joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a811
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4e5e60]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x49a851
cmp byte [ebx], 0xa
jne 0x49a851
or byte [eax + edi + 0x28], 4
jmp 0x49a856
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x49a954
mov al, byte [edx]
cmp al, 0x1a
je 0x49a936
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x49a885
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x49a8aa
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x49a8b4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x49a867
jmp 0x49a954
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49a931
cmp dword [ebp - 0xc], 0
je 0x49a931
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4e5e60]
test byte [eax + edi + 0x28], 0x48
je 0x49a90b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x49a8f6
mov byte [esi], dl
jmp 0x49a907
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4e5e60]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x49a954
cmp byte [ebp - 1], 0xa
jne 0x49a91a
cmp esi, ebx
jne 0x49a91a
mov byte [esi], 0xa
jmp 0x49a953
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004909c2
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x49a954
mov byte [esi], 0xd
jmp 0x49a953
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4e5e60]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x49a950
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x49a954
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x49a95d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4e5e60]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x49a9a0
cmp word [esi], dx
jne 0x49a9a0
or byte [edi + eax + 0x28], 4
jmp 0x49a9a5
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x49aaf8
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x49aad8
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x49a9e7
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x49aa1d
cmp eax, edx
jae 0x49aa29
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x49a9bf
jmp 0x49aaf8
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49aad4
cmp dword [ebp - 0x14], 0
je 0x49aad4
mov eax, dword [ebx*4 + 0x4e5e60]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x49aaac
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x49aa75
mov word [esi], cx
jmp 0x49aaa8
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4e5e60]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4e5e60]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4e5e60]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x49aaf8
pop ebx
cmp word [ebp - 4], bx
jne 0x49aabd
cmp esi, dword [ebp + 0xc]
jne 0x49aabd
mov word [esi], bx
jmp 0x49aaf5
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004909c2
add esp, 0x10
cmp word [ebp - 4], bx
je 0x49aaf8
push 0xd
jmp 0x49aaf1
mov ecx, dword [ebx*4 + 0x4e5e60]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x49aaef
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x49aaf8
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x49d295
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0049d211
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x49d40d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x49d40d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x49d3bc
jg 0x49d2ee
test eax, eax
je 0x49d3b2
push 1
push 0x1000
call fcn.0048fa47
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x49d314
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x49d3a9
push 0x8000
push ebx
call fcn.0048c421
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x49d340
jg 0x49d33b
cmp ecx, 0x1000
jb 0x49d340
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0049057b
add esp, 0x10
cmp eax, 0xffffffff
je 0x49d385
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x49d33b
jl 0x49d36c
test ecx, ecx
jne 0x49d32d
push dword [ebp - 0xc]
push ebx
call fcn.0048c421
push esi
call fcn.0048e3b1
add esp, 0xc
xor edi, edi
jmp 0x49d41e
cmp byte [edi + 0x24], 0
je 0x49d39c
cmp dword [edi + 0x20], 5
jne 0x49d39c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x49d3a7
mov edi, dword [edi + 0x18]
jmp 0x49d3a9
xor edi, edi
push esi
call fcn.0048e3b1
pop ecx
jmp 0x49d41e
test ecx, ecx
jg 0x49d37e
jl 0x49d3bc
test eax, eax
jae 0x49d37e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004909c2
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x49d3df
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x49d37e
jmp 0x49d416
push ebx
call fcn.00496686
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x49d37e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x49d41e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x49d41b
mov edi, dword [edi + 0x18]
jmp 0x49d41e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004909c2
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x49d8a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49d8cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49d8cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1000141c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x2e
mov byte [ebp - 0xe], 0x44
mov byte [ebp - 0xd], 0x4c
mov byte [ebp - 0xc], 0x4c
mov byte [ebp - 0xb], 0
push str.waveOutWrite
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov dl, byte [ecx + 0x45]
test edx, edx
jne 0x10001487
mov ecx, dword [ebp - 0x18]
call fcn.10001685
and eax, 0xff
test eax, eax
jne 0x10001487
xor al, al
jmp 0x100014f4
mov dword [ebp - 8], 0
jmp 0x1000149c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0xc]
jae 0x100014f2
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + ecx*4 + 0x10]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0x20
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4 + 0x38]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x40]
push eax
call dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov edx, 1
sub edx, dword [ecx + 0x20]
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x20], edx
jmp 0x10001490
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x100014fa
Capabilities:
Contain obfuscated stackstrings
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x20], 0x57
mov byte [ebp - 0x1f], 0x49
mov byte [ebp - 0x1e], 0x4e
mov byte [ebp - 0x1d], 0x4d
mov byte [ebp - 0x1c], 0x4d
mov byte [ebp - 0x1b], 0x2e
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x4c
mov byte [ebp - 0x18], 0x4c
mov byte [ebp - 0x17], 0
push str.waveInGetNumDevs
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
push str.waveInOpen
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
call dword [ebp - 0x10]
test eax, eax
jne 0x1000156b
xor al, al
jmp 0x10001681
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
push 4
mov eax, dword [ebp - 0x24]
push eax
push 0x100017ce
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x2c], eax
push 0x20000
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x24]
add eax, 0x46
push eax
push 0xffff
mov ecx, dword [ebp - 0x24]
add ecx, 0x18
push ecx
call dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100015c2
xor al, al
jmp 0x10001681
mov dword [ebp - 0xc], 0
jmp 0x100015d4
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 2
jge 0x10001641
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax*4 + 0x30]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + eax*4 + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + ecx*4 + 0x30]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax*4 + 0x30]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax*4 + 0x30]
mov dword [edx + 0x14], 0
push 0x20
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax*4 + 0x30]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18]
push ecx
call dword [0x10025ec0]
jmp 0x100015cb
push 0x20
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x1c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax*4 + 0x30]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18]
push ecx
call dword [0x10025eb8]
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x18]
push edx
call dword [0x10025eb4]
mov eax, dword [ebp - 0x24]
mov byte [eax + 0x44], 1
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10001685
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x49
mov byte [ebp - 0x16], 0x4e
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x4d
mov byte [ebp - 0x13], 0x2e
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x11], 0x4c
mov byte [ebp - 0x10], 0x4c
mov byte [ebp - 0xf], 0
push str.waveOutGetNumDevs
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
call dword [ebp - 8]
test eax, eax
jne 0x100016dd
xor al, al
jmp 0x100017ca
mov dword [ebp - 0xc], 0
jmp 0x100016ef
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 2
jge 0x10001713
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx*4 + 0x10]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
jmp 0x100016e6
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x46
push ecx
push 0xffff
mov edx, dword [ebp - 0x1c]
add edx, 0x40
push edx
call dword [0x10025eac]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10001742
xor al, al
jmp 0x100017ca
mov dword [ebp - 0xc], 0
jmp 0x10001754
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x100017c1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx*4 + 0x38]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx + ecx*4 + 0x10]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + edx*4 + 0x38]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx*4 + 0x38]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx*4 + 0x38]
mov dword [eax + 0x14], 0
push 0x20
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx*4 + 0x38]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x40]
push edx
call dword [0x10025eb0]
jmp 0x1000174b
mov eax, dword [ebp - 0x1c]
mov byte [eax + 0x45], 1
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10001bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [eax], 0x1001e220
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 8], 0
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], 0x6f
mov byte [ebp - 8], 0x6e
mov byte [ebp - 7], 0
lea ecx, [ebp - 0x20]
push ecx
push 0x100220b8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x24]
add edx, 0x10
push edx
call dword [ebp - 4]
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret

Function at 0x10001cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x1c], 0x4c
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0x19], 0x76
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x43
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x69
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x6e
mov byte [ebp - 8], 0
lea eax, [ebp - 0x1c]
push eax
push 0x100220c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x20]
call fcn.10001ff0
mov edx, dword [ebp + 0xc]
add edx, eax
push edx
mov ecx, dword [ebp - 0x20]
call fcn.1000201c
cmp eax, 0xffffffff
jne 0x10001d6c
mov eax, dword [ebp - 0x20]
add eax, 0x10
push eax
call dword [ebp - 4]
xor eax, eax
jmp 0x10001d9f
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 8]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x20]
add edx, 0x10
push edx
call dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x10001eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x1c], 0x4c
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0x19], 0x76
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x43
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x69
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x6e
mov byte [ebp - 8], 0
lea eax, [ebp - 0x1c]
push eax
push 0x100220e8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x20]
call fcn.10001fdf
cmp dword [ebp + 0xc], eax
jbe 0x10001f51
mov edx, dword [ebp - 0x20]
add edx, 0x10
push edx
call dword [ebp - 4]
xor eax, eax
jmp 0x10001fd9
mov ecx, dword [ebp - 0x20]
call fcn.10001ff0
cmp dword [ebp + 0xc], eax
jbe 0x10001f69
mov ecx, dword [ebp - 0x20]
call fcn.10001ff0
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
je 0x10001fbb
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x20]
call fcn.10001fdf
sub eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
add edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 8]
sub eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 8], eax
mov ecx, dword [ebp - 0x20]
call fcn.10001ff0
push eax
mov ecx, dword [ebp - 0x20]
call fcn.10002140
mov edx, dword [ebp - 0x20]
add edx, 0x10
push edx
call dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x1000201c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x18], 0x56
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x41
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
push 0x100220f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x24]
call fcn.10001fdf
cmp dword [ebp + 8], eax
jae 0x10002086
xor eax, eax
jmp 0x1000213a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
fild qword [ebp - 0x2c]
fdiv qword [0x1001e228]
sub esp, 8
fstp qword [esp]
call dword [sym.imp.MSVCRT.dll_ceil]
add esp, 8
call sub.MSVCRT.dll__ftol
shl eax, 0xa
mov dword [ebp - 4], eax
push 4
push 0x1000
mov edx, dword [ebp - 4]
push edx
push 0
call dword [ebp - 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x100020d4
or eax, 0xffffffff
jmp 0x1000213a
mov ecx, dword [ebp - 0x24]
call fcn.10001ff0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 4], 0
je 0x10002113
push 0x8000
push 0
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
add ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov dword [edx + 8], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10002140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x18], 0x56
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x41
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
push 0x10022108
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x24]
call fcn.10001ff0
cmp dword [ebp + 8], eax
jae 0x100021aa
xor eax, eax
jmp 0x1000225b
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
fild qword [ebp - 0x2c]
fdiv qword [0x1001e228]
sub esp, 8
fstp qword [esp]
call dword [sym.imp.MSVCRT.dll_ceil]
add esp, 8
call sub.MSVCRT.dll__ftol
shl eax, 0xa
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
call fcn.10001fdf
cmp dword [ebp - 4], eax
jae 0x100021eb
xor eax, eax
jmp 0x1000225b
push 4
push 0x1000
mov edx, dword [ebp - 4]
push edx
push 0
call dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
call fcn.10001ff0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0x8000
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0xc]
mov esp, ebp
pop ebp
ret 4