joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 8], 0x746f6873
push eax
mov esi, edx
mov dword [ebp - 0x1a], 0x65746165
mov word [ebp - 0xe], 0x3233
mov word [ebp - 0x14], 0x6c6f
mov word [ebp - 0x1c], 0x7243
mov word [ebp - 0x11], 0x6c65
mov word [ebp - 0xb], 0x616e
mov word [ebp - 0x16], 0x6f54
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 9], 0x70
mov byte [ebp - 4], 0
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xc], 0x53
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009d7d
push esi
push 4
call eax
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10009d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xd], 0x33646165
push eax
mov esi, edx
mov word [ebp - 7], 0x7269
mov edi, ecx
mov word [ebp - 4], 0x74
mov word [ebp - 9], 0x4632
mov word [ebp - 0xf], 0x7268
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 5], 0x73
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009de1
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10009df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0x10]
mov word [ebp - 9], 0x4e32
push eax
mov esi, edx
mov word [ebp - 0xc], 0x6461
mov edi, ecx
mov dword [ebp - 7], 0x747865
mov byte [ebp - 0xa], 0x33
mov word [ebp - 0xf], 0x7268
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x10], 0x54
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009e3f
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10009e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, 1
call fcn.10009c60
mov edi, eax
test edi, edi
je 0x10009ec2
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], 0x41784565
push eax
push edi
mov dword [ebp - 0x10], 0x756c6156
mov word [ebp - 0x15], 0x7551
mov word [ebp - 0x18], 0x6552
mov word [ebp - 0x13], 0x7265
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x16], 0x67
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009ebb
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push 0
push ebx
push dword [ebp - 4]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 0x18]
mov word [ebp - 0xa], 0x6e6f
push eax
mov esi, edx
mov dword [ebp - 0xf], 0x74637572
mov edi, ecx
mov word [ebp - 7], 0x6361
mov word [ebp - 0x12], 0x736e
mov word [ebp - 4], 0x65
mov byte [ebp - 8], 0x43
mov dword [ebp - 0x17], 0x6873756c
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0x18], 0x46
mov byte [ebp - 5], 0x68
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0xb], 0x69
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009f3b
push dword [ebp + 8]
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10009f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.10009ca0
mov edi, eax
test edi, edi
je 0x10009fb0
lea eax, [ebp - 0x10]
mov word [ebp - 4], 0x7845
push eax
push edi
mov byte [ebp - 2], 0
mov dword [ebp - 9], 0x6f6f4874
mov dword [ebp - 0xd], 0x78654e6c
mov word [ebp - 0xf], 0x6c61
mov byte [ebp - 5], 0x6b
mov byte [ebp - 0x10], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009fa9
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x14]
mov word [ebp - 0xb], 0x6946
push eax
mov esi, edx
mov dword [ebp - 0x10], 0x6c75646f
mov dword [ebp - 0x14], 0x4d746547
mov word [ebp - 6], 0x6d61
mov byte [ebp - 0xc], 0x65
mov word [ebp - 3], 0x41
mov word [ebp - 8], 0x4e65
mov byte [ebp - 9], 0x6c
mov byte [ebp - 4], 0x65
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a01e
push 0x104
push esi
push 0
call eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
mov esi, 1
call fcn.10009c60
mov edi, eax
test edi, edi
je 0x1000a097
lea eax, [ebp - 0x10]
mov dword [ebp - 6], 0x417845
push eax
push edi
mov word [ebp - 0x10], 0x6552
mov dword [ebp - 0xd], 0x6e65704f
mov word [ebp - 9], 0x654b
mov byte [ebp - 0xe], 0x67
mov byte [ebp - 7], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a090
push dword [ebp + 0x10]
push 0x20019
push 0
push ebx
push 0x80000001
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 0x65536c61
push eax
mov dword [ebp - 6], 0x6e6f69
mov dword [ebp - 0x16], 0x657a696c
mov dword [ebp - 0x1a], 0x61697469
mov word [ebp - 8], 0x7463
mov word [ebp - 0x11], 0x6972
mov word [ebp - 0x1c], 0x6e49
mov word [ebp - 0xe], 0x6369
mov byte [ebp - 0x12], 0x43
mov byte [ebp - 0xf], 0x74
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a15d
push 0x1006e678
call eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov word [ebp - 5], 0x64
push eax
mov esi, ecx
mov dword [ebp - 0xe], 0x656d7573
mov dword [ebp - 0xa], 0x65726854
mov word [ebp - 0x10], 0x6552
mov byte [ebp - 6], 0x61
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a1b3
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 6], 0x7972746e
push eax
mov esi, edx
mov word [ebp - 0x15], 0x6854
mov edi, ecx
mov word [ebp - 0xa], 0x6f74
mov word [ebp - 0xd], 0x656c
mov word [ebp - 0x18], 0x6547
mov dword [ebp - 0x12], 0x53646165
mov byte [ebp - 2], 0
mov word [ebp - 8], 0x4572
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xe], 0x65
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a22d
push dword [ebp + 8]
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x12], 0x61757472
push eax
mov esi, edx
mov dword [ebp - 7], 0x784574
mov edi, ecx
mov dword [ebp - 0xd], 0x746f7250
mov word [ebp - 0x14], 0x6956
mov word [ebp - 9], 0x6365
mov byte [ebp - 0xe], 0x6c
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a298
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x11], 0x65726854
push eax
mov esi, edx
mov dword [ebp - 7], 0x747865
mov edi, ecx
mov word [ebp - 0x14], 0x6547
mov dword [ebp - 0xc], 0x6e6f4364
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x61
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a2f1
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov word [ebp - 7], 0x7268
push eax
mov word [ebp - 4], 0x6461
mov dword [ebp - 0xc], 0x6e65704f
mov byte [ebp - 2], 0
mov byte [ebp - 8], 0x54
mov byte [ebp - 5], 0x65
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a349
push dword [ebp + 8]
push 0
push 0x1fffff
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xb], 0x6d657473
push eax
mov esi, ecx
mov word [ebp - 0xd], 0x7953
mov word [ebp - 0x10], 0x6547
mov word [ebp - 4], 0x6f
mov word [ebp - 7], 0x6e49
mov byte [ebp - 5], 0x66
mov byte [ebp - 0xe], 0x74
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a397
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0xf], 0x64616572
push eax
mov esi, edx
mov word [ebp - 7], 0x6972
mov edi, ecx
mov word [ebp - 4], 0x79
mov word [ebp - 0xa], 0x6972
mov byte [ebp - 5], 0x74
mov byte [ebp - 0xb], 0x50
mov dword [ebp - 0x14], 0x54746553
mov byte [ebp - 8], 0x6f
mov byte [ebp - 0x10], 0x68
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a3fa
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov word [ebp - 5], 0x64
push eax
mov dword [ebp - 0xe], 0x746e6572
mov word [ebp - 0x14], 0x6547
mov word [ebp - 0x11], 0x7543
mov dword [ebp - 0xa], 0x65726854
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 6], 0x61
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a4bc
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000a4d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0x10]
mov word [ebp - 5], 0x79
push eax
mov esi, edx
mov word [ebp - 8], 0x6575
mov edi, ecx
mov word [ebp - 0xb], 0x6c61
mov dword [ebp - 0x10], 0x74726956
mov byte [ebp - 6], 0x72
mov byte [ebp - 9], 0x51
mov byte [ebp - 0xc], 0x75
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a521
push 0x1c
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov word [ebp - 0x10], 0x6956
push eax
mov esi, ecx
mov dword [ebp - 7], 0x636f6c
mov dword [ebp - 0xd], 0x6c617574
mov word [ebp - 9], 0x6c41
mov byte [ebp - 0xe], 0x72
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a5dc
push 0x20
push 0x3000
push 0x6c
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a5f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xb], 0x6854646e
push eax
mov esi, ecx
mov dword [ebp - 6], 0x646165
mov dword [ebp - 0x10], 0x70737553
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x72
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a632
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x14]
mov word [ebp - 0xb], 0x7250
push eax
mov esi, ecx
mov dword [ebp - 0x12], 0x72685474
mov dword [ebp - 7], 0x79746972
mov word [ebp - 0xe], 0x6165
mov word [ebp - 9], 0x6f69
mov byte [ebp - 3], 0
mov word [ebp - 0x14], 0x6547
mov byte [ebp - 0xc], 0x64
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a693
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x7fffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0x10]
mov word [ebp - 4], 0x79
push eax
mov esi, edx
mov word [ebp - 0xf], 0x6c74
mov edi, ecx
mov word [ebp - 0xa], 0x4d6f
mov word [ebp - 7], 0x6f6d
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 5], 0x72
mov word [ebp - 0xc], 0x7265
mov byte [ebp - 0xd], 0x5a
mov byte [ebp - 8], 0x65
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a782
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1000a85e
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xf], 0x69577465
push ecx
push eax
mov dword [ebp - 8], 0x736f5077
mov word [ebp - 0xb], 0x646e
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 4], 0
mov byte [ebp - 9], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a8b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1000a8ff
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x11], 0x65726f46
push ecx
push eax
mov dword [ebp - 5], 0x776f646e
mov dword [ebp - 0xa], 0x57646e75
mov word [ebp - 0x14], 0x6553
mov word [ebp - 0xd], 0x7267
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xb], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000b280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1000b2c3
lea ecx, [ebp - 0x14]
mov word [ebp - 0xf], 0x6957
push ecx
push eax
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 0xd], 0x776f646e
mov dword [ebp - 7], 0x706f54
mov byte [ebp - 0x10], 0x67
mov word [ebp - 9], 0x6f54
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000b4b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x118
cmp eax, 1
jne 0x1000b564
push ecx
lea edx, [esp + 0x14]
call fcn.10009fc0
add esp, 4
mov dword [esp + 6], 0x75732074
lea eax, [esp]
mov dword [esp + 0xc], 0x74726f
mov dword [esp + 1], 0x6174736e
mov word [esp + 0xa], 0x7070
push eax
lea eax, [esp + 0x14]
mov byte [esp + 4], 0x69
push eax
mov byte [esp + 0xd], 0x6e
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1000b590
mov edx, sym.drvhlp.dll_v20kjl
mov ecx, 0x1006e560
call fcn.1000ac40
test eax, eax
je 0x1000b590
mov edx, sym.drvhlp.dll_sxuri5
mov ecx, 0x1006e528
call fcn.1000ac40
test eax, eax
je 0x1000b590
mov edx, sym.drvhlp.dll_ml3buv
mov ecx, 0x1006e540
call fcn.1000ac40
test eax, eax
je 0x1000b590
mov edx, sym.drvhlp.dll_vdl38b
mov ecx, 0x1006e53c
call fcn.1000ac40
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1000b590
mov ecx, 0x1006e560
call fcn.1003c2a0
mov ecx, 0x1006e528
call fcn.1003c2a0
mov ecx, 0x1006e540
call fcn.1003c2a0
mov ecx, 0x1006e53c
call fcn.1003c2a0
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1002b213
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002aabf

Function at 0x1002b21e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002acfa

Function at 0x10035b7e
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100359bc
Function at 0x1003bda0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1003bde1
lea ecx, [ebp - 0x10]
mov dword [ebp - 5], 0x776f646e
push ecx
push eax
mov dword [ebp - 0xb], 0x65766974
mov dword [ebp - 0x10], 0x41746553
mov word [ebp - 7], 0x6957
mov byte [ebp - 1], 0
mov byte [ebp - 0xc], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003be30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
push 0x104
lea eax, [ebp - 0x130]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x10], esi
call fcn.1000e530
add esp, 0xc
mov dword [ebp - 5], 0x73255c45
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xa], 0x41575446
mov word [ebp - 0xc], 0x4f53
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x52
call fcn.1000bb10
cmp dword [eax + 0x14], 0x10
jb 0x1003be81
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x130]
push 0x104
push eax
call fcn.1000ba10
mov edx, dword [ebp - 0x14]
add esp, 0x14
cmp edx, 0x10
jb 0x1003becc
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003bec2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003bee1
push edx
push ecx
call fcn.1000c37b
add esp, 8
lea eax, [ebp - 0x130]
mov ecx, esi
push eax
call fcn.1000bbb0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1001f677
int3

Function at 0x1003c230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [0x1006e56c], 0
jne 0x1003c257
call fcn.1000a100
mov edx, 0x100
mov ecx, 0x1006e570
call fcn.1000a730
mov dword [0x1006e56c], 1
jmp fcn.1000a790
Function at 0x402f1d
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x42e1c4]
sub esi, dword [0x4321d0]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1f4
xor ebx, ebx
mov dword [0x470600], eax
cmp esi, ebx
jle 0x40307b
push dword [0x4321cc]
call fcn.00402f06
push ebx
push ebx
push dword [0x4321d0]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x42e1c0], esi
mov dword [0x41e134], ebx
mov ebp, 0x4261c0
mov eax, dword [0x4321c8]
sub eax, dword [0x4321cc]
mov edi, 0x4000
cmp eax, edi
jg 0x402f92
mov edi, eax
push edi
mov esi, 0x42e1c8
push esi
call fcn.00402ed4
test eax, eax
je 0x40308d
add dword [0x4321cc], edi
mov dword [0x426150], esi
mov dword [0x426154], edi
cmp dword [0x4705bc], ebx
je 0x402fe9
cmp dword [0x470680], ebx
jne 0x402fe9
mov eax, dword [0x42e1c0]
sub eax, dword [0x42e1c4]
push ebx
sub eax, dword [esp + 0x1c]
add eax, dword [0x4321d0]
mov dword [0x41e134], eax
call fcn.00402e32
pop ecx
mov ecx, 0x426138
mov dword [0x426158], ebp
mov dword [0x42615c], 0x8000
call fcn.00406bd9
test eax, eax
js 0x403092
mov esi, dword [0x426158]
sub esi, ebp
je 0x403047
push ebx
lea eax, [esp + 0x14]
push eax
push esi
push ebp
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403097
cmp esi, dword [esp + 0x10]
jne 0x403097
add dword [0x4321d0], esi
cmp dword [0x426154], ebx
jne 0x402fb8
jmp 0x403053
cmp dword [0x426154], ebx
jne 0x403092
cmp edi, ebx
je 0x403092
mov eax, dword [0x42e1c4]
mov ecx, eax
sub ecx, dword [0x4321d0]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x402f7c
push ebx
push ebx
push eax
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
call fcn.00402e32
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
or eax, 0xffffffff
jmp 0x403085
push 0xfffffffffffffffd
pop eax
jmp 0x403085
push 0xfffffffffffffffe
jmp 0x403094
Function at 0x40309b
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x4030c5
add eax, dword [0x4705f8]
push edi
push edi
push eax
push dword [0x40a014]
mov dword [0x42e1c4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00402f1d
cmp eax, edi
jl 0x4031be
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call ebx
test eax, eax
je 0x4031ba
cmp dword [ebp - 4], esi
jne 0x4031ba
push dword [ebp + 8]
add dword [0x42e1c4], esi
call fcn.00402f1d
mov dword [ebp - 8], eax
cmp eax, edi
jl 0x4031bd
cmp dword [ebp + 0x10], edi
jne 0x403189
cmp dword [ebp + 8], edi
jle 0x4031b5
mov esi, 0x42e1c8
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x403139
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x40a014]
call ebx
test eax, eax
je 0x4031ba
cmp edi, dword [ebp - 4]
jne 0x4031ba
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403185
cmp dword [ebp + 0x14], edi
jne 0x403185
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x42e1c4], eax
cmp dword [ebp + 8], 0
jg 0x40312c
jmp 0x4031b5
push 0xfffffffffffffffe
jmp 0x4031bc
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403194
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call ebx
test eax, eax
je 0x4031ba
mov eax, dword [ebp - 4]
add dword [0x42e1c4], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4031bd
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10