joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492ab4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x492bd4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x492b73
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x103]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
mov byte [ebp - 0x104], al
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x104]
call fcn.00404a5c
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
mov edx, 1
call fcn.0043018c
mov eax, dword [ebp - 0x108]
mov edx, 0x492bec
call fcn.00404c04
jne 0x492b5b
xor edx, edx
mov dl, byte [ebp - 0x104]
lea eax, [ebp - 0x104]
mov ecx, 1
call fcn.00402914
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x104]
call fcn.00404a5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492ba9
mov edx, dword [ebp - 4]
mov eax, 0x1a
call fcn.0049299c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492bdb
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.0040481c
ret

Function at 0x492e70
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x78], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x492fbe
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x492f65
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.004031c4
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x41
mov word [ebp - 0x34], si
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x492f53
push 0x64
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov ebx, eax
cmp ebx, 0x102
jne 0x492f46
push 0
push 0x12
push 0x12
push 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x492f1e
push 0
push 0x12
push 0x12
push 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x492f3a
push 0
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 4], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492fa8
mov eax, dword [0x49f380]
mov eax, dword [eax]
call fcn.004658b0
cmp ebx, 0x102
je 0x492edf
mov dword [ebp - 4], ebx
jmp 0x492f5b
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492fa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492fc5
lea eax, [ebp - 0x78]
call fcn.004047f8
ret
Function at 0x493078
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff690
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x970], edx
mov dword [ebp - 0x96c], edx
mov dword [ebp - 0x968], edx
mov dword [ebp - 0x960], edx
mov dword [ebp - 0x964], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49339d
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x493329
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30c]
mov dl, 1
mov eax, dword [0x47d194]
call fcn.0047f274
call fcn.0047ee6c
call fcn.0047d20c
mov byte [ebp - 5], al
call fcn.00402abc
mov esi, eax
test esi, esi
jle 0x493166
mov ebx, 1
lea edx, [ebp - 0x964]
mov eax, ebx
call fcn.00402b1c
mov eax, dword [ebp - 0x964]
lea edx, [ebp - 0x960]
call fcn.00408920
mov eax, dword [ebp - 0x960]
mov edx, 0x4933b4
call fcn.00404c04
je 0x493162
push dword [ebp - 0x10]
push 0x4933c4
lea edx, [ebp - 0x968]
mov eax, ebx
call fcn.00402b1c
push dword [ebp - 0x968]
push 0x4933d0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404b78
inc ebx
dec esi
jne 0x493105
mov edx, dword [0x49efe8]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
mov ecx, 0x4933dc
call fcn.00404b04
push dword [ebp - 0xc]
push 0x4933f0
push dword [ebp - 0x10]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404b78
call fcn.00402944
test eax, eax
mov eax, dword [ebp - 0xc]
call fcn.00409310
test al, al
je 0x4931ae
mov eax, dword [ebp - 0xc]
call fcn.00409380
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x15c]
call fcn.00402ee0
mov edx, 1
lea eax, [ebp - 0x15c]
call fcn.00403308
mov ebx, 0x3e8
push 0
mov eax, 0x418
call fcn.004031e4
mov ecx, eax
add ecx, 0x3e8
lea edx, [ebp - 0x95c]
lea eax, [ebp - 0x15c]
call fcn.0040303c
dec ebx
jne 0x4931d1
lea eax, [ebp - 0x15c]
call fcn.0040305c
mov eax, dword [ebp - 0xc]
call fcn.00409380
call fcn.00402944
test eax, eax
cmp byte [ebp - 5], 0
jne 0x49331f
xor eax, eax
push ebp
push 0x493242
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, 0x4933fc
call fcn.00467570
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4932a0
mov eax, dword [0x49f594]
cmp dword [eax], 2
jne 0x4932bc
push 4
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404cb8
push eax
call sub.kernel32.dll_MoveFileExA
mov eax, dword [ebp - 4]
call fcn.004624bc
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004450c8
mov eax, dword [ebp - 0xc]
call fcn.00409310
test al, al
je 0x4932ff
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.00409358
call fcn.00402944
test eax, eax
lea eax, [ebp - 0x10]
call fcn.00404d10
mov dx, 5
call fcn.00492e70
mov eax, dword [ebp - 0xc]
call fcn.00409310
test al, al
je 0x493313
mov eax, dword [ebp - 0xc]
call fcn.00409380
mov eax, dword [0x49f2dc]
mov eax, dword [eax]
call fcn.00402b7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493372
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4933a4
lea eax, [ebp - 0x970]
mov edx, 5
call fcn.0040481c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040481c
ret
Function at 0x49516c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x495324
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x30]
mov ecx, dword [edx + 4]
add ecx, eax
mov esi, ecx
mov edx, esi
movzx ebx, word [edx + 0xc]
movzx edx, word [edx + 0xe]
add ebx, edx
mov edx, ebx
mov ebx, dword [ebp + 8]
mov ebx, ecx
add ebx, 0x10
dec edx
test edx, edx
jl 0x495309
inc edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], 0
movzx eax, word [esi + 0xc]
cmp eax, dword [ebp - 8]
setle byte [ebp - 9]
mov eax, dword [ebp - 4]
sub eax, 1
jb 0x4951e4
je 0x495208
dec eax
je 0x49522c
jmp 0x49525b
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov ecx, dword [ebx]
mov al, byte [ebp - 9]
call fcn.0049512c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
call fcn.00404890
jmp 0x49525b
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov ecx, dword [ebx]
mov al, byte [ebp - 9]
call fcn.0049512c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
call fcn.00404890
jmp 0x49525b
cmp byte [ebp - 9], 0
jne 0x495253
lea edx, [ebp - 0x20]
mov eax, 0x494058
call fcn.00406738
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x493fdc]
call fcn.0040c64c
call fcn.00404234
mov eax, dword [ebp + 8]
mov edx, dword [ebx]
mov dword [eax - 0x10], edx
mov edx, dword [ebx + 4]
test edx, 0x80000000
jbe 0x49527d
mov eax, dword [ebp + 8]
push eax
mov eax, edx
and eax, 0x7fffffff
mov edx, dword [ebp - 4]
inc edx
call fcn.0049516c
pop ecx
jmp 0x4952fa
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 4]
mov ecx, eax
add ecx, edx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xc]
push edx
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
push edx
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 4]
push edx
mov edx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
add eax, dword [edx]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x14]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x14]
mov eax, dword [0x493588]
call fcn.00493978
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 8]
mov dword [eax + 0xc], edx
mov edx, dword [esi]
mov dword [eax + 0x28], edx
movzx edx, word [esi + 8]
shl edx, 0x10
movzx ecx, word [esi + 0xa]
add edx, ecx
mov dword [eax + 0x20], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x14]
mov edx, dword [edx + 0x78]
xchg edx, eax
call fcn.00428718
add ebx, 8
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0x4951ca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49532b
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040481c
ret
Function at 0x487e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 0x140]
test eax, eax
jl 0x487f00
mov edx, dword [esi + 0x13c]
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, edx
jne 0x487f13
cmp eax, 0xa
jne 0x487e39
cmp dword [esi + 0x12c], 0
jne 0x487f13
cmp eax, 0xb
je 0x487f13
mov eax, dword [esi + 0x130]
cmp dword [esi + 0x134], eax
je 0x487e5b
test eax, eax
jbe 0x487e5b
pop ebx
or eax, 0xffffffff
pop esi
pop ebp
ret
mov ecx, dword [esi + 0x128]
cmp eax, ecx
push edi
jb 0x487f03
add edx, ecx
lea edi, [eax + ebx]
cmp edi, edx
ja 0x487f03
test ebx, ebx
jbe 0x487ebf
cmp eax, ecx
jne 0x487ebf
test al, 0xf
je 0x487e94
lea ecx, [esi + 0x30]
lea eax, [esi + 0x20]
push ecx
push eax
push eax
call fcn.00488e5d
add esp, 0xc
movzx edx, byte [esi]
lea edi, [esi + 0x10]
and edx, 7
xor ecx, ecx
mov eax, edi
add edx, 1
sub eax, 1
mov byte [eax], cl
shr ecx, 8
sub edx, 1
jne 0x487ea4
lea edx, [esi + 0x30]
push edx
push edi
push esi
call fcn.00488e5d
add esp, 0xc
mov ecx, dword [esi + 0x130]
sub ecx, dword [esi + 0x128]
xor eax, eax
test ebx, ebx
jbe 0x487eeb
mov edi, dword [ebp + 8]
lea ecx, [ecx + esi + 0x10]
mov dl, byte [ecx + 0x10]
xor dl, byte [ecx]
add eax, 1
mov byte [eax + edi - 1], dl
add ecx, 1
cmp eax, ebx
jb 0x487ed8
mov eax, dword [esi + 0x130]
xor ecx, ecx
cmp eax, dword [esi + 0x134]
pop edi
setne cl
pop ebx
mov eax, ecx
pop esi
pop ebp
ret
pop edi
mov eax, 0xfffffff9
pop ebx
mov dword [esi + 0x140], eax
pop esi
pop ebp
ret
mov eax, 0xfffffffa
pop ebx
mov dword [esi + 0x140], eax
pop esi
pop ebp
ret
Function at 0x1002621
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1004004]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push 0x10011a8
mov dword [ebp - 4], eax
mov dword [0x10044a4], edi
call fcn.01002f2e
push edi
call sub.KERNEL32.dll_SetThreadUILanguage
push esi
push dword [ebp + 8]
call fcn.01001b46
sub eax, edi
mov ebx, 0x10043a0
je 0x1002722
dec eax
je 0x1002689
dec eax
je 0x100267f
dec eax
jne 0x100272e
call fcn.01001b23
jmp 0x100272e
call fcn.01001a26
jmp 0x1002727
push 2
mov edi, 0x10011a4
mov esi, 0x1004980
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x10026c1
push eax
push 7
call fcn.01001601
lea eax, [ebp - 0x415]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x101
push 0x1004980
call fcn.01001932
push 0x101
call fcn.01002db7
push eax
push ebx
call fcn.01002d57
push 2
mov edi, 0x10011a4
mov esi, ebx
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002708
push eax
push 8
call fcn.01001601
mov edx, 0x101
mov eax, ebx
mov ecx, edx
mov byte [eax], 0
inc eax
dec ecx
jne 0x10026f3
lea eax, [ebp - 0x414]
push eax
push edx
push ebx
call fcn.01001584
push 0x101
call fcn.01002db7
push eax
push ebx
call fcn.01002cf7
call fcn.01002285
xor edi, edi
jmp 0x1002727
call fcn.0100199b
mov byte [0x1004041], 1
mov eax, dword [0x10044a4]
cmp eax, edi
je 0x1002821
mov esi, 0x258
cmp eax, esi
jb 0x100274b
cmp eax, 0x325
jbe 0x100275d
cmp eax, 0x384
jb 0x10027d7
cmp eax, 0x3bc
ja 0x10027d7
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.msvcrt.dll__itoa]
add esp, 0xc
mov dword [0x10044c4], edi
mov edi, 0x10044c0
push edi
push 0x1a
mov dword [0x10044c0], eax
call fcn.01001601
push 0x400
lea eax, [ebp - 0x410]
push eax
push dword [0x10044a4]
call sub.RASAPI32.dll_RasGetErrorStringA
lea eax, [ebp - 0x410]
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.msvcrt.dll_fputs]
mov eax, dword [0x10044a4]
cmp eax, esi
pop ecx
pop ecx
jb 0x1002829
cmp eax, 0x325
ja 0x1002829
push edi
push 0x19
jmp 0x1002824
push edi
push 0x400
lea ecx, [ebp - 0x410]
push ecx
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x410]
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.msvcrt.dll_fputs]
pop ecx
pop ecx
jmp 0x1002829
push edi
push 0x14
call fcn.01001601
cmp byte [0x1004041], 0
je 0x1002837
call sub.RASAPI32.dll_DwRasUninitialize
push 0x101
push ebx
call fcn.01002ccd
call fcn.01002f49
push dword [0x10044a4]
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x10028cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004004]
jne 0x10028dd
test ecx, 0xffff0000
jne 0x10028dd
ret
jmp fcn.010028e7
Function at 0x1002cf7
Capabilities:
Encrypt data using dpapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x1002d4a
cmp dword [ebp + 0xc], esi
je 0x1002d4a
test dword [ebp + 0xc], 0xf
jne 0x1002d4a
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptProtectMemory]
test eax, eax
jne 0x1002d46
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1004014]
cmp eax, 0xffffffff
je 0x1002d46
push esi
push esi
push 0x10011c4
push eax
call dword [0x100438c]
add esp, 0x10
mov eax, esi
jmp 0x1002d4d
push 0x57
pop eax
pop esi
pop ebp
ret 8

Function at 0x1002d57
Capabilities:
Encrypt data using dpapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x1002daa
cmp dword [ebp + 0xc], esi
je 0x1002daa
test dword [ebp + 0xc], 0xf
jne 0x1002daa
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptUnprotectMemory]
test eax, eax
jne 0x1002da6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1004014]
cmp eax, 0xffffffff
je 0x1002da6
push esi
push esi
push 0x1001208
push eax
call dword [0x100438c]
add esp, 0x10
mov eax, esi
jmp 0x1002dad
push 0x57
pop eax
pop esi
pop ebp
ret 8
Function at 0x10007e88
Capabilities:
Enumerate pe sections

Disassembly:
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10007ebb
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10007ea2
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10007eb3
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10007ebd
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10007e98
xor eax, eax
pop edi
pop esi
ret

Function at 0x1000811f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1000812e
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
in al, dx

Function at 0x10008141
Capabilities:
Contain obfuscated stackstrings

Disassembly:
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
invalid
inc ebp

Function at 0x100081a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10007e50
push eax
push esi
push dword [ebp + 8]
call fcn.10007e05
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
invalid

Function at 0x10008256
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10007e50
push eax
push esi
push dword [ebp + 8]
Function at 0x10009666
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x710], 0xc8
mov byte [ebp - 0x70f], 0xe2
mov byte [ebp - 0x70e], 0xe1
mov byte [ebp - 0x70d], 0xe1
mov byte [ebp - 0x70c], 0xea
mov byte [ebp - 0x70b], 0xc8
mov byte [ebp - 0x70a], 0xe7
mov byte [ebp - 0x709], 0xf6
mov byte [ebp - 0x708], 0xbc
mov byte [ebp - 0x707], 0x8e
call fcn.10007e40
test eax, 0x80940147
movsd dword es:[edi], dword [esi]
mov esp, 0xfffff8
and byte [ebp - 0x743], 0
mov byte [ebp - 0x742], 2
and byte [ebp - 0x741], 0
mov byte [ebp - 0x740], 0xb1
mov byte [ebp - 0x73f], 0x92
mov byte [ebp - 0x73e], 0x9c
mov byte [ebp - 0x73d], 0x99
mov byte [ebp - 0x73c], 0xb1
mov byte [ebp - 0x73b], 0x94
mov byte [ebp - 0x73a], 0x9f
mov byte [ebp - 0x739], 0x8f
mov byte [ebp - 0x738], 0x9c
mov byte [ebp - 0x737], 0x8f
mov byte [ebp - 0x736], 0x84
invalid
test ebx, ecx
Function at 0x10001b00
Capabilities:
Check mutex on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1004c8b8], 0
jne 0x10001b20
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x1004c8b8], eax
push 0xffffffffffffffff
mov eax, dword [0x1004c8b8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0xc], 0x40000
jle 0x10001b4f
mov ecx, dword [ebp + 0xc]
push ecx
push str.Max_amount_of_data_to_send_to_hand2note_is_256kb_but_was__d_bytes
push 4
call fcn.10001cc0
add esp, 0xc
jmp 0x10001cb6
push 0xffffffffffffffff
mov edx, dword [0x1004c8e4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x10001c0d
push 0
push 0
push 3
push 0
push 1
push 0x40000000
mov ecx, dword [0x1004c8e4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10001b99
jmp 0x10001c0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
je 0x10001bd1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_pipe_file_n._error_d__dataLength_d
push 4
call fcn.10001cc0
add esp, 0x10
mov eax, dword [0x1004c8b8]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x10001cb6
push 0x1388
mov ecx, dword [0x1004c8e4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
jne 0x10001c08
push str.Could_not_open_pipe:_5_second_wait_timed_out.
push 4
call fcn.10001cc0
add esp, 8
mov edx, dword [0x1004c8b8]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x10001cb6
jmp 0x10001b65
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
call fcn.1000c551
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10001e60
add esp, 8
push 4
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10007d00
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
add eax, 4
push eax
call fcn.10007d00
add esp, 0xc
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10001c89
push str.Failed_to_write_into_pipe_n
push 4
call fcn.10001cc0
add esp, 8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call fcn.1000a846
add esp, 4
mov edx, dword [0x1004c8b8]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esp, ebp
pop ebp
ret
Function at 0x10001cc0
Capabilities:
Check mutex on windows
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.10006b90
mov eax, dword [0x1002b518]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1000
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.10007ba0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.10001ed0
add esp, 4
push eax
lea edx, [ebp - 0x1004]
push edx
call fcn.1000a6b0
add esp, 8
lea eax, [ebp + 0x10]
mov dword [ebp - 0x100c], eax
mov ecx, dword [ebp - 0x100c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x1004]
push eax
call fcn.1000a7b0
add esp, 4
lea ecx, [ebp + eax - 0x1004]
push ecx
call fcn.10001f90
add esp, 0xc
mov dword [ebp - 0x100c], 0
cmp dword [0x1004c8b4], 0
jne 0x10001d60
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x1004c8b4], eax
push 0xffffffffffffffff
mov edx, dword [0x1004c8b4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0xffffffffffffffff
mov ecx, dword [0x1004c8e0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
push 0
push 3
push 0
push 1
push 0x40000000
mov edx, dword [0x1004c8e0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0xffffffff
jne 0x10001dd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_log_pipe_file._Error___lu__n
call fcn.10001f10
add esp, 8
mov eax, dword [0x1004c8b4]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x10001e44
push 0
lea ecx, [ebp - 0x1010]
push ecx
lea edx, [ebp - 0x1004]
push edx
call fcn.1000a7b0
add esp, 4
push eax
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp - 0x1008]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10001e1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_write_into_log_pipe._Error___lu_n
call fcn.10001f10
add esp, 8
mov edx, dword [ebp - 0x1008]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1004c8b4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006b80
mov esp, ebp
pop ebp
ret

Function at 0x10001f10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.10006b90
mov eax, dword [0x1002b518]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1000
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.10007ba0
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1008], ecx
mov edx, dword [ebp - 0x1008]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1004]
push ecx
call fcn.10001f90
add esp, 0xc
mov dword [ebp - 0x1008], 0
lea edx, [ebp - 0x1004]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006b80
mov esp, ebp
pop ebp
ret