joyce8/EMBER2024-capa huggingface dataset:
Function at 0xda4e00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0xdba8f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0xda4ed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.00da17a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0xda4e61
mov edx, dword [eax]
jmp 0xda4e63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00da3050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0xda4ebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xda4ebf
cmp esi, edi
je 0xda4ebf
mov ecx, esi
call fcn.00d9ca00
push esi
call fcn.00daa1c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00da1990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0xda4ef5
mov eax, dword [eax]
jmp 0xda4ef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.00da0640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0xda4f25
mov eax, dword [eax]
jmp 0xda4f27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0xda4f76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xda4f76
cmp esi, edi
je 0xda4f76
mov eax, dword [esi]
cmp eax, edi
je 0xda4f5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0xda4f6d
push eax
call fcn.00daa1c8
add esp, 4
push esi
call fcn.00daa1c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xda4f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0xda4ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xda5035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00da4e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0xda4fc5
mov edi, 0xdbf8b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xda5035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00da4e00
add edi, 4
add esp, 0xc
cmp edi, 0xdbf8c0
jb 0xda5000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0xda5070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00dab082
mov esi, eax
add esp, 8
test esi, esi
je 0xda5107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0xda5102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00daa946
add esp, 8
test eax, eax
je 0xda50e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0xda50e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00daa946
add esp, 8
test eax, eax
jne 0xda50c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0xda5102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0xda5f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xdba9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xda6002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00da9dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xda6002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00da16e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00daa20b
push 0x10
call fcn.00daa1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xda5fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00d961c0
jmp 0xda5fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00da5b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xda5ff0
mov ecx, edi
call fcn.00d962c0
push edi
call fcn.00daa1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xda6021
inc ebx
cmp ebx, 0x20
jb 0xda5f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xda7250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xdbb808
push 0xdab288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xda7329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xda7329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00daa1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xda7329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xda7329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xda732c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00da7351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xda7d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xda7d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xda7d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xda7d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xda7d94
push eax
push esi
call fcn.00daa20b
add esp, 8
pop esi
ret 0x10

Function at 0xda7da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xda7e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xda7e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xdc0320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00da9dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xda7dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xda7e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xda7ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xda7eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xdc0320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00da9dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xda7eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xda7e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xda8000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xda8131
push esi
call fcn.00dab145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00d9a080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xda8131
push 0
push ebp
call fcn.00d9a3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00d9a260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xda808b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00d9a2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xda8121
push 0xdc0918
push edi
call fcn.00da93f0
push eax
push ebx
push esi
call fcn.00da7f60
push 0xdc08f8
push edi
call fcn.00da93f0
push eax
push ebx
push esi
call fcn.00da7f60
push 0xdc08d8
push edi
call fcn.00da93f0
push eax
push ebx
push esi
call fcn.00da7f60
push 0xdc08c0
push edi
call fcn.00da93f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00da7f60
push 0xdc08a0
push edi
call fcn.00da93f0
push eax
push ebx
push esi
call fcn.00da7f60
push 0xdc0888
push edi
call fcn.00da93f0
push eax
push ebx
push esi
call fcn.00da7f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xda91b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00da9140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00da9140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00da9140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00da9140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xda9bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xda9c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xdbb87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xda9c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xda9c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10001c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10149de0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov cl, 0x64
mov al, 0x6c
push esi
mov byte [ebp - 0xe], cl
mov byte [ebp - 0xa], cl
mov byte [ebp - 0x23], cl
mov cl, 0x69
push edi
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc], al
mov byte [ebp - 9], al
mov byte [ebp - 8], al
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x24]
mov dl, 0x6e
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x1d], cl
mov byte [ebp - 0x1a], cl
push eax
lea ecx, [ebp - 0x10]
mov bl, 0x74
push ecx
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 7], 0
mov byte [ebp - 0x24], 0x4c
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x49
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x1e], bl
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x19], 0x7a
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0x6b
mov byte [ebp - 0x12], 0
call fcn.100d9cf0
mov ebx, eax
xor esi, esi
lea edi, [esi + ebx]
push edi
lea edx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
call fcn.1000fbb0
mov edx, dword [ebp - 0x28]
mov cl, byte [edx]
cmp cl, 0xe8
je 0x10001d61
cmp cl, 0xe9
je 0x10001d61
add esi, eax
cmp esi, 0x1000
jb 0x10001d22
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007168f
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 1]
mov ecx, dword [ebp - 4]
lea eax, [eax + edi + 5]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007168f
mov esp, ebp
pop ebp
ret

Function at 0x100031a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10149de0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10168028], 0
jne 0x10003250
mov byte [0x10168028], 1
call fcn.10002900
call fcn.10003260
call fcn.100036a0
mov dword [0x10168024], eax
mov al, 0x73
mov cl, 0x65
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x14], al
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x20]
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xc], cl
mov byte [ebp - 0x15], cl
mov dl, 0x6f
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1e], 0x57
mov byte [ebp - 0x1d], dl
mov byte [ebp - 0x1c], 0x77
mov byte [ebp - 0x1b], 0x36
mov byte [ebp - 0x1a], 0x34
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x12], 0
call dword [0x100eb3e8]
push eax
call dword [0x100eb3e4]
mov dword [0x10168020], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007168f
mov esp, ebp
pop ebp
ret
Function at 0x100036a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x10149de0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x65
mov cl, 0x74
mov byte [ebp - 0xf], al
mov byte [ebp - 0xc], al
mov byte [ebp - 0x23], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x17], al
lea eax, [ebp - 0x24]
mov byte [ebp - 0x22], cl
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x18], cl
mov dl, 0x6e
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x76
mov byte [ebp - 0x1b], 0x53
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x49
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0
call dword [0x100eb3e8]
push eax
call dword [0x100eb3e4]
test eax, eax
je 0x10003782
xor ecx, ecx
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
call eax
mov eax, dword [ebp - 0x48]
cmp ax, 6
je 0x1000376f
cmp ax, 9
jne 0x10003782
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007168f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.1007168f
mov esp, ebp
pop ebp
ret
Function at 0x100083b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10149de0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x74
push ebx
mov byte [ebp - 0x23], al
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x15], al
mov al, 0x6c
mov cl, 0x64
push esi
mov byte [ebp - 8], al
mov byte [ebp - 7], al
lea eax, [ebp - 0x28]
mov dl, 0x69
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x10], cl
mov byte [ebp - 9], cl
mov bl, 0x77
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x28], 0x44
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], 0x6d
mov byte [ebp - 0x25], 0x53
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x22], 0x57
mov byte [ebp - 0x21], dl
mov byte [ebp - 0x20], 0x6e
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], bl
mov byte [ebp - 0x1c], 0x41
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], dl
mov byte [ebp - 0x17], 0x62
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], dl
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 6], 0
call fcn.100d9cf0
mov esi, eax
test esi, esi
je 0x10008475
push 4
lea edx, [ebp - 0x30]
push edx
push 2
mov ebx, 1
push edi
mov dword [ebp - 0x30], ebx
call esi
push 4
lea eax, [ebp - 0x2c]
push eax
push 3
push edi
mov dword [ebp - 0x2c], ebx
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1007168f
mov esp, ebp
pop ebp
ret

Function at 0x1000b9e0
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Hash data with crc32
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e28
call fcn.10079fe0
mov eax, dword [0x10149de0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, edx
push 0x101126b0
mov edi, ecx
mov dword [ebp - 0x1e18], eax
mov dword [ebp - 0x1e0c], esi
jmp loc.104c42bf

Function at 0x10013e42
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push 0x840971d4
call fcn.101c42f5
mov word [ebp - 0x96], cx
mov ecx, 0x9ca5b91
not ecx
movzx ecx, sp
push eax
movsx ecx, cx
movsx cx, ch
lea ecx, [ebp - 0xd8]
jmp fcn.103ba5ad

Function at 0x1001d840
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
xor ecx, ecx
test edx, edx
jbe 0x1001d86f
push ebx
push edi
jmp 0x1001d850
movzx edi, byte [ecx + esi]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x1014ee50]
inc ecx
cmp ecx, edx
jb 0x1001d850
pop edi
pop ebx
not eax
ret
Function at 0x1001ec80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0xc69b04
call fcn.1007178a
mov esi, eax
shl esi, 0x10
call fcn.1007178a
or eax, esi
mov dword [0xc69b0c], eax
xor esi, esi
call fcn.1007178a
mov ebx, eax
shl ebx, 0x10
call fcn.1007178a
mov ecx, dword [0xc69b08]
or eax, ebx
mov dword [esi + ecx], eax
call fcn.1007178a
mov ecx, dword [0xc69b08]
shl eax, 4
cdq
and edx, 0x7fff
add eax, edx
mov edx, dword [0xc69b0c]
xor edx, dword [ebp + 8]
sar eax, 0xf
mov dword [edi], eax
mov dword [ecx + eax*4], edx
xor dword [edi], 0xc0017921
add esi, 4
cmp esi, 0x40
jl 0x1001eca3
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10037030
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test esi, esi
jbe 0x10037048
mov dl, byte [eax + ecx]
xor dl, 0xd1
shr dl, 1
dec dl
mov byte [eax + ecx], dl
inc eax
cmp eax, esi
jb 0x10037036
ret

Function at 0x1003bf79
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
bsf eax, edx
push 0x100e8487
cmovge eax, ebx
mov eax, dword fs:[0]
push eax
sub esp, 0x114
sub eax, 0x32731f19
cwde
movsx eax, di
mov eax, dword [0x10149de0]
test ax, 0x78e0
xor eax, ebp
jmp loc.104a5142

Function at 0x10040527
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
push 0x83db820f
call fcn.103dbcab
xor edx, ebx
clc
xor eax, ebx
cmp dword [eax], edx
jmp loc.1038578a

Function at 0x10040a20
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
push 0x10113f34
jmp loc.104021e1

Function at 0x100493f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10149de0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x65
mov cl, 0x6c
mov dl, 0x72
mov byte [ebp - 8], cl
mov byte [ebp - 7], cl
mov cl, 0x74
mov byte [ebp - 0xe], al
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x2a], al
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x17], al
lea eax, [ebp - 0x30]
mov byte [ebp - 0x2e], cl
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x15], cl
mov byte [ebp - 0xd], dl
mov byte [ebp - 0x2b], dl
mov byte [ebp - 0x21], dl
mov dl, 0x6e
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x64
mov byte [ebp - 6], 0
mov byte [ebp - 0x30], 0x53
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x70
mov byte [ebp - 0x25], 0x69
mov byte [ebp - 0x24], 0x41
mov byte [ebp - 0x23], 0x77
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x1f], dl
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x43
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], dl
mov byte [ebp - 0x16], 0x78
mov byte [ebp - 0x14], 0
call fcn.100d9cf0
test eax, eax
je 0x100494bc
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007168f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.1007168f
mov esp, ebp
pop ebp
ret