joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000307e
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x1002620b
call fcn.10025fe0
sub esp, 0x264
push ebx
push esi
push edi
mov esi, ecx
push str.Kernel32.dll
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
push str.QueryFullProcessImageNameW
push ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edi, [esi + 0x40d0]
mov esi, dword [edi]
mov ecx, edi
push dword [esi + 4]
push edi
call fcn.10006bf2
xor edx, edx
mov dword [esi + 4], esi
push 7
mov dword [esi], esi
xor eax, eax
mov dword [esi + 8], esi
pop ecx
mov dword [ebp - 0x2c], edx
mov dword [edi + 4], edx
mov dword [ebp - 0x270], 0x22c
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x44], ax
push edx
push 2
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x10003157
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x270]
push eax
push esi
call edi
cmp eax, 1
jne 0x10003157
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x268]
mov ecx, ebx
call fcn.10002fe8
lea eax, [ebp - 0x270]
push eax
push esi
call edi
cmp eax, 1
je 0x10003138
mov ebx, dword [ebp - 0x14]
mov ecx, esi
call fcn.10008bd8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x100035a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebp
push esi
mov ebp, ecx
call fcn.10008a2c
mov esi, eax
test esi, esi
je 0x100035ff
lea eax, [esp + 0xc]
mov word [esp + 0x16], 0x657a
push eax
push esi
mov dword [esp + 0x14], 0x6e496f43
mov word [esp + 0x1b], 0x6c61
mov byte [esp + 0x1d], 0x69
mov word [esp + 0x18], 0x7469
mov byte [esp + 0x20], 0
mov byte [esp + 0x1a], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100035f8
push 0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 8]
push eax
push ecx
push ecx
call fcn.10008ced
add esp, 0xc
test eax, eax
jne 0x1000361d
mov eax, dword [esp + 8]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call fcn.10008a2c
mov esi, eax
test esi, esi
je 0x1000367e
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x696c6169
push eax
push esi
mov word [esp + 0x18], 0x6e69
mov word [esp + 0x15], 0x556f
mov word [esp + 0x20], 0x657a
mov byte [esp + 0x14], 0x43
mov word [esp + 0x1a], 0x7469
mov byte [esp + 0x22], 0
mov byte [esp + 0x17], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003677
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x100036d4
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x22c], 0x22c
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000381a
push edi
lea eax, [ebp - 0x22c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
xor edi, edi
inc edi
jmp 0x1000380a
lea eax, [ebp - 0x208]
push eax
push str.avgcsrvx.exe
call fcn.10011da9
test eax, eax
movzx ebx, bl
lea eax, [ebp - 0x208]
push eax
push str.avgemcx.exe
cmove ebx, edi
call fcn.10011da9
test eax, eax
movzx ebx, bl
lea eax, [ebp - 0x208]
push eax
push str.avgidsagent.exe
cmove ebx, edi
call fcn.10011da9
test eax, eax
movzx ebx, bl
lea eax, [ebp - 0x208]
push eax
push str.avgnsx.exe
cmove ebx, edi
call fcn.10011da9
test eax, eax
movzx ebx, bl
lea eax, [ebp - 0x208]
push eax
push str.avgrsx.exe
cmove ebx, edi
call fcn.10011da9
test eax, eax
movzx ebx, bl
lea eax, [ebp - 0x208]
push eax
push str.avgsvcx.exe
cmove ebx, edi
call fcn.10011da9
test eax, eax
movzx ebx, bl
lea eax, [ebp - 0x208]
push eax
push str.avgui.exe
cmove ebx, edi
call fcn.10011da9
test eax, eax
movzx ebx, bl
lea eax, [ebp - 0x208]
push eax
push str.avguix.exe
cmove ebx, edi
call fcn.10011da9
add esp, 0x40
movzx ebx, bl
test eax, eax
lea eax, [ebp - 0x208]
cmove ebx, edi
push eax
push str.avgwdsvcx.exe
call fcn.10011da9
pop ecx
test eax, eax
movzx ebx, bl
pop ecx
lea eax, [ebp - 0x22c]
cmove ebx, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, edi
je 0x10003716
mov ecx, esi
call fcn.10008bd8
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x10003d59
Capabilities:
Create directory

Disassembly:
sub esp, 0x38
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10003e6d
push ecx
push 0x2000000
push 3
pop edi
push edi
push ecx
push ebx
mov edx, 0x60000
mov ecx, esi
call fcn.10008c8e
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x10003e6d
push ebp
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push ecx
lea eax, [esp + 0x24]
mov ecx, esi
push eax
sub esp, 0xc
call fcn.100090db
add esp, 0x18
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x20]
mov word [esp + 0x24], 0x500
push eax
sub esp, 0x20
call fcn.1000914c
mov eax, dword [esp + 0x38]
add esp, 0x24
mov dword [esp + 0x44], eax
xor ebp, ebp
lea eax, [esp + 0x10]
mov dword [esp + 0x28], 0x10000000
inc ebp
mov dword [esp + 0x30], edi
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x30]
mov dword [esp + 0x34], ebp
push eax
xorps xmm0, xmm0
mov dword [esp + 0x4c], 2
push ebp
movlpd qword [esp + 0x44], xmm0
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x20], ebx
call dword [0x10032994]
cmp dword [esp + 0x10], ebx
je 0x10003e39
push ebx
push dword [esp + 0x14]
push ebx
push ebx
push 4
push ebp
push esi
call dword [0x10032990]
push dword [esp + 0x14]
call dword [0x1003298c]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x18], ebx
je 0x10003e55
push dword [esp + 0x18]
call edi
cmp dword [esp + 0x10], ebx
je 0x10003e61
push dword [esp + 0x10]
call edi
mov ecx, esi
call fcn.10008bd8
mov eax, ebp
pop ebp
jmp 0x10003e6f
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x38
ret

Function at 0x10003e76
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x10026276
call fcn.10025fe0
sub esp, 0x244
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], 7
push esi
xor eax, eax
mov dword [ebp - 0x24], ebx
push edi
mov edi, ecx
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x24], ax
push ebx
push 2
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x10003f23
lea eax, [ebp - 0x250]
mov dword [ebp - 0x250], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x10003ed8
mov ecx, esi
call fcn.10008bd8
jmp 0x10003f23
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x24]
call fcn.100063d0
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x24]
push ecx
cmp eax, dword [edi + 8]
je 0x10003f00
mov ecx, eax
call fcn.100064c4
add dword [edi + 4], 0x18
jmp 0x10003f08
push eax
mov ecx, edi
call fcn.10006d02
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10003ed8
mov ecx, esi
call fcn.10008bd8
mov bl, 1
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x10003f58
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10003f4f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003f69
push edx
push ecx
call fcn.1000a29b
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.1000e0dd
int3
Function at 0x10004ea6
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002647b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [0x10032763], 1
cmp dword [0x10032970], 0
push edi
mov edi, ecx
je 0x10004f06
push 0x1388
push dword [0x10032970]
call ebx
test eax, eax
je 0x10004efc
push 0
push dword [0x10032970]
call esi
mov dword [0x10032970], 0
cmp dword [0x10032974], 0
je 0x10004f34
push 0x898
push dword [0x10032974]
call ebx
test eax, eax
je 0x10004f2a
push 0
push dword [0x10032974]
call esi
mov dword [0x10032974], 0
cmp dword [0x10032978], 0
je 0x10004f62
push 0xc8
push dword [0x10032978]
call ebx
test eax, eax
je 0x10004f58
push 0
push dword [0x10032978]
call esi
mov dword [0x10032978], 0
mov eax, dword [edi + 0x416c]
test eax, eax
je 0x10004f8b
push 0xc8
push eax
call ebx
xor ebx, ebx
test eax, eax
je 0x10004f83
push ebx
push dword [edi + 0x416c]
call esi
mov dword [edi + 0x416c], ebx
jmp 0x10004f8d
xor ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x10032764], ebx
je 0x10004fd2
lea eax, [ebp - 0x10]
push eax
push dword [0x10032764]
call esi
test eax, eax
je 0x10004fb4
cmp dword [ebp - 0x10], 0x103
jne 0x10004fc1
push ebx
push dword [0x10032764]
call dword [0x100329c0]
mov ecx, dword [0x10032764]
call fcn.10008bd8
mov dword [0x10032764], ebx
cmp dword [0x10032968], ebx
je 0x10005011
lea eax, [ebp - 0x14]
push eax
push dword [0x10032968]
call esi
test eax, eax
je 0x10004ff3
cmp dword [ebp - 0x14], 0x103
jne 0x10005000
push ebx
push dword [0x10032968]
call dword [0x100329c0]
mov ecx, dword [0x10032968]
call fcn.10008bd8
mov dword [0x10032968], ebx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x10005020
call fcn.10008bd8
mov dword [edi + 8], ebx
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x1000502f
call fcn.10008bd8
mov dword [edi + 0xc], ebx
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x1000503e
call fcn.10008bd8
mov dword [edi + 0x10], ebx
cmp dword [0x1003296c], ebx
je 0x10005057
mov ecx, dword [0x1003296c]
call fcn.10008bd8
mov dword [0x1003296c], ebx
lea ecx, [edi + 0x419c]
call fcn.10006877
lea ecx, [edi + 0x4198]
call fcn.10008928
lea ecx, [edi + 0x4180]
call fcn.10006877
lea ecx, [edi + 0x413c]
call fcn.10006238
lea ecx, [edi + 0x4130]
call fcn.10006238
lea ecx, [edi + 0x4124]
call fcn.10006238
lea esi, [edi + 0x40e0]
lea ecx, [esi + 0x2c]
call fcn.10006877
mov ecx, esi
call fcn.10006877
lea ecx, [edi + 0x40d0]
call fcn.100060b1
lea ecx, [edi + 0x40a8]
call fcn.10006877
lea ecx, [edi + 0x4090]
call fcn.1000614f
lea ecx, [edi + 0x407c]
call fcn.1000614f
lea ecx, [edi + 0x60]
call fcn.10006238
lea ecx, [edi + 0x54]
call fcn.10006238
lea ecx, [edi + 0x48]
call fcn.10006238
lea ecx, [edi + 0x30]
call fcn.10006877
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10005ef7
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [0x10032762], 0
push esi
mov esi, ecx
je 0x10005fad
push 0x6d
pop eax
push 0x54
mov word [esp + 0x10], ax
pop eax
push 0x55
mov word [esp + 0xe], ax
pop eax
push 0x70
mov word [esp + 8], ax
pop eax
push 0x64
mov word [esp + 0xa], ax
pop eax
mov word [esp + 8], ax
xor eax, eax
mov word [esp + 0xe], ax
lea eax, [esp + 4]
push eax
push ecx
call fcn.100059d3
test eax, eax
je 0x10005fad
push ecx
mov ecx, esi
call fcn.10005fb2
test eax, eax
je 0x10005fad
push str.GlobalAweAPCPDBUpdMutex
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x10005f79
mov ecx, eax
call fcn.10008bd8
jmp 0x10005fad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10005fad
cmp dword [0x10032970], 0
je 0x10005f98
mov ecx, dword [0x10032970]
call fcn.10008bd8
push ecx
push ecx
push esi
push 0x10003220
call fcn.10009279
add esp, 0x10
mov dword [0x10032970], eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10005fb2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x4178]
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x1000600e
lea ecx, [ebx + 0x419c]
cmp dword [ecx + 0x14], 8
jb 0x10005fd8
mov ecx, dword [ecx]
push ecx
push 0x80
push 3
push ecx
push 1
mov edx, 0x80000000
call fcn.10008c8e
mov edi, eax
add esp, 0x14
cmp edi, 0xffffffff
je 0x1000600e
push 0
lea eax, [ebp - 8]
push eax
push 8
push esi
push edi
call dword [0x10032998]
mov ecx, edi
call fcn.10008bd8
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x20]
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10008e50
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x20]
call fcn.10008d62
mov ecx, dword [ebp - 0xc]
xor edi, edi
or edi, dword [ebp - 0x10]
and ecx, 0x7fffffff
mov edx, edi
mov eax, ecx
sub edx, dword [esi]
sbb eax, dword [esi + 4]
cmp eax, 0xc9
jl 0x100060a8
jg 0x1000605a
cmp edx, 0x2b025680
jb 0x100060a8
mov dword [esi + 4], ecx
lea ecx, [ebx + 0x419c]
mov dword [esi], edi
cmp dword [ecx + 0x14], 8
jb 0x1000606d
mov ecx, dword [ecx]
push ecx
push 0x80
push 2
push ecx
push 1
mov edx, 0x40000000
call fcn.10008c8e
mov edi, eax
add esp, 0x14
cmp edi, 0xffffffff
je 0x100060a3
push 0
lea ecx, [ebp - 8]
push ecx
push 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, edi
call fcn.10008bd8
xor eax, eax
inc eax
jmp 0x100060aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10007bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 0x2e
pop eax
push 0x65
pop edi
push 0x6c
mov esi, edx
mov word [ebp - 0x20], ax
pop edx
push 0x64
pop ecx
push 0x4b
pop eax
push 0x32
mov word [ebp - 0x30], ax
xor ebx, ebx
pop eax
push 0x72
mov word [ebp - 0x22], ax
pop eax
push 0x6e
mov word [ebp - 0x2c], ax
pop eax
push 0x33
mov word [ebp - 0x2a], ax
pop eax
mov word [ebp - 0x24], ax
xor eax, eax
push edi
mov word [ebp - 0x18], ax
pop eax
mov byte [ebp - 0xc], al
mov byte [ebp - 8], al
mov byte [ebp - 0x13], al
mov byte [ebp - 4], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
mov word [ebp - 0x2e], di
push eax
mov word [ebp - 0x26], dx
mov word [ebp - 0x1e], cx
mov word [ebp - 0x1c], dx
mov word [ebp - 0x28], di
mov word [ebp - 0x1a], dx
mov word [ebp - 6], 0x6d61
mov byte [ebp - 0xe], 0x75
mov word [ebp - 0x11], 0x6f4d
mov word [ebp - 0xb], 0x6946
mov byte [ebp - 0x12], 0x74
mov word [ebp - 3], 0x57
mov byte [ebp - 9], dl
mov byte [ebp - 7], 0x4e
mov byte [ebp - 0xf], cl
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xd], dl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10007c71
push 0x104
push esi
push ebx
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x10007e6b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x10026663
call fcn.10025fe0
sub esp, 0x248
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 4], ebx
push 0x1002eb10
mov dword [ebp - 0x48], ebx
call fcn.100088bf
push 0x208
lea eax, [ebp - 0x254]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x48], 1
call fcn.1000bff0
pop ecx
pop ecx
lea edx, [ebp - 0x254]
call fcn.10007bb0
pop ecx
push 0x70
pop eax
push 0x6c
pop ecx
push 0x69
mov word [ebp - 0x3a], ax
pop eax
push 0x2e
mov word [ebp - 0x38], ax
pop eax
push 0x53
mov word [ebp - 0x36], ax
pop eax
mov word [ebp - 0x44], ax
xor eax, eax
push 0x64
mov word [ebp - 0x2e], ax
pop eax
push 0x77
mov word [ebp - 0x34], ax
pop eax
push 0x68
mov word [ebp - 0x3e], ax
pop eax
push 0x61
mov word [ebp - 0x42], ax
pop eax
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x44]
push eax
mov word [ebp - 0x30], cx
mov word [ebp - 0x40], cx
mov word [ebp - 0x32], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10007fa0
push 0x65
pop ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x68746150
push eax
push edi
mov byte [ebp - 0x11], bl
mov word [ebp - 0x10], 0x57
mov dword [ebp - 0x1c], 0x646e6946
mov word [ebp - 0x14], 0x614e
mov byte [ebp - 0x12], 0x6d
mov word [ebp - 0x17], 0x6c69
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x18], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10007f99
lea ecx, [ebp - 0x254]
push ecx
call eax
push eax
mov ecx, esi
call fcn.10008885
push 0x2e
pop eax
mov word [ebp - 0x2c], ax
xor eax, eax
push 0x78
mov word [ebp - 0x24], ax
pop eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x2c]
push ecx
push eax
mov ecx, esi
mov word [ebp - 0x26], bx
mov word [ebp - 0x2a], bx
call fcn.10007cc9
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10007fb2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
mov dword [ebp - 8], 0x6e6f6974
push eax
mov word [ebp - 0xe], 0x6163
mov dword [ebp - 0x13], 0x74697243
mov dword [ebp - 0xc], 0x6365536c
mov word [ebp - 0x15], 0x6576
mov byte [ebp - 4], 0
mov word [ebp - 0x18], 0x654c
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0x16], 0x61
call fcn.100080ce
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10008006
push 0x100329dc
call eax
leave
ret

Function at 0x10008008
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
mov word [ebp - 0xe], 0x6163
push eax
mov dword [ebp - 0xb], 0x74636553
mov dword [ebp - 0x12], 0x69746972
mov dword [ebp - 0x18], 0x65746e45
mov dword [ebp - 7], 0x6e6f69
mov byte [ebp - 0xc], 0x6c
mov word [ebp - 0x14], 0x4372
call fcn.100080ce
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10008055
push 0x100329dc
call eax
leave
ret
Function at 0x1000841e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10008472
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10008472
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x10008464
cmp esi, ecx
jae 0x10008472
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x10008452
cmp esi, ecx
jae 0x10008472
cmp word [esi], 0
je 0x10008472
mov eax, esi
jmp 0x10008474
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x10008b3b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov word [ebp - 0xb], 0x7261
push eax
mov esi, ecx
mov dword [ebp - 0x10], 0x53746547
mov dword [ebp - 6], 0x6f666e49
mov byte [ebp - 0xc], 0x74
mov word [ebp - 2], 0x57
mov word [ebp - 8], 0x7075
mov byte [ebp - 9], 0x74
call fcn.100089c9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10008b83
push esi
call eax
pop esi
leave
ret

Function at 0x10008b86
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov word [ebp - 4], 0x6570
xor ebx, ebx
mov dword [ebp - 0xc], 0x61657243
push eax
mov esi, edx
mov byte [ebp - 2], bl
mov edi, ecx
mov word [ebp - 7], 0x5065
mov byte [ebp - 8], 0x74
mov byte [ebp - 5], 0x69
call fcn.100089c9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10008bd1
push ebx
push dword [ebp + 8]
push esi
push edi
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10008bd8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 5], 0x656c646e
xor ebx, ebx
mov dword [ebp - 9], 0x61486573
push eax
mov esi, ecx
mov word [ebp - 0xc], 0x6c43
mov byte [ebp - 1], bl
mov byte [ebp - 0xa], 0x6f
call fcn.100089c9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10008c18
push esi
call eax
mov ebx, eax
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10008c1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x6974616d
push eax
mov esi, edx
mov dword [ebp - 0x1a], 0x6c694674
mov edi, ecx
mov dword [ebp - 5], 0x656c64
xor ebx, ebx
mov dword [ebp - 0xc], 0x79426e6f
mov word [ebp - 0x1c], 0x6547
mov word [ebp - 0x15], 0x6e49
mov word [ebp - 7], 0x6e61
mov byte [ebp - 8], 0x48
mov word [ebp - 0x12], 0x726f
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x13], 0x66
call fcn.100089c9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10008c87
push esi
push edi
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x10008c8e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov word [ebp - 0xa], 0x6165
push eax
mov edi, edx
mov dword [ebp - 5], 0x57656c69
mov ebx, ecx
mov word [ebp - 7], 0x4665
or esi, 0xffffffff
mov word [ebp - 0xc], 0x7243
mov byte [ebp - 1], 0
mov byte [ebp - 8], 0x74
call fcn.100089c9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10008ce6
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push edi
push ebx
call eax
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x10008ced
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, 0x80004005
call fcn.10008a2c
mov esi, eax
test esi, esi
je 0x10008d5c
lea eax, [ebp - 0x14]
mov dword [ebp - 0xf], 0x49657461
push eax
push esi
mov dword [ebp - 8], 0x65636e61
mov word [ebp - 0x14], 0x6f43
mov word [ebp - 0xa], 0x7473
mov byte [ebp - 0xb], 0x6e
mov word [ebp - 0x11], 0x6572
mov byte [ebp - 0x12], 0x43
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10008d55
push dword [ebp + 0x10]
push 0x10027220
push 0x15
push 0
push 0x10027230
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10008d62
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x17], 0x65747379
push eax
mov esi, edx
mov word [ebp - 8], 0x6954
mov edi, ecx
mov word [ebp - 0x12], 0x6954
xor ebx, ebx
mov byte [ebp - 0x13], 0x6d
mov dword [ebp - 0xf], 0x466f5465
mov word [ebp - 0xb], 0x6c69
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x18], 0x53
mov word [ebp - 5], 0x65
mov byte [ebp - 9], 0x65
mov byte [ebp - 6], 0x6d
call fcn.100089c9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10008dc5
push esi
push edi
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10008dcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.10008a7d
mov esi, eax
test esi, esi
je 0x10008e49
lea eax, [ebp - 0x20]
mov dword [ebp - 0x12], 0x79746972
push eax
push esi
mov word [ebp - 0x1f], 0x696e
mov word [ebp - 0x1c], 0x6169
mov dword [ebp - 0xa], 0x74706972
mov dword [ebp - 0xe], 0x63736544
mov dword [ebp - 0x17], 0x63655365
mov word [ebp - 5], 0x72
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 6], 0x6f
mov byte [ebp - 0x1d], 0x74
mov word [ebp - 0x19], 0x7a69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x20], 0x49
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10008e42
push 1
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret