joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70cbb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x1f2000]
lea eax, [edi + 0x2e9864]
push dword [eax]
mov dword [eax], 0x9101b80e
push eax
push edi
or ebp, 0xffffffff
jmp 0x70cbe2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x70cbe9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70cbd8
mov eax, 1
add ebx, ebx
jne 0x70cbfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x70cc0c
jne 0x70cc2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70cc2b
dec eax
add ebx, ebx
jne 0x70cc18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x70cbf0
add ebx, ebx
jne 0x70cc27
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x70cc7d
xor ecx, ecx
sub eax, 3
jb 0x70cc43
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x70ccb2
sar eax, 1
mov ebp, eax
jmp 0x70cc4e
add ebx, ebx
jne 0x70cc4e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70cc1c
inc ecx
add ebx, ebx
jne 0x70cc5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70cc1c
add ebx, ebx
jne 0x70cc69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x70cc5e
jne 0x70cc7a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x70cc5e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x70cc9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x70cc8e
jmp 0x70cbde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x70cc9c
add edi, ecx
jmp 0x70cbde
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x108e9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x70ccbe
cmp byte [edi], 0x29
jne 0x70ccbe
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x70ccc3
lea edi, [esi + 0x2ff000]
mov eax, dword [edi]
or eax, eax
je 0x70cd3b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x30c1e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x30c3dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x70ccf0
mov ecx, edi
jns 0x70cd1f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x30c3e4]
or eax, eax
je 0x70cd35
mov dword [ebx], eax
add ebx, 4
jmp 0x70cd0d
call dword [esi + 0x30c3e0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x70cd6c
cmp al, 0xef
ja 0x70cd5f
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x70cd41
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x70cd4e
mov ebp, dword [esi + 0x30c3e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x70cda0
sub esp, 0xffffff80
jmp 0x5c7969
Function at 0x6836a98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov bl, byte [0x6858500]
mov ecx, 0x14f8
push esi
push edi
mov edi, dword [0x68585a0]
mov edx, 0x6858500
sub edi, 0x4d59294f
movzx eax, bl
test bl, bl
je 0x6836ad0
add ecx, eax
inc edx
cmp ecx, 0x26c
ja 0x6836af4
movzx eax, byte [edx]
test eax, eax
jne 0x6836abe
mov eax, dword [0x68585a4]
imul esi, eax, 0x9a0d0e68
mov dword [0x68585a4], esi
movzx eax, byte [str._tSendAnalyticsEventOnStateChange___]
mov ecx, 0x2476
mov edx, str._tSendAnalyticsEventOnStateChange___
jmp 0x6836b0e
mov eax, dword [0x68585bc]
add eax, 0xf659c7de
jmp 0x6836ad5
add ecx, eax
inc edx
cmp ecx, 0x240b
ja 0x6836b14
movzx eax, byte [edx]
test eax, eax
jne 0x6836b00
jmp 0x6836b20
lea esi, [edi - 0x6cf856e2]
mov dword [0x68585a4], esi
lea ecx, [esi + 0x4162bd34]
mov al, byte [str.._AVCSystemRestoreManager_Piriform__]
mov edx, str.._AVCSystemRestoreManager_Piriform__
jmp 0x6836b3b
sub al, 0x30
cmp al, 9
ja 0x6836b41
inc edx
mov al, byte [edx]
test al, al
jne 0x6836b32
jmp 0x6836b4d
lea esi, [ecx - 0x1f54e41c]
mov dword [0x68585a4], esi
lea eax, [esi - 0xbbdfeaa]
mov dword [0x68585a0], eax
xor edx, edx
mov eax, str.BackButton_
mov edi, edx
inc edi
lea eax, [eax + 2]
cmp edi, 0x154b
jg 0x6836b74
cmp word [eax], dx
jne 0x6836b61
jmp 0x6836b7a
and ecx, 0xc253bbc6
mov al, byte [str.container_id_may_not_be_null]
xor ecx, 0xddc0a4eb
mov edi, str.container_id_may_not_be_null
jmp 0x6836b95
sub al, 0x30
cmp al, 9
ja 0x6836b9b
inc edi
mov al, byte [edi]
test al, al
jne 0x6836b8c
jmp 0x6836ba6
imul eax, ecx, 0x352bef5e
mov dword [0x68585a0], eax
add ecx, 0x331a7a89
mov dword [0x6858590], ecx
test bl, bl
je 0x6836bd6
inc edx
cmp edx, 0x410
je 0x6836bca
cmp byte [edx + 0x6858500], 0
jne 0x6836bb6
jmp 0x6836bd6
add ecx, 0xed44a36
mov dword [0x6858590], ecx
pop edi
mov eax, esi
add ecx, 0xe035a789
pop esi
mov dword [0x68585bc], ecx
pop ebx
ret
Function at 0x683a120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
movzx eax, word [eax]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x68588cc]
or esi, 0xb9b259d
lea edi, [esi + 0x2405ba32]
lea edx, [esi + 0x45ef6fa6]
xor eax, eax
inc eax
cmp eax, 0xc20
je 0x683a15f
cmp byte [eax + str.RegKey2HKCUSoftwarePowerISOReopen1], 0
jne 0x683a14c
jmp 0x683a165
imul edx, esi, 0x2436a78b
and edx, 0x499dc413
mov ecx, edx
and ecx, 0x7dbfe6e1
xor esi, esi
mov eax, esi
inc eax
cmp eax, 0x1459
jl 0x683a18a
cmp byte [eax + str.bits.avcdn.net], 0
jne 0x683a177
jmp 0x683a190
lea edx, [ecx - 0x117ca36]
mov eax, dword [ebp - 4]
xor ecx, 0x9f51f38d
test ax, ax
je 0x683a1c5
movzx esi, ax
lea eax, [esi - 0x30]
cmp ax, 9
ja 0x683a1bf
mov eax, dword [ebp + 8]
add eax, 2
mov dword [ebp + 8], eax
movzx eax, word [eax]
mov esi, eax
test ax, ax
jne 0x683a1a1
jmp 0x683a1c5
imul ecx, edx, 0x5a118994
and edi, 0x17754469
and ecx, 0xe2029b7b
xor eax, eax
mov dword [0x685891c], ecx
mov edx, eax
add ecx, 0xfcd7d69c
mov eax, str._t_tview.sendUserComment_oContext__
xor esi, esi
inc edx
lea eax, [eax + 2]
cmp edx, 0x1359
jl 0x683a1fb
cmp word [eax], si
jne 0x683a1e8
jmp 0x683a207
lea ecx, [edi - 0x1e52f688]
or ecx, 0xdfdf0548
lea eax, [ecx - 0x3c6211df]
mov esi, 0xc1f
mov dword [0x6858ae0], eax
jmp 0x683a224
add esi, edx
inc ebx
cmp esi, 0x907
ja 0x683a22d
movzx edx, byte [ebx]
test edx, edx
jne 0x683a219
jmp 0x683a238
lea eax, [ecx + 0x431401b7]
mov dword [0x6858ae0], eax
imul ecx, ecx, 0xd1a76eaf
mov dword [0x6858880], ecx
pop edi
xor eax, 0x551c50ea
pop esi
mov dword [0x68588cc], eax
pop ebx
leave
ret
Function at 0x683a4d7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
movzx edi, word [ecx]
mov esi, edx
mov edx, ecx
test di, di
je 0x683a505
mov ebx, edi
lea eax, [ebx - 0x30]
push 9
pop ebx
cmp ax, bx
ja 0x683a522
add edx, 2
movzx eax, word [edx]
mov ebx, eax
test ax, ax
jne 0x683a4ed
mov eax, dword [0x68589dc]
mov edx, esi
mov dword [ebp - 4], 0x1f4a
and edx, 0x261661a1
mov ebx, ecx
mov dword [ebp - 8], edx
mov edx, edi
jmp 0x683a53c
imul eax, esi, 0x231c297
jmp 0x683a50a
add dword [ebp - 4], edx
lea ebx, [ebx + 2]
cmp dword [ebp - 4], 0x1e55
ja 0x683a57e
movzx edx, word [ebx]
test edx, edx
jne 0x683a52a
lea edx, [esi - 0x71ee3344]
xor ebx, ebx
add edx, 0x4c8c1a7c
or eax, 0xfd5310b7
mov dword [ebp - 4], ebx
mov dword [0x6858b08], edx
mov ebx, ecx
test di, di
je 0x683a595
inc dword [ebp - 4]
lea ebx, [ebx + 2]
cmp dword [ebp - 4], 0x1490
jl 0x683a589
xor edi, edi
cmp word [ebx], di
movzx edi, word [ecx]
jne 0x683a563
jmp 0x683a595
mov edx, dword [ebp - 8]
add edx, 0x435e4ee9
jmp 0x683a546
imul edx, eax, 0x1820fcd6
mov dword [0x6858b08], edx
and edx, 0x633e91ca
mov dword [0x68589dc], edx
test di, di
je 0x683a5d1
push 9
movzx edi, di
pop ebx
lea eax, [edi - 0x30]
cmp ax, bx
ja 0x683a5c3
add ecx, 2
movzx eax, word [ecx]
mov edi, eax
test ax, ax
jne 0x683a5ac
jmp 0x683a5d1
mov edx, esi
xor edx, 0x978bceae
mov dword [0x68589dc], edx
mov eax, esi
mov ecx, str.Wipe_Alternate_Data_Streams
or eax, 0x1cda40f6
imul ebx, esi, 0x106d2eaf
push 0x57
mov dword [0x6858a2c], eax
mov eax, 0x21e7
pop edi
add eax, edi
lea ecx, [ecx + 2]
cmp eax, 0x1586
ja 0x683a605
movzx edi, word [ecx]
test edi, edi
jne 0x683a5f0
jmp 0x683a611
lea ecx, [ebx + 0x4cc46aaa]
mov dword [0x6858b08], ecx
mov ecx, esi
or ecx, 0xe6e3f4a9
mov dword [0x68588c8], ecx
pop edi
lea ecx, [esi - 0x69b0a06f]
mov eax, edx
pop esi
mov dword [0x6858b70], ecx
pop ebx
leave
ret
Function at 0x6842662
Capabilities:
Gather direct-ftp information

Disassembly:
push esi
push edi
mov edx, dword [0x6859954]
mov esi, str.com.avast.ipm.ClientParameters.SecureLineInstallationSource
push 0x63
pop edi
lea ecx, [edx - 0x19dfa29a]
lea eax, [edi - 0x30]
cmp ax, 9
ja 0x6842690
add esi, 2
movzx eax, word [esi]
mov edi, eax
test ax, ax
jne 0x6842678
jmp 0x6842698
mov ecx, edx
xor ecx, 0x912e1aed
imul ecx, ecx, 0x63912ec4
imul eax, edx, 0x12ba865c
mov esi, str.DetectFile_AppData_CoffeeCup_SoftwareCoffeeCup_HTML_Editor
add ecx, 0x74aea279
mov dword [0x6859958], ecx
mov dword [0x6859a00], eax
mov al, byte [str.DetectFile_AppData_CoffeeCup_SoftwareCoffeeCup_HTML_Editor]
jmp 0x68426ca
sub al, 0x30
cmp al, 9
ja 0x68426d0
inc esi
mov al, byte [esi]
test al, al
jne 0x68426c1
jmp 0x68426dc
lea ecx, [edx + 0x5f29e199]
mov dword [0x6859958], ecx
xor edx, 0x8a3e3e2a
mov eax, ecx
pop edi
mov dword [0x68599fc], edx
pop esi
ret
Function at 0x68434fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 0x22
mov esi, ecx
mov dword [ebp - 8], 0x64
mov eax, edi
mov dword [ebp - 4], 0xffffff7a
mov edx, edi
sub eax, dword [ebp + edx*4 - 0xc]
inc edx
cmp edx, 3
jl 0x6843521
cmp word [esi + eax*2], di
je 0x6843558
mov edx, dword [0x6859ad4]
mov ecx, edx
xor ecx, 0x65b5c7f5
and ecx, 0x7bed42cf
imul edx, edx, 0xac4b4ffe
inc eax
mov dword [0x6859b98], ecx
cmp word [esi + eax*2], di
jne 0x6843537
pop edi
mov dword [0x6859ad4], 0x4ba655af
pop esi
leave
ret
Function at 0x68479c1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
mov ebx, esi
mov dword [ebp - 8], ecx
mov ecx, esi
push edi
mov eax, ecx
mov byte [ebp + ecx - 0x108], cl
and eax, 0x1f
mov al, byte [eax + edx]
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x68479dc
mov edi, esi
mov dl, byte [ebp + edi - 0x108]
movzx eax, byte [ebp + edi - 0x208]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x6847a23
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x108]
mov byte [ebp + ebx - 0x108], dl
mov byte [ebp + edi - 0x108], al
inc edi
cmp edi, 0x100
jl 0x68479fd
mov edi, esi
cmp dword [ebp - 4], esi
jle 0x6847ab5
mov ebx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
sub ebx, edx
inc esi
and esi, 0x800000ff
jns 0x6847a61
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + esi - 0x108]
movzx eax, cl
add edi, eax
and edi, 0x800000ff
jns 0x6847a7d
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + edi - 0x108], cl
mov byte [ebp + esi - 0x108], al
movzx ecx, byte [ebp + edi - 0x108]
movzx eax, al
add ecx, eax
movzx eax, cl
mov al, byte [ebp + eax - 0x108]
xor al, byte [ebx + edx]
mov byte [edx], al
inc edx
sub dword [ebp - 4], 1
jne 0x6847a50
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6848302
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [0x685b050]
push esi
mov esi, 0x685b050
mov ecx, esi
push edi
test bl, bl
je 0x6848329
mov al, bl
sub al, 0x30
cmp al, 9
ja 0x6848369
inc ecx
mov al, byte [ecx]
test al, al
jne 0x684831c
mov ecx, dword [0x685b0e8]
or ecx, 0x5f12565d
add ecx, 0x1fa19c86
mov edx, dword [0x685b040]
mov edi, 0xc94
mov dword [ebp - 4], esi
movzx eax, bl
test bl, bl
je 0x684837d
inc dword [ebp - 4]
add edi, eax
cmp edi, 0xbe9
ja 0x6848377
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
jne 0x6848350
jmp 0x684837d
mov ecx, dword [0x685b0e8]
or ecx, 0xf8756f4
jmp 0x684832f
lea ecx, [edx - 0x4a05b3e8]
movzx eax, byte [str.LogModule_is_going_to_be_destroyed.]
mov edi, 0x1f1f
mov dword [ebp - 4], str.LogModule_is_going_to_be_destroyed.
jmp 0x68483a5
inc dword [ebp - 4]
add edi, eax
cmp edi, 0x1067
ja 0x68483ab
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
jne 0x6848392
jmp 0x68483b1
lea ecx, [edx + 0x20a8ec7c]
lea eax, [edx - 0x1230e271]
mov dword [0x685b0e8], eax
jmp 0x68483c9
sub bl, 0x30
cmp bl, 9
ja 0x68483cf
inc esi
mov bl, byte [esi]
test bl, bl
jne 0x68483be
jmp 0x68483db
mov eax, ecx
xor eax, 0xa7f5011d
mov dword [0x685b0e8], eax
push 0x41
and ecx, 0x5b641b8
mov eax, 0x1b9b
mov esi, str.Apple_ComputerSafari
pop edi
add eax, edi
inc esi
cmp eax, 0xddb
ja 0x6848401
movsx edi, byte [esi]
test edi, edi
jne 0x68483ee
jmp 0x6848409
mov ecx, edx
or ecx, 0xc391ad28
lea eax, [edx + 0x31cc97e7]
mov dword [0x685b2e0], eax
xor eax, eax
inc eax
cmp eax, 0x260c
jl 0x6848429
cmp byte [eax + str.Apple_ComputerSafari], 0
jne 0x6848416
jmp 0x6848435
and ecx, 0x9d2cf82e
mov dword [0x685b0e8], ecx
mov ecx, edx
mov esi, str.english_south_africa
push 0x65
and ecx, 0x3c60dbb0
pop edi
lea eax, [edi - 0x30]
cmp ax, 9
ja 0x684845d
add esi, 2
movzx eax, word [esi]
mov edi, eax
test ax, ax
jne 0x6848445
jmp 0x6848468
imul eax, ecx, 0x12cec369
mov dword [0x685b2e0], eax
pop edi
and edx, 0x938917b4
pop esi
mov dword [0x685b3b8], edx
pop ebx
leave
ret
Function at 0x6848848
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x6859ec4]
push ebx
push esi
and eax, 0x5edd7a8a
mov esi, ecx
push edi
imul edi, eax, 0xefe5c491
add edi, 0x3f61c672
mov dword [ebp - 4], edi
movzx ebx, word [esi]
mov edx, dword [0x685b26c]
mov eax, edi
xor eax, 0x506248c1
xor edx, 0x21bccfd
mov dword [ebp - 8], eax
xor eax, eax
mov ecx, eax
mov eax, esi
test bx, bx
je 0x68488b0
inc ecx
lea eax, [eax + 2]
cmp ecx, 0xa69
je 0x68488a7
xor ebx, ebx
cmp word [eax], bx
movzx ebx, word [esi]
jne 0x684888f
jmp 0x68488b0
lea edi, [edx + 0x1a34586]
mov dword [ebp - 4], edi
imul edx, dword [ebp - 8], 0xf703a3d
mov dword [0x685b244], edx
mov eax, dword [0x685b26c]
mov ecx, edi
xor eax, 0x7c3d3d82
and ecx, 0x45a8a529
mov dword [ebp - 8], eax
mov edi, esi
mov dword [0x685b21c], ecx
test bx, bx
je 0x6848909
movzx ebx, bx
lea eax, [ebx - 0x30]
cmp ax, 9
ja 0x68488fa
add edi, 2
movzx eax, word [edi]
mov ebx, eax
test ax, ax
jne 0x68488e2
jmp 0x6848906
imul edx, ecx, 0x1199f596
mov dword [0x685b244], edx
movzx ebx, word [esi]
mov eax, dword [ebp - 4]
xor edi, edi
add eax, 0x46a4bb46
mov dword [0x685b0f0], eax
mov eax, edi
test bx, bx
je 0x684893e
inc eax
lea esi, [esi + 2]
cmp eax, 0x2068
jg 0x6848931
cmp word [esi], di
jne 0x684891f
jmp 0x684893e
mov eax, dword [ebp - 8]
add eax, 0xb9de5a5c
mov dword [0x685b0f0], eax
and ecx, 0x9ffc6e7e
imul eax, edx, 0x25520687
pop edi
pop esi
mov dword [0x6859ec4], ecx
pop ebx
mov dword [0x685b150], eax
lea eax, [edx - 0x52aed2aa]
mov dword [0x685b26c], eax
leave
ret
Function at 0x684b557
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret
Function at 0x10037470
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1004e44c]
xor eax, esp
mov dword [esp + 0x10], eax
cmp byte [0x100516ba], 0
push esi
mov esi, ecx
je 0x10037538
mov eax, 0x64
mov word [esp + 0xc], ax
xor eax, eax
mov word [esp + 0x12], ax
lea eax, [esp + 8]
push eax
push ecx
mov dword [esp + 0x10], 0x700055
mov dword [esp + 0x16], 0x6d0054
call fcn.10037550
test eax, eax
je 0x10037538
push ecx
mov ecx, esi
call fcn.10037320
test eax, eax
je 0x10037538
push str.GlobalPCAProMutex
push 0
push 0x100000
call dword [0x1006fa28]
test eax, eax
je 0x100374fd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100084c3
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10037538
cmp dword [0x1006f9f4], 0
je 0x1003751d
mov eax, dword [0x1006f9f4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push esi
push 0x1003b440
push 0
push 0
call fcn.10009fc5
add esp, 0x18
mov dword [0x1006f9f4], eax
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.100084c3
mov esp, ebp
pop ebp
ret
Function at 0x100381e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [0x1006fab4]
push esi
push edi
push 0x44
lea eax, [ebx + 0x40e0]
push 0
push eax
mov dword [ebp - 8], ebx
call fcn.1000b010
add esp, 0xc
call fcn.100016a0
lea ecx, [ebx + 0x407c]
mov byte [ebx + 0x40dd], 0
mov byte [ebx + 0x40da], 0
mov byte [ebx + 0x29], 0
call fcn.10002570
lea eax, [ebx + 0x4130]
mov ecx, eax
mov dword [ebx + 0x40a4], 0
mov dword [ebx + 0x416c], 0
mov dword [ebp - 4], eax
call fcn.100023e0
lea ecx, [ebx + 0x413c]
call fcn.100023e0
mov edi, dword [ebp + 8]
mov ecx, edi
mov byte [ebx + 0x40dc], 1
xor esi, esi
call fcn.10002310
test eax, eax
je 0x1003828f
mov ebx, dword [ebp - 4]
push esi
mov ecx, edi
call fcn.10002330
push eax
mov ecx, ebx
call fcn.10002350
mov ecx, edi
inc esi
call fcn.10002310
cmp esi, eax
jb 0x10038270
mov ebx, dword [ebp - 8]
push 0
push 0
push ebx
push 0x1003c9a0
push 0
push 0
call fcn.10009fc5
add esp, 0x18
mov dword [ebx + 0x416c], eax
call fcn.100016b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100382c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [0x1006fab4]
push esi
push edi
push 0x44
lea eax, [ebx + 0x40e0]
push 0
push eax
mov dword [ebp - 8], ebx
call fcn.1000b010
add esp, 0xc
call fcn.100016a0
lea ecx, [ebx + 0x407c]
mov byte [ebx + 0x40dd], 0
mov byte [ebx + 0x40da], 0
mov byte [ebx + 0x29], 0
call fcn.10002570
lea ecx, [ebx + 0x4130]
mov dword [ebx + 0x40a4], 0
mov dword [ebx + 0x416c], 0
call fcn.100023e0
lea eax, [ebx + 0x413c]
mov ecx, eax
mov dword [ebp - 4], eax
call fcn.100023e0
mov edi, dword [ebp + 8]
mov ecx, edi
mov byte [ebx + 0x40dc], 1
xor esi, esi
call fcn.10002310
test eax, eax
je 0x1003836f
mov ebx, dword [ebp - 4]
push esi
mov ecx, edi
call fcn.10002330
push eax
mov ecx, ebx
call fcn.10002350
mov ecx, edi
inc esi
call fcn.10002310
cmp esi, eax
jb 0x10038350
mov ebx, dword [ebp - 8]
mov ecx, edi
call fcn.10002310
push 0
push 0
push ebx
push 0x1003c9a0
push 0
push 0
mov dword [ebx + 0x40fc], eax
call fcn.10009fc5
add esp, 0x18
mov dword [ebx + 0x416c], eax
call fcn.100016b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10038410
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1003fb82
mov eax, dword fs:[0]
push eax
sub esp, 0x1f8
mov eax, dword [0x1004e44c]
xor eax, esp
mov dword [esp + 0x1f0], eax
push ebx
push esi
push edi
mov eax, dword [0x1004e44c]
xor eax, esp
push eax
lea eax, [esp + 0x208]
mov dword fs:[0], eax
mov edi, ecx
push 0xff
lea eax, [esp + 0x101]
push 0
push eax
mov byte [esp + 0x108], 0
call fcn.1000b010
mov ebx, 0x61
mov eax, 0x79
add esp, 0xc
mov word [esp + 0xc8], ax
lea eax, [esp + 0xac]
add edi, 0x414c
lea esi, [ebx + 0xb]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x94], 0
mov byte [edi], 0
mov dword [esp + 0xb4], 0x740061
mov dword [esp + 0xc8], 0x6c0069
mov dword [esp + 0xce], 0x63002e
mov dword [esp + 0xc2], 0x64005c
mov dword [esp + 0xd4], 0x64
mov dword [esp + 0xb0], 0x44005c
mov dword [esp + 0xb8], 0x620061
mov dword [esp + 0xbe], 0x650073
mov word [esp + 0xc6], bx
mov word [esp + 0xd2], si
mov word [esp + 0xbc], bx
call fcn.10002000
mov esi, eax
push 0x100516c0
lea ecx, [esp + 0x78]
mov dword [esp + 0x214], 0
call fcn.10002000
push esi
mov edx, eax
lea ecx, [esp + 0x98]
mov byte [esp + 0x214], 1
call fcn.10004c40
add esp, 4
lea ecx, [esp + 0x74]
call fcn.100020d0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x210], 4
call fcn.100020d0
lea ecx, [esp + 0x94]
call fcn.100021a0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10038672
mov word [esp + 0xfa], ax
mov eax, 0x79
mov word [esp + 0xf0], ax
lea eax, [esp + 0xd4]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0xf0], 0x6c0069
mov dword [esp + 0xfa], 0x640076
mov dword [esp + 0xe6], 0x650073
mov dword [esp + 0xe0], 0x620061
mov dword [esp + 0xd8], 0x44005c
mov dword [esp + 0xf6], 0x63002e
mov word [esp + 0xe4], bx
mov dword [esp + 0xdc], 0x740061
mov dword [esp + 0xea], 0x64005c
mov word [esp + 0xee], bx
call fcn.10002000
mov esi, eax
push 0x100516c0
lea ecx, [esp + 0x60]
mov byte [esp + 0x214], 5
call fcn.10002000
push esi
mov edx, eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x214], 6
call fcn.10004c40
add esp, 4
lea ecx, [esp + 0x94]
push eax
call fcn.10002060
lea ecx, [esp + 0x14]
call fcn.100020d0
lea ecx, [esp + 0x5c]
call fcn.100020d0
lea ecx, [esp + 0x44]
mov byte [esp + 0x210], 4
call fcn.100020d0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0xac]
call fcn.100021a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100386f2
push 0
lea eax, [esp + 0x94]
push eax
push pe_nt_image_headers32
lea eax, [esp + 0x108]
push eax
push esi
call dword [0x1006fa34]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x123]
push 0x1004895c
push eax
call fcn.1000a450
add esp, 0xc
test eax, eax
je 0x100386f2
push 0xffffffffffffffff
push eax
push 0x10
push edi
call fcn.1000a53b
add esp, 0x10
lea ecx, [esp + 0x94]
call fcn.100020d0
mov ecx, dword [esp + 0x208]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1f0]
xor ecx, esp
call fcn.100084c3
mov esp, ebp
pop ebp
ret