joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fe240
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x3c
cmp dword [0x5743e4], 0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4c]
push edi
mov dword [esp + 0x10], 0
jne 0x4fe26f
push esi
call fcn.00503470
add esp, 4
mov dword [0x5743e4], 1
mov eax, dword [0x5743d8]
mov ebp, eax
test eax, eax
jne 0x4fe27c
mov ebp, esi
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x58]
mov ebx, eax
test eax, eax
jne 0x4fe2ba
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
push 0x4fc190
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x18]
mov ebx, eax
test eax, eax
je 0x4fe30c
cmp dword [edi + 0x30], 2
jne 0x4fe30c
push 0x2c
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.004948b0
add esp, 0xc
lea edx, [esp + 0x20]
push edx
push ebx
mov dword [esp + 0x28], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x4fe30c
mov eax, dword [esp + 0x28]
cmp eax, 6
je 0x4fe304
cmp eax, 2
je 0x4fe304
mov dword [esp + 0x10], 0
cmp eax, 7
jne 0x4fe30c
mov dword [esp + 0x10], 1
mov eax, dword [edi + 0x30]
cmp eax, 1
je 0x4fe328
cmp eax, 2
jne 0x4fe413
cmp dword [esp + 0x10], 0
je 0x4fe413
push ebp
call fcn.004fe1b0
add esp, 4
test eax, eax
je 0x4fe413
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebp
push 0
push 0
push 0x64
push 0x14a
push 0
push 0
push 0x80800000
push 0
push str.Clp_Tray
push 0x388
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
je 0x4fe413
push 1
push str.tray
push esi
call dword [sym.imp.USER32.dll_SetPropA]
test byte [edi + 0x34], 0x20
je 0x4fe406
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4fe406
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageA]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
mov edi, edi
cmp dword [esp + 0x20], esi
jne 0x4fe3bd
cmp dword [esp + 0x24], 0x10
je 0x4fe3f9
lea ecx, [esp + 0x20]
push ecx
push esi
call edi
test eax, eax
jne 0x4fe3d7
lea edx, [esp + 0x20]
push edx
call ebx
lea eax, [esp + 0x20]
push eax
call ebp
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4fe3b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c
ret
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c
ret
push edi
push fcn.004fd500
push ebx
push 0x73c6
push ebp
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x500540
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push 0x5743e8
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x57440c]
mov edi, esi
test esi, esi
je 0x500588
mov eax, dword [esp + 0x18]
cmp dword [edi], eax
jne 0x500581
mov ecx, dword [esp + 0x20]
cmp dword [edi + 4], ecx
jne 0x500581
cmp dword [edi + 8], ebp
jne 0x500581
cmp dword [edi + 0xc], ebx
je 0x500604
mov edi, dword [edi + 0x24]
test edi, edi
jne 0x500562
push 0x28
call fcn.00494940
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
add esp, 4
mov dword [eax + 0xc], ebx
xor edi, edi
or ebx, 0xffffffff
push 0x5743e8
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [eax + 8], ebp
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], edi
mov dword [eax + 0x24], esi
mov dword [0x57440c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x574400], edi
jne 0x500629
lea eax, [esp + 0x10]
push eax
push 4
push edi
push 0x500520
push edi
push edi
mov dword [0x574400], 1
call fcn.00496b36
add esp, 0x18
mov dword [0x574404], eax
cmp eax, edi
jne 0x500622
pop edi
pop esi
pop ebp
mov dword [0x574400], ebx
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x1c]
push edx
call fcn.004fe850
add esp, 4
push 0x5743e8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x502e90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xa4
mov eax, dword [0x56a8e0]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xac]
push ebp
mov ebp, dword [esp + 0xac]
mov ecx, dword [ebp + 0x14]
push 1
push eax
push ecx
call fcn.00503560
add esp, 0xc
test eax, eax
je 0x502fb1
mov eax, dword [eax]
test eax, eax
je 0x502fb1
add eax, 4
je 0x502fb1
mov edx, dword [ebp + 0x1c]
push ebx
push eax
push edx
call fcn.005035b0
add esp, 8
push 1
push 0
push 0
mov ebx, eax
push ebx
push 0x570ee0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x502f8f
push str.ProgramFiles
call fcn.004aba60
add esp, 4
test eax, eax
je 0x502f8f
mov ecx, eax
push esi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x502f21
sub ecx, esi
cmp ecx, 0x80
jae 0x502f8e
lea edx, [esp + 0xc]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x502f38
mov eax, str.Internet_Exploreriexplore.exe
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x502f50
push edi
lea edi, [esp + 0x10]
sub eax, esi
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x502f60
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 1
push 0
mov ecx, eax
push ebx
lea eax, [esp + 0x1c]
push eax
push str.open
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov eax, dword [ebp + 0x10]
push ebx
push eax
push 0x4e0
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
call fcn.004934fd
add esp, 4
pop ebx
mov ecx, dword [esp + 0xa4]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00493d56
add esp, 0xa4
ret
Function at 0x10017a20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0ea4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], 0xffffffff
mov dword [edx + 0x18], 0xf
mov dword [edx + 0x14], 0
mov byte [edx + 4], 0
mov dword [ebp - 4], 0
mov dword [edx + 0x30], 0xf
mov dword [edx + 0x2c], 0
mov byte [edx + 0x1c], 0
mov byte [ebp - 4], 1
lea ecx, [edx + 0x38]
lea eax, [ecx + 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov byte [eax], 0
mov byte [ebp - 4], 3
mov al, byte [ebp + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 6
mov dword [ecx + 0xc], 0
mov byte [ecx + 0x10], al
mov dword [ecx + 0x14], 0x201
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov byte [ebp - 4], 4
mov dword [edx + 0x60], 0xffffffff
mov dword [edx + 0x64], closesocket
mov dword [edx + 0x68], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x1001b390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x1001b3c1
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1001b3b0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x10027c50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d28d2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.100a754a
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10027d04
lea eax, [ebp + 8]
mov dword [ebp + 8], str.bad_locale_name
push eax
lea ecx, [ebp - 0x1c]
call fcn.100abd78
mov byte [ebp - 4], 7
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x1c]
push 0x10121d68
push eax
call fcn.100b19eb
push eax
push esi
call fcn.100a7344
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100293f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2a68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
call fcn.10029320
test al, al
je 0x100294bc
call fcn.10029520
push eax
lea ecx, [ebp - 0x34]
call fcn.10010a20
mov byte [ebp - 4], 1
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10071160
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34]
call fcn.10010b20
lea ecx, [ebp - 0x4c]
call fcn.1000fc10
mov byte [ebp - 4], 4
call fcn.10045a80
mov dl, 1
mov ecx, 0x2718
call fcn.1002ae70
call fcn.1000f900
test al, al
je 0x1002948d
push 0
push 0x10056de0
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
call esi
push 0
push 0x10056de0
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10029496
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.10046dc0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4c]
call fcn.10010b20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.10029730
mov dword [ebp - 4], 0xffffffff
call fcn.1005dcc0
mov eax, dword [0x100e7744]
test eax, eax
je 0x1002950b
push 0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029ea0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
cmp edx, 1
jne 0x10029ff5
mov dword [ebp - 4], 0
call fcn.1000f600
test al, al
jne 0x10029ee9
call fcn.10055830
test al, al
je 0x1002a08e
call fcn.10055830
test al, al
jne 0x10029ff5
mov dword [ebp - 4], 0xffffffff
mov dword [0x100e7744], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x100e7740], eax
mov ecx, edi
call fcn.10029c80
call fcn.1002a0b0
push eax
lea ecx, [ebp - 0x38]
call fcn.10010a20
mov esi, eax
mov dword [ebp - 4], 2
call fcn.1002a220
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov edx, esi
call fcn.1002ba30
add esp, 4
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
call fcn.100573a0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 8
jb 0x10029f6c
push dword [ebp - 0x38]
call fcn.100ab40c
add esp, 4
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
xor eax, eax
mov word [ebp - 0x38], ax
mov ecx, edi
call fcn.10056fa0
mov dword [ebp - 4], 4
call fcn.1000f8f0
test al, al
je 0x10029f9c
call fcn.10045a80
call fcn.1000f920
test al, al
je 0x10029faa
call fcn.10045a80
call fcn.1000f910
test al, al
je 0x1002a00b
call fcn.10055160
test al, al
jne 0x1002a08e
call fcn.10045a80
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x100297a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x10029ff5
call fcn.10057420
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x100297a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, eax
