joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43dca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0xbcbdbebf
xor eax, eax
nop
nop
nop
mov ebx, eax
add bl, 0xa0
xor bl, byte [esp + eax + 4]
add bl, 0xe0
mov byte [esp + eax + 4], bl
inc eax
cmp eax, 4
jne 0x43dcc0
mov eax, dword [esp + 4]
mov ebx, dword [0x44a7f4]
test ebx, ebx
je 0x43dd2e
xor ebp, ebp
mov edi, dword [0x44a7f8]
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xc81e0bf6
je 0x43dd00
inc ebp
cmp ebx, ebp
jne 0x43dcf0
jmp 0x43dd2e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43dd2e
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x44a7fc]
call fcn.00439fa0
add esp, 0x30
cmp eax, 0x103
jne 0x43dda9
mov dword [esp], 0xbcbdbebf
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0xa0
xor cl, byte [esp + eax]
add cl, 0xe0
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43dd40
mov eax, dword [esp]
mov ecx, dword [0x44a7f4]
test ecx, ecx
je 0x43dda1
xor edx, edx
mov edi, dword [0x44a7f8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43dd80
inc edx
cmp ecx, edx
jne 0x43dd70
jmp 0x43dda1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43dda1
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x44a7fc]
call fcn.00439fa0
add esp, 0x18
test eax, eax
js 0x43dda9
mov eax, dword [esp + 4]
test esi, esi
je 0x43ddbc
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43ddba
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ddd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0xbcbdbebf
xor eax, eax
nop
nop
nop
mov ebx, eax
add bl, 0xa0
xor bl, byte [esp + eax + 4]
add bl, 0xe0
mov byte [esp + eax + 4], bl
inc eax
cmp eax, 4
jne 0x43ddf0
mov eax, dword [esp + 4]
mov ebx, dword [0x44a7f4]
test ebx, ebx
je 0x43de5e
xor ebp, ebp
mov edi, dword [0x44a7f8]
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x7e66a1b5
je 0x43de30
inc ebp
cmp ebx, ebp
jne 0x43de20
jmp 0x43de5e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43de5e
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x44a7fc]
call fcn.00439fa0
add esp, 0x30
cmp eax, 0x103
jne 0x43ded9
mov dword [esp], 0xbcbdbebf
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0xa0
xor cl, byte [esp + eax]
add cl, 0xe0
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43de70
mov eax, dword [esp]
mov ecx, dword [0x44a7f4]
test ecx, ecx
je 0x43ded1
xor edx, edx
mov edi, dword [0x44a7f8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43deb0
inc edx
cmp ecx, edx
jne 0x43dea0
jmp 0x43ded1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43ded1
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x44a7fc]
call fcn.00439fa0
add esp, 0x18
test eax, eax
js 0x43ded9
mov eax, dword [esp + 4]
test esi, esi
je 0x43dee3
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43def0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43df10
sar ebx, 1
mov ebp, ebx
and ebp, 0xfffd
mov ecx, ebx
and ecx, 2
or ebx, 2
imul ebx, ecx
xor ecx, 2
imul ecx, ebp
lea ebp, [ecx + ebx]
mov word [esp + 4], bp
add ecx, ebx
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0xbcbdbebf
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa0
xor cl, byte [esp + eax]
add cl, 0xe0
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43df90
mov eax, dword [esp]
mov edi, dword [0x44a7f4]
test edi, edi
je 0x43dff5
xor ebx, ebx
mov ebp, dword [0x44a7f8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x43dfd1
inc ebx
cmp edi, ebx
jne 0x43dfc0
jmp 0x43dff5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43dff5
lea eax, [esp + 0xc]
push esi
push eax
push edx
push dword [esp + 0x48]
push 0x10
push edi
push dword [0x44a7fc]
call fcn.00439fa0
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x764abc
Capabilities:
Allocate or change rwx memory

Disassembly:
pop eax
push eax
mov dword [0x76c6f1], eax
mov ebx, 0x76323e
and ebx, 0xfffff000
mov eax, 0x763969
sub eax, ebx
mov dword [0x76c6f5], eax
push 0x76c6f9
push 0x40
push dword [0x76c6f5]
push ebx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [0x76c6f1]
mov byte [eax], 0x90
ret

Function at 0x764c59
Capabilities:
Encode data using xor

Disassembly:
push eax
mov ebx, edi
sub ebx, 0x76323e
mov ah, bl
xor ah, 0x22
xor byte [edi], ah
inc edi
dec cl
jne 0x764c5a
pop eax
ret

Function at 0x769094
Capabilities:
Encode data using xor

Disassembly:
push eax
mov ebx, edi
sub ebx, 0x765130
mov ah, bl
and ebx, 7
add ebx, 0x765124
add ah, byte [ebx]
xor byte [edi], ah
inc edi
dec cl
jne 0x769095
pop eax
ret

Function at 0x76aa6a
Capabilities:
Identify system language via api

Disassembly:
push eax
cmp eax, 0
je 0x76ab68
call sub.KERNEL32.dll_GetUserDefaultLangID
and ax, 0xff
cmp ax, 7
jne 0x76aa91
nop
nop
nop
nop
mov esi, 0x76f067
jmp 0x76aafa
cmp ax, 0xc
jne 0x76aaa5
nop
nop
nop
nop
mov esi, 0x76f0a0
jmp 0x76aafa
cmp ax, 0x15
jne 0x76aab9
nop
nop
nop
nop
mov esi, 0x76f081
jmp 0x76aafa
cmp ax, 0x16
jne 0x76aacd
nop
nop
nop
nop
mov esi, 0x76f021
jmp 0x76aafa
cmp ax, 0x14
jne 0x76aae1
nop
nop
nop
nop
mov esi, 0x76f048
jmp 0x76aafa
cmp ax, 0xa
jne 0x76aaf5
nop
nop
nop
nop
mov esi, 0x76f0c1
jmp 0x76aafa
mov esi, 0x76effd
pop eax
push eax
push eax
push esi
push 0x76c8a6
call sub.USER32.dll_wsprintfA
add esp, 0xc
cmp dword [0x76e8da], 0
jne 0x76ab26
nop
nop
nop
nop
cmp word [0x76e8de], 0
je 0x76ab68
nop
nop
nop
nop
mov esi, 0x76c8a6
inc esi
cmp byte [esi], 0xd
jne 0x76ab2b
mov eax, 0
mov al, byte [0x76e8df]
push eax
mov al, byte [0x76e8de]
push eax
mov al, byte [0x76e8dd]
push eax
mov al, byte [0x76e8dc]
push eax
mov al, byte [0x76e8db]
push eax
mov al, byte [0x76e8da]
push eax
push 0x76f0e4
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x20
pop eax
ret

Function at 0x76b1db
Capabilities:
Read .ini file

Disassembly:
push eax
push esi
mov eax, 0x101
push eax
push 0x76cf3d
push 0x76f148
push edi
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov edi, 0x76cf3d
cmp word [edi], 0x6968
pop ecx
jne 0x76b273
nop
nop
nop
nop
cmp ecx, 0
je 0x76b270
nop
nop
nop
nop
push 0x101
push 0x76d131
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
cmp eax, 0
je 0x76b270
nop
nop
nop
nop
mov edi, 0x76d131
add edi, eax
dec edi
cmp byte [edi], 0x5c
jne 0x76b22f
inc edi
movsb byte es:[edi], byte [esi]
cmp byte [esi - 1], 0
jne 0x76b236
push 0x76d131
push 0x101
push 0x76cf3d
push 0x76f148
push 0x76f13a
push 0x76f120
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov edi, 0x76cf3d
cmp word [edi], 0x6968
jne 0x76b273
nop
nop
nop
nop
mov al, 0x21
ret
add edi, eax
mov al, 0
ret
Function at 0x100015a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
or eax, 0xffffffff
mov cl, byte [edx]
test cl, cl
je 0x10001649
movzx ecx, cl
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
lea edx, [edx + 1]
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x100015b3
not eax
pop ebp
ret
Function at 0x10004dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0x2e302e30
push dword [edi + 0x78]
mov dword [ebp - 0xc], 0x2e373231
mov word [ebp - 4], 0x31
call dword [0x100606cc]
push 6
push 1
push 2
call dword [0x100606ac]
mov dword [edi + 0x78], eax
lea esi, [edi + 0x40c0]
mov eax, 2
mov word [esi], ax
lea eax, [ebp - 0xc]
push eax
call dword [0x100606b4]
mov dword [edi + 0x40c4], eax
mov eax, 0xcee
add ax, word [edi + 0x4168]
movzx eax, ax
push eax
call dword [0x100606b8]
mov word [edi + 0x40c2], ax
push 0x10
push esi
push dword [edi + 0x78]
call dword [0x100606c0]
cmp eax, 0xffffffff
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
lea eax, [ebp - 0x1a4]
push edi
push eax
push 0x101
mov edi, ecx
call dword [0x100606bc]
push 6
push 1
push 2
call dword [0x100606ac]
mov dword [edi + 0x78], eax
cmp eax, 0xffffffff
je 0x10005948
push esi
lea esi, [edi + 0x40c0]
mov eax, 2
mov word [esi], ax
lea eax, [ebp - 0x14]
push eax
mov word [ebp - 8], 0x4950
mov word [ebp - 5], 0x47
mov byte [ebp - 6], 0x4e
mov word [ebp - 0x13], 0x3732
mov dword [ebp - 0x10], 0x2e302e30
mov word [ebp - 0xc], 0x31
mov byte [ebp - 0x14], 0x31
mov byte [ebp - 0x11], 0x2e
call dword [0x100606b4]
mov dword [edi + 0x40c4], eax
mov eax, 0xcee
add ax, word [edi + 0x4168]
movzx eax, ax
push eax
call dword [0x100606b8]
mov word [edi + 0x40c2], ax
push 0x10
push esi
push dword [edi + 0x78]
call dword [0x100606c0]
pop esi
cmp eax, 0xffffffff
jne 0x10005955
push dword [edi + 0x78]
call dword [0x100606cc]
call dword [0x100606b0]
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.10004e50
mov ecx, edi
call fcn.10004ea0
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10005da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10034ac1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e8
push ebx
push esi
push edi
push 0xff
lea eax, [ebp - 0x1f3]
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x1f4], 0
call fcn.10014a20
add esp, 0xc
lea eax, [ebp - 0x34]
add edi, 0x4140
mov edx, 0x5c
mov esi, 0x6c
push eax
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x60], 0
mov byte [edi], 0
mov dword [ebp - 0x1e], 0x690061
mov dword [ebp - 0x18], 0x2e0079
mov dword [ebp - 0x2a], 0x610062
mov dword [ebp - 0x22], 0x64005c
mov dword [ebp - 0x26], 0x650073
mov dword [ebp - 0x32], 0x610044
mov word [ebp - 0x1a], si
mov dword [ebp - 0x14], 0x6c0063
mov word [ebp - 0x34], dx
mov dword [ebp - 0x10], 0x64
mov dword [ebp - 0x2e], 0x610074
call fcn.10009330
mov esi, eax
push 0x100603c8
lea ecx, [ebp - 0xdc]
mov dword [ebp - 4], 0
call fcn.10009330
push esi
push eax
lea eax, [ebp - 0x7c]
push eax
mov byte [ebp - 4], 1
call fcn.10007b70
add esp, 0xc
lea ecx, [ebp - 0xdc]
call fcn.10009780
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 4
call fcn.10009780
lea ecx, [ebp - 0x7c]
call fcn.1000c5a0
push eax
call fcn.1000ee70
add esp, 4
test eax, eax
jne 0x10005f6d
mov word [ebp - 0x36], ax
mov eax, 0x5c
mov word [ebp - 0x5c], ax
mov eax, 0x63
mov word [ebp - 0x3c], ax
mov eax, 0x73
mov word [ebp - 0x4e], ax
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0x48], 0x610064
mov dword [ebp - 0x3a], 0x640076
mov dword [ebp - 0x4c], 0x5c0065
mov dword [ebp - 0x40], 0x2e0079
mov dword [ebp - 0x5a], 0x610044
mov dword [ebp - 0x56], 0x610074
mov dword [ebp - 0x44], 0x6c0069
mov dword [ebp - 0x52], 0x610062
call fcn.10009330
mov esi, eax
push 0x100603c8
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 5
call fcn.10009330
push esi
push eax
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 4], 6
call fcn.10007b70
add esp, 0xc
lea ecx, [ebp - 0x7c]
push eax
call fcn.10009950
lea ecx, [ebp - 0x94]
call fcn.10009780
lea ecx, [ebp - 0xc4]
call fcn.10009780
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 4
call fcn.10009780
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [ebp - 0x7c]
call fcn.1000c5a0
push eax
call fcn.1000edb0
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x10005fe0
push 0
lea eax, [ebp - 0x60]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x1f4]
push eax
push esi
call dword [0x1006066c]
push esi
call fcn.1000ecf0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x1d1]
push 0x100367f4
push eax
call fcn.1001262c
add esp, 0x10
test eax, eax
je 0x10005fe0
push 0xffffffffffffffff
push eax
push 0x10
push edi
call fcn.10012588
add esp, 0x10
lea ecx, [ebp - 0x7c]
call fcn.10009780
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100073f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
push 0
mov dword [ebp - 4], 0
call fcn.1000f050
mov edi, 0x39
mov eax, 0x36
lea edx, [edi - 0xc]
mov word [ebp - 0xa0], ax
mov word [ebp - 0x64], di
lea edi, [eax + 2]
lea eax, [ebp - 0xb4]
push eax
xorps xmm0, xmm0
mov word [ebp - 0x88], dx
lea eax, [ebp - 0xa4]
mov edx, 0x46
mov esi, 0x64
push eax
mov dword [ebp - 0xb4], 0
movq qword [ebp - 0xb0], xmm0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xc4], 0
movq qword [ebp - 0xc0], xmm0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x86], 0x310031
mov dword [ebp - 0x80], 0x2d0030
mov dword [ebp - 0x5e], 0x300039
mov dword [ebp - 0x74], 0x30002d
mov dword [ebp - 0x9e], 0x440046
mov dword [ebp - 0x98], 0x340033
mov dword [ebp - 0xa4], 0x35007b
mov dword [ebp - 0x8c], 0x440036
mov dword [ebp - 0x5a], 0x7d
mov dword [ebp - 0x6c], 0x390030
mov dword [ebp - 0x62], 0x300041
mov dword [ebp - 0x94], 0x2d0034
mov word [ebp - 0x82], si
mov dword [ebp - 0x7c], 0x350039
mov dword [ebp - 0x68], 0x430037
mov dword [ebp - 0x90], 0x440046
mov dword [ebp - 0x70], 0x360030
mov dword [ebp - 0x78], 0x410038
mov word [ebp - 0x9a], dx
call fcn.1000fc90
mov eax, 0x31
mov word [ebp - 0x34], ax
mov eax, 0x46
mov word [ebp - 0x4a], ax
lea eax, [ebp - 0xc4]
push eax
lea edx, [esi - 0x37]
lea eax, [ebp - 0x54]
mov esi, 0x30
mov ebx, 0x36
push eax
mov dword [ebp - 0x32], 0x300064
mov dword [ebp - 0x4e], 0x440046
mov dword [ebp - 0x38], 0x31002d
mov dword [ebp - 0x44], 0x2d0032
mov dword [ebp - 0x26], 0x2d0041
mov dword [ebp - 0x3c], 0x440036
mov dword [ebp - 0xa], 0x7d
mov dword [ebp - 0xe], 0x300039
mov dword [ebp - 0x12], 0x300041
mov dword [ebp - 0x20], 0x360030
mov dword [ebp - 0x16], 0x390043
mov dword [ebp - 0x54], 0x35007b
mov dword [ebp - 0x1a], 0x370039
mov dword [ebp - 0x40], 0x440046
mov dword [ebp - 0x2c], 0x350039
mov dword [ebp - 0x48], 0x340033
mov word [ebp - 0x28], di
mov word [ebp - 0x1c], si
mov word [ebp - 0x2e], dx
mov word [ebp - 0x50], bx
mov word [ebp - 0x22], si
call fcn.1000fd00
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc4]
push eax
push 0x15
lea eax, [ebp - 0xb4]
push 0
push eax
call fcn.1000f0c0
add esp, 0x28
pop edi
pop esi
pop ebx
test eax, eax
jne 0x10007602
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call fcn.1000eff0
mov esp, ebp
pop ebp
ret

Function at 0x10009590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 0x1c]
push eax
mov esi, ecx
mov dword [ebp - 6], 0x6e6f69
mov dword [ebp - 0xa], 0x74636553
mov dword [ebp - 0x16], 0x657a696c
mov dword [ebp - 0xf], 0x61636974
mov word [ebp - 0x11], 0x6972
mov word [ebp - 0x1c], 0x6e49
mov word [ebp - 0x19], 0x6974
mov byte [ebp - 0x12], 0x43
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0x17], 0x61
call fcn.1000d6e0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100095ee
push esi
call eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 0x18]
push eax
mov esi, ecx
mov word [ebp - 0x12], 0x6972
mov dword [ebp - 0xd], 0x65536c61
mov dword [ebp - 7], 0x6e6f69
mov word [ebp - 9], 0x7463
mov dword [ebp - 0x17], 0x7265746e
mov word [ebp - 0xf], 0x6369
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0x18], 0x45
mov byte [ebp - 0x13], 0x43
call fcn.1000d6e0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a7b3
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000ab90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 0x18]
push eax
mov esi, ecx
mov dword [ebp - 0x18], 0x7661654c
mov word [ebp - 0xf], 0x6369
mov word [ebp - 5], 0x6e
mov dword [ebp - 0xc], 0x6365536c
mov word [ebp - 8], 0x6974
mov dword [ebp - 0x14], 0x69724365
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 6], 0x6f
mov byte [ebp - 0x10], 0x74
call fcn.1000d6e0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000abe3
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000ad30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1000ad45
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000ad84
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000ad80
lea ebx, [ebx]
cmp esi, edx
jae 0x1000ad84
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x1000ad70
cmp esi, edx
jb 0x1000ad89
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x1000d6e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, 0x72
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0xe], 0x2e0032
mov dword [ebp - 0x16], 0x65006e
mov dword [ebp - 0x1c], 0x65004b
mov dword [ebp - 0xa], 0x6c0064
mov dword [ebp - 0x12], 0x33006c
mov dword [ebp - 6], 0x6c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esp, ebp
pop ebp
ret

Function at 0x1000e9c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, 0x4b
mov word [ebp - 0x1c], ax
xor eax, eax
mov word [ebp - 4], ax
mov eax, 0x64
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0xe], 0x2e0032
mov dword [ebp - 0x1a], 0x720065
mov dword [ebp - 8], 0x6c006c
mov dword [ebp - 0x16], 0x65006e
mov dword [ebp - 0x12], 0x33006c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esp, ebp
pop ebp
ret
Function at 0x1000eaa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, 0x33
mov word [ebp - 0x10], ax
mov eax, 0x64
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x18], 0x610076
mov dword [ebp - 0x14], 0x690070
mov dword [ebp - 0x1c], 0x640041
mov dword [ebp - 8], 0x6c006c
mov dword [ebp - 0xe], 0x2e0032
call fcn.100101d0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x1000ebf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xf], 0x4e6b6565
mov dword [ebp - 0xb], 0x64656d61
mov dword [ebp - 6], 0x657069
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 7], 0x50
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ec3f
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000ec50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 6], 0x6f666e49
mov dword [ebp - 0xb], 0x75747261
mov word [ebp - 0xd], 0x7453
mov word [ebp - 2], 0x57
mov word [ebp - 0x10], 0x6547
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 7], 0x70
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ec97
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret

Function at 0x1000ecf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xb], 0x65736f6c
mov dword [ebp - 7], 0x646e6148
mov word [ebp - 3], 0x656c
mov byte [ebp - 1], 0
mov byte [ebp - 0xc], 0x43
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ed2f
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000ed40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
mov word [ebp - 3], 0x65
mov dword [ebp - 0x1a], 0x6c694674
mov dword [ebp - 0xb], 0x4879426e
mov word [ebp - 6], 0x646e
mov word [ebp - 0x1c], 0x6547
mov dword [ebp - 0x11], 0x74616d72
mov dword [ebp - 0x16], 0x666e4965
mov byte [ebp - 7], 0x61
mov word [ebp - 0xd], 0x6f69
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 4], 0x6c
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000eda6
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret