joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12bd058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.012bd1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x12bd07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x12bd06a
add dl, dl
jne 0x12bd089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x12bd0dc
xor eax, eax
add dl, dl
jne 0x12bd096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x12bd17d
add dl, dl
jne 0x12bd0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x12bd0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x12bd0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x12bd0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x12bd0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x12bd075
mov eax, 1
add dl, dl
jne 0x12bd0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x12bd0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x12bd0e1
sub eax, ebx
mov ebx, 1
jne 0x12bd128
mov ecx, 1
add dl, dl
jne 0x12bd10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x12bd119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x12bd105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12bd075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x12bd13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x12bd14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x12bd136
cmp eax, 0x7d00
jae 0x12bd16d
cmp eax, 0x500
jb 0x12bd168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12bd075
cmp eax, 0x7f
ja 0x12bd170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12bd075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x12bd19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x12bd075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x8de328
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de32e
pop ebp
sub ebp, 6
sub ebp, 0x4de328
jmp 0x8de38c
jmp 0x8de395
mov eax, 0x4de328
add eax, ebp
add eax, 0x93
mov ecx, 0x62f
mov edx, 0x2c9d98e8
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de3ac
jmp 0x8de3bf
sub byte [eax - 0x17071780], 0xe8
sub al, 0x24
invalid
Function at 0xf121b4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf121be
pushal
call 0xf121c4
pop ebp
sub ebp, 0x10
sub ebp, 0xb121b4
mov cl, 0
jmp 0xf121da
mov eax, 0xb121b4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b9
mov edx, 0x20cac15c
xor byte [eax], dl
inc eax
dec ecx
adc byte [eax + 0x49], al
jne 0xf121f1
jmp 0xf12204
xlatb
xchg ecx, eax
xlatb
aad 0x60
pop esp
pop esp
pop esp
fstp qword [ebp + 0x5c5c5ca4]
pop edi
xchg ecx, eax
in al, 0x5a
pop esp
pop esp
pop esp
out 0x74, al
pop esp
pop esp
pop esp
stosd dword es:[edi], eax
mov esi, 0xddd7945f
push eax
pop esp
pop esp
pop esp
pop edi
cdq
or al, 0xd1
cmp byte [eax - 0x60], bh
js 0xf121cf
aad 0x58
js 0xf12267
mov al, 0xb1
jge 0xf12293
xor al, 0x94
outsd dx, dword [esi]
rcr dword [ebp + ebx*2 + 0x70], cl
js 0xf12274
fld qword [eax + 7]
mov ah, 0x59
pop ecx
pop esp
pop esp
pop esp
mov ch, 0x72
pop esp
pop esp
pop esp
sar dword [eax], 1
js 0xf121f2
aad 0x70
js 0xf1222d
mov al, 0xd7
fst dword [esp + ebx*2 + 0x5c]
pop esp
xlatb
leave
push eax
pop esp
pop esp
pop esp
xlatb
ror dword [esp + ebx*2 + 0x5c], 1
pop esp
pop esp
popfd
mov ch, 0x5e
insd dword es:[edi], dx
pop esi
fistp word [esi - 0x26aceaa8]
test al, 0xa3
mov dword [0x509e01a3], eax
pop esp
xlatb
sar byte [eax + 0x58], 1
pop esp
pop esp
pop esp
xor al, 0xb0
mov cl, 0x7d
pop esp
xor al, 0x94
outsd dx, dword [esi]
rcr dword [ebp + ebx*2 + 0x70], cl
js 0xf12262
cmp byte [eax - 0x60], bh
aad 0x50
js 0xf1224c
mov al, byte [0xb47850d5]
pop ecx
pop esp
pop esp
pop esp
mov ch, 0x65
pop esi
pop esp
pop esp
sar dword [eax], 1
js 0xf12245
aad 0x70
js 0xf12280
mov al, 0xa3
sub dword [eax - 0x5d], edx
sub dword [esp + esi*4 + 0x3a], edx
pop esp
pop esp
pop esp
xlatb
loope 0xf1230c
pop esp
pop esp
pop esp
outsd dx, dword [esi]
xchg ebp, eax
outsd dx, dword [esi]
mov ds, edi
mov ah, 0x59
adc al, 0x53
fcom dword [edx]
pop esp
pop esp
pop esp
push ebx
aam 0x14
pop esp
pop esp
pop esp
cmp dl, bh
inc eax
fsub qword gs:[edi + 0x46d853b4]
pop esp
pop esp
pop esp
fsub qword [edi + 0x4dd853b5]
pop esp
pop esp
pop esp
cmp bl, ch
cmpsd dword [esi], dword es:[edi]
mov dword [0x49d85379], eax
pop esp
pop esp
pop esp
sbb eax, 0xa3a390b5
mov dword [0x5d651075], eax
fistp word [ebp + 0x58b4df59]
mov ch, 0xe1
mov dword [0x875a3a3], eax
pop esi
fistp word [ebp + 0x58b6df5a]
fbstp tbyte [ecx + ebx*2 - 0x5c5c084b]
mov dword [0x5c509e01], eax
fbstp tbyte [esi + 0x59b4df58]
mov ch, 0xf7
mov dword [0x9e01a3a3], eax
push eax
pop esp
or edi, edx
mov al, 0xa
or ecx, dword [ecx]
xlatb
sub dword [eax - 0x29], edx
and dword [eax - 0x12], edx
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100026f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x100027ca
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x100027ca
mov edx, dword [ebx + 0x18]
lea ecx, [ebp - 4]
push ecx
push 0x40
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebx + 0x14]
cmp byte [eax], 0xe9
jne 0x100027ad
push esi
push edi
push eax
sbb eax, esp
xor eax, esp
xor eax, esp
sbb eax, esp
and eax, ebp
and eax, ebp
pop eax
mov ecx, dword [ebx + 0x18]
mov edi, dword [ebx + 0x14]
mov edx, ecx
mov eax, 0x90909090
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x18]
test esi, esi
jne 0x10002772
mov esi, dword [ebx + 0xc]
mov edi, dword [ebx + 0x14]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x1000277e
mov edi, dword [ebx + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.100115c0
pop edi
pop esi
test eax, eax
jl 0x10002798
cmp eax, 0xffffffff
jge 0x10002798
call fcn.1000af80
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebx + 0x14]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100027e0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x10002918
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10002918
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
add eax, esi
mov edi, dword [eax + 0x18]
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0xc], edi
add ecx, esi
push ebx
mov ebx, 0xc6e40527
mov ebx, 0xce627890
sbb ebx, esi
pop ebx
mov edx, dword [eax + 0x24]
mov eax, dword [eax + 0x1c]
add edx, esi
add eax, esi
test edi, edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
jbe 0x10002918
mov dword [ebp - 4], ecx
mov bl, 0x6c
jmp 0x1000284a
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov byte [ebp - 0x30], 0x4b
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x72
mov eax, dword [ecx]
mov byte [ebp - 0x2d], 0x6e
add esi, eax
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0x33
mov byte [ebp - 0x29], 0x32
mov byte [ebp - 0x28], 0x2e
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x24], 0
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x63
mov byte [ebp - 0x1b], 0x6d
mov byte [ebp - 0x1a], 0x70
mov byte [ebp - 0x19], 0x41
mov byte [ebp - 0x18], 0
push edi
mov edi, 0xc8c1bcb9
mov edi, 0xaf8e9dc
nop
pop edi
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x100028f2
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x100028f2
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call edi
test eax, eax
je 0x10002921
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc eax
add edx, 4
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jb 0x10002847
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
sbb ecx, edx
sbb ecx, edx
add ecx, edx
sbb ecx, edx
sbb ecx, edx
add ecx, edx
sbb ecx, edx
pop ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
xor edx, edx
pop edi
mov dx, word [eax + ecx*2]
mov eax, dword [ebp - 0x14]
pop esi
pop ebx
lea eax, [eax + edx*4]
mov esp, ebp
pop ebp
ret
Function at 0x10004d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ed20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov ecx, 0x10
xor eax, eax
mov edi, 0x10027d10
rep stosd dword es:[edi], eax
mov cl, 0x6c
xor ebx, ebx
mov byte [ebp - 0x1b], cl
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], cl
mov al, 0x65
mov dl, 0x74
mov cl, 0x6d
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], ebx
mov dword [0x10027d90], 0x40
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], al
mov byte [ebp - 0x32], dl
mov byte [ebp - 0x31], 0x43
mov byte [ebp - 0x30], 0x6f
mov byte [ebp - 0x2f], cl
mov byte [ebp - 0x2e], 0x70
mov byte [ebp - 0x2d], 0x75
mov byte [ebp - 0x2c], dl
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x4e
mov byte [ebp - 0x28], 0x61
mov byte [ebp - 0x27], cl
mov byte [ebp - 0x26], al
mov byte [ebp - 0x25], 0x57
mov byte [ebp - 0x24], bl
push eax
xor eax, eax
mov eax, 0xf4ebe4
and eax, edi
and eax, ebp
pop eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x20]
push eax
push ecx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
jne 0x10004e5b
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x10004e5b
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x20]
push eax
push ecx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x10027d90
push 0x10027d10
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push eax
xor eax, esp
xor eax, esi
sbb eax, eax
xor eax, edx
pop eax
cmp dword [0x10027d90], 0xfffffe0e
jne 0x10004e92
cmp byte [0x100270b4], bl
jne 0x10004e9b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10027d90], 5
jbe 0x10004ea5
mov dword [0x10027d90], 5
push 0x10027d10
call fcn.1001263b
mov edx, dword [0x10027d90]
mov ecx, 0x40
sub ecx, edx
xor eax, eax
lea edi, [edx*2 + 0x10027d10]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x10027d10
and ecx, 3
rep stosb byte es:[edi], al
call fcn.100124fe
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ed30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x100270e8]
push ebx
push esi
push edi
test eax, eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
jne 0x10005006
mov al, 0x65
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1c], al
mov al, 0x6c
mov cl, 0x72
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x16], al
mov byte [ebp - 0x15], al
mov al, 0x61
mov byte [ebp - 0x2e], al
mov byte [ebp - 0x28], al
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x29], cl
mov byte [ebp - 0x27], cl
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x20]
mov bl, 0x64
mov dl, 0x4c
push eax
push ecx
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x30], dl
mov byte [ebp - 0x2f], 0x6f
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x2c], dl
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x2a], 0x62
mov byte [ebp - 0x26], 0x79
mov byte [ebp - 0x25], 0x41
mov byte [ebp - 0x24], 0
call esi
push eax
call fcn.10002950
add esp, 8
mov dword [0x100270e8], eax
test eax, eax
jne 0x10005006
push edx
add edx, esi
mov edx, 0xe8801ab5
sub edx, ecx
sub edx, edi
pop edx
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x20]
push edx
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov edi, eax
test edi, edi
jne 0x10005000
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10005000
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x20]
push edx
push eax
call esi
push eax
call ebx
mov edi, eax
mov dword [0x100270e8], edi
mov eax, dword [0x100270a4]
test eax, eax
jne 0x10005084
mov eax, dword [0x10027d08]
mov byte [0x100251c0], 1
test eax, eax
jne 0x10005024
call fcn.1000f6e0
push edx
mov edx, 0x4d09fef
sbb edx, edx
add edx, esp
sbb edx, esi
sbb edx, eax
pop edx
mov al, byte [0x10027984]
test al, al
jne 0x1000504a
mov eax, dword [0x10027d90]
test eax, eax
jne 0x1000504a
call fcn.10004d60
mov ecx, dword [0x100270a8]
push 0
push ecx
push 0x10004330
push 4
call fcn.1000b0a0
add esp, 0x10
mov dword [0x100270a4], eax
test eax, eax
jne 0x10005084
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
mov eax, 0x3f4b5969
mov eax, 0x2123272d
sub eax, ebp
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov al, byte [0x10027985]
push ebx
push esi
push edi
test al, al
je 0x10005ffd
mov al, 0x72
mov bl, 0x75
mov byte [ebp - 0x21], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x15], al
mov byte [ebp - 0xd], al
mov cl, 0x65
mov dl, 0x73
mov al, 0x6c
mov byte [ebp - 0x24], 0x51
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], cl
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x55
mov byte [ebp - 0x1e], dl
mov byte [ebp - 0x1d], cl
mov byte [ebp - 0x1b], 0x43
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], dl
mov byte [ebp - 0xe], cl
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], al
mov byte [ebp - 7], al
mov byte [ebp - 6], 0
push ebx
mov ebx, 0xc65c01e
xor ebx, esi
add ebx, edx
sub ebx, edi
pop ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x10]
push eax
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x10005fa1
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10005ffd
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x10]
push eax
push ecx
call edi
push eax
call ebx
mov esi, eax
test esi, esi
je 0x10005ffd
call fcn.100115c0
test eax, eax
jl 0x10005fbc
cmp eax, 0xfffffffc
jge 0x10005fbc
push 0
call dword [sym.imp.USER32.dll_CopyIcon]
call fcn.1000af80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
mov ecx, 0x14
xor eax, eax
lea edi, [ebp - 0x74]
rep stosd dword es:[edi], eax
push ecx
sbb ecx, edx
xor ecx, eax
xor ecx, esi
sbb ecx, esp
and ecx, ebx
and ecx, ecx
pop ecx
lea edx, [ebp - 0x74]
push 0x50
push edx
lea eax, [ebp - 4]
push 4
push eax
push 1
call esi
test eax, eax
je 0x10005ffd
mov eax, dword [ebp - 0x60]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008bf0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
push 0x10025224
mov dword [ebp - 4], 0
call fcn.10012adf
add esp, 8
push ebp
add ebp, eax
xor ebp, esp
add ebp, eax
sub ebp, ebp
pop ebp
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
push 0
call ebx
mov edi, 5
push 0
push 0
push 0
push 0
call ebx
mov esi, 1
mov eax, edi
cmp edi, esi
jge 0x10008c49
mov eax, esi
mov esi, edi
sub eax, esi
je 0x10008c59
push esi
mov esi, 0xbb6f25dc
sub esi, ebx
nop
pop esi
mov esi, eax
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
test esi, esi
mov edi, esi
jne 0x10008c30
movsx ecx, byte [0x10025224]
mov dword [ebp - 8], ecx
push ecx
sbb ecx, eax
xor ecx, eax
add ecx, esi
add ecx, esp
pop ecx
push ebp
add ebp, eax
add ebp, esi
and ebp, ebp
sub ebp, ebx
pop ebp
push esi
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ebx, 4
push edi
mov esi, ebx
call dword [sym.imp.USER32.dll_SetFocus]
mov edi, 0x10
add ebx, esi
push esi
push ebx
call fcn.10008d40
mov ebx, eax
mov esi, edi
imul edi, ebx
add esp, 8
test edi, edi
jne 0x10008c9f
sub eax, esi
je 0x10008cc4
push edi
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_SetLastErrorEx]
add ebx, 2
test ebx, ebx
je 0x10008cd7
push ebp
mov ebp, 0x5bb742f
add ebp, esi
nop
pop ebp
mov esi, ebx
mov ebx, 1
cmp esi, ebx
jl 0x10008d26
test ebx, ebx
mov dword [ebx*4 + 0x10025178], ebx
jne 0x10008d17
mov edi, 1
cmp edi, dword [0x1002517c]
je 0x10008d02
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push edx
add edx, esp
add edx, esi
xor edx, eax
sub edx, ebx
pop edx
inc edi
cmp edi, esi
jle 0x10008cf0
inc dword [0x10025178]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
inc ebx
cmp ebx, esi
jle 0x10008ce0
mov eax, esi
pop edi
imul eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008d40
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp edi, esi
jne 0x10008d56
mov eax, edi
mov edi, esi
mov esi, eax
mov ebx, edi
sub ebx, esi
je 0x10008d8c
push edx
sbb edx, esi
mov edx, 0x72029327
nop
pop edx
cmp edi, esi
mov eax, edi
jge 0x10008d70
mov eax, esi
mov esi, edi
sub eax, esi
je 0x10008d80
push ebp
mov ebp, 0x8df056bd
add ebp, eax
nop
pop ebp
mov esi, eax
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov edi, esi
mov esi, ebx
push 0
call dword [sym.imp.USER32.dll_SetFocus]
mov ebx, edi
imul ebx, esi
test ebx, ebx
je 0x10008db4
add edi, esi
push esi
push edi
call fcn.10008d40
mov edi, eax
mov esi, ebx
imul ebx, edi
add esp, 8
test ebx, ebx
jne 0x10008d9d
mov eax, edi
sub eax, esi
je 0x10008dc6
push 0
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_SetLastErrorEx]
add edi, 2
test edi, edi
je 0x10008dd9
push ebp
sbb ebp, eax
add ebp, eax
sbb ebp, eax
or ebp, ecx
pop ebp
mov esi, edi
mov ebx, 1
cmp esi, ebx
jl 0x10008e28
test ebx, ebx
mov dword [ebx*4 + 0x10025178], ebx
jne 0x10008e19
mov edi, 1
cmp edi, dword [0x1002517c]
je 0x10008e04
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push eax
xor eax, eax
mov eax, 0x104e8ed0
nop
pop eax
inc edi
cmp edi, esi
jle 0x10008df2
inc dword [0x10025178]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
inc ebx
cmp ebx, esi
jle 0x10008de2
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000b0a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov al, 0x6f
mov dl, 0x64
mov byte [ebp - 0x19], al
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], al
mov cl, 0x73
mov al, 0x6c
push esi
push edi
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x57
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], dl
mov byte [ebp - 0x18], 0x77
mov byte [ebp - 0x17], cl
mov byte [ebp - 0x16], 0x48
mov byte [ebp - 0x13], 0x6b
mov byte [ebp - 0x12], 0x45
mov byte [ebp - 0x11], 0x78
mov byte [ebp - 0x10], 0x41
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], cl
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], dl
mov byte [ebp - 4], al
mov byte [ebp - 3], al
mov byte [ebp - 2], 0
push ebp
mov ebp, 0x8b7a6b5e
mov ebp, 0xfee3cab3
mov ebp, 0x25005c3b
pop ebp
push ecx
sbb ecx, eax
sbb ecx, esi
add ecx, esp
sbb ecx, edx
sbb ecx, eax
nop
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0xc]
push eax
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
jne 0x1000b17d
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000b175
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0xc]
push eax
push ecx
call esi
push eax
call edi
test eax, eax
jne 0x1000b17d
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push ecx
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret