joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x2c], eax
mov esi, 1
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push edi
push eax
mov dword [ebp - 0x13], 0x70617664
mov dword [ebp - 0xd], 0x6c642e32
mov word [ebp - 9], 0x6c
mov word [ebp - 0xf], 0x3369
mov byte [ebp - 0x14], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10006705
lea eax, [ebp - 0x24]
mov word [ebp - 0x1c], 0x7965
push eax
push edi
mov word [ebp - 0x19], 0x5778
mov word [ebp - 0x1f], 0x6e65
mov byte [ebp - 0x17], 0
mov dword [ebp - 0x24], 0x4f676552
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x1a], 0x45
mov byte [ebp - 0x1d], 0x4b
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100066fe
push dword [ebp - 0x28]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x2c]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret

Function at 0x10006720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x2c], eax
xor esi, esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x13], 0x70617664
push eax
mov dword [ebp - 0xd], 0x6c642e32
mov word [ebp - 9], 0x6c
mov word [ebp - 0xf], 0x3369
mov byte [ebp - 0x14], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100067b9
lea eax, [ebp - 0x28]
mov word [ebp - 0x21], 0x6563
push eax
push edi
mov dword [ebp - 0x1e], 0x6b6f5473
mov dword [ebp - 0x25], 0x6f72506e
mov byte [ebp - 0x1f], 0x73
mov word [ebp - 0x1a], 0x6e65
mov word [ebp - 0x27], 0x6570
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x28], 0x4f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100067b2
push dword [ebp - 0x2c]
push dword [ebp + 0xc]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
Function at 0x10006940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x34], eax
xor esi, esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x14]
push edi
push eax
mov dword [ebp - 0x13], 0x70617664
mov dword [ebp - 0xd], 0x6c642e32
mov word [ebp - 9], 0x6c
mov word [ebp - 0xf], 0x3369
mov byte [ebp - 0x14], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100069e8
lea eax, [ebp - 0x2c]
mov word [ebp - 0x21], 0x656c
push eax
push edi
mov dword [ebp - 0x26], 0x76697250
mov word [ebp - 0x1b], 0x756c
mov dword [ebp - 0x2c], 0x6b6f6f4c
mov word [ebp - 0x18], 0x41
mov dword [ebp - 0x1f], 0x61566567
mov byte [ebp - 0x22], 0x69
mov byte [ebp - 0x19], 0x65
mov word [ebp - 0x28], 0x7075
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100069e1
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret

Function at 0x10006a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov word [ebp - 0x1d], 0x3233
mov dword [ebp - 0x22], 0x7365636f
mov dword [ebp - 0x1b], 0x7478654e
mov word [ebp - 0x24], 0x7250
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x1e], 0x73
mov word [ebp - 0xa], 0x6c6c
mov word [ebp - 0x14], 0x654b
mov dword [ebp - 0xf], 0x2e32336c
mov word [ebp - 0x11], 0x656e
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 8], 0
mov byte [ebp - 0xb], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006a8c
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
Function at 0x10006aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov word [ebp - 0x17], 0x74
mov dword [ebp - 0x1c], 0x72694632
mov dword [ebp - 0x22], 0x7365636f
mov word [ebp - 0x1e], 0x3373
mov word [ebp - 0x24], 0x7250
mov byte [ebp - 0x18], 0x73
mov word [ebp - 0xa], 0x6c6c
mov word [ebp - 0x14], 0x654b
mov dword [ebp - 0xf], 0x2e32336c
mov word [ebp - 0x11], 0x656e
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 8], 0
mov byte [ebp - 0xb], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006b2e
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret

Function at 0x10006b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov word [ebp - 0x27], 0x6e69
mov dword [ebp - 0x1d], 0x656d756c
mov byte [ebp - 0x28], 0x46
mov word [ebp - 0x19], 0x57
mov dword [ebp - 0x24], 0x73726946
mov word [ebp - 0x20], 0x5674
mov byte [ebp - 0x25], 0x64
mov byte [ebp - 0x1e], 0x6f
mov word [ebp - 0xa], 0x6c6c
mov word [ebp - 0x14], 0x654b
mov dword [ebp - 0xf], 0x2e32336c
mov word [ebp - 0x11], 0x656e
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 8], 0
mov byte [ebp - 0xb], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006bd6
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
Function at 0x10006bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x28], eax
xor esi, esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
push edi
push eax
mov dword [ebp - 0xa], 0x6c6c642e
mov dword [ebp - 0xf], 0x33726573
mov byte [ebp - 6], 0
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0x10], 0x55
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10006c8a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x16], 0x417845
push eax
push edi
mov word [ebp - 0x1b], 0x6e69
mov dword [ebp - 0x20], 0x646e6946
mov word [ebp - 0x18], 0x776f
mov byte [ebp - 0x1c], 0x57
mov byte [ebp - 0x19], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006c83
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret

Function at 0x10006ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x30], eax
mov esi, 1
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x14]
push edi
push eax
mov dword [ebp - 0x13], 0x70617664
mov dword [ebp - 0xd], 0x6c642e32
mov word [ebp - 9], 0x6c
mov word [ebp - 0xf], 0x3369
mov byte [ebp - 0x14], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10006d5d
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1f], 0x65756c61
push eax
push edi
mov word [ebp - 0x25], 0x7551
mov word [ebp - 0x22], 0x7972
mov dword [ebp - 0x1b], 0x577845
mov word [ebp - 0x27], 0x6765
mov byte [ebp - 0x28], 0x52
mov byte [ebp - 0x20], 0x56
mov byte [ebp - 0x23], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006d56
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
Function at 0x10006d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
mov word [ebp - 9], 0x646e
mov word [ebp - 6], 0x65
mov dword [ebp - 0xe], 0x4865736f
mov word [ebp - 0x10], 0x6c43
mov byte [ebp - 7], 0x6c
mov byte [ebp - 0xa], 0x61
mov word [ebp - 0x16], 0x6c6c
mov word [ebp - 0x20], 0x654b
mov dword [ebp - 0x1b], 0x2e32336c
mov word [ebp - 0x1d], 0x656e
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x17], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006df5
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret

Function at 0x10006e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x30], 0x61657243
mov word [ebp - 0x1e], 0x7061
mov dword [ebp - 0x2c], 0x6f546574
mov dword [ebp - 0x25], 0x33706c65
mov word [ebp - 0x21], 0x5332
mov byte [ebp - 0x1f], 0x6e
mov word [ebp - 0x27], 0x686c
mov dword [ebp - 0x1c], 0x746f6873
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x28], 0x6f
mov word [ebp - 0xa], 0x6c6c
mov word [ebp - 0x14], 0x654b
mov dword [ebp - 0xf], 0x2e32336c
mov word [ebp - 0x11], 0x656e
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 8], 0
mov byte [ebp - 0xb], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006eb4
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
Function at 0x10006ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x20], eax
xor esi, esi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xa], 0x6c6c642e
push eax
mov dword [ebp - 0xf], 0x33726573
mov byte [ebp - 6], 0
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0x10], 0x55
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10006f52
lea eax, [ebp - 0x1c]
mov word [ebp - 0x17], 0x6e69
push eax
push edi
mov dword [ebp - 0x1c], 0x646e6946
mov byte [ebp - 0x18], 0x57
mov dword [ebp - 0x15], 0x41776f64
mov byte [ebp - 0x11], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006f4b
push dword [ebp - 0x20]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret

Function at 0x10006f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push esi
push edi
push eax
mov esi, 1
mov dword [ebp - 0x1f], 0x70617664
mov dword [ebp - 0x19], 0x6c642e32
mov word [ebp - 0x15], 0x6c
mov word [ebp - 0x1b], 0x3369
mov byte [ebp - 0x20], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10006fee
lea eax, [ebp - 0x10]
mov dword [ebp - 0xa], 0x654b6573
push eax
push edi
mov word [ebp - 6], 0x79
mov dword [ebp - 0x10], 0x43676552
mov word [ebp - 0xc], 0x6f6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006fe7
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret

Function at 0x10007010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x24], 0x74616e69
mov dword [ebp - 0x1b], 0x737365
mov dword [ebp - 0x28], 0x6d726554
mov word [ebp - 0x1d], 0x636f
mov word [ebp - 0x20], 0x5065
mov byte [ebp - 0x1e], 0x72
mov word [ebp - 0xa], 0x6c6c
mov word [ebp - 0x14], 0x654b
mov dword [ebp - 0xf], 0x2e32336c
mov word [ebp - 0x11], 0x656e
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 8], 0
mov byte [ebp - 0xb], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000709c
push dword [ebp + 0xc]
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
Function at 0x100070b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push esi
push edi
push eax
xor esi, esi
mov dword [ebp - 0x10], 0x33696447
mov word [ebp - 9], 0x6c6c
mov word [ebp - 0xc], 0x2e32
mov byte [ebp - 7], 0
mov byte [ebp - 0xa], 0x64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000713d
lea eax, [ebp - 0x24]
mov dword [ebp - 0x22], 0x65766f6d
push eax
push edi
mov dword [ebp - 0x16], 0x65637275
mov dword [ebp - 0x1e], 0x746e6f46
mov word [ebp - 0x19], 0x7365
mov word [ebp - 0x12], 0x41
mov word [ebp - 0x24], 0x6552
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x1a], 0x52
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10007136
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret

Function at 0x10007150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0xc], 0x41797063
mov dword [ebp - 0x10], 0x7274736c
mov byte [ebp - 8], 0
mov word [ebp - 0x16], 0x6c6c
mov word [ebp - 0x20], 0x654b
mov dword [ebp - 0x1b], 0x2e32336c
mov word [ebp - 0x1d], 0x656e
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x17], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100071cc
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
Function at 0x100071e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov word [ebp - 0xd], 0x506e
mov word [ebp - 7], 0x7373
mov word [ebp - 0x10], 0x704f
mov word [ebp - 0xa], 0x636f
mov byte [ebp - 5], 0
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 8], 0x65
mov word [ebp - 0x16], 0x6c6c
mov word [ebp - 0x20], 0x654b
mov dword [ebp - 0x1b], 0x2e32336c
mov word [ebp - 0x1d], 0x656e
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x17], 0x64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10007278
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x56d20f69
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x43ce42ec
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401298
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x48e880]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x40132d
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40132d
push 0x228
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x230], 0x22c
push 0
push eax
call fcn.0045e110
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x40131d
push ebx
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call dword [0x46b4a4]
call edi
pop ecx
pop ecx
test eax, eax
jne 0x401321
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4012f7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x40132f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a206
leave
ret

Function at 0x4015a2
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x48e880]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x418
lea eax, [ebp - 0x628]
mov esi, ecx
push 0
push eax
call fcn.0045e110
add esp, 0xc
mov dword [ebp - 0x62c], esi
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, eax
cmp esi, 2
jb 0x4016ae
cmp word [ebp - 0x20e], 0x3a
jne 0x4016ae
mov edi, str.explorer.exe
push edi
call fcn.0043d5e8
inc eax
add eax, esi
pop ecx
cmp eax, 0x105
jae 0x4016ae
add esi, esi
cmp esi, 0x20a
jae 0x4016be
xor eax, eax
mov word [ebp + esi - 0x210], ax
lea eax, [ebp - 0x210]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call fcn.0043d5e8
mov esi, eax
mov dword [esp], 0x208
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4016ae
add eax, 0xfffffffe
add eax, esi
cmp eax, 0x209
jae 0x4016ae
lea eax, [ebp - 0x20a]
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x62c]
mov ecx, 0x401490
call fcn.00401298
mov eax, dword [ebp - 0x628]
jmp 0x4016b0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045a206
leave
ret
call fcn.0045a338
int3

Function at 0x40186a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x401891
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x40188c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401891
test al, 0x10
jne 0x401891
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x401895
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test ecx, ecx
je 0x4018ad
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4018ad
test al, 0x10
je 0x4018ad
xor eax, eax
inc eax
ret
xor eax, eax
ret