joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ff20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4760ec
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4922f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x495c34]
and eax, 1
jne 0x45ff75
mov ecx, dword [0x495c34]
or ecx, 1
mov dword [0x495c34], ecx
mov ecx, 0x495c18
call fcn.00401620
push 0x479e10
call fcn.004444ee
add esp, 4
mov ecx, 0x495c18
call fcn.004018a0
movzx edx, al
test edx, edx
je 0x46002c
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00401bb0
mov dword [ebp - 4], 0
push 1
push 0x1c
lea ecx, [ebp - 0x14]
call fcn.00418f20
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x14]
call fcn.00418f20
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0045f720
add esp, 8
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x54], ecx
mov byte [ebp - 4], 1
push str.Media_Get_LLCMediaGet2_
mov edx, dword [ebp - 0x54]
push edx
lea eax, [ebp - 0x4c]
push eax
call fcn.00402d60
add esp, 0xc
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x5c]
push edx
mov ecx, 0x495c18
call fcn.004016f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.004016d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401bf0
mov eax, 0x495c18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x460040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47611f
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4922f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x495c54]
and eax, 1
jne 0x460095
mov ecx, dword [0x495c54]
or ecx, 1
mov dword [0x495c54], ecx
mov ecx, 0x495c38
call fcn.00401620
push 0x479e00
call fcn.004444ee
add esp, 4
mov ecx, 0x495c38
call fcn.004018a0
movzx edx, al
test edx, edx
je 0x46014c
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00401bb0
mov dword [ebp - 4], 0
push 1
push 0x1c
lea ecx, [ebp - 0x14]
call fcn.00418f20
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x14]
call fcn.00418f20
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0045f720
add esp, 8
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x54], ecx
mov byte [ebp - 4], 1
push 0x48544c
mov edx, dword [ebp - 0x54]
push edx
lea eax, [ebp - 0x4c]
push eax
call fcn.00402d60
add esp, 0xc
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x5c]
push edx
mov ecx, 0x495c38
call fcn.004016f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.004016d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401bf0
mov eax, 0x495c38
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4611b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
push 0
lea ecx, [ebp - 8]
call fcn.00401bb0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045f220
add esp, 8
push 0
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 8]
call fcn.00401b20
shl eax, 1
push eax
lea ecx, [ebp - 8]
call fcn.00418f20
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov edx, 0x1234
mov word [ebp - 0xc], dx
push 0
lea eax, [ebp - 0x10]
push eax
push 2
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
lea ecx, [ebp - 8]
call fcn.00401bf0
mov esp, ebp
pop ebp
ret 4

Function at 0x461230
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475c8d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4922f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
push 0x3e8
lea ecx, [ebp - 0x18]
call fcn.00401bb0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401b20
sub eax, 1
cmp eax, dword [ebp - 0x10]
ja 0x46128f
jmp 0x461317
push 0
lea eax, [ebp - 0x1c]
push eax
push 2
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4612e0
cmp dword [ebp - 0x1c], 2
jne 0x4612e0
movzx ecx, word [ebp - 0x20]
cmp ecx, 0x1234
je 0x4612dc
lea ecx, [ebp - 0x18]
call fcn.00418f20
mov edx, dword [ebp - 0x10]
mov cx, word [ebp - 0x20]
mov word [eax + edx*2], cx
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x4612de
jmp 0x461317
jmp 0x46130a
push 0x47dcc7
mov ecx, dword [ebp + 8]
call fcn.00401650
mov eax, dword [ebp - 0x24]
or eax, 1
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401bf0
mov eax, dword [ebp + 8]
jmp 0x461358
mov ecx, 1
test ecx, ecx
jne 0x46127a
lea ecx, [ebp - 0x18]
call fcn.00418f20
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x18]
call fcn.00418f20
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0045f720
add esp, 8
mov eax, dword [ebp - 0x24]
or eax, 1
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401bf0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4613e0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476898
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4922f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
cmp dword [eax + 4], 0xffffffff
jne 0x461495
push 0
push 0
push 0
push 0
push 0xff
push 0
push 2
push str..pipemediaget_admin_proxy_pipe_in
call dword [sym.imp.KERNEL32.DLL_CreateNamedPipeW]
mov ecx, dword [ebp - 0x48]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x48]
cmp dword [edx + 4], 0xffffffff
jne 0x461495
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00460aa0
add esp, 8
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x50]
push edx
push str.unable_to_create_mediaget_admin_proxy_pipe_in
call fcn.0046b360
mov ecx, eax
call fcn.00412410
mov ecx, eax
call fcn.00412410
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004016d0
xor al, al
jmp 0x46151d
mov eax, dword [ebp - 0x48]
cmp dword [eax + 8], 0xffffffff
jne 0x46151b
push 0
push 0
push 0
push 0
push 0xff
push 0
push 1
push str..pipemediaget_admin_proxy_pipe_out
call dword [sym.imp.KERNEL32.DLL_CreateNamedPipeW]
mov ecx, dword [ebp - 0x48]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x48]
cmp dword [edx + 8], 0xffffffff
jne 0x46151b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00460aa0
add esp, 8
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x58], ecx
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x58]
push edx
push str.unable_to_create_mediaget_admin_proxy_pipe_out
call fcn.0046b360
mov ecx, eax
call fcn.00412410
mov ecx, eax
call fcn.00412410
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.004016d0
xor al, al
jmp 0x46151d
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x461c70
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call fcn.00401080
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x20]
test ecx, ecx
je 0x461ca0
push 2
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x80]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x20], 0
mov esp, ebp
pop ebp
ret

Function at 0x462f80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call fcn.00401080
mov eax, dword [ebp - 8]
mov byte [eax + 0x20], 1
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
push 0x461d70
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x80], eax
mov esp, ebp
pop ebp
ret

Function at 0x463b70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x39]
shr cl, 2
and cl, 1
movzx edx, cl
test edx, edx
je 0x463bc3
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x39]
shr cl, 3
and cl, 1
movzx edx, cl
test edx, edx
sete al
and al, 1
shl al, 3
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + 0x39]
and dl, 0xf7
or dl, al
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], dl
push 1
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040f390
jmp 0x463bf2
mov ecx, dword [ebp - 4]
add ecx, 0x58
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
test eax, eax
jle 0x463bf2
push 3
push 0
push 0
mov edx, dword [ebp - 4]
add edx, 0x58
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
jmp 0x463bf4
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46a680
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
mov byte [ecx + 1], 0
mov edx, dword [ebp - 8]
mov byte [edx + 2], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 8]
mov byte [edx + 0x1c], 0
call fcn.00401080
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x465d50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x46ba60
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call fcn.00401080
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x20]
test ecx, ecx
je 0x46baa4
push 2
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x90]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x44], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x20], 0
mov esp, ebp
pop ebp
ret
Function at 0x46c9f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call fcn.00401080
mov eax, dword [ebp - 8]
mov byte [eax + 0x20], 1
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
push 0x46bc00
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x90], eax
mov esp, ebp
pop ebp
ret
Function at 0x46e0a0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475f81
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4922f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00401bb0
mov dword [ebp - 4], 0
push 0
push 0x26
lea ecx, [ebp - 0x14]
call fcn.00418f20
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x14]
call fcn.00418f20
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0045f720
add esp, 8
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x58], ecx
mov byte [ebp - 4], 1
push str.Yontoo_LayersYontooIEClient.dll
mov edx, dword [ebp - 0x58]
push edx
lea eax, [ebp - 0x50]
push eax
call fcn.00402d60
add esp, 0xc
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.0045f2f0
add esp, 4
mov byte [ebp - 0x15], al
lea ecx, [ebp - 0x50]
call fcn.004016d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401bf0
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x470760
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call fcn.00401080
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x58]
test ecx, ecx
jne 0x47079d
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0x4706c0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x5c], eax
mov edx, dword [ebp - 8]
mov byte [edx + 0x58], 1
mov esp, ebp
pop ebp
ret
Function at 0x471100
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
ja case.default.0x471120
mov ecx, dword [ebp - 8]
jmp dword [ecx*4 + 0x4711d0]
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1_
mov ecx, dword [ebp + 8]
call fcn.00401650
mov edx, dword [ebp - 4]
or edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
jmp 0x4711ca
push str.Mozilla_5.0__X11__U__Linux_i686__ru__rv:1.9.2.14__Gecko_20110221_Ubuntu_10.10__maverick__Firefox_3.6.14
mov ecx, dword [ebp + 8]
call fcn.00401650
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x4711ca
push str.Opera_9.80__X11__Linux_i686__U__ru__Presto_2.7.62_Version_11.01
mov ecx, dword [ebp + 8]
call fcn.00401650
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
jmp 0x4711ca
push str.Mozilla_5.0__Windows__U__Windows_NT_5.1__en_US__AppleWebKit_534.13__KHTML__like_Gecko__Chrome_9.0.597.107_Safari_534.13
mov ecx, dword [ebp + 8]
call fcn.00401650
mov edx, dword [ebp - 4]
or edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
jmp 0x4711ca
push str.Mozilla_5.0__Macintosh__U__Intel_Mac_OS_X_10_6_6__en_US__AppleWebKit_534.13__KHTML__like_Gecko__Chrome_9.0.597.102_Safari_534.13
mov ecx, dword [ebp + 8]
call fcn.00401650
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x4711ca
push 0x483fc4
mov ecx, dword [ebp + 8]
call fcn.00401650
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x471560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475f49
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x4922f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x258], 0
push 0
push 0x1a
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x254]
push edx
call fcn.0045f720
add esp, 8
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x260], eax
mov dword [ebp - 4], 0
push str.MozillaFirefox_
mov ecx, dword [ebp - 0x260]
push ecx
lea edx, [ebp - 0x238]
push edx
call fcn.00402d60
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x254]
call fcn.004016d0
lea eax, [ebp - 0x238]
push eax
call fcn.0045f2f0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x47164e
lea edx, [ebp - 0x238]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401690
mov eax, dword [ebp - 0x258]
or eax, 1
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.004016d0
mov eax, dword [ebp + 8]
jmp 0x47168e
mov ecx, dword [ebp + 8]
call fcn.00401620
mov ecx, dword [ebp - 0x258]
or ecx, 1
mov dword [ebp - 0x258], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.004016d0
mov eax, dword [ebp + 8]
jmp 0x47168e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00442777
mov esp, ebp
pop ebp
ret
Function at 0x10001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x20]
mov dl, 0x6e
xor ebx, ebx
push eax
push ecx
mov dword [esi], 0x1001719c
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], bl
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], bl
call dword [0x10017004]
push eax
call dword [section..rdata]
push ebx
push ebx
push ebx
mov edi, eax
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 4], 0x3e8
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [esi + 4]
push edx
call fcn.10015e40
push 0x20
mov dword [edi - 0x28], eax
call fcn.10015e40
mov dword [edi], eax
mov eax, dword [esi + 4]
push eax
call fcn.10015e40
push 0x20
mov dword [edi - 0x20], eax
call fcn.10015e40
mov dword [edi + 8], eax
add esp, 0x10
add edi, 4
dec ebp
jne 0x100010d6
lea eax, [esi + 0x46]
xor ecx, ecx
mov edx, eax
pop edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov word [eax], 0x31
mov word [esi + 0x48], 1
mov dword [esi + 0x4a], 0x1f40
mov dword [esi + 0x4e], 0x659
mov word [esi + 0x52], 0x41
mov word [esi + 0x54], bx
mov word [esi + 0x56], 2
mov word [esi + 0x58], 0x140
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10001005
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x20]
mov dl, 0x6e
xor ebx, ebx
push eax
push ecx
mov dword [esi], 0x1001719c
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], bl
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], bl
call dword [0x10017004]
push eax
call dword [section..rdata]
push ebx
push ebx
push ebx
mov edi, eax
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 4], 0x3e8
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [esi + 4]
push edx
call fcn.10015e40
push 0x20
mov dword [edi - 0x28], eax
call fcn.10015e40
mov dword [edi], eax
mov eax, dword [esi + 4]
push eax
call fcn.10015e40
push 0x20
mov dword [edi - 0x20], eax
call fcn.10015e40
mov dword [edi + 8], eax
add esp, 0x10
add edi, 4
dec ebp
jne 0x100010d6
lea eax, [esi + 0x46]
xor ecx, ecx
mov edx, eax
pop edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov word [eax], 0x31
mov word [esi + 0x48], 1
mov dword [esi + 0x4a], 0x1f40
mov dword [esi + 0x4e], 0x659
mov word [esi + 0x52], 0x41
mov word [esi + 0x54], bx
mov word [esi + 0x56], 2
mov word [esi + 0x58], 0x140
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4058bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4058cc
pop dword [ebp - 0x18]
mov eax, 0xa464e859
sub eax, 0xa4248f8d
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x34b19264
sub dword [ebp - 0x28], 0xe65f4d19
mov dword [ebp - 0x24], 0xa0223e07
add dword [ebp - 0x24], 0x92110e3e
mov dword [ebp - 0x20], 0xf517ffc9
sub dword [ebp - 0x20], 0xa8cbbb9b
mov dword [ebp - 0x1c], 0xbea2f75f
add dword [ebp - 0x1c], 0x415d08a1
lea eax, [ebp - 0x28]
push eax
mov eax, 0x35a81c79
sub eax, 0x35674c25
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xc6d19d8a
sub dword [ebp - 0x28], 0x525f3434
mov dword [ebp - 0x24], 0xeecb4c0e
add dword [ebp - 0x24], 0x52a11567
mov dword [ebp - 0x20], 0x2f6a968e
add dword [ebp - 0x20], 0x3404d5de
mov dword [ebp - 0x1c], 0xa586f668
sub dword [ebp - 0x1c], 0xa586f668
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xd65b2061
add eax, 0x29e5afeb
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3c9f0
push 0
call eax
mov ecx, 0x339e4ab8
add ecx, 0xcc620994
mov edx, eax
mov ebx, 0x401d34ee
add ebx, 0xc0247b12
add ebx, dword [ebp - 0x18]
mov edi, 0x849f52f
add edi, 0xd26757c0
mov esi, dword [ebx]
xor esi, edi
sub dword [ebp - 4], edx
mov dword [edx], esi
add dword [ebp - 4], 0x2d563673
add edx, 4
add ebx, 0xf35c778a
add ebx, 0xca3887a
loop 0x4059ee
add eax, 0xbb32ab56
add eax, 0x44ce98ad
xor ebx, ebx
add ebx, eax
add eax, 0xc02105e0
sub eax, 0xc02105db
mov ecx, 0x5b242516
add ecx, 0xa51bdaea
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4ad01b70
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and word [str..COM_.EXE_.BAT_.CMD_.VBS_.VBE_.JS_.JSE_.WSF_.WSH], 0
push ebx
push esi
mov ebx, 0x2000
push ebx
mov esi, str..COM_.EXE_.BAT_.CMD_.VBS_.VBE_.JS_.JSE_.WSF_.WSH
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4ad045aa
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
cmp byte [0x4ad2fa64], 0
push edi
je 0x4ad0464a
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x4ad34190
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12df9
push str.ERRORLEVEL
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad0a861
push str.CMDEXTVERSION
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e05
push 0x4ad04664
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e0c
push str.DATE
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e17
push str.TIME
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e23
push 0x4ad04654
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e3b
xor eax, eax
pop edi
jmp 0x4ad01b9e
push dword [0x4ad2fa20]
push 0x4ad081bc
push esi
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
mov eax, esi
jmp 0x4ad0464c
push eax
push esi
call fcn.4ad01550
jmp 0x4ad0a876
push 2
jmp 0x4ad0a867
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x4ad0464c
push ebx
push esi
push 1
push eax
call fcn.4ad0b5cc
jmp 0x4ad12e2d
push ebx
push esi
push 1
push eax
call fcn.4ad0b380
and word [eax*2 + str..COM_.EXE_.BAT_.CMD_.VBS_.VBE_.JS_.JSE_.WSF_.WSH], 0
jmp 0x4ad0a876
call dword [sym.imp.msvcrt.dll_rand]
push eax
jmp 0x4ad0a867