lea ecx, [ebp - 0x20]
call fcn.10072920
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1002a04a
mov eax, dword [eax]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x1002a05c
call fcn.10057420
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.10012900
jmp 0x10029ff5
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b220
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d45bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 2
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov byte [ebp - 4], 3
mov dword [ecx + 0x44], 0xf
mov dword [ecx + 0x40], 0
mov byte [ecx + 0x30], 0
mov byte [ebp - 4], 4
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100437f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x7354734b
push 0x7324
push 0x100e9248
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xa
push eax
mov dword [ebp - 0xfc], 0x73567341
mov dword [ebp - 0xf8], 0x730a7345
mov dword [ebp - 0xf4], 0x73487340
mov dword [ebp - 0xf0], 0x73247348
call fcn.10054f40
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10044010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x4f254f0e
push 0x4f4b
push 0x100e92b8
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xf
push eax
mov dword [ebp - 0xfc], 0x4f394f28
mov dword [ebp - 0xf8], 0x4f3b4f32
mov dword [ebp - 0xf4], 0x4f064f3f
mov dword [ebp - 0xf0], 0x4f384f2e
mov dword [ebp - 0xec], 0x4f2a4f38
mov dword [ebp - 0xe8], 0x4f2e4f2c
mov dword [ebp - 0xe4], 0x4f4b
call fcn.10054f40
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x100442f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x433d431c
push 0x4358
push 0x100e92f4
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xf
push eax
mov dword [ebp - 0xfc], 0x432a433b
mov dword [ebp - 0xf8], 0x43284321
mov dword [ebp - 0xf4], 0x4315432c
mov dword [ebp - 0xf0], 0x432b433d
mov dword [ebp - 0xec], 0x4339432b
mov dword [ebp - 0xe8], 0x433d433f
mov dword [ebp - 0xe4], 0x4358
call fcn.10054f40
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10055060
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d75a0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10001840]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x40]
push eax
movdqu xmmword [ebp - 0x3c], xmm0
movdqu xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x40], 0
jne 0x100550b8
xor al, al
jmp 0x1005513c
push esi
push 0
xorps xmm0, xmm0
push 0x400
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.10072920
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0
test eax, eax
je 0x100550ef
mov eax, dword [eax]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x14], 0
sete dl
mov byte [ebp - 0x41], dl
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x1005513a
or edi, 0xffffffff
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x1005513a
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x10055137
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov dl, byte [ebp - 0x41]
mov al, dl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100acdae
mov esp, ebp
pop ebp
ret
Function at 0x10059b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100d7f78
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10001840]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x10001840]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x10059cd3
cmp byte [ebx + 0x45], 0
je 0x10059cd3
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10059ba0
xor al, al
jmp 0x10059cd5
mov ecx, 0xf
mov dword [esp + 0x2c], 0
mov dword [esp + 0x2c], ecx
lea eax, [esp + 0x18]
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x28], 0
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
jmp 0x10059c00
cmp ecx, 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x1c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10059c3b
dec eax
je 0x10059c3f
sub eax, 2
je 0x10059c9d
xor bl, bl
jmp 0x10059c9f
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x10059c7e
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.100ada85
add esp, 0x10
cmp esi, eax
jne 0x10059c37
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
cmp byte [ebx + 0x45], 0
je 0x10059c9d
test esi, esi
jne 0x10059c00
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.100177d0
jmp 0x10059bef
mov bl, 1
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x2c], 0x10
jb 0x10059cba
push dword [esp + 0x18]
call fcn.100ab40c
add esp, 4
mov dword [esp + 0x2c], 0xf
mov al, bl
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
jmp 0x10059cd5
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100acdae
mov esp, ebp
pop ebp
ret