joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10054880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x101b7324]
xor eax, esp
mov dword [esp + 0x30], eax
xor eax, eax
mov dl, 0x65
mov cl, 0x6e
push ebx
mov bl, 0x74
mov byte [esp + 0x24], al
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov word [esp + 0x31], ax
mov byte [esp + 0x33], al
mov byte [esp + 0x14], 0x47
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], 0x75
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], 0x49
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], al
mov byte [esp + 4], 0x41
mov byte [esp + 5], 0x75
mov byte [esp + 6], bl
mov byte [esp + 7], 0x68
mov byte [esp + 8], dl
mov byte [esp + 9], cl
mov byte [esp + 0xa], bl
mov byte [esp + 0xb], 0x69
mov byte [esp + 0xc], 0x63
mov byte [esp + 0xd], 0x41
mov byte [esp + 0xe], 0x4d
mov byte [esp + 0xf], 0x44
mov byte [esp + 0x10], al
mov eax, 0
cpuid
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x14]
lea eax, [esp + 0x24]
pop ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10054961
test dl, dl
je 0x1005495d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10054961
add eax, 2
add ecx, 2
test dl, dl
jne 0x10054941
xor eax, eax
jmp 0x10054966
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1005497e
mov eax, 1
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100ffa66
add esp, 0x34
ret
lea ecx, [esp]
lea eax, [esp + 0x20]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100549a5
test dl, dl
je 0x100549a1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100549a5
add eax, 2
add ecx, 2
test dl, dl
jne 0x10054985
xor eax, eax
jmp 0x100549aa
sbb eax, eax
sbb eax, 0xffffffff
mov ecx, dword [esp + 0x30]
neg eax
sbb eax, eax
and eax, 0xfffffffe
xor ecx, esp
add eax, 2
call fcn.100ffa66
add esp, 0x34
ret

Function at 0x10054a40
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x101b7324]
xor eax, esp
mov dword [esp + 0x800], eax
push 0x7ff
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.101004d0
add esp, 0xc
push 0x800
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov ecx, dword [esp + 0x800]
mov al, byte [esp]
xor ecx, esp
call fcn.100ffa66
add esp, 0x804
ret

Function at 0x10054c20
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x40
lea eax, [esp]
push eax
mov dword [esp + 4], 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
neg eax
sbb eax, eax
and eax, dword [esp + 4]
add esp, 0x40
ret
Function at 0x10054c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x101b7324]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov al, 0x6c
push esi
mov byte [esp + 0x20], al
mov byte [esp + 0x21], al
push edi
lea eax, [esp + 0x1c]
mov bl, 0x73
push eax
mov byte [esp + 0x20], 0x6d
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0x76
mov byte [esp + 0x23], 0x63
mov byte [esp + 0x24], 0x72
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x26], 0x2e
mov byte [esp + 0x27], 0x64
mov byte [esp + 0x2a], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov cl, 0x6e
mov byte [esp + 0x18], cl
mov byte [esp + 0x10], cl
lea ecx, [esp + 0x14]
mov esi, eax
mov al, 0x66
push ecx
push esi
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x70
mov byte [esp + 0x1e], 0x72
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x22], al
mov byte [esp + 0x23], 0
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], 0x63
mov byte [esp + 0x17], 0x61
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0
call edi
lea edx, [esp + 0xc]
push edx
push esi
mov dword [fcn.102c8708], eax
call edi
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [0x102c870c], eax
call fcn.100ffa66
add esp, 0x20
ret
Function at 0x10056a20
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
push 0x38
lea eax, [esp + 0x18]
push 0
push eax
call fcn.101004d0
mov ebx, dword [esp + 0x60]
push ebx
xor edi, edi
call fcn.1004e610
mov ebp, dword [sym.imp.USER32.dll_MapVirtualKeyA]
add esp, 0x10
mov dword [esp + 0x10], eax
mov edi, edi
lea esi, [edi*8]
sub esi, edi
add esi, esi
add esi, esi
cmp dword [esp + 0x10], 0
mov eax, 1
mov dword [esp + esi + 0x14], eax
je 0x10056a71
mov dword [esp + esi + 0x1c], eax
push 0
push ebx
mov word [esp + esi + 0x20], bx
call ebp
mov word [esp + esi + 0x1a], ax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + esi + 0x20], eax
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
cmp edi, 1
mov dword [esp + esi + 0x24], eax
jne 0x10056a9e
or dword [esp + 0x38], 2
add edi, 1
cmp edi, 2
jl 0x10056a50
mov eax, dword [esp + 0x58]
test eax, eax
mov edi, dword [esp + 0x50]
lea edx, [esp + 0x14]
jne 0x10056b10
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c
lea ecx, [eax + 1]
call fcn.100562c0
add esp, 0xc
cmp dword [edi + 0x2604], 0
je 0x10056b01
mov esi, dword [edi + 0x2634]
test esi, esi
jle 0x10056af3
call fcn.101022cc
cdq
idiv esi
mov ecx, esi
sar ecx, 1
sub edx, ecx
add edx, esi
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x10056b15
mov edx, 1
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x10056b15
mov edx, dword [edi + 0x2634]
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x10056b15
cmp eax, 1
je 0x10056b19
lea edx, [esp + 0x30]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c
mov ecx, 1
call fcn.100562c0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x10057410
Capabilities:
Log keystrokes

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x18]
mov dword [esp + 0xc], eax
call fcn.10012ea0
test eax, eax
jne 0x1005743c
mov dword [esi + 0x2654], 0xf
mov dword [esi + 0x2650], 1
jmp 0x10057446
mov dword [esi + 0x2650], 0
cmp dword [0x101b941c], 0x1000
mov ebp, 1
je 0x10057469
mov dword [esi + 0x2654], 0x28
mov dword [esi + 0x2650], ebp
jmp 0x10057473
mov dword [esi + 0x2650], 0
cmp dword [esi + 0x2650], 0
je 0x10057496
call fcn.10012600
cdq
mov ecx, 0x64
idiv ecx
cmp dword [esi + 0x2654], edx
jl 0x10057496
pop esi
mov eax, ebp
pop ebp
ret
push ebx
mov ebx, dword [esp + 0x14]
cmp ebx, 0xa0
push edi
je 0x100574ac
cmp ebx, 0xa1
jne 0x100574b3
mov ebx, 0x10
jmp 0x100574df
cmp ebx, 0xa4
je 0x100574c3
cmp ebx, 0xa5
jne 0x100574ca
mov ebx, 0x12
jmp 0x100574df
cmp ebx, 0xa2
je 0x100574da
cmp ebx, 0xa3
jne 0x100574df
mov ebx, 0x11
cmp dword [esi + 0x3378], 0
jne 0x100574ee
add dword [esi + 0x3364], ebp
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x1005750a
push ebp
push ebx
push esi
call fcn.10056a20
add esp, 0xc
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
ret
cmp eax, ebp
jne 0x1005762b
push 0
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edi, eax
shl edi, 0x10
push ebx
or edi, ebp
call fcn.1004e610
add esp, 4
test eax, eax
je 0x10057535
or edi, 0x1000000
xor ebp, ebp
cmp dword [esi + 0x14], ebp
je 0x10057561
cmp dword [esi + 0x32cc], ebp
jne 0x10057561
push 0x717be38b
push esi
call fcn.10050ac0
add esp, 8
test eax, eax
jne 0x10057561
or edi, 0x4000000
mov ebp, 0x4000000
cmp ebx, 0x12
jne 0x1005756d
mov dword [esi + 0x60], 1
cmp dword [esi + 0x60], 0
jne 0x100575d0
cmp ebx, 0x79
je 0x100575d0
cmp dword [esi + 0x32ac], 0
je 0x10057583
mov edi, ebp
cmp dword [esi + 0x32a8], 0
je 0x100575b5
mov edx, dword [esi + 0x32b0]
mov eax, dword [esp + 0x14]
push 0
push edx
push 1
push edi
push ebx
push 0x100
push eax
call fcn.10054270
add esp, 0x1c
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
ret
mov ecx, dword [esp + 0x14]
push edi
push ebx
push 0x100
push ecx
call fcn.10054130
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
ret
or edi, 0x20000000
cmp dword [esi + 0x32ac], 0
je 0x100575e1
mov edi, ebp
cmp dword [esi + 0x32a8], 0
je 0x10057610
mov edx, dword [esi + 0x32b0]
mov eax, dword [esp + 0x14]
push 0
push edx
push 1
push edi
push ebx
push 0x104
push eax
call fcn.10054140
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
ret
mov ecx, dword [esp + 0x14]
push edi
push ebx
push 0x104
push ecx
call fcn.10054130
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
ret
cmp eax, 2
jne 0x10057643
cmp ebx, 0x12
jne 0x10057638
mov dword [esi + 0x60], ebp
push ebp
push ebx
push esi
call fcn.100b9da0
add esp, 0xc
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
ret
Function at 0x10057650
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x18]
push ebp
push edi
mov edi, dword [esp + 0x14]
cmp edi, 0xa0
mov dword [esp + 0x10], eax
je 0x10057672
cmp edi, 0xa1
jne 0x10057679
mov edi, 0x10
jmp 0x100576a5
cmp edi, 0xa4
je 0x10057689
cmp edi, 0xa5
jne 0x10057690
mov edi, 0x12
jmp 0x100576a5
cmp edi, 0xa2
je 0x100576a0
cmp edi, 0xa3
jne 0x100576a5
mov edi, 0x11
mov eax, dword [ebx + 0x3c]
xor ebp, ebp
cmp eax, ebp
jne 0x100576c1
push 2
push edi
push ebx
call fcn.10056a20
add esp, 0xc
pop edi
lea eax, [ebp + 1]
pop ebp
pop ebx
ret
cmp eax, 1
jne 0x100577e8
push esi
push ebp
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov esi, eax
shl esi, 0x10
push edi
or esi, 1
call fcn.1004e610
add esp, 4
test eax, eax
je 0x100576ee
or esi, 0x1000000
cmp dword [ebx + 0x14], ebp
je 0x10057718
cmp dword [ebx + 0x32cc], ebp
jne 0x10057718
push 0x717be38b
push ebx
call fcn.10050ac0
add esp, 8
test eax, eax
jne 0x10057718
or esi, 0x4000000
mov ebp, 0x4000000
cmp edi, 0x12
jne 0x10057724
mov dword [ebx + 0x60], 0
cmp dword [ebx + 0x60], 0
jne 0x1005778d
cmp edi, 0x79
je 0x1005778d
or esi, 0xc0000000
cmp dword [ebx + 0x32ac], 0
je 0x10057740
mov esi, ebp
cmp dword [ebx + 0x32a8], 0
je 0x10057772
mov ecx, dword [ebx + 0x32b0]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push esi
push edi
push 0x101
push edx
call fcn.10054270
add esp, 0x1c
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
ret
mov eax, dword [esp + 0x14]
push esi
push edi
push 0x101
push eax
call fcn.10054130
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
ret
or esi, 0xe0000000
cmp dword [ebx + 0x32ac], 0
je 0x1005779e
mov esi, ebp
cmp dword [ebx + 0x32a8], 0
je 0x100577cd
mov ecx, dword [ebx + 0x32b0]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push esi
push edi
push 0x105
push edx
call fcn.10054140
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
ret
mov eax, dword [esp + 0x14]
push esi
push edi
push 0x105
push eax
call fcn.10054130
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
ret
cmp eax, 2
jne 0x10057784
cmp edi, 0x12
jne 0x100577f5
mov dword [ebx + 0x60], ebp
push 2
push edi
push ebx
call fcn.100b9da0
add esp, 0xc
pop edi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x10057810
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.1004f500
test eax, eax
jle 0x10057826
mov dword [esp + 8], eax
jmp fcn.10056f80
xor eax, eax
ret

Function at 0x10057830
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.1004f500
test eax, eax
jle 0x10057846
mov dword [esp + 8], eax
jmp fcn.10057410
xor eax, eax
ret

Function at 0x10057850
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.1004f500
test eax, eax
jle 0x10057866
mov dword [esp + 8], eax
jmp fcn.10057650
xor eax, eax
ret
Function at 0x100584a0
Capabilities:
Get keyboard layout

Disassembly:
push 0xffffffffffffffff
push 0x101633ab
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x101b7324]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
push esi
push edi
mov eax, dword [0x101b7324]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x230]
push 0
push eax
call fcn.10054110
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
lea ecx, [esp + 0x10]
mov ebp, eax
call fcn.100d9150
mov dword [esp + 0x224], 0
lea ecx, [esp + 0x10]
call fcn.100d80f0
mov edi, dword [esp + 0x234]
mov esi, eax
test esi, esi
je 0x10058562
lea esp, [esp]
mov ecx, edi
lea eax, [esi + 0xf]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10058545
test dl, dl
je 0x10058541
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10058545
add eax, 2
add ecx, 2
test dl, dl
jne 0x10058525
xor eax, eax
jmp 0x1005854a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1005855a
mov esi, dword [esi + 0x90]
test esi, esi
jne 0x10058520
jmp 0x10058562
test esi, esi
jne 0x100585ea
lea ecx, [esp + 0x10]
call fcn.1011fa80
mov esi, eax
test esi, esi
je 0x100585a9
mov ecx, edi
lea eax, [esi + 0xf]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10058596
test dl, dl
je 0x10058592
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10058596
add eax, 2
add ecx, 2
test dl, dl
jne 0x10058576
xor eax, eax
jmp 0x1005859b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100585e6
mov esi, dword [esi + 0x90]
test esi, esi
jne 0x10058571
mov dword [esp + 0x224], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.100d8100
xor eax, eax
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.100ffa66
add esp, 0x218
ret
test esi, esi
je 0x100585a9
push 0xff
lea eax, [esp + 0x11d]
push 0
push eax
mov byte [esp + 0x124], 0
call fcn.101004d0
push 0xff
lea ecx, [esp + 0x29]
push 0
push ecx
mov byte [esp + 0x30], 0
call fcn.101004d0
lea edx, [esp + 0x30]
add esp, 0x18
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x10058627
lea edx, [esp + 0x18]
push edx
call fcn.1015bd59
push 0x10
lea eax, [esp + 0x120]
push eax
push ebp
call fcn.1015bdfb
add esp, 0x10
lea ecx, [esp + 0x18]
lea eax, [esp + 0x118]
jmp 0x10058660
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10058680
test dl, dl
je 0x1005867c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10058680
add eax, 2
add ecx, 2
test dl, dl
jne 0x10058660
xor eax, eax
jmp 0x10058685
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100585a9
mov dword [esp + 0x224], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.100d8100
mov eax, 1
jmp 0x100585bf
Function at 0x100586b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x68
mov eax, dword [0x101b7324]
xor eax, esp
mov dword [esp + 0x64], eax
call fcn.10051f00
test eax, eax
jne 0x100586d6
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.100ffa66
add esp, 0x68
ret
push ebx
xor ebx, ebx
cmp dword [0x102bbf68], ebx
je 0x1005875c
call fcn.10051f00
test eax, eax
je 0x1005875c
push 0x3f
lea eax, [esp + 0x2d]
push ebx
push eax
call fcn.101004d0
mov ecx, dword [esp + 0x7c]
lea eax, [esp + 0x10]
cdq
push ebx
mov dword [esp + 0x4c], edx
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
mov dword [esp + 0x54], eax
lea eax, [esp + 0x44]
push 0x18
push eax
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], 0x17
mov dword [esp + 0x28], ebx
mov dword [esp + 0x54], ecx
call fcn.10022660
add esp, 0x24
test eax, eax
je 0x100587fc
cmp dword [esp + 4], ebx
jne 0x100587fc
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.100ffa66
add esp, 0x68
ret
cmp dword [fcn.102c8700], ebx
jne 0x1005880e
mov cl, 0x65
mov dl, 0x6f
mov byte [esp + 0xd], cl
mov byte [esp + 0x10], cl
mov byte [esp + 0x23], cl
lea ecx, [esp + 0x18]
mov al, 0x73
mov byte [esp + 0x1b], dl
mov byte [esp + 0x21], dl
push ecx
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x14], 0x6b
mov byte [esp + 0x16], 0x72
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x19], 0x6c
mov byte [esp + 0x1a], 0x33
mov byte [esp + 0x1b], 0x32
mov byte [esp + 0x1c], bl
mov byte [esp + 0x20], 0x49
mov byte [esp + 0x21], al
mov byte [esp + 0x22], 0x57
mov byte [esp + 0x24], 0x77
mov byte [esp + 0x25], 0x36
mov byte [esp + 0x26], 0x34
mov byte [esp + 0x27], 0x50
mov byte [esp + 0x28], 0x72
mov byte [esp + 0x2a], 0x63
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], bl
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, ebx
mov dword [fcn.102c8700], eax
jne 0x1005880e
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.100ffa66
add esp, 0x68
ret
mov eax, dword [esp + 0x70]
push esi
push ebx
push ebx
push eax
push ebx
push 0x400
mov dword [esp + 0x1c], ebx
call fcn.10053d60
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x10058841
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.100ffa66
add esp, 0x68
ret
lea ecx, [esp + 8]
push ecx
push esi
call dword [fcn.102c8700]
push esi
call fcn.10039220
mov ecx, dword [esp + 0x70]
add esp, 4
xor eax, eax
cmp dword [esp + 8], ebx
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.100ffa66
add esp, 0x68
ret
Function at 0x10058ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x101b7324]
xor eax, esp
mov dword [esp + 0x1c], eax
mov al, 0x65
mov cl, 0x6c
push esi
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 6], al
mov byte [esp + 0xb], al
lea eax, [esp + 4]
mov byte [esp + 0x15], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], cl
mov dl, 0x64
push eax
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x18], 0x6b
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], dl
mov byte [esp + 0x24], 0
mov byte [esp + 0xc], 0x4f
mov byte [esp + 0xd], 0x70
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], 0x54
mov byte [esp + 0x11], 0x68
mov byte [esp + 0x12], 0x72
mov byte [esp + 0x14], 0x61
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x10058d91
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100ffa66
add esp, 0x20
ret
push ebp
push edi
call fcn.1002d8d0
mov ebp, dword [esp + 0x34]
push ebp
push 0
push 0x1f03ff
mov edi, eax
call esi
push edi
mov esi, eax
call fcn.1002d970
add esp, 4
test esi, esi
jne 0x10058dcb
pop edi
pop ebp
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100ffa66
add esp, 0x20
ret
push 0
push 0
push 0xbb8
push ebp
call fcn.10054160
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x28]
pop edi
pop ebp
pop esi
xor ecx, esp
mov eax, 1
call fcn.100ffa66
add esp, 0x20
ret
Function at 0x1005a740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x10163588
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x101b7324]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1005a780
test al, 0x10
je 0x1005a780
mov esi, 1
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.1001e080
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret
Function at 0x10062430
Capabilities:
Access peb ldr_data
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x10163748
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x101b7324]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov edx, dword [esp + 0x30]
mov eax, dword [edx - 0xc]
cmp eax, 2
jl 0x10062591
lea ecx, [eax - 1]
cmp ecx, ebx
jl 0x1006263b
cmp ecx, eax
jg 0x1006263b
mov dl, byte [ecx + edx]
cmp dl, 0x5c
jne 0x100624b8
push ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
call fcn.10047100
mov byte [esp + 0x28], 1
push eax
lea ecx, [esp + 0x34]
call fcn.100471b0
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x10]
call fcn.1001e080
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx - 0xc]
cmp eax, ebx
jle 0x10062591
cmp eax, 3
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
jg 0x10062517
lea edx, [esp + 0x34]
push edx
call fcn.10046f90
mov byte [esp + 0x2c], 2
mov byte [esp + 0x2c], bl
call fcn.1005a740
add esp, 4
cmp eax, ebx
je 0x10062591
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.1001e080
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
lea eax, [esp + 0x34]
push eax
call fcn.10046f90
mov byte [esp + 0x2c], 3
mov byte [esp + 0x2c], bl
call fcn.1005a740
add esp, 4
cmp eax, ebx
jne 0x100624ef
lea ecx, [esp + 0xc]
call fcn.1001e010
mov byte [esp + 0x28], 4
push 0x5c
lea ecx, [esp + 0x34]
call fcn.100595e0
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x38]
call fcn.10047100
mov byte [esp + 0x28], 5
push eax
lea ecx, [esp + 0x10]
call fcn.100471b0
mov byte [esp + 0x28], 4
lea ecx, [esp + 0x10]
call fcn.1001e080
mov edx, dword [esp + 0xc]
cmp dword [edx - 0xc], ebx
jg 0x100625b6
mov byte [esp + 0x28], bl
lea ecx, [esp + 0xc]
call fcn.1001e080
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.1001e080
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.10046f90
mov byte [esp + 0x2c], 6
mov byte [esp + 0x2c], 4
call fcn.10062430
add esp, 4
cmp eax, ebx
je 0x10062584
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov esi, eax
sub esi, 1
neg esi
sbb esi, esi
add esi, 1
mov byte [esp + 0x28], bl
lea ecx, [esp + 0xc]
call fcn.1001e080
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.1001e080
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
push 0x80070057
call fcn.10001140