joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002a40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x103381f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], eax
test esi, esi
je 0x10002bb6
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x10002bb6
push edi
push 0x40
push 0x3000
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x80
push eax
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
xor edi, edi
test eax, eax
cmovns edi, dword [ebp - 0x18]
test edi, edi
je 0x10002ad7
push ecx
lea edx, [edi + 0x40]
mov dword [edi], esi
mov ecx, esi
call fcn.100026f0
movzx eax, al
add esp, 4
mov dword [edi + 4], eax
test eax, eax
jne 0x10002aec
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push 0x8000
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014a7d0
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [edi + 0x40]
mov dword [ebp - 0x14], 5
add ecx, eax
mov dword [ebp - 0x20], esi
sub eax, ecx
add eax, 0xfffffffb
add eax, esi
mov dword [ecx + 1], eax
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x14]
mov byte [ecx], 0xe9
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
jns 0x10002b32
mov ecx, edi
call fcn.100023f0
jmp 0x10002ad7
call fcn.10002650
mov eax, dword [ebp - 0x38]
sub ebx, esi
sub ebx, 5
mov byte [esi], 0xe9
mov dword [esi + 1], ebx
lea ebx, [edi + 0x40]
test eax, eax
je 0x10002b4e
mov dword [eax], ebx
lea eax, [ebp - 8]
mov ecx, esi
push eax
push dword [ebp - 8]
call fcn.10002430
mov eax, dword fs:[0x18]
lea edx, [ebp - 0x34]
add esp, 8
mov ecx, 0x100028e0
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], ebx
mov eax, dword [edi + 4]
mov dword [ebp - 0x24], eax
call fcn.10002470
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtFlushInstructionCache]
call fcn.100026a0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014a7d0
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.1014a7d0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002c70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
mov dword [ebp - 0xc], ecx
mov ecx, 0xb
mov esi, str._pipediscord_ipc_0
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x10], 0x15
mov eax, 2
imul ecx, eax, 0x15
mov edx, 0x30
mov word [ebp + ecx - 0x40], dx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x10002cdd
mov ecx, dword [ebp - 4]
mov byte [ecx], 1
mov al, 1
jmp 0x10002d4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jne 0x10002d20
mov edx, 2
imul eax, edx, 0x15
movzx ecx, word [ebp + eax - 0x40]
cmp ecx, 0x39
jge 0x10002d1e
mov edx, 2
imul eax, edx, 0x15
mov cx, word [ebp + eax - 0x40]
add cx, 1
mov edx, 2
imul eax, edx, 0x15
mov word [ebp + eax - 0x40], cx
jmp 0x10002cab
jmp 0x10002d45
cmp dword [ebp - 8], 0xe7
jne 0x10002d45
push 0x2710
lea ecx, [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x10002d40
xor al, al
jmp 0x10002d4e
jmp 0x10002cab
xor al, al
jmp 0x10002d4e
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10002d60
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
jne 0x10002d76
xor al, al
jmp 0x10002e09
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10002d89
xor al, al
jmp 0x10002e09
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0xffffffff
jne 0x10002d96
xor al, al
jmp 0x10002e09
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x10002dff
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jb 0x10002dfd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x10002df5
mov al, 1
jmp 0x10002e09
mov ecx, dword [ebp - 8]
call fcn.10002c10
jmp 0x10002e07
mov ecx, dword [ebp - 8]
call fcn.10002c10
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x10002e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0xc], 0
jne 0x10002e23
mov al, 1
jmp 0x10002e92
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10002e33
xor al, al
jmp 0x10002e92
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0xffffffff
jne 0x10002e40
xor al, al
jmp 0x10002e92
cmp dword [ebp + 8], 0
jne 0x10002e4a
xor al, al
jmp 0x10002e92
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x10002e88
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
jne 0x10002e88
mov dword [ebp - 0x10], 1
jmp 0x10002e8f
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8

Function at 0x10003270
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x100032d1
mov ecx, 2
imul edx, ecx, 0
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx]
test ecx, ecx
je 0x100032d1
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100032cb
mov eax, dword [ebp - 8]
jmp 0x1000330b
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x10003308
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 8]
je 0x10003308
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x100033a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa9c
push 0x20
lea eax, [ebp - 0x94]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x20
lea edx, [ebp - 0x54]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push 0
push str.SoftwareValveSteam
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10003420
push str.Error_opening_Steam_key_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.100035c0
add esp, 8
jmp 0x100034f7
mov dword [ebp - 0xc], 0x208
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x29c]
push eax
push 0
push 0
push str.SteamExe
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x1000345e
cmp dword [ebp - 0xc], 1
jae 0x10003479
push str.Error_reading_SteamExe_key_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.100035c0
add esp, 8
jmp 0x100034f7
mov eax, dword [ebp - 0xc]
shr eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x10003493
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x14]
jae 0x100034bd
mov eax, dword [ebp - 4]
movzx ecx, word [ebp + eax*2 - 0x29c]
cmp ecx, 0x2f
jne 0x100034bb
mov edx, 0x5c
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x29c], dx
jmp 0x1000348a
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x29c]
push edx
push str.__s__steam:__rungameid__s
push 0x800
lea eax, [ebp - 0xa9c]
push eax
call fcn.10003120
add esp, 0x14
lea ecx, [ebp - 0xa9c]
push ecx
lea edx, [ebp - 0x94]
push edx
call fcn.10002ea0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x10003780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014b0f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.10003f40
add esp, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.100048a0
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x10003ff0
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.100056e0
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x100037ff
lea ecx, [ebp - 0x14]
call fcn.100070b0
jmp 0x10003810
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10005550
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x10004a00
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014b132
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.10004bc0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.10004d60
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.100051b0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x10], 0
jne 0x10004abd
push 0x14
call fcn.101493f6
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0
je 0x10004a9a
push 0
push 0x10000
mov ecx, dword [ebp - 0x14]
call fcn.10004c30
mov dword [ebp - 0x18], eax
jmp 0x10004aa1
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10014d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014b52c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x1f
mov byte [ebp - 0x34], 0x46
mov byte [ebp - 0x33], 0x5a
mov byte [ebp - 0x32], 0x5a
mov byte [ebp - 0x31], 0x5e
mov byte [ebp - 0x30], 0x14
mov byte [ebp - 0x2f], 1
mov byte [ebp - 0x2e], 1
mov byte [ebp - 0x2d], 0x5e
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x2b], 0x4d
mov byte [ebp - 0x2a], 0x42
mov byte [ebp - 0x29], 0x4f
mov byte [ebp - 0x28], 0x40
mov byte [ebp - 0x27], 0
mov byte [ebp - 0x26], 0x5d
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0x24], 1
mov byte [ebp - 0x23], 0x41
mov byte [ebp - 0x22], 0x5a
mov byte [ebp - 0x21], 0x4d
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0x5e
mov byte [ebp - 0x1e], 0x46
mov byte [ebp - 0x1d], 0x5e
mov byte [ebp - 0x1c], 0x11
mov byte [ebp - 0x1b], 0x40
mov byte [ebp - 0x1a], 0x4f
mov byte [ebp - 0x19], 0x43
mov byte [ebp - 0x18], 0x4b
mov byte [ebp - 0x17], 0x13
mov byte [ebp - 0x16], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036f778]
cmp eax, dword [edx + 4]
jle 0x10014e69
push 0x1036f778
call fcn.1014a06c
add esp, 4
cmp dword [0x1036f778], 0xffffffff
jne 0x10014e69
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, 0x1036f758
call fcn.100146a0
push 0x101500e0
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036f778
call fcn.1014a022
add esp, 4
mov eax, 0x1036f758
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10014e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014b54c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xb
mov byte [ebp - 0x20], 0x5b
mov byte [ebp - 0x1f], 0x5c
mov byte [ebp - 0x1e], 0x42
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x41
mov byte [ebp - 0x1b], 0x40
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 0x4a
mov byte [ebp - 0x18], 0x42
mov byte [ebp - 0x17], 0x42
mov byte [ebp - 0x16], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036f73c]
cmp eax, dword [edx + 4]
jle 0x10014f39
push 0x1036f73c
call fcn.1014a06c
add esp, 4
cmp dword [0x1036f73c], 0xffffffff
jne 0x10014f39
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x1036f730
call fcn.100146f0
push 0x101500f0
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036f73c
call fcn.1014a022
add esp, 4
mov eax, 0x1036f730
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10015010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014b58c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x13
mov byte [ebp - 0x28], 0x7b
mov byte [ebp - 0x27], 0x7c
mov byte [ebp - 0x26], 0x62
mov byte [ebp - 0x25], 0x6a
mov byte [ebp - 0x24], 0x41
mov byte [ebp - 0x23], 0x59
mov byte [ebp - 0x22], 0x40
mov byte [ebp - 0x21], 0x42
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1f], 0x4f
mov byte [ebp - 0x1e], 0x4a
mov byte [ebp - 0x1d], 0x7a
mov byte [ebp - 0x1c], 0x41
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x47
mov byte [ebp - 0x19], 0x42
mov byte [ebp - 0x18], 0x4b
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036f754]
cmp eax, dword [edx + 4]
jle 0x100150e9
push 0x1036f754
call fcn.1014a06c
add esp, 4
cmp dword [0x1036f754], 0xffffffff
jne 0x100150e9
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, 0x1036f740
call fcn.10014600
push 0x10150110
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036f754
call fcn.1014a022
add esp, 4
mov eax, 0x1036f740
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10015100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014b5ac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x11
mov byte [ebp - 0x28], 0x4d
mov byte [ebp - 0x27], 0x5d
mov byte [ebp - 0x26], 0x49
mov byte [ebp - 0x25], 0x41
mov byte [ebp - 0x24], 0
mov byte [ebp - 0x23], 0x5d
mov byte [ebp - 0x22], 0x47
mov byte [ebp - 0x21], 0x49
mov byte [ebp - 0x20], 0x40
mov byte [ebp - 0x1f], 0x4f
mov byte [ebp - 0x1e], 0x5a
mov byte [ebp - 0x1d], 0x5b
mov byte [ebp - 0x1c], 0x5c
mov byte [ebp - 0x1b], 0x4b
mov byte [ebp - 0x1a], 0x5d
mov byte [ebp - 0x19], 0x1c
mov byte [ebp - 0x18], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036f7a4]
cmp eax, dword [edx + 4]
jle 0x100151d1
push 0x1036f7a4
call fcn.1014a06c
add esp, 4
cmp dword [0x1036f7a4], 0xffffffff
jne 0x100151d1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, 0x1036f790
call fcn.100145b0
push 0x10150120
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036f7a4
call fcn.1014a022
add esp, 4
mov eax, 0x1036f790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100152a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014b5ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x1f
mov byte [ebp - 0x34], 0x61
mov byte [ebp - 0x33], 0x7a
mov byte [ebp - 0x32], 0x6d
mov byte [ebp - 0x31], 0xe
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0xe
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x5b
mov byte [ebp - 0x2c], 0x47
mov byte [ebp - 0x2b], 0x42
mov byte [ebp - 0x2a], 0x4a
mov byte [ebp - 0x29], 0xe
mov byte [ebp - 0x28], 0x6a
mov byte [ebp - 0x27], 0x4f
mov byte [ebp - 0x26], 0x5a
mov byte [ebp - 0x25], 0x4b
mov byte [ebp - 0x24], 0x14
mov byte [ebp - 0x23], 0xe
mov byte [ebp - 0x22], 0x1f
mov byte [ebp - 0x21], 0x1d
mov byte [ebp - 0x20], 0xe
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x5b
mov byte [ebp - 0x1d], 0x42
mov byte [ebp - 0x1c], 0x57
mov byte [ebp - 0x1b], 0xe
mov byte [ebp - 0x1a], 0x1c
mov byte [ebp - 0x19], 0x1e
mov byte [ebp - 0x18], 0x1c
mov byte [ebp - 0x17], 0x1e
mov byte [ebp - 0x16], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036f804]
cmp eax, dword [edx + 4]
jle 0x100153a9
push 0x1036f804
call fcn.1014a06c
add esp, 4
cmp dword [0x1036f804], 0xffffffff
jne 0x100153a9
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, 0x1036f7e4
call fcn.100146a0
push 0x10150140
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036f804
call fcn.1014a022
add esp, 4
mov eax, 0x1036f7e4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10015420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014b60c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x14
mov byte [ebp - 0x28], 0x79
mov byte [ebp - 0x27], 0x4b
mov byte [ebp - 0x26], 0x42
mov byte [ebp - 0x25], 0x4d
mov byte [ebp - 0x24], 0x41
mov byte [ebp - 0x23], 0x43
mov byte [ebp - 0x22], 0x4b
mov byte [ebp - 0x21], 0xe
mov byte [ebp - 0x20], 0x4c
mov byte [ebp - 0x1f], 0x4f
mov byte [ebp - 0x1e], 0x4d
mov byte [ebp - 0x1d], 0x45
mov byte [ebp - 0x1c], 0xe
mov byte [ebp - 0x1b], 0xb
mov byte [ebp - 0x1a], 0x5d
mov byte [ebp - 0x19], 0xd
mov byte [ebp - 0x18], 0xb
mov byte [ebp - 0x17], 0x5d
mov byte [ebp - 0x16], 0xf
mov byte [ebp - 0x15], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036f7bc]
cmp eax, dword [edx + 4]
jle 0x100154fd
push 0x1036f7bc
call fcn.1014a06c
add esp, 4
cmp dword [0x1036f7bc], 0xffffffff
jne 0x100154fd
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, 0x1036f7a8
call fcn.10014650
push 0x10150150
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036f7bc
call fcn.1014a022
add esp, 4
mov eax, 0x1036f7a8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10015510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014b62c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x13
mov byte [ebp - 0x28], 0x4a
mov byte [ebp - 0x27], 0x47
mov byte [ebp - 0x26], 0x5d
mov byte [ebp - 0x25], 0x4d
mov byte [ebp - 0x24], 0x41
mov byte [ebp - 0x23], 0x5c
mov byte [ebp - 0x22], 0x4a
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1f], 0x49
mov byte [ebp - 0x1e], 1
mov byte [ebp - 0x1d], 0x4f
mov byte [ebp - 0x1c], 0x45
mov byte [ebp - 0x1b], 0x60
mov byte [ebp - 0x1a], 0x60
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0x18], 0x5a
mov byte [ebp - 0x17], 0x48
mov byte [ebp - 0x16], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036f81c]
cmp eax, dword [edx + 4]
jle 0x100155e9
push 0x1036f81c
call fcn.1014a06c
add esp, 4
cmp dword [0x1036f81c], 0xffffffff
jne 0x100155e9
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, 0x1036f808
call fcn.10014600
push 0x10150160
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036f81c
call fcn.1014a022
add esp, 4
mov eax, 0x1036f808
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10015c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x10015cad
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10015cb4
mov al, 1
jmp 0x10015d91
call fcn.10013600
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x14], eax
call fcn.10013600
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.10016820
add esp, 8
movzx eax, al
test eax, eax
je 0x10015cf0
xor al, al
jmp 0x10015d91
mov dword [ebp - 0x20], 0x20
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x38]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10015d2d
cmp dword [ebp - 8], 1
je 0x10015d34
cmp dword [ebp - 8], 3
je 0x10015d84
jmp 0x10015d8f
mov eax, dword [ebp - 4]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x44]
sub ecx, edx
mov dword [ebp - 0xc], ecx
je 0x10015d64
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 1
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0xc], eax
je 0x10015d64
xor al, al
jmp 0x10015d91
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10015d78
mov dword [ebp - 0x10], 1
jmp 0x10015d7f
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
jmp 0x10015d91
mov eax, dword [ebp - 4]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x10015d91
xor al, al
mov esp, ebp
pop ebp
ret