joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x1003d318]
sub esp, 0x24
test eax, eax
je 0x10006e15
mov eax, 1
add esp, 0x24
ret
push esi
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
push 0x14
push 0
push esi
call fcn.10006b20
push 3
push 5
push esi
mov dword [0x1003d318], eax
call fcn.10006bc0
add esp, 0x18
mov dword [0x1003d30c], eax
call fcn.10006f40
test eax, eax
pop esi
jne 0x10006f27
mov eax, dword [sym.imp.USER32.dll_SetCursorPos]
push 3
push 5
push eax
call fcn.10006bc0
mov cl, 0x6c
mov dl, 0x72
mov byte [esp + 0x14], cl
mov byte [esp + 0x15], cl
mov byte [esp + 0x22], cl
mov cl, 0x6f
add esp, 0xc
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1e], cl
mov byte [esp + 3], dl
mov byte [esp + 0x19], dl
mov byte [esp + 0x1c], dl
lea ecx, [esp + 0xc]
mov dword [0x1003d310], eax
lea edx, [esp]
mov al, 0x73
push ecx
push edx
mov byte [esp + 8], 0x75
mov byte [esp + 9], al
mov byte [esp + 0xa], 0x65
mov byte [esp + 0xc], 0x33
mov byte [esp + 0xd], 0x32
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x17], 0x50
mov byte [esp + 0x18], 0x68
mov byte [esp + 0x19], 0x79
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x63
mov byte [esp + 0x1d], 0x61
mov byte [esp + 0x1f], 0x43
mov byte [esp + 0x20], 0x75
mov byte [esp + 0x22], al
mov byte [esp + 0x25], 0x50
mov byte [esp + 0x27], al
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 3
push 5
push eax
call fcn.10006bc0
add esp, 0xc
mov dword [0x1003d314], eax
mov ecx, dword [0x1003d318]
xor eax, eax
test ecx, ecx
setne al
add esp, 0x24
ret
Function at 0x10006f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x1003d2f8]
sub esp, 0x20
test eax, eax
jne 0x10007067
mov eax, dword [0x1003d2fc]
test eax, eax
jne 0x10007067
mov al, 0x6c
mov dl, 0x65
mov byte [esp + 8], al
mov byte [esp + 9], al
mov al, 0x72
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov byte [esp + 0x15], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x14], dl
mov byte [esp + 0x17], dl
lea eax, [esp + 4]
push edi
mov cl, 0x73
mov dl, 0x6f
push eax
mov byte [esp + 0xc], 0x77
mov byte [esp + 0xd], 0x69
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0xf], 0x33
mov byte [esp + 0x10], 0x32
mov byte [esp + 0x11], 0x75
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x16], 0
mov byte [esp + 0x18], 0x4e
mov byte [esp + 0x19], 0x74
mov byte [esp + 0x1a], 0x55
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1e], 0x53
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x21], 0x43
mov byte [esp + 0x22], 0x75
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], dl
mov byte [esp + 0x27], 0x50
mov byte [esp + 0x28], dl
mov byte [esp + 0x29], cl
mov byte [esp + 0x2a], 0
call esi
test eax, eax
je 0x1000704d
lea ecx, [esp + 0x14]
lea edx, [esp + 8]
push ecx
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x1000704d
cmp byte [eax + 0xd], 0xc
jne 0x10007039
lea eax, [esp + 0x14]
lea ecx, [esp + 8]
push eax
push ecx
call esi
push eax
call edi
mov dword [0x1003d2f8], eax
jmp 0x1000704d
lea edx, [esp + 0x14]
lea eax, [esp + 8]
push edx
push eax
call esi
push eax
call edi
mov dword [0x1003d2fc], eax
mov eax, dword [0x1003d2f8]
pop edi
test eax, eax
pop esi
jne 0x10007067
mov eax, dword [0x1003d2fc]
test eax, eax
jne 0x10007067
xor eax, eax
add esp, 0x20
ret
mov eax, 1
add esp, 0x20
ret
Function at 0x10009ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2f0
mov cl, 0x64
mov al, 0x6c
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2e], cl
push ebx
mov cl, 0x72
push ebp
mov byte [esp + 0x33], al
mov byte [esp + 0x34], al
mov byte [esp + 0x37], al
mov byte [esp + 0x38], al
mov byte [esp + 0x19], al
push esi
mov byte [esp + 0x15], cl
mov byte [esp + 0x19], cl
mov byte [esp + 0x22], cl
lea eax, [esp + 0x10]
push edi
lea ecx, [esp + 0x38]
xor ebx, ebx
mov dl, 0x79
push eax
push ecx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x40], 0x6e
mov byte [esp + 0x41], 0x74
mov byte [esp + 0x45], 0x2e
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], bl
mov byte [esp + 0x1c], 0x5a
mov byte [esp + 0x1d], 0x77
mov byte [esp + 0x1e], 0x51
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x65
mov byte [esp + 0x22], dl
mov byte [esp + 0x23], 0x56
mov byte [esp + 0x24], 0x69
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x75
mov byte [esp + 0x28], 0x61
mov byte [esp + 0x2a], 0x4d
mov byte [esp + 0x2b], 0x65
mov byte [esp + 0x2c], 0x6d
mov byte [esp + 0x2d], 0x6f
mov byte [esp + 0x2f], dl
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], bl
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
cmp ebp, ebx
je 0x10009ebe
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
mov dword [esp + 0x34], eax
je 0x10009ebe
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x76]
mov word [esp + 0x74], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x74]
lea edx, [esp + 0x74]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x304]
push 0x3c
push edx
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, dword [esp + 0x34]
push ebx
lea ecx, [esp + 0x5c]
push 0x1c
push ecx
push ebx
push esi
push edi
call ebp
test eax, eax
jl 0x10009e9e
cmp dword [esp + 0x70], 0x1000000
jne 0x10009e9e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x5c]
cmp eax, edx
je 0x10009e9e
push ebx
lea eax, [esp + 0xf8]
push 0x20c
push eax
push 2
push esi
push edi
call ebp
test eax, eax
jl 0x10009e9e
mov eax, dword [esp + 0xf8]
push 0x5c
push eax
call fcn.10019ea3
add eax, 2
lea ecx, [esp + 0x7c]
push eax
push ecx
call fcn.1001aff5
add esp, 0x10
test eax, eax
jne 0x10009e9e
cmp esi, dword [esp + 0x308]
jne 0x10009eb1
cmp dword [esp + 0x10], ebx
jne 0x10009eb1
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x10], edx
add esi, 0x10000
cmp esi, 0x80000000
jae 0x10009ebe
jmp 0x10009e20
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f0
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f0
ret
Function at 0x1000b6a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x1003c9fc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
jne 0x1000b6b7
call esi
mov dword [0x1003c9fc], eax
inc dword [0x1003ca00]
call esi
mov esi, dword [0x1003c9fc]
mov ecx, eax
sub ecx, esi
pop esi
cmp ecx, 0x3e8
jbe 0x1000b6ed
mov edx, dword [0x1003ca00]
mov dword [0x1003ca00], 0
mov dword [0x1003c9f8], edx
mov dword [0x1003c9fc], eax
ret

Function at 0x1000b880
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x64
lea edi, [esp + 0xc]
mov byte [esp + 0xd], al
mov byte [esp + 0xf], al
mov byte [esp + 0x12], al
mov al, 0x6c
mov byte [esp + 0x13], al
mov byte [esp + 0x14], al
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xe], 0x33
mov byte [esp + 0x10], 0x38
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x15], 0
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1000b925
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
test ecx, ecx
jne 0x1000b939
xor eax, eax
add esp, 0x20c
ret
add eax, ecx
add esp, 0x20c
ret

Function at 0x1000b950
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x64
lea edi, [esp + 0xc]
mov byte [esp + 0xd], al
mov byte [esp + 0xf], al
mov byte [esp + 0x12], al
mov al, 0x6c
mov byte [esp + 0x13], al
mov byte [esp + 0x14], al
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xe], 0x33
mov byte [esp + 0x10], 0x39
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x15], 0
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1000b9f5
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
test ecx, ecx
jne 0x1000ba09
xor eax, eax
add esp, 0x20c
ret
add eax, ecx
add esp, 0x20c
ret
Function at 0x1000ba20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x64
lea edi, [esp + 0xc]
mov byte [esp + 0xd], al
mov byte [esp + 0xe], al
mov byte [esp + 0x13], al
mov al, 0x6c
mov byte [esp + 0x14], al
mov byte [esp + 0x15], al
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xf], 0x72
mov byte [esp + 0x10], 0x61
mov byte [esp + 0x11], 0x77
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x16], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1000baca
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
test ecx, ecx
jne 0x1000bade
xor eax, eax
add esp, 0x20c
ret
add eax, ecx
add esp, 0x20c
ret

Function at 0x1000baf0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x64
lea edi, [esp + 0xc]
mov byte [esp + 0xd], al
mov byte [esp + 0x15], al
mov al, 0x6c
or ecx, 0xffffffff
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
xor eax, eax
