joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40941f
jmp loc.0041c676

Function at 0x409448
Capabilities:
Packed with generic packer
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40b07c], 2
jne 0x4094af
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40946a
xor eax, eax
jmp 0x4094be
lea eax, [esp + 8]
push eax
push 0x4094c4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x4094af
xor eax, eax
jmp 0x4094be
push 0
push 2
jmp 0x41ec0d
add esp, 0x14
ret

Function at 0x40953c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x409589
xor ebx, ebx
jmp 0x40957e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
jmp 0x41e0dd
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x40955f
mov al, byte [ebp - 1]
sub al, 1
jb 0x409594
je 0x40959d
jmp 0x4095a6
jmp 0x41da84
jmp 0x41b195
xor edi, edi
test di, di
jmp 0x41ca92

Function at 0x409648
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4096eb
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLastError_1
mov esi, eax
lea eax, [ebp - 4]
push eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x40c95c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00404c94
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00407284
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov ecx, 2
mov al, 0x68
call fcn.00408da8
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, 0x404660
call fcn.00405890
jmp loc.0041fa8e

Function at 0x4096fc
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x40975b
jmp loc.0041c004

Function at 0x4099ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
jmp loc.0041de73
Function at 0x409c88
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x409cd8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x409cf0
call fcn.0040322c
push 0x10
push 0x40a5f0
mov eax, dword [ebp - 4]
jmp loc.0041de10

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x10001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x20]
mov dl, 0x6e
xor ebx, ebx
push eax
push ecx
mov dword [esi], 0x1001b210
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], bl
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], bl
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WINMM.dll
mov edi, eax
call ebp
push ebx
push ebx
push ebx
push ebx
mov dword [0x10021c38], eax
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 4], 0x3e8
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [esi + 4]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x28], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi], eax
mov eax, dword [esi + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x20], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi + 8], eax
add esp, 0x10
add edi, 4
dec ebp
jne 0x100010e4
lea eax, [esi + 0x46]
xor ecx, ecx
mov edx, eax
pop edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov word [eax], 0x31
mov word [esi + 0x48], 1
mov dword [esi + 0x4a], 0x1f40
mov dword [esi + 0x4e], 0x659
mov word [esi + 0x52], 0x41
mov word [esi + 0x54], bx
mov word [esi + 0x56], 2
mov word [esi + 0x58], 0x140
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10001190
Capabilities:
Link many functions at runtime
Terminate thread

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_puts]
push 0x1001f0a0
mov dword [esi], 0x1001b210
call edi
mov eax, dword [0x10021c38]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
push str.waveInReset
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov dword [esp + 0x18], eax
call ebp
push 0x1001f0a0
call edi
mov ecx, dword [0x10021c38]
add esp, 4
push str.waveInStop
push ecx
call ebx
push 0
mov dword [esp + 0x14], eax
call ebp
push 0x1001f0a0
call edi
mov edx, dword [0x10021c38]
add esp, 4
push str.waveInClose
push edx
call ebx
push 0
mov dword [esp + 0x20], eax
call ebp
push 0x1001f0a0
call edi
mov eax, dword [0x10021c38]
add esp, 4
push str.waveInUnprepareHeader
push eax
call ebx
push 0
mov dword [esp + 0x1c], eax
call ebp
push 0x1001f0a0
call edi
mov ecx, dword [0x10021c38]
add esp, 4
push str.waveOutReset
push ecx
call ebx
push 0
mov dword [esp + 0x24], eax
call ebp
push 0x1001f0a0
call edi
mov edx, dword [0x10021c38]
add esp, 4
push str.waveOutClose
push edx
call ebx
push 0
mov dword [esp + 0x28], eax
call ebp
push 0x1001f0a0
call edi
mov eax, dword [0x10021c38]
add esp, 4
push str.waveOutUnprepareHeader
push eax
call ebx
push 0
mov ebx, eax
call ebp
mov al, byte [esi + 0x44]
test al, al
je 0x100012d2
mov ecx, dword [esi + 0x18]
push ecx
call dword [esp + 0x14]
mov edx, dword [esi + 0x18]
push edx
call dword [esp + 0x18]
lea edi, [esi + 0x30]
mov ebp, 2
mov eax, dword [edi]
mov ecx, dword [esi + 0x18]
push 0x20
push eax
push ecx
call dword [esp + 0x24]
add edi, 4
dec ebp
jne 0x100012ab
mov edx, dword [esi + 0x18]
push edx
call dword [esp + 0x20]
mov eax, dword [esi + 0x2c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, byte [esi + 0x45]
test al, al
je 0x10001302
mov ecx, dword [esi + 0x40]
push ecx
call dword [esp + 0x24]
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [edi]
mov eax, dword [esi + 0x40]
push 0x20
push edx
push eax
call ebx
add edi, 4
dec ebp
jne 0x100012e9
mov ecx, dword [esi + 0x40]
push ecx
call dword [esp + 0x28]
lea edi, [esi + 0x30]
mov ebx, 2
mov edx, dword [edi - 0x28]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [edi]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [edi - 0x20]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [edi + 8]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
add edi, 4
dec ebx
jne 0x1000130a
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 0x28]
push ecx
call edi
mov edx, dword [esi + 0x2c]
push edx
call edi
mov eax, dword [0x10021c38]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10001370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x44]
test al, al
jne 0x10001391
call fcn.10001520
test al, al
jne 0x10001391
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret 4
mov edi, dword [esp + 0x30]
test edi, edi
jne 0x100013a3
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret 4
mov eax, dword [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 0x45
mov cl, 0x74
mov byte [esp + 9], al
mov byte [esp + 0xc], al
mov dl, 0x69
mov al, 0x6c
mov byte [esp + 0x1b], cl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x20], dl
lea ecx, [esp + 0x18]
mov byte [esp + 0x12], al
mov byte [esp + 0x13], al
mov byte [esp + 0x23], al
lea edx, [esp + 8]
mov al, 0x65
push ecx
push edx
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x12], 0x52
mov byte [esp + 0x13], 0x4e
mov byte [esp + 0x15], 0x4c
mov byte [esp + 0x16], 0x33
mov byte [esp + 0x17], 0x32
mov byte [esp + 0x18], 0x2e
mov byte [esp + 0x19], 0x64
mov byte [esp + 0x1c], 0
mov byte [esp + 0x20], 0x57
mov byte [esp + 0x21], 0x61
mov byte [esp + 0x24], 0x46
mov byte [esp + 0x25], 0x6f
mov byte [esp + 0x26], 0x72
mov byte [esp + 0x27], 0x53
mov byte [esp + 0x29], 0x6e
mov byte [esp + 0x2a], 0x67
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], 0x4f
mov byte [esp + 0x2e], 0x62
mov byte [esp + 0x2f], 0x6a
mov byte [esp + 0x30], al
mov byte [esp + 0x31], 0x63
mov byte [esp + 0x33], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esi + 0x24]
push 0xffffffffffffffff
push ecx
call eax
mov edx, dword [esi + 4]
mov dword [edi], edx
mov eax, dword [esi + 0x1c]
pop edi
mov eax, dword [esi + eax*4 + 8]
pop esi
add esp, 0x24
ret 4
Function at 0x10001520
Capabilities:
Link many functions at runtime
Resume thread

