joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409238
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x40f644]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x40faa0]
je 0x409265
inc eax
cmp eax, 0x12
jb 0x409256
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x40faa0]
jne 0x409399
mov eax, dword [0x410b54]
cmp eax, 1
je 0x409374
cmp eax, edx
jne 0x409295
cmp dword [0x40f8f8], 1
je 0x409374
cmp ecx, 0xfc
je 0x409399
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4092ce
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.00405de0
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.00406250
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x409310
lea eax, [ebp - 0x10c]
push eax
call fcn.00406250
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x40be64
push edi
call fcn.00406120
add esp, 0x10
push edi
call fcn.00406250
push dword [esi + 0x40faa4]
mov ebx, eax
call fcn.00406250
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00409770
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00405de0
push edi
push ebx
call fcn.00405df0
push 0x40be60
push ebx
call fcn.00405df0
push dword [esi + 0x40faa4]
push ebx
call fcn.00405df0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00409959
add esp, 0x2c
jmp 0x409399
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x40faa4]
push dword [esi]
call fcn.00406250
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.00405dc3
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409959
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x410bec], ebx
push esi
push edi
jne 0x4099d9
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x409a14
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40c46c
push edi
call esi
test eax, eax
mov dword [0x410bec], eax
je 0x409a14
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x410bf0], eax
call esi
cmp dword [0x410b9c], 2
mov dword [0x410bf4], eax
jne 0x4099d9
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x410bfc], eax
je 0x4099d9
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x410bf8], eax
mov eax, dword [0x410bf8]
test eax, eax
je 0x409a1e
call eax
test eax, eax
je 0x409a05
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x410bfc]
test eax, eax
je 0x409a05
test byte [ebp - 8], 1
jne 0x409a1e
cmp dword [0x410ba8], 4
jb 0x409a18
or byte [ebp + 0x12], 0x20
jmp 0x409a3d
xor eax, eax
jmp 0x409a4d
or byte [ebp + 0x12], 4
jmp 0x409a3d
mov eax, dword [0x410bf0]
test eax, eax
je 0x409a3d
call eax
mov ebx, eax
test ebx, ebx
je 0x409a3d
mov eax, dword [0x410bf4]
test eax, eax
je 0x409a3d
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x410bec]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a841
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.00409770
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40a8d6
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x410b9c]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x40a8d6
cmp eax, 1
je 0x40a8ee
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40a8d6
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x40a8ab
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x40a8d2
xor eax, eax
inc eax
jmp 0x40a90a
cmp esi, ebx
jae 0x40a8da
xor eax, eax
jmp 0x40a90a
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x410b9c]
jmp 0x40a8f0
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407460
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5000]
push edi
jmp 0x40747a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407481
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407470
mov eax, 1
add ebx, ebx
jne 0x407493
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407488
jne 0x4074a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407488
xor ecx, ecx
sub eax, 3
jb 0x4074b8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40752a
mov ebp, eax
add ebx, ebx
jne 0x4074c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4074d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4074f4
inc ecx
add ebx, ebx
jne 0x4074e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4074d5
jne 0x4074f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4074d5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x407514
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x407505
jmp 0x407476
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x407514
add edi, ecx
jmp 0x407476
pop esi
mov edi, esi
mov ecx, 1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x407532
cmp byte [edi], 1
jne 0x407532
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x407537
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4075af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7f64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7fa0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x407564
mov ecx, edi
jns 0x407593
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7fa8]
or eax, eax
je 0x4075a9
mov dword [ebx], eax
add ebx, 4
jmp 0x407581
call dword [esi + 0x7fa4]
mov ebp, dword [esi + 0x7fac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4075e3
sub esp, 0xffffff80
jmp 0x4010ec
Function at 0x422080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18000]
push edi
jmp 0x42209a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4220a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x422090
mov eax, 1
add ebx, ebx
jne 0x4220b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4220a8
jne 0x4220c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4220a8
xor ecx, ecx
sub eax, 3
jb 0x4220d8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42214a
mov ebp, eax
add ebx, ebx
jne 0x4220e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4220f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x422114
inc ecx
add ebx, ebx
jne 0x422100
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4220f5
jne 0x422111
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4220f5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x422134
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x422125
jmp 0x422096
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x422134
add edi, ecx
jmp 0x422096
pop esi
mov edi, esi
mov ecx, 0x10f4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x422152
cmp byte [edi], 5
jne 0x422152
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x422157
lea edi, [esi + 0x20000]
mov eax, dword [edi]
or eax, eax
je 0x4221cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x233f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2342c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x422184
mov ecx, edi
jns 0x4221b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23434]
or eax, eax
je 0x4221c9
mov dword [ebx], eax
add ebx, 4
jmp 0x4221a1
call dword [esi + 0x23430]
mov ebp, dword [esi + 0x23438]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x422203
sub esp, 0xffffff80
jmp 0x4031c8
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401c66
pop dword [ebp - 0x2c]
mov eax, 0xa74bf623
add eax, 0x58f42643
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x850100d4
sub dword [ebp - 0x3c], 0x36aebb89
mov dword [ebp - 0x38], 0x7b62cc17
sub dword [ebp - 0x38], 0x492f7fd2
mov dword [ebp - 0x34], 0x265031a9
sub dword [ebp - 0x34], 0xda03ed7b
mov dword [ebp - 0x30], 0xd7be437e
sub dword [ebp - 0x30], 0xd7be437e
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x5bc9f34d
add eax, 0xa4763d07
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x5313db7c
add dword [ebp - 0x3c], 0x215e8dda
mov dword [ebp - 0x38], 0xdc930caa
add dword [ebp - 0x38], 0x64d954cb
mov dword [ebp - 0x34], 0x1001909e
add dword [ebp - 0x34], 0x536ddbce
mov dword [ebp - 0x30], 0xe4280e04
add dword [ebp - 0x30], 0x1bd7f1fc
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3716e
push 0
call eax
mov ecx, 0x2c6d6f3c
add ecx, 0xd392db33
mov edx, eax
mov edi, 0x942e8ac6
sub edi, 0x93ee1ac6
add edi, dword [ebp - 0x2c]
mov esi, 0xd1314149
add esi, 0xdba2b3c8
sub dword [ebp - 0xc], 0x2c22372f
mov ebx, dword [edi]
add ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0xc], 0xc95748c2
add edx, 0x434cf38
sub edx, 0x434cf34
add edi, 4
loop 0x401d83
add eax, 0x650f7851
add eax, 0x9af1a43e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb2a2469f
sub ecx, 0xb262469f
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10001020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019012
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x27c], esi
mov dword [esi], 0
call fcn.10003550
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x10001089
push 0x80004005
call fcn.10003290
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x1ff
lea eax, [ebp - 0x267]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x278], 1
mov byte [ebp - 0x268], 0
call fcn.10006890
mov eax, 0x54
mov dword [ebp - 0x26c], 0x200
mov word [ebp - 0x62], ax
lea edx, [ebp - 0x68]
mov eax, 0x53
mov dword [ebp - 0x60], 0x410057
mov word [ebp - 0x68], ax
add esp, 0xc
mov dword [ebp - 0x66], 0x46004f
mov dword [ebp - 0x44], 0x43005c
lea ecx, [eax + 0x16]
mov dword [ebp - 0x58], 0x4d005c
mov eax, 0x65
mov dword [ebp - 0x40], 0x790072
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x274]
push eax
push 0x20019
push ecx
mov dword [ebp - 0x34], 0x610072
mov dword [ebp - 0x2c], 0x79
mov dword [ebp - 0x50], 0x6f0072
mov dword [ebp - 0x48], 0x740066
mov dword [ebp - 0x30], 0x680070
mov dword [ebp - 0x54], 0x630069
mov dword [ebp - 0x5c], 0x450052
mov dword [ebp - 0x38], 0x67006f
mov dword [ebp - 0x3c], 0x740070
mov dword [ebp - 0x4c], 0x6f0073
mov dword [ebp - 0x14], 0x64
mov dword [ebp - 0x24], 0x680063
mov dword [ebp - 0x20], 0x6e0069
mov dword [ebp - 0x1a], 0x750047
mov dword [ebp - 0x28], 0x61004d
mov word [ebp - 0x16], cx
call fcn.10001a70
add esp, 0xc
test eax, eax
jne 0x10001224
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x270]
push eax
push ecx
mov ecx, dword [ebp - 0x274]
lea edx, [ebp - 0x28]
call fcn.10015310
add esp, 0x10
test eax, eax
je 0x1000120b
lea eax, [ebp - 0x274]
push eax
push 0x20119
push ecx
lea edx, [ebp - 0x68]
call fcn.10001a70
add esp, 0xc
test eax, eax
jne 0x10001224
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x270]
push eax
push ecx
mov ecx, dword [ebp - 0x274]
lea edx, [ebp - 0x28]
call fcn.10015310
add esp, 0x10
test eax, eax
jne 0x10001224
lea eax, [ebp - 0x268]
mov ecx, esi
push eax
call fcn.10003810
mov ecx, dword [ebp - 0x274]
call fcn.10001b00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100046cb
mov esp, ebp
pop ebp
ret
Function at 0x10001990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x636f7250
push eax
mov edi, edx
mov dword [ebp - 0xb], 0x73726946
mov esi, ecx
mov dword [ebp - 0xf], 0x32337373
mov word [ebp - 7], 0x74
mov byte [ebp - 0x10], 0x65
call fcn.100187b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100019ed
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100046cb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100046cb
mov esp, ebp
pop ebp
ret

Function at 0x10001a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x10], 0x704f
mov dword [ebp - 0xa], 0x7365636f
mov word [ebp - 0xd], 0x506e
mov byte [ebp - 0xe], 0x65
mov word [ebp - 6], 0x73
mov byte [ebp - 0xb], 0x72
call fcn.100187b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001a5f
push esi
push 0
push 1
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100046cb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100046cb
mov esp, ebp
pop ebp
ret

Function at 0x10001a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x18], eax
mov esi, 1
call fcn.10018800
mov edi, eax
test edi, edi
je 0x10001ae7
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0x78457965
push eax
push edi
mov dword [ebp - 0x11], 0x6e65704f
mov word [ebp - 8], 0x57
mov word [ebp - 0x14], 0x6552
mov byte [ebp - 0xd], 0x4b
mov byte [ebp - 0x12], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001ade
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push 0
push ebx
push 0x80000002
call eax
mov esi, eax
push edi
call fcn.10018f20
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100046cb
mov esp, ebp
pop ebp
ret

Function at 0x10001b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.10001940
mov edi, eax
test edi, edi
je 0x10001bda
lea eax, [ebp - 0x10]
mov dword [ebp - 0xd], 0x6e496f54
push eax
push edi
mov word [ebp - 9], 0x4174
mov word [ebp - 0xf], 0x7274
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 7], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001bd1
push ebx
call eax
mov esi, eax
push edi
call fcn.10018f20
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100046cb
mov esp, ebp
pop ebp
ret
Function at 0x10002510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov word [ebp - 8], 0x6c
push eax
mov dword [ebp - 0xd], 0x642e6c6c
mov word [ebp - 0x10], 0x746e
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0xe], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100046cb
mov esp, ebp
pop ebp
ret

Function at 0x10002560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov ebx, ecx
xor esi, esi
call fcn.10002490
mov edi, eax
test edi, edi
je 0x100025c1
lea eax, [ebp - 0x10]
mov dword [ebp - 0xb], 0x6f646e69
push eax
push edi
mov word [ebp - 6], 0x41
mov dword [ebp - 0x10], 0x646e6946
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 7], 0x77
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100025b8
push dword [ebp - 0x14]
push ebx
call eax
mov esi, eax
push edi
call fcn.10018f20
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100046cb
mov esp, ebp
pop ebp
ret

Function at 0x100025e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
mov word [ebp - 0x15], 0x4664
push eax
mov esi, ecx
mov word [ebp - 9], 0x57
mov dword [ebp - 0xe], 0x6d756c6f
mov word [ebp - 0x18], 0x6946
mov dword [ebp - 0x13], 0x74737269
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0xf], 0x56
call fcn.100187b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000264a
push 0x104
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100046cb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop esi
call fcn.100046cb
mov esp, ebp
pop ebp
ret

Function at 0x100026d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x14], ecx
xor esi, esi
call fcn.10002490
mov edi, eax
test edi, edi
je 0x1000272d
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0x646e6957
push eax
push edi
mov word [ebp - 8], 0x776f
mov byte [ebp - 6], 0
mov dword [ebp - 0x10], 0x776f6853
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002724
push ebx
push dword [ebp - 0x14]
call eax
mov esi, eax
push edi
call fcn.10018f20
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100046cb
mov esp, ebp
pop ebp
ret
Function at 0x100027b0
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
call fcn.10018800
mov edi, eax
test edi, edi
je 0x10002824
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1a], 0x70756b6f
push eax
push edi
mov dword [ebp - 0xc], 0x65756c61
mov word [ebp - 8], 0x41
mov dword [ebp - 0x16], 0x76697250
mov word [ebp - 0x1c], 0x6f4c
mov dword [ebp - 0x10], 0x56656765
mov word [ebp - 0x12], 0x6c69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000281b
push ebx
push str.SeDebugPrivilege
push esi
call eax
mov esi, eax
push edi
call fcn.10018f20
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100046cb
mov esp, ebp
pop ebp
ret

Function at 0x10002840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x626f6c47
push eax
mov esi, ecx
mov word [ebp - 0xb], 0x466c
mov word [ebp - 8], 0x6565
mov byte [ebp - 6], 0
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 9], 0x72
call fcn.100187b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002898
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100046cb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100046cb
mov esp, ebp
pop ebp
ret

Function at 0x100028b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x12], 0x63695474
push eax
mov word [ebp - 0xd], 0x6f43
mov word [ebp - 0xa], 0x746e
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 8], 0
mov word [ebp - 0x14], 0x6547
mov byte [ebp - 0xe], 0x6b
call fcn.100187b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002909
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100046cb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.100046cb
mov esp, ebp
pop ebp
ret

Function at 0x10002920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x13], 0x4c64616f
push eax
mov esi, ecx
mov dword [ebp - 0xc], 0x41797261
mov byte [ebp - 8], 0
mov word [ebp - 0xf], 0x6269
mov byte [ebp - 0x14], 0x4c
mov byte [ebp - 0xd], 0x72
call fcn.100187b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002979
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100046cb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100046cb
mov esp, ebp
pop ebp
ret