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xe], 0x69
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], 0x70
mov byte [esp + 0x11], 0x75
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], 0x38
mov byte [esp + 0x14], 0x2e
mov byte [esp + 0x18], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1000bba5
add esp, 0x210
ret
mov ecx, dword [esp + 0x214]
test ecx, ecx
jne 0x1000bbb9
xor eax, eax
add esp, 0x210
ret
add eax, ecx
add esp, 0x210
ret
Function at 0x1000bbd0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x64
lea edi, [esp + 0xc]
mov byte [esp + 0xd], al
mov byte [esp + 0x14], al
mov al, 0x6c
or ecx, 0xffffffff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], al
xor eax, eax
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xe], 0x69
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], 0x70
mov byte [esp + 0x11], 0x75
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], 0x2e
mov byte [esp + 0x17], 0
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1000bc80
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
test ecx, ecx
jne 0x1000bc94
xor eax, eax
add esp, 0x20c
ret
add eax, ecx
add esp, 0x20c
ret

Function at 0x1000bca0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x64
lea edi, [esp + 0xc]
mov byte [esp + 0xd], al
mov byte [esp + 0x12], al
mov al, 0x6c
or ecx, 0xffffffff
mov byte [esp + 0x13], al
mov byte [esp + 0x14], al
xor eax, eax
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xe], 0x78
mov byte [esp + 0xf], 0x67
mov byte [esp + 0x10], 0x69
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x15], 0
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1000bd46
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
test ecx, ecx
jne 0x1000bd5a
xor eax, eax
add esp, 0x20c
ret
add eax, ecx
add esp, 0x20c
ret
Function at 0x1000d830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
push ebx
push esi
push 0x264d4161
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x1000d9aa
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov al, 0x2e
mov byte [esp + 0xe], al
mov byte [esp + 0x2d], al
lea eax, [esp + 8]
mov bl, 0x6c
mov cl, 0x62
push eax
mov byte [esp + 0xc], bl
mov byte [esp + 0xd], 0x69
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], 0x65
mov byte [esp + 0x10], 0x67
mov byte [esp + 0x11], bl
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], 0
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], 0x69
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], 0x47
mov byte [esp + 0x2c], 0x4c
mov byte [esp + 0x2d], 0x45
mov byte [esp + 0x2e], 0x53
mov byte [esp + 0x2f], 0x76
mov byte [esp + 0x30], 0x32
mov byte [esp + 0x32], 0x64
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0
call esi
test eax, eax
je 0x1000d9aa
lea ecx, [esp + 0x24]
push ecx
call esi
test eax, eax
je 0x1000d9aa
mov al, 0x66
lea edx, [esp + 0x34]
mov byte [esp + 0x3d], al
mov byte [esp + 0x3e], al
mov al, 0x73
push edi
mov byte [esp + 0x45], al
mov byte [esp + 0x23], al
lea eax, [esp + 0xc]
mov cl, 0x61
push edx
push eax
mov byte [esp + 0x40], 0x65
mov byte [esp + 0x41], 0x67
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], 0x53
mov byte [esp + 0x44], 0x77
mov byte [esp + 0x45], cl
mov byte [esp + 0x46], 0x70
mov byte [esp + 0x47], 0x42
mov byte [esp + 0x48], 0x75
mov byte [esp + 0x4b], 0x65
mov byte [esp + 0x4c], 0x72
mov byte [esp + 0x4e], 0
mov byte [esp + 0x20], 0x67
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0x52
mov byte [esp + 0x23], 0x65
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x26], 0x50
mov byte [esp + 0x27], 0x69
mov byte [esp + 0x28], 0x78
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2c], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
lea ecx, [esp + 0x18]
lea edx, [esp + 0x28]
push ecx
push edx
mov dword [0x1003d450], eax
call esi
push eax
call edi
pop edi
mov dword [0x1003d44c], eax
pop esi
mov eax, 1
pop ebx
add esp, 0x3c
ret
pop esi
mov eax, 1
pop ebx
add esp, 0x3c
ret
Function at 0x1000f5c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov al, 0x31
mov cl, 0x64
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
mov byte [esp + 0x13], al
mov byte [esp], cl
mov byte [esp + 2], cl
mov byte [esp + 6], cl
mov al, 0x65
mov cl, 0x6c
mov byte [esp + 0x17], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x20], al
mov byte [esp + 7], cl
mov byte [esp + 8], cl
lea eax, [esp]
mov dl, 0x33
mov cl, 0x44
push eax
mov byte [esp + 5], dl
mov byte [esp + 9], 0x2e
mov byte [esp + 0xd], 0
mov byte [esp + 0x10], cl
mov byte [esp + 0x11], dl
mov byte [esp + 0x12], cl
mov byte [esp + 0x15], 0x4f
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x18], 0x32
mov byte [esp + 0x19], 0x43
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1c], 0x61
mov byte [esp + 0x1d], 0x74
mov byte [esp + 0x1f], cl
mov byte [esp + 0x21], 0x76
mov byte [esp + 0x22], 0x69
mov byte [esp + 0x23], 0x63
mov byte [esp + 0x25], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x1000f685
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x1000f685
mov eax, 0x80004005
add esp, 0x24
ret 0x28
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000f6a0
mov eax, 0x80004005
add esp, 0x24
ret 0x28
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x48]
push ecx
push edx
call eax
add esp, 0x24
ret 0x28
Function at 0x100141f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10023ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x18]
push eax
push 0x40
mov ebx, dword [ebp + 0x14]
push ebx
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1001426e
mov ecx, ebx
mov esi, dword [ebp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push ebx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, 1
mov dword [ebp - 0x14], esi
jmp 0x1001426e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016230
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov dword [esp], 0
test eax, eax
je 0x1001628c
mov eax, dword [esp + 8]
push esi
push 0
push 0
push eax
push fcn.10015f70
push 0
push 0
call fcn.1001aa9f
mov esi, eax
add esp, 0x18
cmp esi, 0xffffffff
je 0x10016270
test esi, esi
je 0x10016270
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, dword [esp]
pop ecx
ret 8
mov edx, dword [esp + 8]
push edx
call fcn.10015f70
pop ecx
ret 8
Function at 0x100179f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100243f8
push 0x10019b10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x10017a8b
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x10017a8b
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
mov esi, dword [ebp + 0xc]
cmp esi, edi
jb 0x10017a8b
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x10017a8b
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017bc0
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1003ef40], eax
je 0x10017bd6
mov eax, 0x10dd
pop ecx
ret
push ebp
push esi
mov esi, dword [0x1003ef50]
xor ebp, ebp
cmp esi, ebp
push edi
je 0x10017c29
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0xc]
push eax
xor eax, eax
mov al, byte [edx + 0x17]
push ecx
mov ecx, dword [esi + 0xc]
push eax
push ecx
call fcn.10006390
cmp dword [esi + 4], ebp
jne 0x10017c18
mov eax, dword [esi + 0x10]
cmp eax, ebp
je 0x10017c18
push eax
call fcn.10017ca0
add esp, 4
mov dword [esi + 0x10], ebp
mov edi, dword [esi]
push esi
call fcn.10019580
add esp, 4
cmp edi, ebp
mov esi, edi
jne 0x10017be5
mov dword [0x1003ef50], ebp
call fcn.10017c70
mov esi, dword [0x1003ef4c]
cmp esi, ebp
je 0x10017c5d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esi + 4]
push edx
call ebx
mov edi, dword [esi]
push esi
call fcn.10019580
add esp, 4
cmp edi, ebp
mov esi, edi
jne 0x10017c45
pop ebx
pop edi
mov dword [0x1003ef4c], ebp
mov dword [0x1003ef40], ebp
pop esi
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x10017f90
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x1003ef44]
push esi
test eax, eax
push edi
jne 0x10018006
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x10018004
push 8
call fcn.10019d62
mov esi, eax
add esp, 4
test esi, esi
jne 0x10017fc0
mov edi, 8
jmp 0x10017fdd
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10017ff4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.10019580
add esp, 4
mov dword [0x1003ef44], edi
mov eax, edi
pop edi
mov dword [0x1003ef48], 0
pop esi
ret 4
mov dword [esi + 4], edi
mov eax, dword [0x1003ef4c]
mov dword [esi], eax
mov dword [0x1003ef4c], esi
xor eax, eax
pop edi
pop esi
ret 4