joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x163a368a
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x63470bd1
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4118a2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b3ec
and dword [ebp - 0x14], 0
cmp dword [0x433124], 0
mov dword [ebp - 0x18], eax
jne 0x411955
push 0x403e58
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4119fd
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e4c
push ebx
call edi
test eax, eax
je 0x4119fd
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e3c
push ebx
mov dword [0x433124], eax
call edi
push eax
call esi
push 0x403e28
push ebx
mov dword [0x433128], eax
call edi
push eax
call esi
push 0x403e0c
push ebx
mov dword [0x43312c], eax
call edi
push eax
call esi
mov dword [0x433134], eax
test eax, eax
je 0x411955
push 0x403df4
push ebx
call edi
push eax
call esi
mov dword [0x433130], eax
mov eax, dword [0x433130]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4119ae
cmp dword [0x433134], ecx
je 0x4119ae
push eax
call esi
push dword [0x433134]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4119ae
test ebx, ebx
je 0x4119ae
call edi
test eax, eax
je 0x4119a5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4119a5
test byte [ebp - 8], 1
jne 0x4119ae
or dword [ebp + 0x10], 0x200000
jmp 0x4119e1
mov eax, dword [0x433128]
cmp eax, dword [ebp - 0x18]
je 0x4119e1
push eax
call esi
test eax, eax
je 0x4119e1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4119e1
mov eax, dword [0x43312c]
cmp eax, dword [ebp - 0x18]
je 0x4119e1
push eax
call esi
test eax, eax
je 0x4119e1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x433124]
call esi
test eax, eax
je 0x4119fd
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4119ff
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040934b
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x20f02fc0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x7d8d1277
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10001210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov word [ebp - 6], 0x7274
mov dword [ebp - 0xb], 0x20657479
mov byte [ebp - 4], 0
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x70
mov word [ebp - 0x15], 0x2064
mov word [ebp - 0x12], 0x7274
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x10], 0
mov word [ebp - 0x17], 0x726f
mov byte [ebp - 0x18], 0x77
mov dword [ebp - 0x22], 0x2064726f
mov word [ebp - 0x1d], 0x7274
mov byte [ebp - 0x1b], 0
mov word [ebp - 0x24], 0x7764
mov byte [ebp - 0x1e], 0x70
mov dword [ebp - 0x41], 0x727470
mov word [ebp - 0x44], 0x6574
mov word [ebp - 0x47], 0x625f
mov byte [ebp - 0x42], 0x20
mov byte [ebp - 0x48], 0x36
mov byte [ebp - 0x45], 0x79
mov word [ebp - 0x2a], 0x7470
mov word [ebp - 0x2d], 0x6472
mov word [ebp - 0x30], 0x7771
mov word [ebp - 0x28], 0x72
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2e], 0x6f
mov dword [ebp - 0x51], 0x65747962
mov dword [ebp - 0x4d], 0x72747020
mov word [ebp - 0x53], 0x5f30
mov byte [ebp - 0x49], 0
mov byte [ebp - 0x54], 0x31
mov word [ebp - 0x5a], 0x2044
mov dword [ebp - 0x60], 0x41564e49
mov word [ebp - 0x57], 0x5254
mov byte [ebp - 0x55], 0
mov word [ebp - 0x5c], 0x494c
mov byte [ebp - 0x58], 0x50
mov dword [ebp - 0x66], 0x54502044
mov dword [ebp - 0x6c], 0x41564e49
mov word [ebp - 0x68], 0x494c
mov word [ebp - 0x62], 0x52
mov dword [ebp - 0x36], 0x727470
mov word [ebp - 0x3b], 0x6f77
mov word [ebp - 0x38], 0x2064
mov byte [ebp - 0x3c], 0x6f
mov byte [ebp - 0x39], 0x72
cmp ecx, 8
ja case.default.0x10001322
jmp dword [ecx*4 + 0x100013f0]
lea eax, [ebp - 0xc]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x48]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x6c]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x3c]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10001420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov word [ebp - 3], 0x73
mov byte [ebp - 4], 0x65
mov word [ebp - 8], 0x7363
mov byte [ebp - 6], 0
mov word [ebp - 0xc], 0x7373
mov byte [ebp - 0xa], 0
mov word [ebp - 0x10], 0x7364
mov byte [ebp - 0xe], 0
mov word [ebp - 0x13], 0x73
mov byte [ebp - 0x14], 0x66
mov word [ebp - 0x17], 0x73
mov byte [ebp - 0x18], 0x67
mov word [ebp - 0x1d], 0x524f
mov word [ebp - 0x20], 0x5245
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1b], 0
mov dword [ebp - 0x26], 0x524f52
mov word [ebp - 0x28], 0x5245
cmp ecx, 7
ja case.default.0x1000148c
jmp dword [ecx*4 + 0x10001544]
lea eax, [ebp - 4]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
push 0x104
push edx
call fcn.10017120
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10009c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 9], 0x6c642e32
push eax
mov word [ebp - 5], 0x6c
mov dword [ebp - 0xf], 0x656e7265
mov word [ebp - 0xb], 0x336c
mov byte [ebp - 0x10], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esp, ebp
pop ebp
ret

Function at 0x10009c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 7], 0x6c6c64
push eax
mov dword [ebp - 0xb], 0x2e323369
mov word [ebp - 0xd], 0x7061
mov word [ebp - 0x10], 0x6441
mov byte [ebp - 0xe], 0x76
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10009ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x3233
push eax
mov dword [ebp - 6], 0x6c6c642e
mov word [ebp - 0xb], 0x6573
mov byte [ebp - 2], 0
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 9], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10009ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x776c6853
push eax
mov dword [ebp - 8], 0x2e697061
mov word [ebp - 3], 0x6c6c
mov byte [ebp - 1], 0
mov byte [ebp - 4], 0x64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret
Function at 0x1000a100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 0x65536c61
push eax
mov dword [ebp - 6], 0x6e6f69
mov dword [ebp - 0x16], 0x657a696c
mov dword [ebp - 0x1a], 0x61697469
mov word [ebp - 8], 0x7463
mov word [ebp - 0x11], 0x6972
mov word [ebp - 0x1c], 0x6e49
mov word [ebp - 0xe], 0x6369
mov byte [ebp - 0x12], 0x43
mov byte [ebp - 0xf], 0x74
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a15d
push 0x1006e674
call eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov word [ebp - 5], 0x64
push eax
mov esi, ecx
mov dword [ebp - 0xe], 0x656d7573
mov dword [ebp - 0xa], 0x65726854
mov word [ebp - 0x10], 0x6552
mov byte [ebp - 6], 0x61
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a1b3
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 6], 0x7972746e
push eax
mov esi, edx
mov word [ebp - 0x15], 0x6854
mov edi, ecx
mov word [ebp - 0xa], 0x6f74
mov word [ebp - 0xd], 0x656c
mov word [ebp - 0x18], 0x6547
mov dword [ebp - 0x12], 0x53646165
mov byte [ebp - 2], 0
mov word [ebp - 8], 0x4572
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xe], 0x65
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a22d
push dword [ebp + 8]
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 0x12], 0x61757472
push eax
mov dword [ebp - 7], 0x784574
mov dword [ebp - 0xd], 0x746f7250
mov word [ebp - 0x14], 0x6956
mov word [ebp - 9], 0x6365
mov byte [ebp - 0xe], 0x6c
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a294
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x11], 0x65726854
push eax
mov esi, edx
mov dword [ebp - 7], 0x747865
mov edi, ecx
mov word [ebp - 0x14], 0x6547
mov dword [ebp - 0xc], 0x6e6f4364
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x61
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a2f1
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov word [ebp - 7], 0x7268
push eax
mov word [ebp - 4], 0x6461
mov dword [ebp - 0xc], 0x6e65704f
mov byte [ebp - 2], 0
mov byte [ebp - 8], 0x54
mov byte [ebp - 5], 0x65
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a349
push dword [ebp + 8]
push 0
push 0x1fffff
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xb], 0x6d657473
push eax
mov esi, ecx
mov word [ebp - 0xd], 0x7953
mov word [ebp - 0x10], 0x6547
mov word [ebp - 4], 0x6f
mov word [ebp - 7], 0x6e49
mov byte [ebp - 5], 0x66
mov byte [ebp - 0xe], 0x74
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a397
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0xf], 0x64616572
push eax
mov esi, edx
mov word [ebp - 7], 0x6972
mov edi, ecx
mov word [ebp - 4], 0x79
mov word [ebp - 0xa], 0x6972
mov byte [ebp - 5], 0x74
mov byte [ebp - 0xb], 0x50
mov dword [ebp - 0x14], 0x54746553
mov byte [ebp - 8], 0x6f
mov byte [ebp - 0x10], 0x68
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a3fa
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov word [ebp - 5], 0x64
push eax
mov dword [ebp - 0xe], 0x746e6572
mov word [ebp - 0x14], 0x6547
mov word [ebp - 0x11], 0x7543
mov dword [ebp - 0xa], 0x65726854
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 6], 0x61
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a4bc
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a4d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0x10]
mov word [ebp - 5], 0x79
push eax
mov esi, edx
mov word [ebp - 8], 0x6575
mov edi, ecx
mov word [ebp - 0xb], 0x6c61
mov dword [ebp - 0x10], 0x74726956
mov byte [ebp - 6], 0x72
mov byte [ebp - 9], 0x51
mov byte [ebp - 0xc], 0x75
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a521
push 0x1c
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov word [ebp - 0x10], 0x6956
push eax
mov esi, ecx
mov dword [ebp - 7], 0x636f6c
mov dword [ebp - 0xd], 0x6c617574
mov word [ebp - 9], 0x6c41
mov byte [ebp - 0xe], 0x72
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a5dc
push 0x20
push 0x3000
push 0x6c
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a5f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xb], 0x6854646e
push eax
mov esi, ecx
mov dword [ebp - 6], 0x646165
mov dword [ebp - 0x10], 0x70737553
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x72
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a632
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x14]
mov word [ebp - 0xb], 0x7250
push eax
mov esi, ecx
mov dword [ebp - 0x12], 0x72685474
mov dword [ebp - 7], 0x79746972
mov word [ebp - 0xe], 0x6165
mov word [ebp - 9], 0x6f69
mov byte [ebp - 3], 0
mov word [ebp - 0x14], 0x6547
mov byte [ebp - 0xc], 0x64
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a693
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x7fffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0x10]
mov word [ebp - 4], 0x79
push eax
mov esi, edx
mov word [ebp - 0xf], 0x6c74
mov edi, ecx
mov word [ebp - 0xa], 0x4d6f
mov word [ebp - 7], 0x6f6d
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 5], 0x72
mov word [ebp - 0xc], 0x7265
mov byte [ebp - 0xd], 0x5a
mov byte [ebp - 8], 0x65
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a782
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1000a87f
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x11], 0x65726f46
push ecx
push eax
mov dword [ebp - 5], 0x776f646e
mov dword [ebp - 0xa], 0x57646e75
mov word [ebp - 0x14], 0x6553
mov word [ebp - 0xd], 0x7267
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xb], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000a8d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1000a911
lea ecx, [ebp - 0x10]
mov dword [ebp - 5], 0x776f646e
push ecx
push eax
mov dword [ebp - 0xb], 0x65766974
mov dword [ebp - 0x10], 0x41746553
mov word [ebp - 7], 0x6957
mov byte [ebp - 1], 0
mov byte [ebp - 0xc], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000aab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x118
cmp eax, 1
jne 0x1000ab64
push ecx
lea edx, [esp + 0x14]
call fcn.10009fc0
add esp, 4
mov dword [esp + 6], 0x75732074
lea eax, [esp]
mov dword [esp + 0xc], 0x74726f
mov dword [esp + 1], 0x6174736e
mov word [esp + 0xa], 0x7070
push eax
lea eax, [esp + 0x14]
mov byte [esp + 4], 0x69
push eax
mov byte [esp + 0xd], 0x6e
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1000ab90
mov edx, sym.drvhlp.dll_elff0k
mov ecx, 0x1006e558
call fcn.1000bd20
test eax, eax
je 0x1000ab90
mov edx, sym.drvhlp.dll_j8hb8h
mov ecx, 0x1006e520
call fcn.1000bd20
test eax, eax
je 0x1000ab90
mov edx, sym.drvhlp.dll_pmhife
mov ecx, 0x1006e540
call fcn.1000bd20
test eax, eax
je 0x1000ab90
mov edx, sym.drvhlp.dll_dwwnoh
mov ecx, 0x1006e53c
call fcn.1000bd20
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1000ab90
mov ecx, 0x1006e558
call fcn.1000ac90
mov ecx, 0x1006e520
call fcn.1000ac90
mov ecx, 0x1006e540
call fcn.1000ac90
mov ecx, 0x1006e53c
call fcn.1000ac90
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000abd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [0x1006e568], 0
jne 0x1000abf7
call fcn.1000a100
mov edx, 0x100
mov ecx, 0x1006e570
call fcn.1000a730
mov dword [0x1006e568], 1
jmp fcn.1000a790

Function at 0x1000b1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
push 0x104
lea eax, [ebp - 0x130]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x10], esi
call fcn.1000eb10
add esp, 0xc
mov dword [ebp - 5], 0x73255c45
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xa], 0x41575446
mov word [ebp - 0xc], 0x4f53
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x52
call fcn.1000c100
cmp dword [eax + 0x14], 0x10
jb 0x1000b211
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x130]
push 0x104
push eax
call fcn.1000c000
mov edx, dword [ebp - 0x14]
add esp, 0x14
cmp edx, 0x10
jb 0x1000b25c
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000b252
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000b271
push edx
push ecx
call fcn.1000c965
add esp, 8
lea eax, [ebp - 0x130]
mov ecx, esi
push eax
call fcn.1000c1a0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1001fc54
int3
Function at 0x1000b7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1000b82e
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xf], 0x69577465
push ecx
push eax
mov dword [ebp - 8], 0x736f5077
mov word [ebp - 0xb], 0x646e
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 4], 0
mov byte [ebp - 9], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000b880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1000b8c3
lea ecx, [ebp - 0x14]
mov word [ebp - 0xf], 0x6957
push ecx
push eax
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 0xd], 0x776f646e
mov dword [ebp - 7], 0x706f54
mov byte [ebp - 0x10], 0x67
mov word [ebp - 9], 0x6f54
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1002b7f3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002b09f

Function at 0x1002b7fe
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002b2da

Function at 0x1003615e
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10035f9c

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2fb913e4
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x62772e77
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219