joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000263b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor edi, edi
call fcn.1000239a
mov esi, eax
test esi, esi
je 0x100026b6
lea eax, [ebp - 0x14]
push eax
push esi
mov byte [ebp - 7], 0x6b
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0x14], 0x4f
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 6], 0x65
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 8], 0x6f
mov byte [ebp - 4], 0
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 9], 0x54
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 5], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100026af
push dword [ebp + 0xc]
push 0x20
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x100026bc
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor edi, edi
call fcn.1000239a
mov esi, eax
test esi, esi
je 0x1000274c
lea eax, [ebp - 0x18]
push eax
push esi
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x75
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 8], 0x61
mov byte [ebp - 0x18], 0x4c
mov byte [ebp - 0xb], 0x67
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 3], 0
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 4], 0x41
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 9], 0x56
mov byte [ebp - 5], 0x65
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0x15], 0x6b
mov byte [ebp - 0x12], 0x50
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xa], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002745
push dword [ebp + 8]
push str.SeDebugPrivilege
push edi
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10002752
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor edi, edi
call fcn.1000239a
mov esi, eax
test esi, esi
je 0x100027e4
lea eax, [ebp - 0x18]
push eax
push esi
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 6], 0x67
mov byte [ebp - 7], 0x65
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 9], 0x69
mov byte [ebp - 0x12], 0x54
mov byte [ebp - 0xd], 0x50
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xa], 0x76
mov byte [ebp - 4], 0x73
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 8], 0x6c
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 5], 0x65
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 3], 0
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x13], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100027dd
push edi
push edi
push 0x10
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x100027ea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor edi, edi
inc edi
call fcn.1000239a
mov esi, eax
test esi, esi
je 0x1000286e
lea eax, [ebp - 0x14]
push eax
push esi
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 7], 0x45
mov byte [ebp - 6], 0x78
mov byte [ebp - 4], 0
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 9], 0x75
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0x14], 0x52
mov byte [ebp - 0xc], 0x56
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0x12], 0x67
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 5], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002867
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10002874
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
inc edi
call fcn.1000239a
mov esi, eax
test esi, esi
je 0x100028ec
lea eax, [ebp - 0x10]
push eax
push esi
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 6], 0x45
mov byte [ebp - 4], 0x41
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 9], 0x4b
mov byte [ebp - 5], 0x78
mov byte [ebp - 3], 0
mov byte [ebp - 8], 0x65
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 7], 0x79
mov byte [ebp - 0xe], 0x67
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 0xd], 0x4f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100028e5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push 0x80000002
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x100028f2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
inc edi
call fcn.1000239a
mov esi, eax
test esi, esi
je 0x10002955
lea eax, [ebp - 0xc]
push eax
push esi
mov byte [ebp - 6], 0x73
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xc], 0x52
mov byte [ebp - 3], 0x65
mov byte [ebp - 4], 0x4b
mov byte [ebp - 5], 0x65
mov byte [ebp - 0xa], 0x67
mov byte [ebp - 2], 0x79
mov byte [ebp - 1], 0
mov byte [ebp - 8], 0x6c
mov byte [ebp - 9], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000294e
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1000295b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x60
pop edi
call fcn.100023e0
mov esi, eax
test esi, esi
je 0x100029c8
lea eax, [ebp - 0x10]
push eax
push esi
mov byte [ebp - 8], 0x65
mov byte [ebp - 3], 0
mov byte [ebp - 0x10], 0x47
mov byte [ebp - 6], 0x61
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 4], 0x73
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 7], 0x43
mov byte [ebp - 0xb], 0x76
mov byte [ebp - 5], 0x70
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 9], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100029c1
push 0x58
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x100029ce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor edi, edi
call fcn.1000241a
mov esi, eax
test esi, esi
je 0x10002a68
lea eax, [ebp - 0x18]
push eax
push esi
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 4], 0x74
mov byte [ebp - 6], 0x50
mov byte [ebp - 0x13], 0x53
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 2], 0x41
mov byte [ebp - 7], 0x72
mov byte [ebp - 1], 0
mov byte [ebp - 5], 0x61
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x16], 0x47
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x17], 0x48
mov byte [ebp - 3], 0x68
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 9], 0x64
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 0x15], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002a61
push edi
push 0x25
push dword [ebp + 8]
push edi
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10002a6e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
push eax
xor esi, esi
mov byte [ebp - 5], 0x74
mov byte [ebp - 4], 0
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 8], 0x6f
mov byte [ebp - 6], 0x6e
mov byte [ebp - 0x10], 0x47
mov byte [ebp - 7], 0x75
mov byte [ebp - 0xa], 0x6b
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 0xb], 0x63
call fcn.10002354
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002ac3
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x10002ac8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x32
pop edi
call fcn.1000245c
mov esi, eax
test esi, esi
je 0x10002b3e
lea eax, [ebp - 0x10]
push eax
push esi
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 0x10], 0x47
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 4], 0x6e
mov byte [ebp - 6], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 8], 0x65
mov byte [ebp - 9], 0x74
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0x6f
mov byte [ebp - 5], 0x49
mov byte [ebp - 7], 0x72
mov byte [ebp - 0xd], 0x41
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 3], 0x66
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002b37
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10002b44
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
call fcn.100024a2
mov esi, eax
test esi, esi
je 0x10002ba3
lea eax, [ebp - 0xc]
push eax
push esi
mov byte [ebp - 9], 0x77
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 6], 0x6e
mov byte [ebp - 2], 0
mov byte [ebp - 3], 0x77
mov byte [ebp - 5], 0x64
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 7], 0x69
mov byte [ebp - 4], 0x6f
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 8], 0x57
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002b9c
push edi
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10002ba9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 0x18]
push eax
xor esi, esi
mov byte [ebp - 6], 0x6f
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 5], 0x6e
mov byte [ebp - 0x15], 0x56
mov byte [ebp - 9], 0x61
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 4], 0x41
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 3], 0
call fcn.10002354
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002c3b
mov ecx, 0x105
push ecx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x10002c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
call fcn.100024a2
mov esi, eax
test esi, esi
je 0x10002c9b
lea eax, [ebp - 0xc]
push eax
push esi
mov byte [ebp - 6], 0x65
mov byte [ebp - 8], 0x61
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0xc], 0x52
mov byte [ebp - 3], 0
mov byte [ebp - 4], 0x43
mov byte [ebp - 9], 0x65
mov byte [ebp - 7], 0x73
mov byte [ebp - 5], 0x44
mov byte [ebp - 0xb], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002c94
push dword [ebp + 8]
push edi
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10002ca1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
call fcn.100024a2
mov esi, eax
test esi, esi
je 0x10002d10
lea eax, [ebp - 0x10]
push eax
push esi
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 6], 0x45
mov byte [ebp - 8], 0x6f
mov byte [ebp - 4], 0x41
mov byte [ebp - 9], 0x64
mov byte [ebp - 5], 0x78
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 3], 0
mov byte [ebp - 7], 0x77
mov byte [ebp - 0xe], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002d09
push edi
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10002d63
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x14]
push eax
or esi, 0xffffffff
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0x14], 0x46
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 4], 0
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 7], 0x6d
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 5], 0x41
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 6], 0x65
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 8], 0x75
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0xd], 0x73
call fcn.10002354
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002dd1
push 0x104
push dword [ebp + 8]
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x10002dd6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
call fcn.100024a2
mov esi, eax
test esi, esi
je 0x10002e4e
lea eax, [ebp - 0x10]
push eax
push esi
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 7], 0x50
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x73
mov byte [ebp - 6], 0x6f
mov byte [ebp - 8], 0x77
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xd], 0x57
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x6f
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002e47
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10002e54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x14]
push eax
xor esi, esi
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xb], 0x50
mov byte [ebp - 7], 0x65
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 9], 0x6f
mov byte [ebp - 8], 0x63
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 5], 0x73
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 4], 0
mov byte [ebp - 6], 0x73
call fcn.10002354
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002ebd
push esi
push dword [ebp + 8]
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret

Function at 0x10002ec2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x14]
push eax
or esi, 0xffffffff
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xc], 0x6e
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 8], 0x6f
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 5], 0x73
mov byte [ebp - 3], 0
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xa], 0x50
mov byte [ebp - 6], 0x65
mov byte [ebp - 7], 0x63
mov byte [ebp - 4], 0x73
mov byte [ebp - 0x11], 0x43
mov byte [ebp - 9], 0x72
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xd], 0x65
call fcn.10002354
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002f2c
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x10002f31
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
call fcn.100024a2
mov esi, eax
test esi, esi
je 0x10002f92
lea eax, [ebp - 0xc]
push eax
push esi
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 2], 0
mov byte [ebp - 4], 0x65
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 9], 0x44
mov byte [ebp - 7], 0x67
mov byte [ebp - 5], 0x74
mov byte [ebp - 0xc], 0x47
mov byte [ebp - 3], 0x6d
mov byte [ebp - 6], 0x49
mov byte [ebp - 8], 0x6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002f8b
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10002f98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 0xc]
push eax
or esi, 0xffffffff
mov byte [ebp - 1], 0
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 8], 0x50
mov byte [ebp - 0xb], 0x70
mov byte [ebp - 2], 0x73
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 7], 0x72
mov byte [ebp - 9], 0x6e
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0x73
mov byte [ebp - 5], 0x63
mov byte [ebp - 6], 0x6f
call fcn.10002354
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002ff4
push dword [ebp + 8]
push 0
push 0x401
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret

Function at 0x10002ff9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 0xc]
push eax
xor esi, esi
mov byte [ebp - 2], 0x65
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 6], 0x61
mov byte [ebp - 9], 0x73
mov byte [ebp - 1], 0
mov byte [ebp - 4], 0x64
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 5], 0x6e
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 7], 0x48
mov byte [ebp - 3], 0x6c
mov byte [ebp - 8], 0x65
call fcn.10002354
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000304d
push dword [ebp + 8]
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret

Function at 0x10003c2d
Capabilities:
Hash data with md5

Disassembly:
push 0x40
lea eax, [esi + 4]
push 0
push eax
mov dword [esi], 0x1002bb38
call fcn.1000a9b0
and dword [esi + 0x48], 0
and dword [esi + 0x44], 0
add esp, 0xc
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov eax, esi
ret
Function at 0x100058f9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
and dword [ebp - 4], 0
push ebx
push esi
push edi
lea ebx, [eax + 0x4c]
push 8
pop ecx
mov esi, ebx
lea edi, [ebp - 0x38]
mov byte [ebp - 0x14], 0x34
mov byte [ebp - 0x10], 0x38
mov byte [ebp - 0x17], 0x31
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 8], 0
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0xf], 0x39
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x15], 0x33
mov byte [ebp - 0x11], 0x37
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x12], 0x36
mov byte [ebp - 0xd], 0x62
mov byte [ebp - 0x16], 0x32
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 9], 0x66
rep movsd dword es:[edi], dword [esi]
call fcn.100057e8
push 0xf
xor eax, eax
xor edx, edx
mov esi, ebx
pop edi
mov ecx, dword [esi]
mov ebx, ecx
shr ebx, 0x1c
mov bl, byte [ebp + ebx - 0x18]
mov byte [ebp + eax - 0x7c], bl
inc eax
mov ebx, ecx
shr ebx, 0x18
and ebx, edi
mov bl, byte [ebp + ebx - 0x18]
mov byte [ebp + eax - 0x7c], bl
mov ebx, ecx
shr ebx, 0x14
and ebx, edi
mov bl, byte [ebp + ebx - 0x18]
mov byte [ebp + eax - 0x7b], bl
inc eax
mov ebx, ecx
shr ebx, 0x10
and ebx, edi
mov bl, byte [ebp + ebx - 0x18]
mov byte [ebp + eax - 0x7b], bl
inc eax
mov ebx, ecx
shr ebx, 0xc
and ebx, edi
mov bl, byte [ebp + ebx - 0x18]
mov byte [ebp + eax - 0x7b], bl
inc eax
mov ebx, ecx
shr ebx, 8
and ebx, edi
mov bl, byte [ebp + ebx - 0x18]
mov byte [ebp + eax - 0x7b], bl
inc eax
mov ebx, ecx
shr ebx, 4
and ebx, edi
mov bl, byte [ebp + ebx - 0x18]
inc eax
and ecx, edi
mov cl, byte [ebp + ecx - 0x18]
mov byte [ebp + eax - 0x7c], bl
inc eax
mov byte [ebp + eax - 0x7c], cl
mov ecx, dword [ebp + edx*4 - 0x38]
inc eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 8
jl 0x10005965
mov ecx, dword [ebp + 8]
mov byte [ebp + eax - 0x7c], 0
lea eax, [ebp - 0x7c]
push eax
call fcn.10001d22
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100076cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002e470]
jne 0x100076d6
repz ret
jmp fcn.1000fefc
Function at 0x10013cde
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000aab6
and dword [ebp - 4], 0
cmp dword [0x1002fd7c], 0
mov ebx, eax
jne 0x10013d8f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10013e40
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10013e40
push eax
call fcn.1000aa44
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1002fd7c], eax
call esi
push eax
call fcn.1000aa44
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1002fd80], eax
call esi
push eax
call fcn.1000aa44
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1002fd84], eax
call esi
push eax
call fcn.1000aa44
pop ecx
mov dword [0x1002fd8c], eax
test eax, eax
je 0x10013d8f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000aa44
pop ecx
mov dword [0x1002fd88], eax
mov eax, dword [0x1002fd88]
cmp eax, ebx
je 0x10013de7
cmp dword [0x1002fd8c], ebx
je 0x10013de7
push eax
call fcn.1000aabf
push dword [0x1002fd8c]
mov esi, eax
call fcn.1000aabf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10013de7
test edi, edi
je 0x10013de7
call esi
test eax, eax
je 0x10013dde
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10013dde
test byte [ebp - 0xc], 1
jne 0x10013de7
or dword [ebp + 0x10], 0x200000
jmp 0x10013e20
mov eax, dword [0x1002fd80]
cmp eax, ebx
je 0x10013e20
push eax
call fcn.1000aabf
pop ecx
test eax, eax
je 0x10013e20
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10013e20
mov eax, dword [0x1002fd84]
cmp eax, ebx
je 0x10013e20
push eax
call fcn.1000aabf
pop ecx
test eax, eax
je 0x10013e20
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002fd7c]
call fcn.1000aabf
pop ecx
test eax, eax
je 0x10013e40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10013e42
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f35
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
mov eax, dword [0x42c040]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [0x486d48]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x401f99
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.0040261a
lea ecx, [esp + 0x14]
call fcn.00401d65
cmp eax, 0x8aafdc01
je 0x401fb1
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00402edf
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x401f68
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004069e9
add esp, 0x24
ret
mov edx, str.QwruxAA
call fcn.0040387f
push eax
call fcn.0040384d
mov eax, dword [ebx + 0x24]
pop ecx
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00402edf
jmp 0x401f9b