joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10069580
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push str.C:UsersClint_vcpkg_buildtreescurl_srce2f4ea635f_0a39edd58e.cleanlibgetenv.c
push 0x2d
lea esi, [ebp + 1]
push esi
push ebp
call fcn.10055550
mov edi, eax
add esp, 0x10
test edi, edi
je 0x100695dd
push esi
push edi
push dword [esp + 0x1c]
mov ebp, edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x100695fb
cmp esi, ebx
je 0x100695fb
cmp esi, 0x8000
ja 0x100695fb
cmp esi, ebx
jb 0x100695f4
push str.C:UsersClint_vcpkg_buildtreescurl_srce2f4ea635f_0a39edd58e.cleanlibgetenv.c
push 0x2d
push esi
push edi
call fcn.10055550
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x100695a0
push str.C:UsersClint_vcpkg_buildtreescurl_srce2f4ea635f_0a39edd58e.cleanlibgetenv.c
push 0x2f
push ebp
call fcn.100553e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push str.C:UsersClint_vcpkg_buildtreescurl_srce2f4ea635f_0a39edd58e.cleanlibgetenv.c
push 0x3a
push edi
call fcn.100553e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1006f130
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x88
mov eax, dword [0x100b0270]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x9c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
or esi, 0xffffffff
push eax
mov ebx, dword [edi + 0xc]
mov ebp, dword [ebx + 0x14c]
push ebp
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1006f19f
push str.C:UsersClint_vcpkg_buildtreescurl_srce2f4ea635f_0a39edd58e.cleanlib_ftp.c
push 0x11c
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x80
push eax
lea eax, [esp + 0x20]
push eax
push ebp
call fcn.10055260
add esp, 0x14
mov esi, eax
push ebp
push ebx
push edi
call fcn.100514f0
add esp, 0xc
cmp esi, 0xffffffff
jne 0x1006f1c4
push str.Error_accept__ing_server_connect
push edi
call fcn.10050bc0
add esp, 8
mov eax, 0x1e
jmp 0x1006f234
push str.Connection_accepted_from_server
push edi
call fcn.10050c90
push 1
push esi
mov byte [ebx + 0x266], 0
mov dword [ebx + 0x14c], esi
call fcn.1007d9c0
add esp, 0x10
mov byte [ebx + 0x279], 1
cmp dword [edi + 0x1b8], 0
je 0x1006f232
push 1
push edi
call fcn.10040530
mov eax, dword [edi + 0x1b8]
push 1
push esi
push dword [edi + 0x1bc]
call eax
push 0
push edi
mov esi, eax
call fcn.10040530
add esp, 0x1c
test esi, esi
je 0x1006f232
push ebx
push edi
call fcn.1006f6c0
add esp, 8
mov eax, 0x2a
jmp 0x1006f234
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100908b3
add esp, 0x88
ret
Function at 0x10071250
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x10071280
push str.Couldnt_set_desired_mode
push esi
call fcn.10050bc0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x10071297
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.10050c90
add esp, 0xc
mov eax, dword [esp + 0x18]
push ebp
cmp eax, 0x13
jne 0x100712b2
push ebx
push esi
call fcn.10071150
add esp, 8
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp eax, 0x14
jne 0x100713de
mov edi, dword [esi + 0xc]
xor ebx, ebx
cmp dword [esi + 0x500], 2
mov dword [esp + 0x18], edi
jne 0x1007133a
mov eax, dword [esi + 0x134]
mov eax, dword [eax]
test eax, eax
je 0x1007133a
push 3
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push ecx
push ebx
push eax
push esi
call fcn.1007ce00
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x1007140b
push 0x2f
push dword [esp + 0x18]
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x10071320
mov ebx, dword [esp + 0x14]
mov ecx, 1
sub eax, ebx
cmovne ecx, eax
mov byte [ecx + ebx], 0
jmp 0x10071336
push str.C:UsersClint_vcpkg_buildtreescurl_srce2f4ea635f_0a39edd58e.cleanlib_ftp.c
push 0x5cc
push dword [esp + 0x1c]
call fcn.100553e0
add esp, 0xc
mov edi, dword [esp + 0x18]
mov ecx, dword [esi + 0x544]
test ecx, ecx
jne 0x10071358
cmp byte [esi + 0xd06], 0
mov ecx, str.NLST
mov eax, str.LIST
cmove ecx, eax
mov edx, 0x100a4e5b
test ebx, ebx
mov eax, edx
cmovne eax, ebx
push eax
mov eax, 0x100a4e98
cmove eax, edx
push eax
push ecx
push 0x100974a8
call fcn.10055a00
push str.C:UsersClint_vcpkg_buildtreescurl_srce2f4ea635f_0a39edd58e.cleanlib_ftp.c
push 0x5d5
push ebx
mov ebp, eax
call fcn.100553e0
add esp, 0x1c
test ebp, ebp
jne 0x1007139e
mov edi, 0x1b
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
push ebp
push 0x100a9f0c
lea eax, [edi + 0x438]
push eax
push esi
call fcn.100875c0
push str.C:UsersClint_vcpkg_buildtreescurl_srce2f4ea635f_0a39edd58e.cleanlib_ftp.c
push 0x5db
push ebp
mov edi, eax
call fcn.100553e0
add esp, 0x1c
test edi, edi
jne 0x1007140b
mov eax, dword [esi + 0xc]
pop ebp
mov dword [eax + 0x4bc], 0x1f
mov eax, edi
pop edi
pop esi
pop ebx
ret
cmp eax, 0x15
jne 0x100713f7
push 0xd
push 1
push esi
call fcn.10070cd0
add esp, 0xc
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp eax, 0x16
jne 0x1007140b
push 0xe
push 1
push esi
call fcn.10070cd0
add esp, 0xc
mov edi, eax
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x10079270
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x100b0270]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x90]
push ebp
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + 0x438]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x18]
push eax
mov eax, dword [edi + 0x13c]
push 0
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x130], 0
mov dword [edi + 0x134], eax
jne 0x100792f6
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [edi + 0xb0]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x130], eax
mov esi, dword [edi + 0x134]
cmp esi, 4
jge 0x10079331
push str.Received_too_short_packet
push ebx
call fcn.10050bc0
add esp, 8
mov dword [edi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100908b3
add esp, 0x88
ret
mov edx, dword [edi + 0x148]
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x10079350.1
jmp dword [ecx*4 + 0x1007945c]
cmp esi, 4
jle case.0x10079350.4
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x144]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x10079350.4
lea eax, [esi - 4]
push eax
lea eax, [edx + 4]
push eax
push 1
push ebx
call fcn.10050b10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100793ab
push 5
push edi
call fcn.10079da0
add esp, 8
mov eax, esi
jmp 0x10079318
mov eax, dword [edi + 0x134]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push ebx
call fcn.10061e30
jmp 0x10079431
movzx ecx, byte [edx + 2]
lea ebp, [edx + 4]
movzx eax, byte [edx + 3]
add esi, 0xfffffffc
shl ecx, 8
or ecx, eax
push esi
push ebp
mov dword [edi + 8], ecx
call fcn.10079e10
add esp, 8
cmp eax, esi
jae case.0x10079350.4
push ebp
push str.TFTP_error:__s
push ebx
call fcn.10050c90
jmp 0x10079431
lea eax, [esi - 2]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.10079000
add esp, 0xc
test eax, eax
je case.0x10079350.4
jmp 0x10079318
push str.Internal_error:_Unexpected_packet
push 0x100a9f0c
push ebx
call fcn.10050bc0
add esp, 0xc
push ebx
call fcn.10062230
add esp, 4
test eax, eax
je 0x10079316
push 5
push edi
call fcn.10079da0
add esp, 8
mov eax, 0x2a
jmp 0x10079318
Function at 0x1008c200
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push esi
imul esi, dword [esp + 0xc], 0x2c
push edi
add esi, dword [0x100b0ea0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebp, [eax*2 + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1008c242
pop edi
pop esi
mov eax, 0xa
pop ebp
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x1008c268
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1008c289
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1008c289
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1008c283
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1008c289
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [esi + 0x14]
and bl, 1
mov cl, bl
and al, 0xfd
add cl, cl
shl bl, 2
or cl, al
xor eax, eax
and cl, 0xfb
or cl, bl
pop ebx
pop edi
mov byte [esi + 0x14], cl
pop esi
pop ebp
ret
Function at 0x1008c350
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x20
mov eax, dword [0x100b0270]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x1008c44f
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1008c448
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esp + 0x10], 0x10
jb 0x1008c42d
call ebx
cmp dword [esp + 0x1c], eax
jne 0x1008c42d
call ebp
cmp dword [esp + 0x18], eax
je 0x1008c42d
mov edx, dword [esi]
test edx, edx
jne 0x1008c3f5
push 0x200
push edx
mov dword [esi + 4], 0x80
push dword [0x100b0a7c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1008c448
jmp 0x1008c420
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1008c420
shl eax, 3
push eax
push edx
push 0
push dword [0x100b0a7c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1008c448
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1008c3b5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1008c497
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x1008c497
mov ebp, dword [esp + 0x3c]
nop
mov eax, dword [esi]
push dword [eax + ebx*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1008c491
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebp
push dword [esp + 0x3c]
push edi
call fcn.1008c8f0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x1008c460
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100908b3
add esp, 0x20
ret

Function at 0x1008ca70
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x1008cac9
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x1008cab9
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
nop dword [eax + eax]
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1008caaf
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x1008ca90
mov eax, dword [ebx]
pop edi
pop ebp
push eax
push 0
push dword [0x100b0a7c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x1008cad0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x100b0e98]
test eax, eax
je 0x1008caec
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x1008cb52
mov eax, dword [eax]
test eax, eax
jne 0x1008cae0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1008cb56
push esi
lea edx, [eax + 0x20]
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov esi, 0x20
nop dword [eax + eax]
mov ecx, dword [eax + 4]
add esi, 0x20
mov dword [edx], ecx
mov dword [eax + 4], edx
add edx, 0x20
cmp esi, 0xfe0
jbe 0x1008cb20
mov ecx, dword [0x100b0e98]
mov dword [eax], ecx
mov dword [0x100b0e98], eax
pop esi
mov edx, dword [eax + 4]
mov ecx, dword [edx]
inc dword [eax + 8]
mov dword [eax + 4], ecx
mov eax, edx
ret
test eax, eax
jne 0x1008cb44
xor eax, eax
ret
Function at 0x1008cf60
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 4]
push esi
mov cl, byte [edx]
test cl, cl
je 0x1008cf75
cmp cl, 0x90
je 0x1008cf75
cmp cl, 0xcc
jne 0x1008cf93
mov esi, dword [esp + 0xc]
mov eax, 1
cmp esi, eax
jbe 0x1008cf8c
cmp byte [eax + edx], cl
jne 0x1008cf93
inc eax
cmp eax, esi
jb 0x1008cf82
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x413dfa
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413e20
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x413e20
xor al, al
jmp 0x413e35
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x417024
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.00416c9f
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00416cda
stosb byte es:[edi], al
cdq
mov cl, 0x93
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
Function at 0x10068000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
cmp dword [0x1006b154], 0
jne 0x10068087
push 0x14
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.10068b28
add esp, 0xc
mov byte [ebp - 0x1c], 0x47
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x16], 0x46
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x19], 0x62
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x13], 0x65
mov eax, dword [0x1006b158]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [fcn.1006b14c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10068075
mov eax, dword [ebp - 0x20]
mov dword [0x1006b154], eax
push 0x14
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.10068b28
add esp, 0xc
jmp 0x1006808f
mov eax, dword [0x1006b154]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x100680a4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100680a9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.10068b28
add esp, 0xc
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x43
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x50
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x49
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x1006b158]
push eax
call dword [fcn.1006b14c]
mov dword [ebp - 4], eax
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.10068b28
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x10068142
call dword [ebp - 4]
jmp 0x10068149
mov eax, 1
jmp 0x10068149
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1006826a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x13], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 8], 0
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 9], 0
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], 0x73
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x1006b158]
push eax
call dword [fcn.1006b14c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x100682c2
jmp 0x100682c9
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10068a1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov byte [ebp - 0x14], 0x56
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 9], 0x63
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0xd], 0x41
mov byte [ebp - 8], 0
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xb], 0x6c
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x1006b158]
push eax
call dword [fcn.1006b14c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x10068a76
xor eax, eax
jmp 0x10068a8b
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x18]
jmp 0x10068a8b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10068c01
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x40
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.10068b58
add esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x10068c30
mov eax, 0xea61
jmp 0x10068cae
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x3c], 0
jne 0x10068c40
mov eax, 0xea62
jmp 0x10068cae
push 0xf8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.10068b58
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x4550
je 0x10068c6d
mov eax, 0xea62
jmp 0x10068cae
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 4]
cmp ecx, 0x14c
je 0x10068c85
mov eax, 0xea65
jmp 0x10068cae
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x16]
test ch, 0x10
je 0x10068c9a
mov eax, 0xea66
jmp 0x10068cae
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x74], 0x10
jbe 0x10068caa
mov eax, 0xea67
jmp 0x10068cae
xor eax, eax
jmp 0x10068cae
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001b81
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x1004729c
call fcn.100464e0
sub esp, 0x448
push ebx
xor ebx, ebx
test byte [0x10060afc], 1
push esi
push edi
mov dword [ebp - 0x1c], ebx
mov esi, 0x10060af0
jne 0x10001bc0
or byte [0x10060afc], 1
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_1
push 0x10001d4d
call fcn.100463d2
pop ecx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
push 0x10060aec
push dword [0x10060af0]
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x452]
mov word [ebp - 0x454], bx
mov dword [ebp - 0x1c], ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
cmp eax, ebx
pop ecx
jne 0x10001d09
cmp dword [ebp - 0x10], 0xffffffff
je 0x10001d32
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 0x22c
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10001c54
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0x240], edi
je 0x10001c4c
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x10001c54
jmp 0x10001c2f
mov eax, dword [ebp - 0x230]
jmp 0x10001c57
mov eax, dword [ebp - 0x1c]
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x10001d09
push str.Psapi.dll
lea ecx, [ebp + 0xc]
call sub.MFC42u.DLL_CString::CString_2
push 1
lea eax, [ebp + 0xc]
pop edi
mov dword [ebp - 4], ebx
push edi
push eax
call fcn.10001217
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 0xc]
call sub.MFC42u.DLL_CString::CString
cmp dword [ebp - 0x14], ebx
je 0x10001d09
push str.GetModuleFileNameExW
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10001d09
lea ecx, [ebp - 0x454]
push 0x104
push ecx
push ebx
push dword [ebp - 0x18]
call eax
lea eax, [ebp - 0x454]
mov ecx, esi
push eax
call sub.MFC42u.DLL_CString::operator
mov eax, dword [0x10060af0]
mov ecx, esi
push dword [eax - 8]
push 0x5c
call sub.MFC42u.DLL_CString::ReverseFind
inc eax
mov ecx, esi
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.MFC42u.DLL_CString::Mid
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.100460f4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call sub.MFC42u.DLL_CString::CString
cmp dword [ebp - 0x10], 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10001d1a
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x18], ebx
je 0x10001d24
push dword [ebp - 0x18]
call edi
cmp dword [ebp - 0x14], ebx
je 0x10001d32
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp + 8]
push esi
call fcn.100460c4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret