joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e5a00
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
sub esp, 0x244
mov eax, dword [0x101cf40c]
xor eax, esp
mov dword [esp + 0x240], eax
mov cl, 0x73
mov al, 0x65
mov dl, 0x2e
push esi
mov byte [esp + 0x138], cl
mov byte [esp + 0x139], 0x76
mov byte [esp + 0x13a], 0x63
mov byte [esp + 0x13b], 0x68
mov byte [esp + 0x13c], 0x6f
mov byte [esp + 0x13d], cl
mov byte [esp + 0x13e], 0x74
mov byte [esp + 0x13f], dl
mov byte [esp + 0x140], al
mov byte [esp + 0x141], 0x78
mov byte [esp + 0x142], al
mov byte [esp + 0x143], 0
nop
mov byte [esp + 0x12e], al
mov al, 0x6c
mov byte [esp + 0x12c], 0x75
mov byte [esp + 0x12d], cl
mov byte [esp + 0x12f], 0x72
mov byte [esp + 0x130], 0x33
mov byte [esp + 0x131], 0x32
mov byte [esp + 0x132], dl
mov byte [esp + 0x133], 0x64
mov byte [esp + 0x134], al
mov byte [esp + 0x135], al
mov byte [esp + 0x136], 0
push edx
pop edx
mov ecx, ecx
push 0x128
lea eax, [esp + 8]
push 0
push eax
call fcn.101184b0
add esp, 0xc
mov ebx, ebx
mov dword [esp + 4], 0x128
mov esi, esi
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
mov ebx, ebx
cmp esi, 0xffffffff
je 0x100e5bf0
lea ecx, [esp + 4]
push ecx
push esi
call sub.KERNEL32.DLL_Process32First
mov esi, esi
test eax, eax
je 0x100e5be7
jmp 0x100e5b20
mov al, al
xor eax, eax
jmp 0x100e5b30
mov cl, byte [esp + eax + 0x28]
mov byte [esp + eax + 0x144], cl
add eax, 1
test cl, cl
jne 0x100e5b30
push edx
pop edx
lea edx, [esp + 0x144]
push edx
call fcn.10055e30
add esp, 4
mov ebp, ebp
lea ecx, [esp + 0x138]
lea eax, [esp + 0x144]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100e5b84
test dl, dl
je 0x100e5b80
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100e5b84
add eax, 2
add ecx, 2
test dl, dl
jne 0x100e5b64
xor eax, eax
jmp 0x100e5b89
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100e5bd2
push eax
mov eax, dword [esp + 0x10]
push 1
push eax
push 0
push 0x400
call fcn.10066f50
add esp, 0x14
mov eax, eax
test eax, eax
je 0x100e5bd2
push eax
call fcn.100c4d20
add esp, 4
mov cl, cl
mov edx, dword [esp + 0xc]
push 0
push 0
lea ecx, [esp + 0x134]
push ecx
push edx
call fcn.1004c1b0
add esp, 0x10
or eax, edx
jne 0x100e5c08
lea eax, [esp + 4]
push eax
push esi
call sub.KERNEL32.DLL_Process32Next
mov ah, ah
test eax, eax
jne 0x100e5b20
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, ecx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.101179ba
add esp, 0x244
ret
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov bh, bh
mov ecx, dword [esp + 0x244]
mov eax, dword [esp + 0xc]
pop esi
xor ecx, esp
call fcn.101179ba
add esp, 0x244
ret
Function at 0x100e9da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x101cf40c]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x38]
mov cl, 0x6c
mov al, 0x65
mov dl, 0x72
push edi
mov edi, dword [esp + 0x40]
mov byte [esp + 0xc], 0x4b
mov byte [esp + 0xd], al
mov byte [esp + 0xe], dl
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], al
mov byte [esp + 0x11], cl
mov byte [esp + 0x12], 0x33
mov byte [esp + 0x13], 0x32
mov byte [esp + 0x14], 0x2e
mov byte [esp + 0x15], 0x64
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], cl
mov byte [esp + 0x18], 0
mov ebp, ebp
mov byte [esp + 0x1d], al
mov byte [esp + 0x22], al
mov al, 0x66
mov cl, 0x74
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], al
mov al, 0x69
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1e], cl
mov byte [esp + 0x1f], 0x54
mov byte [esp + 0x20], 0x68
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x24], 0x64
mov byte [esp + 0x25], 0x47
mov byte [esp + 0x26], dl
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], 0x75
mov byte [esp + 0x29], 0x70
mov byte [esp + 0x2a], 0x41
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], 0x6e
mov byte [esp + 0x2f], al
mov byte [esp + 0x30], cl
mov byte [esp + 0x31], 0x79
mov byte [esp + 0x32], 0
push edx
pop edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ebx, ebx
test eax, eax
je 0x100e9ea7
push ebp
push edi
push esi
call eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.101179ba
add esp, 0x2c
ret 0xc
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.101179ba
add esp, 0x2c
ret 0xc
Function at 0x100e9ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x101cf40c]
xor eax, esp
mov dword [esp + 0x30], eax
mov cl, 0x6c
mov al, 0x65
mov dl, 0x72
mov byte [esp], 0x4b
mov byte [esp + 1], al
mov byte [esp + 2], dl
mov byte [esp + 3], 0x6e
mov byte [esp + 4], al
mov byte [esp + 5], cl
mov byte [esp + 6], 0x33
mov byte [esp + 7], 0x32
mov byte [esp + 8], 0x2e
mov byte [esp + 9], 0x64
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], cl
mov byte [esp + 0xc], 0
nop
mov byte [esp + 0x11], al
mov byte [esp + 0x18], al
mov byte [esp + 0x1d], al
mov al, 0x73
mov cl, 0x6f
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
mov al, 0x75
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], 0x41
mov byte [esp + 0x14], 0x63
mov byte [esp + 0x15], 0x74
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x17], 0x76
mov byte [esp + 0x19], 0x50
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1c], 0x63
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], 0x47
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], al
mov byte [esp + 0x26], 0x70
mov byte [esp + 0x27], 0x43
mov byte [esp + 0x28], cl
mov byte [esp + 0x29], al
mov byte [esp + 0x2a], 0x6e
mov byte [esp + 0x2b], 0x74
mov byte [esp + 0x2c], 0
mov ecx, ecx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, esi
test eax, eax
je 0x100e9fc8
call eax
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.101179ba
add esp, 0x34
ret
mov ecx, dword [esp + 0x30]
xor ecx, esp
xor ax, ax
call fcn.101179ba
add esp, 0x34
ret
Function at 0x100e9fe0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x38
mov eax, dword [0x101cf40c]
xor eax, esp
mov dword [esp + 0x34], eax
push ecx
pop ecx
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov eax, eax
cmp dword [esp + 0x18], 2
jbe 0x100ea0d2
push esi
push 0
call fcn.10064230
add esp, 4
mov eax, eax
cmp eax, 4
jg 0x100ea054
mov ecx, ecx
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea ecx, [esp + 4]
push ecx
push 0x101bcd3c
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcessAffinityMask]
push ebx
pop ebx
push 1
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_SetProcessAffinityMask]
mov bh, bh
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.101179ba
add esp, 0x38
ret
push ebp
push edi
call fcn.100e9ec0
movzx ebp, ax
mov dh, dh
mov ah, ah
movzx edi, bp
xor esi, esi
test edi, edi
jle 0x100ea0c6
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
mov edx, edx
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
nop
lea eax, [esi + esi*2]
lea eax, [eax*4 + 0x102e59b0]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
push edx
pop edx
mov word [esp + 0x3c], si
mov dh, dh
test esi, esi
jne 0x100ea0ae
mov dword [esp + 0x38], 1
mov edi, edi
push eax
lea edx, [esp + 0x3c]
push edx
call ebx
push eax
call fcn.100e9da0
mov edx, edx
add esi, 1
cmp esi, edi
jl 0x100ea072
pop ebx
mov word [0x102e5b98], bp
mov ah, ah
pop edi
pop ebp
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.101179ba
add esp, 0x38
ret

Function at 0x100ea0f0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
mov ebx, ebx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov edx, edx
cmp dword [esp + 0x14], 2
jbe 0x100ea17b
push 0
call fcn.10064230
add esp, 4
mov dh, dh
cmp eax, 4
jg 0x100ea133
mov ecx, dword [0x101bcd3c]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_SetProcessAffinityMask]
mov dl, dl
add esp, 0x24
ret
push esi
mov dh, dh
xor esi, esi
cmp word [0x102e5b98], si
jbe 0x100ea16f
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push edi
mov edi, 0x102e59b0
mov edi, edi
push 0
push edi
call ebx
push eax
call fcn.100e9da0
nop
movzx edx, word [0x102e5b98]
add esi, 1
add edi, 0xc
cmp esi, edx
jl 0x100ea150
pop edi
pop ebx
mov word [0x102e5b98], 0
mov dl, dl
pop esi
add esp, 0x24
ret
Function at 0x100ea250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1017f231
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x101cf40c]
xor eax, esp
mov dword [esp + 0x2c], eax
push edi
mov eax, dword [0x101cf40c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov dword [esp + 0x40], 0
mov dword [esp + 0xc], 0
mov dword [esi + 0x10], esi
mov dword [esp + 0x10], esi
mov dword [esi + 0x14], esi
mov dword [esp + 0x40], 1
mov eax, dword [esi + 0x10]
mov byte [eax], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0xc], 1
mov bh, bh
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.1011a53f
add esp, 4
mov ebp, ebp
call fcn.1011a54c
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x100ea2db
dec eax
or eax, 0xfffffff8
inc eax
add eax, 8
mov al, al
mov ebx, ebx
mov byte [esp + 0x14], 0x61
mov byte [esp + 0x15], 0x62
mov byte [esp + 0x16], 0x63
mov byte [esp + 0x17], 0x64
mov byte [esp + 0x18], 0x65
mov byte [esp + 0x19], 0x66
mov byte [esp + 0x1a], 0x67
mov byte [esp + 0x1b], 0x68
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], 0x6a
mov byte [esp + 0x1e], 0x6b
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], 0x6d
mov byte [esp + 0x21], 0x6e
mov byte [esp + 0x22], 0x6f
mov byte [esp + 0x23], 0x70
mov byte [esp + 0x24], 0x71
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x26], 0x73
mov byte [esp + 0x27], 0x74
mov byte [esp + 0x28], 0x76
mov byte [esp + 0x29], 0x77
mov byte [esp + 0x2a], 0x78
mov byte [esp + 0x2b], 0x79
mov byte [esp + 0x2c], 0x75
mov byte [esp + 0x2d], 0x41
mov byte [esp + 0x2e], 0x42
mov byte [esp + 0x2f], 0x43
mov byte [esp + 0x30], 0x44
mov byte [esp + 0x31], 0x45
mov byte [esp + 0x32], 0x46
mov byte [esp + 0x33], 0x47
push edx
pop edx
test eax, eax
jle 0x100ea3be
mov edi, eax
lea ebx, [ebx]
call fcn.1011a54c
and eax, 0x8000001f
jns 0x100ea3a1
dec eax
or eax, 0xffffffe0
inc eax
mov ah, ah
mov al, byte [esp + eax + 0x14]
mov byte [esp + 8], al
mov ecx, dword [esp + 8]
push ecx
mov ecx, esi
call fcn.1001ee70
mov bl, bl
sub edi, 1
jne 0x100ea390
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.101179ba
add esp, 0x3c
ret
Function at 0x100ecf30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x884
mov eax, dword [0x101cf40c]
xor eax, esp
mov dword [esp + 0x880], eax
mov eax, dword [esp + 0x890]
push ebx
push esi
push edi
mov dword [esp + 0x28], eax
xor edi, edi
mov ebx, ebx
mov ecx, ecx
mov edx, edx
mov ch, ch
mov eax, 0x5c
mov word [esp + 0x454], ax
mov word [esp + 0x456], ax
mov word [esp + 0x45a], ax
mov eax, 0x69
mov word [esp + 0x458], 0x2e
mov word [esp + 0x45c], 0x50
mov word [esp + 0x45e], 0x68
mov word [esp + 0x460], 0x79
mov word [esp + 0x462], 0x73
mov word [esp + 0x464], ax
mov word [esp + 0x466], 0x63
mov word [esp + 0x468], 0x61
mov word [esp + 0x46a], 0x6c
mov word [esp + 0x46c], 0x44
mov word [esp + 0x46e], 0x72
mov word [esp + 0x470], ax
mov word [esp + 0x472], 0x76
mov word [esp + 0x474], 0x65
mov word [esp + 0x476], 0x25
mov word [esp + 0x478], 0x64
mov word [esp + 0x47a], di
push ecx
pop ecx
mov ebx, dword [esp + 0x894]
push ebx
lea ecx, [esp + 0x458]
push ecx
lea edx, [esp + 0x484]
push edx
call fcn.1002bc60
add esp, 0xc
mov ebx, ebx
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
lea eax, [esp + 0x494]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
push ecx
pop ecx
cmp esi, 0xffffffff
je 0x100ed1a7
mov edx, edx
mov dword [esp + 0xc], edi
mov ebx, ebx
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
push ebx
pop ebx
push edi
lea ecx, [esp + 0x10]
push ecx
push 0x18
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push 0x74080
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x100ed19e
cmp byte [esp + 0x13], 0
jbe 0x100ed19e
mov al, al
mov al, byte [esp + 0x13]
mov cl, bl
shr al, cl
and al, 0x10
neg al
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [esp + 0x2c], al
push ecx
pop ecx
xor eax, eax
mov dword [esp + 0x430], eax
mov dword [esp + 0x434], eax
mov dword [esp + 0x438], eax
mov dword [esp + 0x43c], eax
mov dword [esp + 0x440], eax
mov dword [esp + 0x444], eax
mov dword [esp + 0x448], eax
mov dword [esp + 0x44c], eax
mov byte [esp + 0x450], al
mov esi, esi
push 0x210
lea ecx, [esp + 0x680]
push edi
push ecx
call fcn.101184b0
add esp, 0xc
mov ah, ah
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xc]
push edx
push ebx
push eax
lea ecx, [esp + 0x688]
push ecx
lea edx, [esp + 0x440]
push edx
push esi
call fcn.100ecb70
add esp, 0x18
test eax, eax
je 0x100ed19e
mov eax, eax
mov edx, edx
nop
xor eax, eax
movzx ecx, word [esp + eax*2 + 0x68c]
mov dword [esp + eax*4 + 0x30], ecx
mov ch, ch
add eax, 1
cmp eax, 0x100
jl 0x100ed163
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x898]
push edx
lea eax, [esp + 0x34]
push eax
push ecx
call fcn.100ecc80
add esp, 0xc
push ecx
pop ecx
mov edi, 1
mov dl, dl
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov bl, bl
mov ecx, dword [esp + 0x88c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101179ba
add esp, 0x884
ret
Function at 0x100ed1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x650
mov eax, dword [0x101cf40c]
xor eax, esp
mov dword [esp + 0x64c], eax
mov eax, dword [esp + 0x65c]
push ebp
push edi
mov dword [esp + 0x28], eax
xor ebp, ebp
push ecx
pop ecx
mov ebx, ebx
mov ch, ch
mov eax, 0x5c
mov word [esp + 0x42c], ax
mov word [esp + 0x42e], ax
mov word [esp + 0x432], ax
mov eax, 0x69
mov word [esp + 0x430], 0x2e
mov word [esp + 0x434], 0x50
mov word [esp + 0x436], 0x68
mov word [esp + 0x438], 0x79
mov word [esp + 0x43a], 0x73
mov word [esp + 0x43c], ax
mov word [esp + 0x43e], 0x63
mov word [esp + 0x440], 0x61
mov word [esp + 0x442], 0x6c
mov word [esp + 0x444], 0x44
mov word [esp + 0x446], 0x72
mov word [esp + 0x448], ax
mov word [esp + 0x44a], 0x76
mov word [esp + 0x44c], 0x65
mov word [esp + 0x44e], 0x25
mov word [esp + 0x450], 0x64
mov word [esp + 0x452], bp
mov cl, cl
mov ecx, dword [esp + 0x65c]
push ecx
lea edx, [esp + 0x430]
push edx
lea eax, [esp + 0x45c]
push eax
call fcn.1002bc60
add esp, 0xc
xchg ebx, eax
xchg ebx, eax
push ebp
push ebp
push 3
push ebp
push 7
push 0xc0000000
lea ecx, [esp + 0x46c]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
mov ebp, ebp
cmp edi, 0xffffffff
je 0x100ed421
push ebx
mov ebx, ebx
mov dword [esp + 0xc], ebp
xchg ebx, eax
xchg ebx, eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov edx, edx
mov ebx, dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
push ebp
lea edx, [esp + 0x10]
push edx
push 0x18
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push 0x74080
push edi
call ebx
test eax, eax
je 0x100ed407
push esi
mov ebp, ebp
push 0x221
call fcn.1011741c
add esp, 4
mov esi, eax
push edx
pop edx
cmp esi, ebp
je 0x100ed3e3
mov byte [esi + 0xa], 0xec
mov ah, ah
mov dword [esp + 0x14], ebp
mov esi, esi
push ebp
lea ecx, [esp + 0x18]
push ecx
push 0x221
push esi
push 0x21
push esi
push 0x7c088
push edi
call ebx
test eax, eax
je 0x100ed3d8
mov ebx, ebx
mov ecx, ecx
xor eax, eax
lea esp, [esp]
movzx edx, word [esi + eax*2 + 0x10]
mov dword [esp + eax*4 + 0x34], edx
mov bl, bl
add eax, 1
cmp eax, 0x100
jl 0x100ed3a0
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x668]
push eax
lea ecx, [esp + 0x38]
push ecx
push edx
call fcn.100ecc80
add esp, 0xc
mov bl, bl
mov ebp, 1
push eax
pop eax
push esi
call fcn.101174df
add esp, 4
push edx
pop edx
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
pop ecx
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x64c]
xor ecx, esp
call fcn.101179ba
add esp, 0x650
ret
pop ebx
pop edi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x64c]
xor ecx, esp
call fcn.101179ba
add esp, 0x650
ret
mov ecx, dword [esp + 0x654]
pop edi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.101179ba
add esp, 0x650
ret
Function at 0x100edad0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017f370
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101cf40c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x40
push edi
mov esi, dword [ebp + 8]
push esi
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualProtect]
call ebx
test eax, eax
je 0x100edb3d
push edi
mov ecx, dword [ebp + 0x10]
push ecx
push esi
call fcn.10119900
add esp, 0xc
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x18]
push eax
push edi
push esi
call ebx
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100edf30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
mov edx, dword [esp + 0x28]
push ebp
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, dword [esp + 0x30]
mov ecx, edi
add ecx, dword [esp + 0x38]
mov eax, edx
adc eax, dword [esp + 0x3c]
mov dword [esp + 0x38], ecx
cmp eax, esi
mov dword [esp + 0x3c], eax
jb 0x100edf6e
ja 0x100edf62
cmp ecx, dword [esp + 0x4c]
jbe 0x100edf6e
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], esi
mov ebp, dword [esp + 0x2c]
cmp ebp, edx
jb 0x100ee09f
mov esi, dword [esp + 0x28]
ja 0x100edf88
cmp esi, edi
jb 0x100ee09f
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x38]
cdq
sub ecx, eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
sbb eax, edx
cmp ebp, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
ja 0x100ee09f
jb 0x100edfbb
cmp esi, ecx
jae 0x100ee09f
push ebx
lea esp, [esp]
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x4c]
sub ebx, esi
sbb edi, ebp
cmp edi, eax
mov dword [esp + 0x14], edi
jb 0x100edfea
ja 0x100edfe0
cmp ebx, dword [esp + 0x48]
jbe 0x100edfea
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov edi, eax
mov edx, dword [esp + 0x44]
push ebx
push ebp
push esi
call fcn.100eda50
add esp, 0xc
test eax, eax
je 0x100ee078
mov edi, dword [esp + 0x44]
mov eax, ebx
sub eax, dword [esp + 0x58]
add eax, edi
cmp edi, eax
mov dword [esp + 0x34], eax
jae 0x100ee074
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x60]
push ecx
mov ecx, dword [esp + 0x60]
push edx
push eax
push ecx
push edi
call dword [esp + 0x8c]
add esp, 0x14
cmp eax, 1
jne 0x100ee06a
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
push edx
push eax
push ecx
xor eax, eax
xor ecx, ecx
mov edx, edi
sub edx, dword [esp + 0x50]
sbb eax, ecx
mov ecx, dword [esp + 0x74]
add edx, esi
mov esi, dword [esp + 0x78]
adc eax, ebp
push eax
push edx
call fcn.100eddb0
mov esi, dword [esp + 0x40]
add esp, 0x14
add edi, dword [esp + 0x74]
cmp edi, dword [esp + 0x34]
jb 0x100ee011
mov edi, dword [esp + 0x14]
sub ebx, dword [esp + 0x18]
sbb edi, dword [esp + 0x1c]
add esi, ebx
adc ebp, edi
cmp ebp, dword [esp + 0x24]
mov dword [esp + 0x2c], esi
jb 0x100edfc0
ja 0x100ee09e
cmp esi, dword [esp + 0x20]
jb 0x100edfc0
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x100f1e30
Capabilities:
Read .ini file

Disassembly:
push 0
push 0x102e5bac
call fcn.10055e40
add esp, 8
mov edx, edx
push ecx
pop ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push 0x2ee0
push ecx
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
mov ebp, ebp
push 0x102e5bac
call fcn.10055ed0
add esp, 4
mov edx, edx
mov ebx, ebx
ret 0x10
Function at 0x100f2470
Capabilities:
Read .ini file

Disassembly:
push esi
mov edx, edx
push 0
push 0x102e5bac
call fcn.10055e40
add esp, 8
mov edx, edx
mov edi, edi
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push 0x2ee0
push ecx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionNamesA]
mov esi, eax
mov ch, ch
push 0x102e5bac
call fcn.10055ed0
add esp, 4
mov edx, edx
mov edi, edi
mov bl, bl
lea eax, [esi - 1]
pop esi
ret 8
Function at 0x100f2750
Capabilities:
Read .ini file

Disassembly:
push esi
mov ebx, ebx
push 0
push 0x102e5bac
call fcn.10055e40
add esp, 8
mov edx, edx
mov ah, ah
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push 0xea60
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionA]
mov esi, eax
push eax
pop eax
push 0x102e5bac
call fcn.10055ed0
add esp, 4
mov edx, edx
nop
mov eax, esi
pop esi
ret 0xc