
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x416c17
push 0x3e9
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call ebx
mov eax, dword [ebp + 8]
push 0
inc eax
shl eax, 4
push dword [eax + esi]
push dword [ebp - 4]
push dword [edi + 0xc]
push dword [0x42b378]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
sub edx, ecx
sub edx, 4
push 0x40
push edx
mov edx, dword [ebp - 0x14]
sub ebx, edx
add ecx, 2
sub ebx, 4
add edx, 2
push ebx
push ecx
push edx
push 0
push eax
mov dword [edi + 0x14], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ebx, dword [ebp + 8]
push 5
push dword [edi + 0x14]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
mov eax, dword [esi + 0x10c]
cmp eax, 0xffffffff
je 0x416c3a
shl eax, 4
push 0
push dword [eax + esi + 0x14]
call edi
mov dword [esi + 0x10c], ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x416e7c
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
mov ebp, 0x104
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov ebx, 0x418c9c
push ebp
push ebx
push 1
push esi
mov dword [0x42b378], esi
call edi
mov dword [esp + 0x10], 0x14
push 0
push 0x4057a0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
mov dword [esp + 0x14], eax
je 0x416f0d
lea eax, [esp + 0x18]
push ebp
push eax
push 0xc
push esi
call edi
push 0x41
lea eax, [esp + 0x1c]
push ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
push 1
je 0x416f4f
push 0
push 2
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0
jg 0x416eb2
mov edi, dword [esp + 0x128]
push 0x405c98
push 1
mov ecx, 0x42b370
push dword [esp + 0x134]
push edi
push esi
call fcn.00405cec
mov esi, 0x41849c
mov ebx, eax
push esi
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x416f52
xor eax, eax
push 5
push eax
push eax
push esi
push 0x404040
push eax
jmp 0x416f83
pop eax
jmp 0x416f8b
xor esi, esi
cmp dword [0x417768], esi
jne 0x416f89
cmp edi, esi
je 0x416f89
push edi
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x416f89
push esi
push edi
call fcn.0040e6be
pop ecx
test eax, eax
pop ecx
je 0x416f89
push 0xa
push esi
push esi
push edi
push 0x404040
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0x10
Function at 0x40108e
Capabilities:
Query or enumerate registry value

Disassembly:
jae 0x4010fe
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebp - 0x75], dl
in al, dx
add esp, 0xfffffef0
invalid

Function at 0xcc1eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 0x14], 0
and byte [ebp - 4], 0
push ebx
push esi
mov esi, dword [fcn.00401004]
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 0x20], 0x4b
push eax
mov byte [ebp - 0x1f], 0x45
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x1c], 0x45
mov byte [ebp - 0x1b], 0x4c
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x10], 0x4c
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x4c
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x61
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x79
mov byte [ebp - 5], 0x41
call esi
mov edi, dword [entry0]
push eax
call edi
cmp dword [ebp + 8], 0
mov ebx, eax
je 0xcc1f4c
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
jmp 0xcc1f66
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0xcc1f5e
push dword [ebp + 0xc]
call ebx
test eax, eax
je 0xcc1f64
push dword [ebp + 0x10]
push eax
jmp 0xcc1f48
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xcc1f6b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
lea eax, [ebp - 0x3c]
push edi
push eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push ebx
mov byte [ebp - 0x2c], 0x4b
mov byte [ebp - 0x2b], 0x45
mov byte [ebp - 0x2a], 0x52
mov byte [ebp - 0x29], 0x4e
mov byte [ebp - 0x28], 0x45
mov byte [ebp - 0x27], 0x4c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x3c], 0x47
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x74
mov byte [ebp - 0x39], 0x50
mov byte [ebp - 0x38], 0x72
mov byte [ebp - 0x37], 0x6f
mov byte [ebp - 0x36], 0x63
mov byte [ebp - 0x35], 0x65
mov byte [ebp - 0x34], 0x73
mov byte [ebp - 0x33], 0x73
mov byte [ebp - 0x32], 0x48
mov byte [ebp - 0x31], 0x65
mov byte [ebp - 0x30], 0x61
mov byte [ebp - 0x2f], 0x70
mov byte [ebp - 0x2e], bl
call fcn.00cc1eb0
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0x19], 0x70
mov byte [ebp - 0x18], 0x52
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x41
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x11], bl
call fcn.00cc1eb0
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x70
mov byte [ebp - 0xc], 0x41
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6f
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], bl
call fcn.00cc1eb0
add esp, 0x24
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
je 0xcc2081
push dword [ebp + 8]
push ebx
call esi
push eax
call edi
jmp 0xcc2088
push ebx
call esi
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0xcc208d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
lea eax, [ebp - 0x2c]
push edi
push eax
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
push ebx
mov byte [ebp - 0x1c], 0x4b
mov byte [ebp - 0x1b], 0x45
mov byte [ebp - 0x1a], 0x52
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x18], 0x45
mov byte [ebp - 0x17], 0x4c
mov byte [ebp - 0x16], 0x33
mov byte [ebp - 0x15], 0x32
mov byte [ebp - 0x14], 0x2e
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x10], bl
mov byte [ebp - 0x2c], 0x47
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x50
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x73
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], 0x48
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1f], 0x70
mov byte [ebp - 0x1e], bl
call fcn.00cc1eb0
mov esi, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
mov byte [ebp - 0xc], 0x48
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x70
mov byte [ebp - 8], 0x46
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], bl
call fcn.00cc1eb0
add esp, 0x18
mov edi, eax
push dword [ebp + 8]
push ebx
call esi
push eax
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0xcc2374
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
and byte [ebp - 0x20], 0
and byte [ebp - 0x10], 0
push esi
lea eax, [ebp - 0x1c]
push edi
push eax
lea eax, [ebp - 0x2c]
xor edi, edi
push eax
push edi
mov byte [ebp - 0x2c], 0x4b
mov byte [ebp - 0x2b], 0x45
mov byte [ebp - 0x2a], 0x52
mov byte [ebp - 0x29], 0x4e
mov byte [ebp - 0x28], 0x45
mov byte [ebp - 0x27], 0x4c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x1c], 0x56
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], 0x75
mov byte [ebp - 0x17], 0x61
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x41
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x63
call fcn.00cc1eb0
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
add esp, 0xc
mov dword [ebp - 4], edi
mov eax, dword [esi + 4]
mov dword [ebp - 8], eax
mov eax, dword [esi]
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], di
lea ebx, [ecx + eax + 0x18]
jbe 0xcc249c
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0xcc245b
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0xcc248b
mov eax, dword [ebx - 4]
push 4
add eax, dword [ebp - 8]
push 0x1000
push edi
push eax
call dword [ebp - 0xc]
mov edx, eax
mov ecx, edi
mov dword [ebx - 8], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0xcc248b
push 4
push 0x1000
push eax
mov eax, dword [ebx - 4]
add eax, dword [ebp - 8]
push eax
call dword [ebp - 0xc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
add esi, dword [ebp + 8]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x10]
mov dword [ebx - 8], eax
mov eax, dword [esi]
inc dword [ebp - 4]
add ebx, 0x28
movzx eax, word [eax + 6]
cmp dword [ebp - 4], eax
jl 0xcc241e
pop edi
pop esi
pop ebx
leave
ret
Function at 0xcc24a1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x28]
push ebx
push eax
lea eax, [ebp - 0x38]
xor ebx, ebx
push eax
push ebx
mov byte [ebp - 0x38], 0x4b
mov byte [ebp - 0x37], 0x45
mov byte [ebp - 0x36], 0x52
mov byte [ebp - 0x35], 0x4e
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x4c
mov byte [ebp - 0x32], 0x33
mov byte [ebp - 0x31], 0x32
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x6c
mov byte [ebp - 0x2c], bl
mov byte [ebp - 0x28], 0x56
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x75
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x46
mov byte [ebp - 0x20], 0x72
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], bl
call fcn.00cc1eb0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
mov byte [ebp - 0x48], 0x56
mov byte [ebp - 0x47], 0x69
mov byte [ebp - 0x46], 0x72
mov byte [ebp - 0x45], 0x74
mov byte [ebp - 0x44], 0x75
mov byte [ebp - 0x43], 0x61
mov byte [ebp - 0x42], 0x6c
mov byte [ebp - 0x41], 0x50
mov byte [ebp - 0x40], 0x72
mov byte [ebp - 0x3f], 0x6f
mov byte [ebp - 0x3e], 0x74
mov byte [ebp - 0x3d], 0x65
mov byte [ebp - 0x3c], 0x63
mov byte [ebp - 0x3b], 0x74
mov byte [ebp - 0x3a], bl
call fcn.00cc1eb0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
add esp, 0x18
mov dword [ebp - 0xc], ebx
mov eax, dword [eax]
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], bx
lea ecx, [ecx + eax + 0x18]
jbe 0xcc262a
add ecx, 0x24
push esi
mov dword [ebp - 8], ecx
push edi
mov esi, dword [ecx]
mov dword [ebp - 4], esi
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 4]
shr esi, 0x1d
shr edi, 0x1e
and esi, 1
and edi, 1
shr edx, 0x1f
test byte [ebp - 1], 2
mov dword [ebp - 0x14], edx
je 0xcc25c1
push 0x4000
push dword [ecx - 0x14]
push dword [ecx - 0x1c]
call dword [ebp - 0x10]
jmp 0xcc260a
test byte [ebp - 1], 4
lea edx, [edi + esi*2]
mov esi, dword [ebp - 0x14]
lea edx, [esi + edx*2]
mov edi, dword [edx*4 + 0x5410f0]
je 0xcc25dd
or edi, 0x200
mov esi, dword [ecx - 0x14]
mov edx, esi
cmp edx, ebx
jne 0xcc25fc
test byte [ebp - 4], 0x40
je 0xcc25f1
mov edx, dword [eax + 0x20]
jmp 0xcc25fa
test byte [ebp - 4], 0x80
je 0xcc260d
mov edx, dword [eax + 0x24]
cmp edx, ebx
jbe 0xcc260d
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push dword [ecx - 0x1c]
call dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
inc dword [ebp - 0xc]
add ecx, 0x28
mov eax, dword [eax]
mov dword [ebp - 8], ecx
movzx edx, word [eax + 6]
cmp dword [ebp - 0xc], edx
jl 0xcc258e
pop edi
pop esi
pop ebx
leave
ret
Function at 0xcc26a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
and byte [ebp - 0x18], 0
and byte [ebp - 0x28], 0
push esi
lea eax, [ebp - 0x34]
push edi
push eax
lea eax, [ebp - 0x24]
xor ebx, ebx
push eax
push ebx
mov byte [ebp - 0x24], 0x4b
mov byte [ebp - 0x23], 0x45
mov byte [ebp - 0x22], 0x52
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x4c
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x32
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x34], 0x49
mov byte [ebp - 0x33], 0x73
mov byte [ebp - 0x32], 0x42
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], 0x64
mov byte [ebp - 0x2f], 0x52
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x61
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x50
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x72
call fcn.00cc1eb0
mov dword [ebp - 0x10], eax
and byte [ebp - 0x38], bl
lea eax, [ebp - 0x44]
mov byte [ebp - 0x44], 0x4c
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
mov byte [ebp - 0x43], 0x6f
mov byte [ebp - 0x42], 0x61
mov byte [ebp - 0x41], 0x64
mov byte [ebp - 0x40], 0x4c
mov byte [ebp - 0x3f], 0x69
mov byte [ebp - 0x3e], 0x62
mov byte [ebp - 0x3d], 0x72
mov byte [ebp - 0x3c], 0x61
mov byte [ebp - 0x3b], 0x72
mov byte [ebp - 0x3a], 0x79
mov byte [ebp - 0x39], 0x41
call fcn.00cc1eb0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
add esp, 0x18
mov dword [ebp - 4], 1
mov eax, dword [esi]
mov edi, dword [esi + 4]
add eax, 0x80
mov dword [ebp - 8], edi
cmp dword [eax + 4], ebx
jbe 0xcc2863
mov ebx, dword [eax]
push 0x14
add ebx, edi
push ebx
call dword [ebp - 0x10]
test eax, eax
jne 0xcc2863
jmp 0xcc27a9
mov edi, dword [ebp - 8]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0xcc2863
add eax, edi
push eax
call dword [ebp - 0x14]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0xcc285f
mov eax, dword [esi + 0xc]
lea eax, [eax*4 + 4]
push eax
push dword [esi + 8]
call fcn.00cc1f6b
pop ecx
mov dword [esi + 8], eax
test eax, eax
pop ecx
je 0xcc285f
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax + ecx*4], edx
inc dword [esi + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0xcc2801
add eax, edi
mov edi, dword [ebx + 0x10]
add edi, dword [ebp - 8]
mov dword [ebp + 8], eax
jmp 0xcc2837
mov eax, dword [ebx + 0x10]
add edi, eax
mov dword [ebp + 8], edi
jmp 0xcc2837
jns 0xcc2814
and eax, 0xffff
jmp 0xcc281c
mov ecx, dword [ebp - 8]
add eax, ecx
add eax, 2
push eax
push 0
push dword [ebp - 0xc]
call fcn.00cc1eb0
add esp, 0xc
mov dword [edi], eax
test eax, eax
je 0xcc2842
add dword [ebp + 8], 4
add edi, 4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jne 0xcc280b
jmp 0xcc2846
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0xcc2863
add ebx, 0x14
push 0x14
push ebx
call dword [ebp - 0x10]
test eax, eax
je 0xcc27a6
jmp 0xcc2863
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret