joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454a97
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0xa
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 8]
je 0x454ac3
call dword [sym.imp.MSVCR80.dll__ltoa]
jmp 0x454ac9
call dword [sym.imp.MSVCR80.dll__ultoa]
add esp, 0xc
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push edi
push 0
push eax
push 0
mov esi, 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
test eax, eax
mov dword [ebp - 0x58], eax
je 0x454b12
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x454b12
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
test eax, eax
pop ecx
pop ecx
je 0x454b12
mov byte [eax], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x58]
pop edi
xor ecx, ebp
pop esi
call fcn.00456f61
leave
ret 0x10
Function at 0x4551c8
Capabilities:
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x4d8]
sub esp, 0x558
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp + 0x4d4], eax
mov eax, dword [ebp + 0x4e0]
push ebx
mov ebx, dword [ebp + 0x4e4]
push esi
push edi
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x4e8]
mov esi, 0x9c
push esi
mov dword [ebp - 0x7c], eax
xor edi, edi
lea eax, [ebp + 0x230]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp + 0x230]
mov dword [ebp + 0x230], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x455242
lea eax, [ebp + 0x230]
push eax
mov dword [ebp + 0x230], 0x94
call esi
cmp dword [ebp + 0x240], edi
je 0x45532d
cmp dword [ebp + 0x240], 2
jne 0x455264
cmp dword [ebp + 0x234], 4
jb 0x45532d
push 0x800
push 0x160
lea eax, [ebp + 0xd0]
push eax
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x45532d
test dword [ebp + 0xd8], 0x10000
je 0x45532d
lea eax, [ebp - 0x74]
push eax
push 0x46db3c
push 1
push edi
push 0x46dd6c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x45532d
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
lea edx, [ebp - 0x78]
push edx
push 0x46e30c
push eax
call dword [ecx]
test eax, eax
jl 0x455324
mov esi, 0x104
push esi
lea eax, [ebp + 0x2cc]
push eax
push 0xffffffffffffffff
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push edi
lea edx, [ebp + 0x2cc]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x45531b
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push 3
push dword [ebp - 0x80]
push eax
call dword [ecx + 0x4c]
test eax, eax
jl 0x45531b
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x70]
push edx
push esi
push dword [ebp - 0x7c]
push eax
call dword [ecx + 0xc]
test eax, eax
jge 0x455347
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov ecx, dword [ebp + 0x4d4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456f61
add ebp, 0x4d8
leave
ret
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
inc eax
jmp 0x45532f

Function at 0x456f61
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47a4b0]
jne 0x456f6b
repz ret
jmp fcn.00457801
Function at 0x45ae6c
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0xaec]
sub esp, 0xb6c
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp + 0xae8], eax
push ebx
xor ebx, ebx
cmp dword [0x47b600], ebx
jne 0x45b031
lea eax, [ebp + 0x39c]
push eax
push dword [0x47a730]
call fcn.00464692
cmp dword [ebp + 0x3a8], ebx
pop ecx
pop ecx
jne 0x45aebe
cmp dword [ebp + 0xaf4], ebx
je 0x45b031
push 0x103
lea eax, [ebp + 0x9e5]
push ebx
push eax
mov byte [ebp + 0x9e4], bl
call sub.MSVCR80.dll_memset
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x9e4]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [0x47b5ec]
mov dword [ebp - 0x7c], 1
call fcn.0045442a
add esp, 0x1c
cmp dword [ebp - 0x7c], ebx
jne 0x45af19
lea eax, [ebp + 0x39c]
push eax
push dword [0x47a730]
mov dword [ebp + 0x3a8], ebx
call fcn.004646c1
pop ecx
pop ecx
mov eax, dword [ebp - 0x80]
dec eax
je 0x45b01a
dec eax
je 0x45afce
dec eax
je 0x45afc6
dec eax
je 0x45afbe
dec eax
jne 0x45b031
lea eax, [ebp + 0x7dc]
push eax
call fcn.0041a3ec
lea eax, [ebp + 0x8e0]
push eax
call fcn.0041a20c
lea eax, [ebp + 0x7dc]
push eax
lea eax, [ebp + 0x8e0]
push eax
lea eax, [ebp + 0x6d8]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 5
lea eax, [ebp + 0x6d8]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x45b031
lea eax, [ebp + 0x8e0]
push eax
push 0x281a
call fcn.0046708d
push eax
call fcn.00460601
pop ecx
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call fcn.00453880
add esp, 0xc
jmp 0x45b031
push ebx
push 0x3fc
jmp 0x45b020
push ebx
push 0x3f6
jmp 0x45b020
lea eax, [ebp + 0x9e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x45b012
push 0x414
lea eax, [ebp - 0x78]
push ebx
push eax
call sub.MSVCR80.dll_memset
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x9e4]
push eax
mov dword [ebp - 0x78], 0x414
call fcn.0042b80c
add esp, 0x18
test eax, eax
jne 0x45b031
push ebx
push 0x10
jmp 0x45afad
push ebx
push 0x3ea
jmp 0x45b020
push ebx
push 0x3ec
push 0x111
push dword [0x47b5ec]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp + 0xae8]
xor ecx, ebp
pop ebx
call fcn.00456f61
add ebp, 0xaec
leave
ret
Function at 0x460a8d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x460b3a
push ebx
push esi
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
lea esi, [ebp - 4]
mov eax, edi
call fcn.004609f4
mov ecx, dword [ebp + 0x10]
xor esi, esi
cmp eax, esi
mov dword [ecx], eax
je 0x460af4
push esi
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
push ebx
call dword [sym.imp.GDI32.dll_RealizePalette]
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
push esi
push edi
lea eax, [eax + ecx*4]
add eax, edi
push eax
push 4
push edi
push ebx
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x460b1a
mov ecx, dword [edi + 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
cmp eax, esi
je 0x460b26
mov ecx, dword [edi + 8]
mov dword [eax], ecx
push ebx
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 4]
leave
ret
Function at 0x46102d
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x90
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp + 0x64], eax
mov ecx, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x70]
push edi
push dword [ebp + 0x74]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0x78]
call fcn.004015ea
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 0x28], edi
je 0x4611ed
push ebx
push esi
push 0x3f
lea eax, [ebp + 0x25]
push 0
push eax
mov byte [ebp + 0x24], 0
call sub.MSVCR80.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
test byte [edi + 8], 8
je 0x4610b8
push 0x28bf
call fcn.0046708d
push eax
call ebx
mov esi, eax
lea eax, [ebp + 0x24]
push eax
call ebx
add esi, eax
cmp esi, 0x40
jge 0x4610b8
push 0x28bf
call fcn.0046708d
push eax
lea eax, [ebp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test byte [edi + 8], 4
je 0x4610ef
push 0x28c0
call fcn.0046708d
push eax
call ebx
mov esi, eax
lea eax, [ebp + 0x24]
push eax
call ebx
add esi, eax
cmp esi, 0x40
jge 0x4610ef
push 0x28c0
call fcn.0046708d
push eax
lea eax, [ebp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test byte [edi + 8], 0x10
je 0x461126
push 0x28c1
call fcn.0046708d
push eax
call ebx
mov esi, eax
lea eax, [ebp + 0x24]
push eax
call ebx
add esi, eax
cmp esi, 0x40
jge 0x461126
push 0x28c1
call fcn.0046708d
push eax
lea eax, [ebp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test byte [edi + 8], 1
je 0x461195
push 0x3f
lea eax, [ebp - 0x1b]
push 0
push eax
mov byte [ebp - 0x1c], 0
call sub.MSVCR80.dll_memset
mov ax, word [edi + 0xa]
add esp, 0xc
lea esi, [ebp - 0x1c]
call fcn.0045904d
test eax, eax
jne 0x46116f
push 0x40
mov eax, esi
push eax
movzx eax, word [edi + 0xa]
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx eax, ax
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea eax, [ebp + 0x24]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x24]
call ebx
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
call ebx
add esi, eax
cmp esi, 0x40
jge 0x4611e8
lea eax, [ebp - 0x1c]
jmp 0x4611de
xor eax, eax
mov byte [ebp - 0x20], 0
lea edi, [ebp - 0x1f]
stosb byte es:[edi], al
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + 0xa]
push eax
lea eax, [ebp - 0x20]
push 0x469fc4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 0x24]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x20]
push eax
call ebx
mov esi, eax
lea eax, [ebp + 0x24]
push eax
call ebx
add esi, eax
cmp esi, 0x40
jge 0x4611e8
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
pop esi
inc eax
pop ebx
mov ecx, dword [ebp + 0x64]
xor ecx, ebp
pop edi
call fcn.00456f61
add ebp, 0x68
leave
ret
Function at 0x464369
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
mov esi, 0x400
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x674], ecx
push ebx
mov dword [ebp - 0x66c], ebx
mov dword [ebp - 0x670], eax
call edi
push dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetMenuItemID]
jmp 0x4643d4
add eax, 0xfffffbf9
cmp eax, 7
ja 0x4643db
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x66c]
call edi
push dword [ebp + 0xc]
push dword [ebp - 0x66c]
call ebx
cmp eax, 0xffffffff
jne 0x4643b5
mov edi, dword [ebp - 0x674]
add edi, 0xc
push edi
call fcn.00463d95
test eax, eax
pop ecx
jne 0x464428
push 0x40
lea eax, [ebp - 0x44]
push eax
mov edi, 0x406
push edi
call fcn.0046184d
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x66c]
call dword [sym.imp.USER32.dll_InsertMenuA]
mov eax, dword [ebp - 0x670]
push 0
push eax
call dword [eax]
jmp 0x464521
lea eax, [ebp - 0x148]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov byte [ebp + ebx - 0x148], 0x5c
inc ebx
push edi
mov byte [ebp + ebx - 0x148], 0
call fcn.00463d95
test eax, eax
pop ecx
mov dword [ebp - 0x670], eax
jle 0x464521
mov edi, 0x406
mov ecx, dword [ebp - 0x674]
push ebx
lea eax, [ebp - 0x148]
push eax
lea eax, [edi - 0x406]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.00464205
test eax, eax
je 0x464521
mov cl, byte [ebp - 0x24c]
lea edx, [ebp - 0x24c]
lea eax, [ebp - 0x454]
jmp 0x4644bf
cmp cl, 0x26
jne 0x4644b9
mov byte [eax], cl
inc eax
mov byte [eax], cl
inc eax
inc edx
mov cl, byte [edx]
test cl, cl
jne 0x4644b1
mov byte [eax], cl
lea eax, [ebp - 0x454]
push eax
push 0xa
pop ecx
lea eax, [edi - 0x405]
cdq
idiv ecx
lea eax, [ebp - 0x668]
push edx
push 0x46aeec
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x668]
push eax
mov eax, dword [ebp + 0xc]
push edi
push esi
lea eax, [eax + edi - 0x406]
push eax
push dword [ebp - 0x66c]
call dword [sym.imp.USER32.dll_InsertMenuA]
inc edi
lea eax, [edi - 0x406]
cmp eax, dword [ebp - 0x670]
jl 0x464474
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456f61
leave
ret 0xc
Function at 0x10002300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x100bcc40]
xor eax, esp
mov dword [esp + 0x14], eax
mov al, 0x65
xor edx, edx
push esi
mov esi, dword [esp + 0x20]
mov byte [esp + 9], al
mov byte [esp + 0xf], al
mov cl, 0x73
mov byte [esp + 0x13], al
lea eax, [esp + 8]
push edi
mov byte [esp + 0xc], 0x47
mov byte [esp + 0xe], 0x74
mov byte [esp + 0xf], 0x50
mov byte [esp + 0x10], 0x72
mov byte [esp + 0x11], 0x6f
mov byte [esp + 0x12], 0x63
mov byte [esp + 0x14], cl
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x48
mov byte [esp + 0x18], 0x61
mov byte [esp + 0x19], 0x70
mov byte [esp + 0x1a], dl
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], edx
mov dword [esp + 8], edx
mov byte [esi + 4], dl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, dl
jne 0x10002377
sub eax, edi
push eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.100014f0
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.1005b626
add esp, 0x18
ret

Function at 0x100091a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100091b9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100091f4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x100091f0
lea ebx, [ebx]
cmp esi, eax
jae 0x100091f4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100091e0
cmp esi, eax
jb 0x100091fa
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x1000a6a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.1003ed4a
Function at 0x1000a7f0
Capabilities:
Get hostname
Get session user name
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x10076854
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100bcc40]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
call fcn.1003e813
mov eax, dword [esi + 0x1b0]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
mov eax, dword [esi + 0x20]
push 1
push 0x80
push eax
call edi
mov eax, dword [esi + 0x1b0]
mov ecx, dword [esi + 0x20]
push eax
push 0
push 0x80
push ecx
call edi
mov edx, dword [esi + 0x17c]
push 0x21
push 0
push 0x1036
push edx
call edi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x1007ac90
lea edi, [esi + 0x15c]
push 0
mov ecx, edi
call fcn.1003f257
push 0xffffffffffffffff
push 0x64
push 0
push 0x1007ac88
push 1
mov ecx, edi
call fcn.1003f257
push 0xffffffffffffffff
push 0x78
push 0
push 0x1007ac80
push 2
mov ecx, edi
call fcn.1003f257
push 0xffffffffffffffff
push 0x78
push 0
push 0x1007ac78
push 3
mov ecx, edi
call fcn.1003f257
push 0x64
lea edi, [esi + 0x74]
push 0
push edi
call fcn.1005beb0
add esp, 0xc
lea eax, [esp + 0xc]
mov dword [edi], 0
push eax
lea ecx, [esi + 0x78]
mov edi, 0x20
push ecx
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], edi
push edx
lea edi, [esi + 0x98]
push edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
lea edi, [esi + 0xb8]
mov ecx, edi
mov dl, byte [eax]
mov byte [ecx], dl
inc eax
inc ecx
test dl, dl
jne 0x1000a913
push 0x18
call fcn.1003bf38
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
test eax, eax
je 0x1000a941
push esi
mov ecx, eax
call fcn.1003bd20
jmp 0x1000a943
xor eax, eax
push 0x7d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi + 0xf4], eax
call fcn.1000a720
mov ecx, dword [esi + 0xf4]
call fcn.1003bda0
push 0x18
call fcn.1003bf38
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 1
test eax, eax
je 0x1000a992
push esi
mov ecx, eax
call fcn.1003bb20
jmp 0x1000a994
xor eax, eax
push 0x7d1
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi + 0xf8], eax
call fcn.1000a720
mov ecx, dword [esi + 0xf8]
call fcn.1003bba0
mov ecx, esi
call fcn.10009100
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x1000ac50
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
push ebx
push ebp
mov ebp, dword [edi + 4]
xor edx, edx
push esi
lea esi, [ecx + eax + 0x18]
mov dword [esp + 0xc], 0
cmp dx, word [eax + 6]
jae 0x1000ad2c
add esi, 0x10
mov ecx, dword [esi]
test ecx, ecx
jne 0x1000acc2
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax + 0x38]
test ebx, ebx
jle 0x1000ad12
mov ecx, dword [edi + 0x34]
mov edx, dword [esi - 4]
mov eax, dword [edi + 0x1c]
push ecx
push 4
push 0x1000
add edx, ebp
push ebx
push edx
call eax
add esp, 0x14
test eax, eax
je 0x1000ad36
mov eax, dword [esi - 4]
push ebx
add eax, ebp
push 0
push eax
mov dword [esi - 8], eax
call fcn.1005beb0
jmp 0x1000ad0f
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x18]
add edx, ecx
push edx
call fcn.1000ac40
add esp, 4
test eax, eax
je 0x1000ad36
mov eax, dword [edi + 0x34]
mov edx, dword [edi + 0x1c]
push eax
push 4
push 0x1000
push ecx
mov ecx, dword [esi - 4]
add ecx, ebp
push ecx
call edx
add esp, 0x14
test eax, eax
je 0x1000ad36
mov ecx, dword [esi + 4]
mov eax, dword [esi]
add ecx, dword [esp + 0x14]
mov ebx, dword [esi - 4]
push eax
add ebx, ebp
push ecx
push ebx
call fcn.1005c010
mov dword [esi - 8], ebx
add esp, 0xc
mov edx, dword [edi]
mov eax, dword [esp + 0xc]
movzx ecx, word [edx + 6]
inc eax
add esi, 0x28
cmp eax, ecx
mov dword [esp + 0xc], eax
jl 0x1000ac78
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x1000ae10
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov ecx, dword [ebp + 0x3c]
push esi
push edi
mov edi, dword [ebp]
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov eax, dword [esi + 8]
push ecx
mov dword [esp + 0x18], eax
call fcn.1000ac10
add esp, 4
mov ecx, esi
mov edx, ebp
mov dword [esp + 0x18], eax
call fcn.1000ad40
mov edx, dword [esi + 0x24]
mov dword [esp + 0x1c], eax
mov eax, 1
add esi, 0x28
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], 1
cmp ax, word [edi + 6]
jae 0x1000af1d
mov eax, dword [esi + 8]
mov ecx, dword [ebp + 0x3c]
push ecx
mov dword [esp + 0x30], eax
call fcn.1000ac10
add esp, 4
mov ecx, esi
mov edx, ebp
mov ebx, eax
call fcn.1000ad40
mov edi, eax
cmp dword [esp + 0x18], ebx
je 0x1000aecf
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
add edx, eax
cmp edx, ebx
ja 0x1000aecf
lea ecx, [esp + 0x14]
mov eax, ebp
call fcn.1000ad60
test eax, eax
je 0x1000af3e
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 0x24]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], edx
jmp 0x1000aefe
mov eax, dword [esi + 0x24]
test eax, 0x2000000
je 0x1000aee9
test dword [esp + 0x20], 0x2000000
je 0x1000aee9
or dword [esp + 0x20], eax
jmp 0x1000aef6
or eax, dword [esp + 0x20]
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
sub edi, dword [esp + 0x14]
add edi, dword [esp + 0x2c]
mov ecx, dword [ebp]
mov eax, dword [esp + 0x10]
movzx edx, word [ecx + 6]
inc eax
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
jl 0x1000ae73
lea ecx, [esp + 0x14]
mov eax, ebp
mov dword [esp + 0x24], 1
call fcn.1000ad60
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x10012fc0
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x10077269
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100bcc40]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100bcc40]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov edi, dword [esp + 0x74]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov dword [esp + 0x1c], edi
mov byte [edi + 4], bl
push ebx
push 0x1007aa5f
mov ecx, edi
mov dword [esp + 0x74], ebx
mov dword [esp + 0x20], 1
mov byte [esp + 0x28], 0x5f
mov byte [esp + 0x29], 0x30
mov byte [esp + 0x2a], 0x31
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x2c], 0x33
mov byte [esp + 0x2d], 0x34
mov byte [esp + 0x2e], 0x35
mov byte [esp + 0x2f], 0x36
mov byte [esp + 0x30], 0x37
mov byte [esp + 0x31], 0x38
mov byte [esp + 0x32], 0x39
mov byte [esp + 0x33], 0x61
mov byte [esp + 0x34], 0x62
mov byte [esp + 0x35], 0x63
mov byte [esp + 0x36], 0x64
mov byte [esp + 0x37], 0x65
mov byte [esp + 0x38], 0x66
mov byte [esp + 0x39], 0x67
mov byte [esp + 0x3a], 0x68
mov byte [esp + 0x3b], 0x69
mov byte [esp + 0x3c], 0x6a
mov byte [esp + 0x3d], 0x6b
mov byte [esp + 0x3e], 0x6c
mov byte [esp + 0x3f], 0x6d
mov byte [esp + 0x40], 0x6e
mov byte [esp + 0x41], 0x6f
mov byte [esp + 0x42], 0x70
mov byte [esp + 0x43], 0x71
mov byte [esp + 0x44], 0x72
mov byte [esp + 0x45], 0x73
mov byte [esp + 0x46], 0x74
mov byte [esp + 0x47], 0x75
mov byte [esp + 0x48], 0x76
mov byte [esp + 0x49], 0x77
mov byte [esp + 0x4a], 0x78
mov byte [esp + 0x4b], 0x79
mov byte [esp + 0x4c], 0x7a
mov byte [esp + 0x4d], 0x41
mov byte [esp + 0x4e], 0x42
mov byte [esp + 0x4f], 0x43
mov byte [esp + 0x50], 0x44
mov byte [esp + 0x51], 0x45
mov byte [esp + 0x52], 0x46
mov byte [esp + 0x53], 0x47
mov byte [esp + 0x54], 0x48
mov byte [esp + 0x55], 0x49
mov byte [esp + 0x56], 0x4a
mov byte [esp + 0x57], 0x4b
mov byte [esp + 0x58], 0x4c
mov byte [esp + 0x59], 0x4d
mov byte [esp + 0x5a], 0x4e
mov byte [esp + 0x5b], 0x4f
mov byte [esp + 0x5c], 0x50
mov byte [esp + 0x5d], 0x51
mov byte [esp + 0x5e], 0x52
mov byte [esp + 0x5f], 0x53
mov byte [esp + 0x60], 0x54
mov byte [esp + 0x61], 0x55
mov byte [esp + 0x62], 0x56
mov byte [esp + 0x63], 0x57
mov byte [esp + 0x64], 0x58
mov byte [esp + 0x65], 0x59
mov byte [esp + 0x66], 0x5a
mov byte [esp + 0x67], bl
call fcn.100014f0
mov ebp, dword [esp + 0x78]
xor esi, esi
cmp ebp, ebx
jle 0x100131b1
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10008b30
add eax, esi
push eax
call fcn.1005e03c
add esp, 4
call fcn.1005e04e
cdq
mov ecx, 0x3e
idiv ecx
mov ecx, edi
mov dl, byte [esp + edx + 0x20]
mov byte [esp + 0x14], dl
mov eax, dword [esp + 0x14]
push eax
push 1
call fcn.1000d080
push 0xa
call ebx
inc esi
cmp esi, ebp
jl 0x10013175
mov eax, edi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.1005b626
add esp, 0x5c
ret