joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4897ed
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4c9f98]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x48982d
cmp byte [ebx], 0xa
jne 0x48982d
or byte [edi + eax + 0x28], 4
jmp 0x489832
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x489931
mov dl, byte [eax]
cmp dl, 0x1a
je 0x489914
inc eax
cmp dl, 0xd
je 0x48985e
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x489884
cmp eax, ecx
jae 0x489892
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x489846
jmp 0x489931
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48990f
cmp dword [ebp - 0x10], 0
je 0x48990f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4c9f98]
test byte [eax + edi + 0x28], 0x48
je 0x4898e9
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4898d4
mov byte [esi], dl
jmp 0x4898e5
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4c9f98]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x489931
cmp byte [ebp - 1], 0xa
jne 0x4898f8
cmp esi, ebx
jne 0x4898f8
mov byte [esi], 0xa
jmp 0x489930
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0048a373
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x489931
mov byte [esi], 0xd
jmp 0x489930
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4c9f98]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x48992e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x489931
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x48993a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4c9f98]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x489980
cmp word [ebx], dx
jne 0x489980
or byte [eax + edi + 0x28], 4
jmp 0x489985
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x489ae8
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x489ac8
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4899c6
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4899fc
cmp eax, edx
jae 0x489a0a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x4899a1
jmp 0x489ae8
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x489ac3
cmp dword [ebp - 0x18], 0
je 0x489ac3
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4c9f98]
test byte [eax + edi + 0x28], 0x48
je 0x489a99
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x489a5d
mov word [esi], cx
jmp 0x489a94
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4c9f98]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4c9f98]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4c9f98]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x489ae8
pop eax
cmp word [ebp - 4], ax
jne 0x489aa9
cmp esi, ebx
jne 0x489aa9
mov word [esi], ax
jmp 0x489ae5
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0048a373
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x489ae8
push 0xd
pop eax
jmp 0x489aa4
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4c9f98]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x489ae2
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x489ae8
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x48b29b
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048b21d
Function at 0x48e0e2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x48e17f
push ebx
push esi
call fcn.0048e0ab
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0048b8ea
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x48e12c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x48e17e
push edi
push eax
call fcn.00486f91
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x48e14c
call fcn.00486ae2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x48e17d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0048b8ea
add esp, 0x20
test eax, eax
jne 0x48e16b
push edi
call fcn.00486ae2
jmp 0x48e173
push ebx
call fcn.00486ae2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x48e182
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x48e193
pop esi
ret
push ebx
push edi
push esi
call fcn.0048e0ab
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00486f91
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x48e1bb
push ebx
push esi
push edi
call fcn.0046da90
add esp, 0xc
push 0
call fcn.00486ae2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x48e58b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048e1d0

Function at 0x490a96
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0048568f
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x490b05
cmp esi, dword [ebp - 4]
je 0x490b00
cmp dword [ebp + 0xc], 0
je 0x490b00
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x490add
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.004905e8
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x490b07
xor eax, eax
inc eax
jmp 0x490b07
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x490b6c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4c7080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0048568f
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0048568f
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x490be3
cmp word [ecx], dx
je 0x490be3
mov eax, dword [0x4a33b4]
push edi
dec eax
push eax
push 0x4a32a0
call fcn.00490b0b
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x490c56
cmp word [eax], dx
je 0x490c56
mov eax, dword [edi]
test eax, eax
je 0x490c07
cmp word [eax], dx
je 0x490c07
lea eax, [ebp - 0x10]
push eax
call fcn.004904ee
jmp 0x490c10
lea eax, [ebp - 0x10]
push eax
call fcn.00490589
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x490c80
mov eax, dword [0x4a329c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x4a2f90
call fcn.00490b0b
add esp, 0xc
test al, al
je 0x490c80
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x490c4b
cmp word [eax], di
je 0x490c4b
lea eax, [ebp - 0x10]
push eax
call fcn.004904ee
pop ecx
jmp 0x490c82
lea eax, [ebp - 0x10]
push eax
call fcn.00490589
jmp 0x490c48
mov eax, dword [edi]
test eax, eax
je 0x490c6d
cmp word [eax], dx
je 0x490c6d
lea eax, [ebp - 0x10]
push eax
call fcn.004904a3
pop ecx
jmp 0x490c80
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x490d4b
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00490990
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x490d4b
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x490d4b
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x490d4b
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x490cd8
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004889d6
test ebx, ebx
je 0x490d46
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004889d6
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x490d4b
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x490d4b
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0048af3c
add esp, 0x10
xor eax, eax
inc eax
jmp 0x490d4d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046be79
leave
ret
Function at 0x494c35
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00494bb1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x494da4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x494da4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x494d59
jg 0x494c91
test eax, eax
je 0x494d4f
push 1
push 0x1000
call fcn.00485b6c
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x494cb4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x494d46
push 0x8000
push ebx
call fcn.004835ef
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x494cdd
jg 0x494cd8
cmp ecx, 0x1000
jb 0x494cdd
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004868c6
add esp, 0x10
cmp eax, 0xffffffff
je 0x494d22
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x494cd8
jl 0x494d09
test ecx, ecx
jne 0x494cca
push dword [ebp - 0xc]
push ebx
call fcn.004835ef
push esi
call fcn.00486ae2
add esp, 0xc
xor ebx, ebx
jmp 0x494db2
cmp byte [edi + 0x24], 0
je 0x494d39
cmp dword [edi + 0x20], 5
jne 0x494d39
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x494d44
mov ebx, dword [edi + 0x18]
jmp 0x494d46
xor ebx, ebx
push esi
call fcn.00486ae2
pop ecx
jmp 0x494db2
test ecx, ecx
jg 0x494d1b
jl 0x494d59
test eax, eax
jae 0x494d1b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0048a373
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x494d79
cmp byte [edi + 0x1c], 0
je 0x494d1b
jmp 0x494daa
push ebx
call fcn.0048eb5a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x494d1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x494db2
cmp byte [edi + 0x1c], 0
je 0x494daf
mov ebx, dword [edi + 0x18]
jmp 0x494db2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0048a373
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x495f40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x495f6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x495f6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43b62e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
add esi, ebx
or ebx, ebx
mov esi, esi
call fcn.0043b66f
mov esi, 0xd293ecc3
xor dword [ecx], eax
push 0x300be929
pop ebx
add ecx, 1
add ebx, 0xef6fb7bf
mov ebx, 0x4f566ac7
cmp ecx, edx
jne fcn.0043b62e
or ebx, esi
ret
Function at 0x10005b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x20]
mov dl, 0x6e
xor ebx, ebx
push eax
push ecx
mov dword [esi], 0x10004ce0
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], bl
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], bl
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10002430
mov edi, eax
call ebp
push ebx
push ebx
push ebx
push ebx
mov dword [section..bss], eax
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 4], 0x3e8
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [esi + 4]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x28], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi], eax
mov eax, dword [esi + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x20], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi + 8], eax
add esp, 0x10
add edi, 4
dec ebp
jne 0x10005c24
lea eax, [esi + 0x46]
xor ecx, ecx
mov edx, eax
pop edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov word [eax], 0x31
mov word [esi + 0x48], 1
mov dword [esi + 0x4a], 0x1f40
mov dword [esi + 0x4e], 0x659
mov word [esi + 0x52], 0x41
mov word [esi + 0x54], bx
mov word [esi + 0x56], 2
mov word [esi + 0x58], 0x140
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10005b45
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x20]
mov dl, 0x6e
xor ebx, ebx
push eax
push ecx
mov dword [esi], 0x10004ce0
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], bl
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], bl
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10002430
mov edi, eax
call ebp
push ebx
push ebx
push ebx
push ebx
mov dword [section..bss], eax
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 4], 0x3e8
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [esi + 4]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x28], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi], eax
mov eax, dword [esi + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x20], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi + 8], eax
add esp, 0x10
add edi, 4
dec ebp
jne 0x10005c24
lea eax, [esi + 0x46]
xor ecx, ecx
mov edx, eax
pop edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov word [eax], 0x31
mov word [esi + 0x48], 1
mov dword [esi + 0x4a], 0x1f40
mov dword [esi + 0x4e], 0x659
mov word [esi + 0x52], 0x41
mov word [esi + 0x54], bx
mov word [esi + 0x56], 2
mov word [esi + 0x58], 0x140
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10006040
Capabilities:
Create thread
Link many functions at runtime
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..bss]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push 0x10002500
mov edi, ecx
push eax
call esi
call eax
test eax, eax
jne 0x1000606d
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [section..bss]
push 0x100024f4
push ecx
call esi
lea edx, [ebp - 4]
mov esi, eax
push edx
push 4
push edi
push 0x100062b0
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x2c], eax
mov eax, dword [ebp - 4]
push 0x20000
push 0
lea ecx, [edi + 0x46]
push eax
lea ebx, [edi + 0x18]
push ecx
push 0xffff
push ebx
call esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test eax, eax
je 0x100060d9
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [section..bss]
push 0x100024e0
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
lea esi, [edi + 0x30]
mov dword [ebp - 8], 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov ecx, dword [ebx]
push eax
push ecx
call dword [ebp - 0xc]
mov eax, dword [ebp - 8]
add esi, 4
dec eax
mov dword [ebp - 8], eax
jne 0x100060f8
mov edx, dword [section..bss]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100024d0
push edx
call esi
mov ecx, dword [edi + 0x1c]
push 0x20
mov edx, dword [edi + ecx*4 + 0x30]
mov ecx, dword [ebx]
push edx
push ecx
call eax
mov edx, dword [edi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [section..bss]
push 0x100024c4
push eax
call esi
mov ecx, dword [ebx]
push ecx
call eax
mov al, 1
mov byte [edi + 0x44], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006b10
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x1001bfb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 4]
call fcn.100066a0
xor ebx, ebx
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1d0], ebx
call fcn.100066a0
lea ecx, [esi + 0x54]
mov byte [esp + 0x1d0], 1
call fcn.100066a0
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1d0], 2
call fcn.100066a0
mov al, 0x65
mov cl, 0x6c
mov byte [esp + 0x29], al
mov byte [esp + 0x2c], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0x2d], cl
mov byte [esp + 0x32], cl
mov byte [esp + 0x33], cl
lea eax, [esp + 0x18]
lea ecx, [esp + 0x28]
mov dl, 0x6e
push eax
push ecx
mov byte [esp + 0x1d8], 3
mov dword [esi], 0x10004cf8
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], dl
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3c], bl
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x24], 0x74
mov byte [esp + 0x26], 0x45
mov byte [esp + 0x27], 0x76
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x74
mov byte [esp + 0x2b], 0x41
mov byte [esp + 0x2c], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x38]
mov edi, eax
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ebp, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call ebp
add esp, 4
push ebx
push ebx
push 1
push ebx
call edi
push 0x30
mov dword [esi + 0xac], eax
call ebp
add esp, 4
mov byte [esi + 0xb5], bl
mov dword [esi + 0xa8], 0xffffffff
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x11], 0x68
mov byte [esp + 0x12], 0x30
mov byte [esp + 0x13], 0x73
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0xb0]
mov al, 0x74
pop edi
mov dword [ecx], edx
mov byte [ecx + 4], al
mov ecx, dword [esp + 0x1c4]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c4
ret