joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x41de20
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4252f0]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
xor eax, eax
mov word [esp + 0x54], ax
mov edi, 7
xor ebp, ebp
push 6
mov eax, str.32768
lea esi, [esp + 0x54]
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], ebp
call fcn.004037f0
mov dword [esp + 0x74], ebp
xor ecx, ecx
push ebp
mov eax, 0x4216e0
lea esi, [esp + 0x38]
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebp
mov word [esp + 0x3c], cx
call fcn.004037f0
mov edx, dword [esp + 0x7c]
push edx
lea edx, [esp + 0x54]
mov ecx, esi
lea ebx, [esp + 0x1c]
mov byte [esp + 0x78], 1
call fcn.004015b0
mov esi, 8
add esp, 4
cmp dword [esp + 0x4c], esi
jb 0x401d43
mov eax, dword [esp + 0x38]
push eax
call fcn.00409e67
add esp, 4
xor ecx, ecx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebp
mov word [esp + 0x38], cx
cmp dword [esp + 0x68], esi
jb 0x401d65
mov edx, dword [esp + 0x54]
push edx
call fcn.00409e67
add esp, 4
cmp dword [esp + 0x30], ebp
jne 0x401da8
lea edi, [esp + 0x18]
call fcn.00402d50
mov eax, dword [esp + 0x2c]
push eax
call fcn.00409e67
mov ecx, dword [esp + 0x1c]
add esp, 4
push ecx
mov dword [esp + 0x30], ebp
call fcn.00409e67
add esp, 4
xor al, al
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx]
mov esi, dword [esp + 0x18]
mov ebx, ecx
cmp esi, ebp
je 0x401dbe
cmp esi, dword [esp + 0x18]
je 0x401dc7
call fcn.0040a384
mov ecx, dword [esp + 0x2c]
cmp edi, ebx
je 0x401e10
cmp esi, ebp
jne 0x401e08
call fcn.0040a384
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x401de0
call fcn.0040a384
mov edx, dword [edi + 0xc]
push ebp
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, ebp
jne 0x401e0c
call fcn.0040a384
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x401e00
call fcn.0040a384
mov edi, dword [edi]
mov ecx, dword [esp + 0x2c]
jmp 0x401db2
mov eax, dword [esi]
jmp 0x401dd6
mov eax, dword [esi]
jmp 0x401df6
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x30], ebp
cmp eax, ecx
je 0x401e4e
mov edi, vtable.Window.0
lea esp, [esp]
mov esi, dword [eax]
push eax
mov dword [eax + 8], edi
mov dword [eax + 0xc], ebp
mov dword [eax + 0x10], ebp
call fcn.00409e67
mov ecx, dword [esp + 0x30]
add esp, 4
mov eax, esi
cmp esi, ecx
jne 0x401e30
push ecx
call fcn.00409e67
mov eax, dword [esp + 0x1c]
add esp, 4
push eax
mov dword [esp + 0x30], ebp
call fcn.00409e67
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
Function at 0x401e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x41de20
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4252f0]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
xor eax, eax
mov word [esp + 0x54], ax
mov edi, 7
xor ebp, ebp
push 0xb
mov eax, str.SunAwtFrame
lea esi, [esp + 0x54]
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], ebp
call fcn.004037f0
mov dword [esp + 0x74], ebp
xor ecx, ecx
push 0x12
mov eax, str.PopupMessageWindow
lea esi, [esp + 0x38]
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebp
mov word [esp + 0x3c], cx
call fcn.004037f0
mov edx, dword [esp + 0x7c]
push edx
lea edx, [esp + 0x54]
mov ecx, esi
lea ebx, [esp + 0x1c]
mov byte [esp + 0x78], 1
call fcn.004015b0
mov esi, 8
add esp, 4
cmp dword [esp + 0x4c], esi
jb 0x401f24
mov eax, dword [esp + 0x38]
push eax
call fcn.00409e67
add esp, 4
xor ecx, ecx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebp
mov word [esp + 0x38], cx
cmp dword [esp + 0x68], esi
jb 0x401f46
mov edx, dword [esp + 0x54]
push edx
call fcn.00409e67
add esp, 4
cmp dword [esp + 0x30], ebp
jne 0x401f89
lea edi, [esp + 0x18]
call fcn.00402d50
mov eax, dword [esp + 0x2c]
push eax
call fcn.00409e67
mov ecx, dword [esp + 0x1c]
add esp, 4
push ecx
mov dword [esp + 0x30], ebp
call fcn.00409e67
add esp, 4
xor al, al
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov ecx, dword [esp + 0x2c]
mov ebp, dword [ecx]
mov ebx, dword [esp + 0x18]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea esp, [esp]
mov esi, ecx
test ebx, ebx
je 0x401fac
cmp ebx, dword [esp + 0x18]
je 0x401fb5
call fcn.0040a384
mov ecx, dword [esp + 0x2c]
cmp ebp, esi
je 0x40202c
test ebx, ebx
jne 0x402024
call fcn.0040a384
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x401fce
call fcn.0040a384
mov esi, dword [ebp + 0xc]
push 0
push 0x81800001
push 0x11f
push esi
call edi
push 0
push 1
push 0x111
push esi
call edi
push esi
push esi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
add eax, 2
movzx edx, ax
push edx
push 0x111
push esi
call edi
test ebx, ebx
jne 0x402028
call fcn.0040a384
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x402018
call fcn.0040a384
mov ebp, dword [ebp]
mov ecx, dword [esp + 0x2c]
jmp 0x401fa0
mov eax, dword [ebx]
jmp 0x401fc4
mov eax, dword [ebx]
jmp 0x40200e
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x30], 0
cmp eax, ecx
je 0x40206c
mov esi, vtable.Window.0
mov edi, dword [eax]
xor ecx, ecx
push eax
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
call fcn.00409e67
mov ecx, dword [esp + 0x30]
add esp, 4
mov eax, edi
cmp edi, ecx
jne 0x40204c
push ecx
call fcn.00409e67
mov eax, dword [esp + 0x1c]
add esp, 4
push eax
mov dword [esp + 0x30], 0
call fcn.00409e67
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
Function at 0x407350
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1b], 1
call fcn.00406fd0
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx]
xor ebx, ebx
add esp, 4
cmp dword [esp + 0x38], ebx
jne 0x4073c9
mov dword [ecx], ecx
mov ecx, dword [esp + 0x34]
mov dword [ecx + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x38], ebx
cmp eax, ecx
je 0x4073a5
lea esp, [esp]
mov esi, dword [eax]
push eax
call fcn.00409e67
mov ecx, dword [esp + 0x38]
add esp, 4
mov eax, esi
cmp esi, ecx
jne 0x407390
push ecx
call fcn.00409e67
mov ecx, dword [esp + 0x24]
add esp, 4
push ecx
mov dword [esp + 0x38], ebx
call fcn.00409e67
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, dword [esp + 0x20]
mov dword [esp + 0x18], edi
mov ebp, eax
mov esi, ecx
cmp edi, ebx
je 0x4073df
cmp edi, dword [esp + 0x20]
je 0x4073e8
call fcn.0040a384
mov ecx, dword [esp + 0x34]
cmp ebp, esi
je 0x40748b
cmp edi, ebx
jne 0x407422
call fcn.0040a384
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x407405
call fcn.0040a384
mov edi, dword [ebp + 8]
push edi
push 1
push 0x100611
mov bl, 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x407426
xor bl, bl
jmp 0x407458
mov eax, dword [edi]
jmp 0x4073fb
push edi
push 0x407310
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x407451
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, 1
sete bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
and byte [esp + 0x17], bl
test eax, eax
jne 0x407487
call fcn.0040a384
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x407475
call fcn.0040a384
mov ebp, dword [ebp]
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x18]
xor ebx, ebx
jmp 0x4073d3
mov eax, dword [eax]
jmp 0x40746b
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esp + 0x34]
mov dword [ecx + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x38], ebx
cmp eax, ecx
je 0x4074b7
mov esi, dword [eax]
push eax
call fcn.00409e67
mov ecx, dword [esp + 0x38]
add esp, 4
mov eax, esi
cmp esi, ecx
jne 0x4074a2
push ecx
call fcn.00409e67
mov edx, dword [esp + 0x24]
add esp, 4
push edx
mov dword [esp + 0x38], ebx
call fcn.00409e67
mov al, byte [esp + 0x1b]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x408947
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x41d53e
call fcn.0040aae6
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x408a59
cmp byte [esi + 0x42], bl
je 0x408a59
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x408983
xor al, al
jmp 0x408a5b
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040891d
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004086f9
mov ecx, eax
call fcn.00407ac2
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004086f9
mov ecx, eax
call fcn.00407ac2
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x4089f3
dec eax
je 0x4089f7
dec eax
dec eax
je 0x408a55
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406d50
mov al, bl
jmp 0x408a5b
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004086f9
mov ecx, eax
call fcn.00407ac2
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x408a37
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004086f9
mov ecx, eax
call fcn.00407ac2
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040bd79
add esp, 0x10
cmp edi, eax
jne 0x4089e1
cmp byte [esi + 0x42], 0
je 0x408a55
test edi, edi
jne 0x408991
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00404870
jmp 0x408991
mov bl, 1
jmp 0x4089e3
mov al, 1
call fcn.0040ab30
ret
Function at 0x408ba3
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x41d5ac
call fcn.0040aae6
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x408bcd
lea eax, [ebp + 8]
push eax
call fcn.004081c3
pop ecx
jmp 0x408d48
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x408bfb
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x408bfb
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x408d48
mov eax, dword [esi + 0x4c]
cmp eax, ebx
je 0x408d43
cmp dword [esi + 0x3c], ebx
jne 0x408c24
push eax
push edi
call fcn.00408234
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x408d48
jmp 0x408d43
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
call fcn.0040891d
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.004086f9
mov ecx, eax
call fcn.00407ac2
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004086f9
mov ecx, eax
call fcn.00407ac2
lea edx, [ebp - 0x38]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x408d15
cmp eax, 1
jg 0x408d50
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004086f9
mov ecx, eax
call fcn.00407ac2
mov edi, dword [ebp - 0x38]
sub edi, eax
je 0x408cba
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004086f9
mov ecx, eax
call fcn.00407ac2
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040bd79
add esp, 0x10
cmp edi, eax
jne 0x408d37
lea eax, [ebp - 0x30]
mov byte [esi + 0x42], 1
cmp dword [ebp - 0x3c], eax
jne 0x408d80
test edi, edi
ja 0x408ce0
cmp dword [ebp - 0x18], 0x20
push 0
lea ecx, [ebp - 0x2c]
jae 0x408d3c
push 8
call fcn.00404870
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004086f9
mov ecx, eax
call fcn.00407ac2
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004086f9
mov ecx, eax
call fcn.00407ac2
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x40]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x3c]
push edx
lea edx, [ebp - 0x2e]
push edx
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x408c71
push 0
lea ecx, [ebp - 0x2c]
push 1
call fcn.00406d50
mov eax, 0xffff
call fcn.0040ab30
ret 4
cmp eax, 3
jne 0x408d37
push dword [esi + 0x4c]
push dword [ebp - 0x30]
call fcn.00408234
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x408d6f
mov esi, 0xffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406d50
mov ax, si
jmp 0x408d48
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406d50
mov ax, word [ebp + 8]
jmp 0x408d48

Function at 0x409cc9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4252f0]
jne 0x409cd3
repz ret
jmp fcn.0040ef2a
Function at 0x418bdb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040fdaa
and dword [ebp - 4], 0
cmp dword [0x427414], 0
mov ebx, eax
jne 0x418c8c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x418d3d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x418d3d
push eax
call fcn.0040fd38
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x427414], eax
call esi
push eax
call fcn.0040fd38
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x427418], eax
call esi
push eax
call fcn.0040fd38
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42741c], eax
call esi
push eax
call fcn.0040fd38
pop ecx
mov dword [0x427424], eax
test eax, eax
je 0x418c8c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040fd38
pop ecx
mov dword [0x427420], eax
mov eax, dword [0x427420]
cmp eax, ebx
je 0x418ce4
cmp dword [0x427424], ebx
je 0x418ce4
push eax
call fcn.0040fdb3
push dword [0x427424]
mov esi, eax
call fcn.0040fdb3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x418ce4
test edi, edi
je 0x418ce4
call esi
test eax, eax
je 0x418cdb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x418cdb
test byte [ebp - 0xc], 1
jne 0x418ce4
or dword [ebp + 0x10], 0x200000
jmp 0x418d1d
mov eax, dword [0x427418]
cmp eax, ebx
je 0x418d1d
push eax
call fcn.0040fdb3
pop ecx
test eax, eax
je 0x418d1d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x418d1d
mov eax, dword [0x42741c]
cmp eax, ebx
je 0x418d1d
push eax
call fcn.0040fdb3
pop ecx
test eax, eax
je 0x418d1d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x427414]
call fcn.0040fdb3
pop ecx
test eax, eax
je 0x418d3d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x418d3f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10011090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 8]
mov esi, eax
and esi, 7
je 0x100110b2
cmp eax, esi
jge 0x100110aa
mov edx, edi
call fcn.10010950
mov ecx, esi
shr dword [edi + 0xc], cl
sub dword [edi + 8], esi
xor eax, eax
cmp dword [edi + 8], eax
jle 0x100110da
lea ecx, [eax - 8]
lea esp, [esp]
mov dl, byte [edi + 0xc]
shr dword [edi + 0xc], 8
add dword [edi + 8], ecx
mov byte [esp + eax + 8], dl
inc eax
cmp dword [edi + 8], 0
jg 0x100110c0
cmp eax, 4
jge 0x100110f7
mov esi, dword [edi + 4]
mov edx, dword [edi]
nop
cmp edx, esi
jb 0x100110e8
xor cl, cl
jmp 0x100110eb
mov cl, byte [edx]
inc edx
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jl 0x100110e0
mov dword [edi], edx
mov eax, dword [esp + 8]
movzx ecx, byte [esp + 0xb]
movzx edx, byte [esp + 0xa]
movzx esi, ah
movzx eax, al
shl esi, 8
add esi, eax
shl ecx, 8
mov eax, esi
add ecx, edx
xor eax, 0xffff
cmp ecx, eax
je 0x10011130
mov dword [0x100a6abc], str.zlib_corrupt
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [edi]
add ecx, esi
cmp ecx, dword [edi + 4]
jbe 0x10011149
pop edi
mov dword [0x100a6abc], 0x1006e94c
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [edi + 0x10]
lea edx, [eax + esi]
cmp edx, dword [edi + 0x18]
jbe 0x10011161
push esi
call fcn.10010a50
add esp, 4
test eax, eax
je 0x1001112a
push ebx
mov ebx, dword [edi]
push ebp
mov ebp, dword [edi + 0x10]
push esi
push ebx
push ebp
call sub.MSVCR90.dll_memcpy
add esp, 0xc
add ebx, esi
add ebp, esi
mov dword [edi + 0x10], ebp
pop ebp
mov dword [edi], ebx
pop ebx
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x10018487
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
mov bh, 0x41
adc al, 0xf
mov bh, 0x71
push es

Function at 0x10018740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10018447
rcr dl, 5
xor cl, byte [ebp - 0x17af3fbb]
invalid
Function at 0x100187b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call 0x60e9e53d
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10018457
push eax
push esi
push dword [ebp + 8]
call fcn.1001840c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10018457
push eax
push esi
push dword [ebp + 8]
call fcn.1001840c
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
aam 0x88
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10018457
push eax
push esi
push dword [ebp + 8]
call fcn.1001840c
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10018447
push cs
test al, 0x75
pop esp
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
popfd
jge 0x100188d2
invalid
inc esi
test dword [esi - 1], edi
invalid
invalid
jmp 0xf812668
invalid
inc esi
inc ebp
adc byte [ecx - 0x3a], 0x45
xor dword [ebx - 0x3a], 0xc6628245
inc ebp
sbb dword [ebx - 0x3a], 0x45
test byte [ecx - 0x3a], bh
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jb 0x100188dd
inc ebp
lea edi, [edx - 0x3a]
inc ebp
invalid
jae 0x100188e5
inc ebp
invalid
push edi
mov byte [ebp - 0x70], 0x16
call fcn.10018447
push ds
sbb al, 0xae
jnp 0x100188bd
invalid
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid
Function at 0x10018870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call 0x60e9e53d
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10018457
push eax
push esi
push dword [ebp + 8]
call fcn.1001840c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10018457
push eax
push esi
push dword [ebp + 8]
call fcn.1001840c
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
aam 0x88
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10018457
push eax
push esi
push dword [ebp + 8]
call fcn.1001840c
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10018447
push cs
test al, 0x75
pop esp
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
popfd
jge 0x100188d2
invalid
inc esi
test dword [esi - 1], edi
invalid
invalid
jmp 0xf812668
invalid
inc esi
inc ebp
adc byte [ecx - 0x3a], 0x45
xor dword [ebx - 0x3a], 0xc6628245
inc ebp
sbb dword [ebx - 0x3a], 0x45
test byte [ecx - 0x3a], bh
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jb 0x100188dd
inc ebp
lea edi, [edx - 0x3a]
inc ebp
invalid
jae 0x100188e5
inc ebp
invalid
push edi
mov byte [ebp - 0x70], 0x16
call fcn.10018447
push ds
sbb al, 0xae
jnp 0x100188bd
invalid
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid