joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000127d
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x1002c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x244], eax
mov eax, dword [ebp + 0x18]
push str.mscoree.dll
mov dword [ebp - 0x248], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x100012df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_load_mscoree.dll__Error_code__d_._This_custom_action_requires_the_.NET_Framework_to_be_installed.
push dword [ebp + 8]
call fcn.10003ff9
add esp, 0xc
xor al, al
jmp 0x10001420
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetRequestedRuntimeInfo
push edi
call esi
push str.CorBindToRuntimeEx
push edi
mov dword [ebp - 0x23c], eax
call esi
mov esi, eax
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x100013ff
test esi, esi
je 0x100013ff
xor edx, edx
test ebx, ebx
je 0x1000136e
cmp word [ebx], dx
je 0x1000136e
push 0x14
push ebx
lea eax, [ebp - 0x2c]
push 0x14
push eax
call fcn.10007001
add esp, 0x10
lea eax, [ebp - 0x2c]
push eax
push str.Binding_to_CLR_version__s
push dword [ebp + 8]
call fcn.10003ff9
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push 0x100162c0
push 0x100162b0
push 2
push 0
lea eax, [ebp - 0x2c]
push eax
call esi
test eax, eax
jns 0x100013b7
push eax
push str.Failed_to_bind_to_the_CLR._Error_code_0x_X
jmp 0x1000140b
push edx
push 0x14
lea ecx, [ebp - 0x2c]
push ecx
push edx
push 0x104
lea ecx, [ebp - 0x234]
push ecx
push edx
push edx
push dword [ebp - 0x240]
push edx
push dword [ebp - 0x244]
call eax
test eax, eax
jns 0x10001330
push eax
push str.Failed_to_get_requested_CLR_info._Error_code_0x_x
push dword [ebp + 8]
call fcn.10003ff9
push str.Ensure_that_the_proper_version_of_the_.NET_Framework_is_installed__or_that_there_is_a_matching_supportedRuntime_element_in_CustomAction.config._If_you_are_binding_to_.NET_4_or_greater_add_useLegacyV2RuntimeActivationPolicytrue_to_the__startup__element.
push dword [ebp + 8]
call fcn.10003ff9
add esp, 0x14
jmp 0x10001416
mov eax, dword [ebp - 0x238]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
jns 0x100013e6
push eax
push str.Failed_to_start_the_CLR._Error_code_0x_X
push dword [ebp + 8]
call fcn.10003ff9
mov eax, dword [ebp - 0x238]
add esp, 0xc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10001416
mov ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x238]
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
jmp 0x1000141f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_locate_functions_in_mscoree.dll__Error_code__d_._This_custom_action_requires_the_.NET_Framework_to_be_installed.
push dword [ebp + 8]
call fcn.10003ff9
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.100048e3
leave
ret 0x14
Function at 0x10001721
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100017a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100017a5
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x100017a1
push 0x5c
mov edx, eax
pop edi
cmp dx, di
jne 0x1000175d
mov ebx, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x10001756
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x100017a1
xor eax, eax
push edi
mov word [ebx], ax
call fcn.10001721
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
jne 0x100017a4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100017a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100017a4
or esi, 0xffffffff
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002313
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
push 2
pop ebx
mov ecx, dword [esi + 8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
test ax, ax
jne 0x10002321
sub ecx, edx
sar ecx, 1
lea edi, [ecx + 0xa]
xor ecx, ecx
mov eax, edi
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000492c
mov dword [esi + 0xc], eax
pop ecx
test eax, eax
jne 0x10002354
push 0xe
pop eax
pop edi
pop esi
pop ebx
ret
push str..pipe_
push edi
push eax
call fcn.1000903e
push dword [esi + 8]
push edi
push dword [esi + 0xc]
call fcn.10008fc9
add esp, 0x18
mov ecx, esi
cmp byte [esi + 0x40], 0
pop edi
pop esi
pop ebx
jne 0x100023bf
jmp 0x10002383
push esi
push edi
xor esi, esi
mov edi, ecx
push esi
push 0x40000000
push 3
push esi
push esi
push 0xc0000000
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x10], eax
cmp eax, 0xffffffff
je 0x100023af
mov byte [edi + 0x42], 1
jmp 0x100023ba
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
pop edi
mov eax, esi
pop esi
ret
push ebx
push esi
push edi
xor ebx, ebx
mov eax, 0x400
push ebx
push ebx
push eax
push eax
push 1
mov edi, ecx
mov esi, ebx
push ebx
push 0x40080003
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ecx, eax
mov dword [edi + 0x10], ecx
cmp ecx, 0xffffffff
jne 0x100023f9
mov dword [edi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10002446
lea eax, [edi + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1000240e
mov byte [edi + 0x42], 1
jmp 0x10002446
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov esi, eax
cmp esi, 0xe7
jne 0x10002438
push 0x4e20
push dword [edi + 0xc]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x10002408
call ebx
mov esi, eax
cmp esi, 0x3e5
jne 0x10002446
xor esi, esi
mov byte [edi + 0x41], 1
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x1000244c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c0
mov eax, dword [0x1002c004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002c920], 0
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x6c0], eax
jne 0x10002487
test esi, esi
jne 0x10002487
push eax
push dword [ebp + 8]
call fcn.10002756
jmp 0x10002606
mov byte [ebp - 0x6a9], 0
push edi
mov edi, dword [ebp + 8]
test esi, esi
jne 0x100024c9
push 0x104
lea eax, [ebp - 0x43c]
push eax
push dword [0x1002c91c]
push edi
call fcn.10003da2
test al, al
jne 0x100024bc
mov eax, 0x643
jmp 0x10002605
lea esi, [ebp - 0x43c]
mov byte [ebp - 0x6a9], 1
push ebx
push esi
mov ebx, pe_nt_image_headers32
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.100014ae
push str.CustomAction.config
push ebx
lea eax, [ebp - 0x234]
push eax
call fcn.10001430
lea ebx, [ebp - 0x234]
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
push esi
sbb eax, eax
and eax, ebx
mov ebx, 0x136
mov dword [ebp - 0x6b8], eax
lea eax, [ebp - 0x6a8]
push ebx
push eax
call fcn.100014ae
push str.Microsoft.Deployment.WindowsInstaller.dll
push ebx
lea eax, [ebp - 0x6a8]
push eax
call fcn.10001430
lea eax, [ebp - 0x6b0]
mov ebx, 0x643
push eax
lea eax, [ebp - 0x6a8]
mov dword [ebp - 0x6bc], ebx
push eax
push dword [ebp - 0x6b8]
push 0
push edi
call fcn.1000127d
test al, al
je 0x100025ed
lea eax, [ebp - 0x6b4]
push eax
push dword [ebp - 0x6b8]
push esi
push str.CustomAction
push dword [ebp - 0x6b0]
push edi
call section..text
test al, al
je 0x100025d5
lea eax, [ebp - 0x6bc]
push eax
push dword [ebp - 0x6c0]
push dword [ebp - 0x6b4]
push edi
call fcn.10002615
test al, al
je 0x100025a4
mov ebx, dword [ebp - 0x6bc]
mov eax, dword [ebp - 0x6b0]
push dword [ebp - 0x6b4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
test eax, eax
jns 0x100025c9
push eax
push str.Failed_to_unload_app_domain._Error_code_0x_X
push edi
call fcn.10003ff9
add esp, 0xc
mov eax, dword [ebp - 0x6b4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6b0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x6b0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp byte [ebp - 0x6a9], 0
je 0x10002602
lea eax, [ebp - 0x43c]
push eax
call fcn.10003c0c
mov eax, ebx
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100048e3
leave
ret 0xc
Function at 0x10002ab4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
xor ebx, ebx
cmp ebx, dword [ebp + 0xc]
jae 0x10002b6e
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [edi + 0x1c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
sub eax, ebx
push eax
mov eax, dword [ebp + 8]
add eax, ebx
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10002b63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x3e5
jne 0x10002b63
cmp byte [edi + 0x40], 0
mov eax, dword [edi + 0x2c]
push 0xffffffffffffffff
je 0x10002b2a
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x10002b31
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
test esi, esi
jne 0x10002b4f
push eax
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x1c]
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x10002b63
jmp 0x10002b54
cmp esi, 0xffffffff
jne 0x10002b5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10002b63
mov esi, 0x3e3
add ebx, dword [ebp - 4]
test esi, esi
je 0x10002ac3
test esi, esi
je 0x10002b9a
cmp byte [edi + 0x40], 0
push dword [edi + 0x10]
je 0x10002b8c
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x10002b96
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [edi + 0x10], 0
mov byte [edi + 0x42], 0
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x10002d64
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x40], 0
je 0x10002dd4
xor eax, eax
cmp dword [esi + 0x18], eax
jne 0x10002dd4
push edi
push eax
push eax
push 1
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x18], eax
test eax, eax
jne 0x10002d93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10002dcf
cmp dword [esi + 0x14], edi
je 0x10002da1
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push eax
push eax
push esi
push 0x10002aa5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x10002dcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi + 0x18]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x18], 0
mov eax, edi
pop edi
pop esi
ret
mov eax, 0x10dd
pop esi
ret
Function at 0x10002e07
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
xor ebx, ebx
cmp ebx, dword [ebp + 0xc]
jae 0x10002ec1
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [edi + 0x1c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
sub eax, ebx
push eax
mov eax, dword [ebp + 8]
add eax, ebx
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10002eb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x3e5
jne 0x10002eb6
cmp byte [edi + 0x40], 0
mov eax, dword [edi + 0x2c]
push 0xffffffffffffffff
je 0x10002e7d
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x10002e84
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
test esi, esi
jne 0x10002ea2
push eax
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x1c]
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x10002eb6
jmp 0x10002ea7
cmp esi, 0xffffffff
jne 0x10002eb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10002eb6
mov esi, 0x3e3
add ebx, dword [ebp - 4]
test esi, esi
je 0x10002e16
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x10003c0c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x1002c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
mov esi, eax
mov dword [ebp - 0x258], eax
push edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x10003c32
sub esi, ecx
sar esi, 1
lea edi, [esi + 0x107]
lea eax, [edi + edi]
call fcn.10004900
mov ebx, esp
test ebx, ebx
jne 0x10003c5c
xor al, al
jmp 0x10003d66
push dword [ebp - 0x258]
push edi
push ebx
call fcn.100014ae
push 0x100214c8
push edi
push ebx
call fcn.10001430
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10003d55
inc esi
lea esi, [ebx + esi*2]
lea eax, [ebp - 0x228]
push eax
push 0x106
push esi
call fcn.100014ae
test byte [ebp - 0x254], 0x10
je 0x10003d29
mov ecx, 0x100214d0
lea eax, [ebp - 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10003cde
test dx, dx
je 0x10003cda
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10003cde
add eax, 4
add ecx, 4
test dx, dx
jne 0x10003cb8
xor eax, eax
jmp 0x10003ce3
sbb eax, eax
or eax, 1
test eax, eax
je 0x10003d30
mov ecx, 0x100214d4
lea eax, [ebp - 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10003d18
test dx, dx
je 0x10003d14
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10003d18
add eax, 4
add ecx, 4
test dx, dx
jne 0x10003cf2
xor eax, eax
jmp 0x10003d1d
sbb eax, eax
or eax, 1
test eax, eax
je 0x10003d30
push ebx
call fcn.10003c0c
jmp 0x10003d30
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x254]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10003d4c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x10003c92
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
lea esp, [ebp - 0x264]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100048e3
leave
ret 4

Function at 0x10003d7d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x10003d9c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10003d9c
test al, 0x10
je 0x10003d9c
mov al, 1
jmp 0x10003d9e
xor al, al
pop ebp
ret 4
Function at 0x10001e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
push 2
push 0
push 0x10001d20
mov ecx, dword [0x10049244]
call fcn.1001ad20
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001f8d
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x10048828]
call fcn.10001440
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x1004882c]
call fcn.10014030
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10003290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 5
mov dword [ebp - 8], 0
jmp 0x100032b2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x33
jge 0x100032f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x779227d4]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100032ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100032a9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x33], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10003b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0x2d0], 0
push 0x2c8
push 0
lea eax, [ebp - 0x2cc]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x2d0], 0x10010
lea ecx, [ebp - 0x2d0]
push ecx
push 0xfffffffffffffffe
mov edx, dword [0x10048824]
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x10003cda
cmp dword [ebp - 0x2cc], 0
jne 0x10003be6
cmp dword [ebp - 0x2c8], 0
jne 0x10003be6
cmp dword [ebp - 0x2c4], 0
jne 0x10003be6
cmp dword [ebp - 0x2c0], 0
jne 0x10003be6
cmp dword [ebp - 0x2b8], 0
je 0x10003cda
mov byte [ebp - 0x2f0], 0x48
mov byte [ebp - 0x2ef], 0x61
mov byte [ebp - 0x2ee], 0x72
mov byte [ebp - 0x2ed], 0x64
mov byte [ebp - 0x2ec], 0x77
mov byte [ebp - 0x2eb], 0x61
mov byte [ebp - 0x2ea], 0x72
mov byte [ebp - 0x2e9], 0x65
mov byte [ebp - 0x2e8], 0x20
mov byte [ebp - 0x2e7], 0x62
mov byte [ebp - 0x2e6], 0x72
mov byte [ebp - 0x2e5], 0x65
mov byte [ebp - 0x2e4], 0x61
mov byte [ebp - 0x2e3], 0x6b
mov byte [ebp - 0x2e2], 0x70
mov byte [ebp - 0x2e1], 0x6f
mov byte [ebp - 0x2e0], 0x69
mov byte [ebp - 0x2df], 0x6e
mov byte [ebp - 0x2de], 0x74
mov byte [ebp - 0x2dd], 0x20
mov byte [ebp - 0x2dc], 0x64
mov byte [ebp - 0x2db], 0x65
mov byte [ebp - 0x2da], 0x74
mov byte [ebp - 0x2d9], 0x65
mov byte [ebp - 0x2d8], 0x63
mov byte [ebp - 0x2d7], 0x74
mov byte [ebp - 0x2d6], 0x65
mov byte [ebp - 0x2d5], 0x64
mov byte [ebp - 0x2d4], 0
mov ecx, dword [0x10048828]
call fcn.10001440
push eax
push 0
lea ecx, [ebp - 0x2f0]
push ecx
push 1
lea edx, [ebp - 0x2f0]
push edx
mov ecx, dword [0x1004882c]
call fcn.10014030
mov esp, ebp
pop ebp
ret

Function at 0x10003ce0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10048820]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x10003d01
xor eax, eax
jmp 0x10003d43
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
je 0x10003d1c
xor eax, eax
jmp 0x10003d43
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x28]
add ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, byte [edx]
xor ecx, ecx
cmp eax, 0xcc
sete cl
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x10003d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
call fcn.10003ce0
test eax, eax
je 0x10003e05
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x79
mov byte [ebp - 0x1b], 0x70
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x11], 0x6b
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x20
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0x74
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0x64
mov byte [ebp - 2], 0
mov ecx, dword [0x10048828]
call fcn.10001440
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 1
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [0x1004882c]
call fcn.10014030
mov esp, ebp
pop ebp
ret
Function at 0x100042c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10023b28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x10]
call fcn.10013fc0
mov dword [ebp - 4], 0
mov byte [ebp - 0x3c], 0x44
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x62
mov byte [ebp - 0x39], 0x75
mov byte [ebp - 0x38], 0x67
mov byte [ebp - 0x37], 0x67
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x44
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3b
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x45
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0x30
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x39
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x36
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x10048824]
mov edx, dword [ecx + 0x2cc]
call edx
cmp dword [ebp - 0x14], 0
je 0x100043d1
mov ecx, dword [0x10048828]
call fcn.10001440
push eax
push 0
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [0x1004882c]
call fcn.10014030
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10014010
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100043f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
pushal
mov eax, dword fs:[0xc0]
mov dword [ebp - 8], eax
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
mov byte [ebp - 2], al
popal
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1000442e
mov eax, 1
jmp 0x1000445b
cmp dword [ebp - 8], 0
je 0x10004459
pushal
mov eax, dword fs:[0x18]
sub eax, 0x2000
mov eax, dword [eax + 0x60]
mov al, byte [eax + 2]
mov byte [ebp - 1], al
popal
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x10004459
mov eax, 2
jmp 0x1000445b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret