joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a550
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x1001a56c
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x1001a588
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1001a577
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp + 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 8], eax
cmp edx, edi
jne 0x1001a5b0
mov eax, edi
jmp 0x1001a5b4
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x1001a5eb
lea eax, [esi + 8]
push ebx
push eax
call fcn.10011750
add esp, 8
test al, al
jne 0x1001a5d3
mov esi, dword [esi]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
jmp 0x1001a5a8
lea eax, [esi + 8]
push eax
push ebx
call fcn.10011750
add esp, 8
mov ecx, edi
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x1001a5ef
mov ecx, edi
mov eax, edi
cmp eax, edi
jne 0x1001a647
mov esi, dword [edi]
lea eax, [ebp + 0xb]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 4]
mov edi, dword [esi + 4]
push eax
push 0x1010e6e0
push edi
push esi
lea ecx, [ebx + 4]
call fcn.10019120
mov edx, eax
mov ecx, 0x5d1745c
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1001a653
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.100194b0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
lea eax, [ecx + 0x20]
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.10032d3a
int3

Function at 0x1001ab00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x20
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], 0x6e004e
mov dword [ebp - 0x44], 0x360044
mov dword [ebp - 0x40], 0x500054
mov dword [ebp - 0x3c], 0x48004d
mov dword [ebp - 0x38], 0x52006c
mov dword [ebp - 0x34], 0x740037
mov dword [ebp - 0x30], 0x480061
mov dword [ebp - 0x2c], 0x53004d
mov dword [ebp - 0x28], 0x680045
mov dword [ebp - 0x24], 0x36004e
mov dword [ebp - 0x20], 0x530068
mov dword [ebp - 0x1c], 0x46004b
mov dword [ebp - 0x18], 0x670078
mov dword [ebp - 0x14], 0x630068
mov dword [ebp - 0x10], 0x580078
mov dword [ebp - 0xc], 0x300077
call fcn.1000f230
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4
Function at 0x1001c820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x4c
pop ebp
jmp fcn.1001a550
Function at 0x100201b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0xc
push eax
mov ecx, esi
mov dword [ebp - 0x18], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 0x14], 0x776f7262
mov dword [ebp - 0x10], 0x5f726573
mov dword [ebp - 0xc], 0x656d616e
mov byte [ebp - 8], 0
mov byte [esi], 0
call fcn.1000f130
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4

Function at 0x10020410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
xor eax, eax
mov dword [ebp - 0x28], 0x62006f
push esi
mov dword [ebp - 0x24], 0x6f0061
mov dword [ebp - 0x20], 0x63002e
mov dword [ebp - 0x1c], 0x6d006f
mov dword [ebp - 0x18], 0x69002f
mov dword [ebp - 0x14], 0x650074
mov dword [ebp - 0x10], 0x2e006d
mov dword [ebp - 0xc], 0x740068
mov dword [ebp - 8], 0x3f006d
mov word [ebp - 4], ax
call fcn.10001bd0
mov ecx, eax
test ecx, ecx
je 0x100204b5
mov eax, dword [ecx]
push 2
push 0x12
call dword [eax]
test eax, eax
je 0x100204bf
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x12
jl 0x100204ab
mov dword [eax - 0xc], 0x12
xor eax, eax
mov ecx, dword [esi]
push 0x24
mov word [ecx + 0x24], ax
lea eax, [ebp - 0x28]
push eax
push 0x24
push dword [esi]
call fcn.1001f5c0
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001900
push 0x80004005
call fcn.10001900
call fcn.100029e0
int3
Function at 0x10025440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101036ab
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x1014b520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 8], eax
call fcn.1003fde0
test eax, eax
je 0x100254dc
call fcn.1003fde0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x100254dc
call fcn.1003fde0
lea ecx, [ebp - 0xa4]
mov edi, eax
call fcn.100053e0
mov esi, eax
push str.main::Start
push esi
mov dword [ebp - 4], 0
call fcn.10003110
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x14]
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 0xffffffff
call fcn.100083c0
lea eax, [ebx + 0xc]
push eax
push 0
push ebx
push 0x10025910
push 0
push 0
call fcn.100df9ce
add esp, 0x18
mov dword [ebx + 0x10], eax
call fcn.100225e0
mov ecx, eax
call fcn.1002f730
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025520
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10104bae
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
call fcn.1003fde0
test eax, eax
je 0x100255b4
call fcn.1003fde0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x100255b4
call fcn.1003fde0
lea ecx, [ebp - 0xb0]
mov edi, eax
call fcn.100053e0
mov esi, eax
push 0x1010f190
push esi
mov dword [ebp - 4], 0
call fcn.10003110
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x14]
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], 0xffffffff
call fcn.100083c0
mov esi, dword [ebp - 0x18]
cmp dword [esi + 0x24], 0
jne 0x1002564a
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call fcn.10002b20
mov edi, dword [ebp - 0x14]
mov dword [ebp - 4], 1
test edi, edi
je 0x10025672
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10025672
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x100255ff
lea ebx, [eax + 3]
jmp 0x10025677
push str.GetBrowserAcceptorMgr
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10025614
lea ebx, [eax + 4]
jmp 0x10025677
call eax
mov dword [esi + 0x24], eax
test eax, eax
jne 0x10025622
lea ebx, [eax + 5]
jmp 0x10025677
xor ebx, ebx
test eax, eax
je 0x10025677
mov edx, dword [ebp - 0x14]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002564a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 0x24]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100bb073
mov esp, ebp
pop ebp
ret
mov ebx, 1
call fcn.1003fde0
test eax, eax
je 0x100256d3
call fcn.1003fde0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x100256d3
call fcn.1003fde0
lea ecx, [ebp - 0x148]
mov edi, eax
call fcn.100053e0
mov esi, eax
push str.AcceptorMgrHelper_InitDll_failed:
push esi
mov byte [ebp - 4], 2
call fcn.10003110
add esp, 8
mov ecx, esi
push ebx
call fcn.10012dd0
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0x148]
call fcn.100083c0
mov edx, dword [ebp - 0x14]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100256f5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
jmp 0x10025656
Function at 0x10026390
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10104d51
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x10026582
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10026582
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10026579
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetSkyObj
push ebx
call esi
push str.GetSkyObjEx
push ebx
mov dword [ebp - 0x12c], eax
call esi
mov ebx, eax
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x10026417
call eax
mov dword [edi], eax
cmp dword [edi], 0
jne 0x10026579
test ebx, ebx
je 0x10026579
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xc8
mov esi, eax
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.100d6e30
push 0xa
lea eax, [ebp - 0x124]
push eax
push esi
call fcn.100dfb88
xor eax, eax
mov dword [ebp - 0x5c], 0x460038
add esp, 0x18
mov word [ebp - 0x14], ax
mov dword [ebp - 0x128], eax
lea ecx, [ebp - 0x12c]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x320044
mov dword [ebp - 0x54], 0x410038
push eax
mov dword [ebp - 0x50], 0x320038
mov dword [ebp - 0x4c], 0x34002d
mov dword [ebp - 0x48], 0x430042
mov dword [ebp - 0x44], 0x2d0030
mov dword [ebp - 0x40], 0x450034
mov dword [ebp - 0x3c], 0x430039
mov dword [ebp - 0x38], 0x42002d
mov dword [ebp - 0x34], 0x340033
mov dword [ebp - 0x30], 0x2d0036
mov dword [ebp - 0x2c], 0x380039
mov dword [ebp - 0x28], 0x320043
mov dword [ebp - 0x24], 0x390036
mov dword [ebp - 0x20], 0x390043
mov dword [ebp - 0x1c], 0x430034
mov dword [ebp - 0x18], 0x310042
call fcn.10002a70
lea eax, [ebp - 0x124]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x130]
call fcn.10002a70
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.10052260
add esp, 0xc
lea ecx, [ebp - 0x130]
call fcn.10001730
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 4
call fcn.10001730
mov eax, dword [ebp - 0x128]
cmp dword [eax - 4], 1
jle 0x10026562
push dword [eax - 0xc]
lea ecx, [ebp - 0x128]
call fcn.10001a20
mov eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x124]
push ecx
push eax
call ebx
lea ecx, [ebp - 0x128]
mov dword [edi], eax
call fcn.10001730
xor eax, eax
cmp dword [edi], eax
setne al
jmp 0x10026584
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4
Function at 0x10027330
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10104f10
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
push ebx
push esi
push edi
mov eax, dword [0x1014b520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 8], 0
je 0x10027422
cmp dword [ebx + 4], 0
je 0x10027422
push 0
push 0
push 0x12
push dword [ebx]
mov dword [ebx + 0xc], 1
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [ebx + 8], 0
mov dword [ebp - 0x10], eax
je 0x1002741b
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
sub eax, dword [ebp - 0x10]
cmp eax, 0x1f4
jae 0x100273b7
push 0xa
call esi
cmp dword [ebx + 8], 0
jne 0x100273a1
cmp dword [ebx + 8], 0
je 0x1002741b
call fcn.1003fde0
test eax, eax
je 0x10027422
call fcn.1003fde0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x10027422
call fcn.1003fde0
lea ecx, [ebp - 0xa8]
mov edi, eax
call fcn.100053e0
mov esi, eax
push str.CWorkThread::Stop__wait_thread_stop_timeout_
push esi
call fcn.10006900
add esp, 8
mov ecx, esi
push 0x1f4
call fcn.1001ff80
mov edx, dword [edi]
mov ecx, edi
push esi
call dword [edx + 0x14]
lea ecx, [ebp - 0xa8]
call fcn.100083c0
jmp 0x10027422
mov dword [ebx + 4], 0
mov ecx, dword [ebx + 0x34]
add ebx, 0x10
test ecx, ecx
je 0x10027441
mov edx, dword [ecx]
cmp ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebx + 0x24], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100276c0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10104fce
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push ebx
push esi
push edi
mov eax, dword [0x1014b520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], 0
cmp dword [esi + 4], 0
mov dword [ebp - 4], 0
je 0x10027717
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x38]
mov dword [esi + 8], 0
push eax
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 0
call fcn.10027460
push esi
push 0
push esi
push 0x10027880
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x100277b6
call fcn.1003fde0
test eax, eax
je 0x100277af
call fcn.1003fde0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x100277af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.1003fde0
lea ecx, [ebp - 0xd0]
mov ebx, eax
call fcn.100053e0
mov esi, eax
push str.CWorkThread::Start__CreateThread_failed__errno:
push esi
mov byte [ebp - 4], 1
call fcn.10006900
add esp, 8
mov ecx, esi
push edi
call fcn.1001ff80
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0xd0]
call fcn.100083c0
xor edi, edi
jmp 0x10027852
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [esi + 8], 0
mov dword [ebp - 0x10], eax
jne 0x1002784d
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jae 0x100277e5
push 0xa
call ebx
cmp dword [esi + 8], 0
je 0x100277d1
cmp dword [esi + 8], 0
jne 0x1002784d
call fcn.1003fde0
test eax, eax
je 0x100277af
call fcn.1003fde0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x100277af
call fcn.1003fde0
lea ecx, [ebp - 0x168]
mov edi, eax
call fcn.100053e0
mov esi, eax
push str.CWorkThread::Start__wait_thread_running_timeout_
push esi
mov byte [ebp - 4], 2
call fcn.10006900
add esp, 8
mov ecx, esi
push dword [ebp + 8]
call fcn.1001ff80
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0x168]
call fcn.100083c0
xor edi, edi
jmp 0x10027852
mov edi, 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1002786a
mov esi, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10028130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x6c]
push edi
push 0x33
push eax
mov ecx, esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], 0x6f0053
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x610057
mov dword [ebp - 0x60], 0x650072
mov dword [ebp - 0x5c], 0x4d005c
mov dword [ebp - 0x58], 0x630069
mov dword [ebp - 0x54], 0x6f0072
mov dword [ebp - 0x50], 0x6f0073
mov dword [ebp - 0x4c], 0x740066
mov dword [ebp - 0x48], 0x57005c
mov dword [ebp - 0x44], 0x6e0069
mov dword [ebp - 0x40], 0x6f0064
mov dword [ebp - 0x3c], 0x730077
mov dword [ebp - 0x38], 0x43005c
mov dword [ebp - 0x34], 0x720075
mov dword [ebp - 0x30], 0x650072
mov dword [ebp - 0x2c], 0x74006e
mov dword [ebp - 0x28], 0x650056
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x6f0069
mov dword [ebp - 0x1c], 0x5c006e
mov dword [ebp - 0x18], 0x6e0055
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x6c0061
mov dword [ebp - 8], 0x6c
call fcn.10027ca0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4

Function at 0x10028230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x3f
push eax
mov ecx, esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x84], 0x6f0053
mov dword [ebp - 0x80], 0x740066
mov dword [ebp - 0x7c], 0x610077
mov dword [ebp - 0x78], 0x650072
mov dword [ebp - 0x74], 0x57005c
mov dword [ebp - 0x70], 0x77006f
mov dword [ebp - 0x6c], 0x340036
mov dword [ebp - 0x68], 0x320033
mov dword [ebp - 0x64], 0x6f004e
mov dword [ebp - 0x60], 0x650064
mov dword [ebp - 0x5c], 0x4d005c
mov dword [ebp - 0x58], 0x630069
mov dword [ebp - 0x54], 0x6f0072
mov dword [ebp - 0x50], 0x6f0073
mov dword [ebp - 0x4c], 0x740066
mov dword [ebp - 0x48], 0x57005c
mov dword [ebp - 0x44], 0x6e0069
mov dword [ebp - 0x40], 0x6f0064
mov dword [ebp - 0x3c], 0x730077
mov dword [ebp - 0x38], 0x43005c
mov dword [ebp - 0x34], 0x720075
mov dword [ebp - 0x30], 0x650072
mov dword [ebp - 0x2c], 0x74006e
mov dword [ebp - 0x28], 0x650056
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x6f0069
mov dword [ebp - 0x1c], 0x5c006e
mov dword [ebp - 0x18], 0x6e0055
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x6c0061
mov dword [ebp - 8], 0x6c
call fcn.10027ca0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4
Function at 0x10029930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010527a
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], 0
mov dword [ebp - 4], 1
mov dword [esi], 0
call fcn.10001bd0
mov ecx, eax
test ecx, ecx
je 0x10029a5c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x224], 1
push 0
push eax
mov dword [ebp - 0x21c], 0x208
mov dword [ebp - 0x220], 1
call fcn.100d6e30
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10029a1e
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10029a00
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100028b0
mov edi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10029a3d
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100bb073
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10001900
int3
Function at 0x1002a0a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64], 0x6c0041
push edi
mov dword [ebp - 0x60], 0x630069
mov dword [ebp - 0x5c], 0x410065
mov dword [ebp - 0x58], 0x730073
mov dword [ebp - 0x54], 0x730069
mov dword [ebp - 0x50], 0x5f0074
mov dword [ebp - 0x4c], 0x380041
mov dword [ebp - 0x48], 0x460041
mov dword [ebp - 0x44], 0x320042
mov dword [ebp - 0x40], 0x420031
mov dword [ebp - 0x3c], 0x30002d
mov dword [ebp - 0x38], 0x440035
mov dword [ebp - 0x34], 0x2d0044
mov dword [ebp - 0x30], 0x450034
mov dword [ebp - 0x2c], 0x380043
mov dword [ebp - 0x28], 0x42002d
mov dword [ebp - 0x24], 0x370042
mov dword [ebp - 0x20], 0x2d0037
mov dword [ebp - 0x1c], 0x390046
mov dword [ebp - 0x18], 0x380041
mov dword [ebp - 0x14], 0x450030
mov dword [ebp - 0x10], 0x440042
mov dword [ebp - 0xc], 0x440030
mov dword [ebp - 8], 0x310046
mov word [ebp - 4], ax
call fcn.10001bd0
mov ecx, eax
test ecx, ecx
je 0x1002a1b2
mov eax, dword [ecx]
push 2
push 0x30
call dword [eax]
test eax, eax
je 0x1002a1bc
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x30
jl 0x1002a1a8
mov dword [eax - 0xc], 0x30
xor eax, eax
mov ecx, dword [esi]
push 0x30
mov word [ecx + 0x60], ax
lea eax, [ebp - 0x64]
push eax
push 0x30
push dword [esi]
call fcn.10001990
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001900
push 0x80004005
call fcn.10001900
call fcn.100029e0
int3
Function at 0x1002b620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
xor eax, eax
mov dword [ebp - 0x30], 0x720058
push edi
mov dword [ebp - 0x2c], 0x430061
mov dword [ebp - 0x28], 0x670066
mov dword [ebp - 0x24], 0x6e0049
mov dword [ebp - 0x20], 0x6f0066
mov dword [ebp - 0x1c], 0x58005c
mov dword [ebp - 0x18], 0x610072
mov dword [ebp - 0x14], 0x69004c
mov dword [ebp - 0x10], 0x650074
mov dword [ebp - 0xc], 0x610047
mov dword [ebp - 8], 0x65006d
mov word [ebp - 4], ax
call fcn.10001bd0
mov ecx, eax
test ecx, ecx
je 0x1002b6d5
mov eax, dword [ecx]
push 2
push 0x16
call dword [eax]
test eax, eax
je 0x1002b6df
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x16
jl 0x1002b6cb
mov dword [eax - 0xc], 0x16
xor eax, eax
mov ecx, dword [esi]
push 0x2c
mov word [ecx + 0x2c], ax
lea eax, [ebp - 0x30]
push eax
push 0x2c
push dword [esi]
call fcn.1001f5c0
add esp, 0x10
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001900
push 0x80004005
call fcn.10001900
call fcn.100029e0
int3

Function at 0x1002b990
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x74]
test ecx, ecx
jne 0x1002b9ea
lea eax, [ebp - 8]
mov dword [ebp - 8], ecx
push eax
push 0x10004
push esi
push 0x1002dba0
push dword [esi + 0x84]
push ecx
call fcn.100df9ce
mov ecx, dword [ebp - 8]
add esp, 0x18
mov dword [esi + 0x74], eax
mov dword [esi + 0x7c], ecx
push dword [esi + 0x18]
push eax
call fcn.1002ce20
push dword [esi + 0x74]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esi + 0x74]
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
pop esi
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4