Disassembly:
mov eax, dword [0x10021c38]
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push edi
push str.waveInGetNumDevs
mov edi, ecx
push eax
call ebp
call eax
test eax, eax
jne 0x1000154c
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
mov ecx, dword [0x10021c38]
push str.waveInOpen
push ecx
call ebp
push str.CreateThread
push str.KERNEL32.dll
mov esi, eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call ebp
lea edx, [esp + 0x10]
push edx
push 4
push edi
push 0x10001720
push 0
push 0
call eax
mov dword [edi + 0x2c], eax
mov eax, dword [esp + 0x10]
push 0x20000
push 0
lea ecx, [edi + 0x46]
push eax
lea ebx, [edi + 0x18]
push ecx
push 0xffff
push ebx
call esi
test eax, eax
je 0x100015b6
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
mov edx, dword [0x10021c38]
push str.waveInPrepareHeader
push edx
call ebp
mov dword [esp + 0x18], eax
lea esi, [edi + 0x30]
mov dword [esp + 0x14], 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov ecx, dword [ebx]
push eax
push ecx
call dword [esp + 0x24]
mov eax, dword [esp + 0x14]
add esi, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x100015d3
mov edx, dword [0x10021c38]
push str.waveInAddBuffer
push edx
call ebp
mov ecx, dword [edi + 0x1c]
push 0x20
mov edx, dword [edi + ecx*4 + 0x30]
mov ecx, dword [ebx]
push edx
push ecx
call eax
mov edx, dword [edi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x10021c38]
push str.waveInStart
push eax
call ebp
mov ecx, dword [ebx]
push ecx
call eax
mov al, 1
mov byte [edi + 0x44], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10001960
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1001a878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x1001b214
mov al, 0x45
mov cl, 0x74
mov byte [esp + 0xd], al
mov byte [esp + 0x10], al
mov al, 0x6c
mov byte [esp + 0x1f], cl
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
mov byte [esp + 0x27], al
mov al, 0x65
mov byte [esp + 0x28], al
mov byte [esp + 0x2c], al
mov byte [esp + 0x2e], cl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0xc]
xor ebx, ebx
mov dl, 0x69
push eax
push ecx
mov dword [esp + 0x40], ebx
mov byte [0x10021c3c], bl
mov byte [esp + 0x14], 0x4b
mov byte [esp + 0x16], 0x52
mov byte [esp + 0x17], 0x4e
mov byte [esp + 0x19], 0x4c
mov byte [esp + 0x1a], 0x33
mov byte [esp + 0x1b], 0x32
mov byte [esp + 0x1c], 0x2e
mov byte [esp + 0x1d], 0x64
mov byte [esp + 0x20], bl
mov byte [esp + 0x24], 0x57
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], dl
mov byte [esp + 0x28], 0x46
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], 0x53
mov byte [esp + 0x2c], dl
mov byte [esp + 0x2d], 0x6e
mov byte [esp + 0x2e], 0x67
mov byte [esp + 0x31], 0x4f
mov byte [esp + 0x32], 0x62
mov byte [esp + 0x33], 0x6a
mov byte [esp + 0x35], 0x63
mov byte [esp + 0x37], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esi + 0x14]
push 0xffffffffffffffff
push edx
call eax
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
je 0x10001a60
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, esi
mov dword [esp + 0x38], 0xffffffff
call fcn.1000b480
mov ecx, dword [esp + 0x30]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x10002080
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1001a8e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 4]
call fcn.10001c30
xor ebx, ebx
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1d0], ebx
call fcn.10001c30
lea ecx, [esi + 0x54]
mov byte [esp + 0x1d0], 1
call fcn.10001c30
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1d0], 2
call fcn.10001c30
mov cl, 0x6c
mov al, 0x65
mov byte [esp + 0x2d], cl
mov byte [esp + 0x32], cl
mov byte [esp + 0x33], cl
mov cl, 0x74
mov byte [esp + 0x29], al
mov byte [esp + 0x2c], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0x1c], cl
mov byte [esp + 0x22], cl
lea eax, [esp + 0x18]
lea ecx, [esp + 0x28]
mov dl, 0x6e
push eax
push ecx
mov byte [esp + 0x1d8], 3
mov dword [esi], 0x1001b228
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], dl
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3c], bl
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x26], 0x45
mov byte [esp + 0x27], 0x76
mov byte [esp + 0x29], dl
mov byte [esp + 0x2b], 0x41
mov byte [esp + 0x2c], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x38]
mov edi, eax
push edx
push 0x202
call dword [0x10021c28]
mov ebp, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call ebp
add esp, 4
push ebx
push ebx
push 1
push ebx
call edi
push 0x30
mov dword [esi + 0xac], eax
call ebp
add esp, 4
mov byte [esi + 0xb5], bl
mov dword [esi + 0xa8], 0xffffffff
mov byte [esp + 0x10], 0x54
mov byte [esp + 0x11], 0x79
mov byte [esp + 0x12], 0x6a
mov byte [esp + 0x13], 0x68
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0xb0]
mov al, 0x75
pop edi
mov dword [ecx], edx
mov byte [ecx + 4], al
mov ecx, dword [esp + 0x1c4]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c4
ret
Function at 0x10002230
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1001a92c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x1001b228
mov edi, dword [sym.imp.MSVCRT.dll_puts]
push 0x1001f0a0
mov dword [esp + 0x44], 3
call edi
add esp, 4
xor ebx, ebx
mov byte [esi + 0xb5], bl
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 0x45
mov cl, 0x74
mov byte [esp + 0x15], al
mov byte [esp + 0x18], al
mov al, 0x6c
mov byte [esp + 0x27], cl
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x2f], al
mov al, 0x65
mov byte [esp + 0x30], al
mov byte [esp + 0x34], al
mov byte [esp + 0x36], cl
lea eax, [esp + 0x24]
lea ecx, [esp + 0x14]
mov dl, 0x69
push eax
push ecx
mov byte [esp + 0x1c], 0x4b
mov byte [esp + 0x1e], 0x52
mov byte [esp + 0x1f], 0x4e
mov byte [esp + 0x21], 0x4c
mov byte [esp + 0x22], 0x33
mov byte [esp + 0x23], 0x32
mov byte [esp + 0x24], 0x2e
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x28], bl
mov byte [esp + 0x2c], 0x57
mov byte [esp + 0x2d], 0x61
mov byte [esp + 0x2e], dl
mov byte [esp + 0x30], 0x46
mov byte [esp + 0x31], 0x6f
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], 0x53
mov byte [esp + 0x34], dl
mov byte [esp + 0x35], 0x6e
mov byte [esp + 0x36], 0x67
mov byte [esp + 0x39], 0x4f
mov byte [esp + 0x3a], 0x62
mov byte [esp + 0x3b], 0x6a
mov byte [esp + 0x3d], 0x63
mov byte [esp + 0x3f], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esi + 0xa4]
push 0xffffffffffffffff
push edx
call eax
push 0x1001f0a0
call edi
mov eax, dword [esi + 0xa8]
add esp, 4
cmp eax, 0xffffffff
je 0x1000235f
mov ecx, esi
call fcn.100029f0
push 0x1001f0a0
call edi
mov eax, dword [esi + 0xa4]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push eax
call ebp
push 0x30
call dword [sym.imp.MSVCRT.dll_putchar]
mov ecx, dword [esi + 0xac]
add esp, 4
push ecx
call ebp
push 0x1001f0a0
call edi
add esp, 4
call dword [0x10021c2c]
lea ecx, [esi + 0x7c]
mov byte [esp + 0x40], 2
call fcn.10001c90
lea ecx, [esi + 0x54]
mov byte [esp + 0x40], 1
call fcn.10001c90
lea ecx, [esi + 0x2c]
mov byte [esp + 0x40], bl
call fcn.10001c90
lea ecx, [esi + 4]
mov dword [esp + 0x40], 0xffffffff
call fcn.10001c90
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret