joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fba49
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, 0x7e
bswap edi
xchg byte [esp + 8], dh
setae dh
push word [esp + 0xf]
jmp 0x6fba68
jmp 0x6fba31
xchg edx, eax
xchg word [esp + 0xf], di
neg di
rdtsc
lea eax, [edi*4]
jmp 0x6fbbf2
pop word [esp + 9]
xchg edx, edi
xchg dword [esp], edi
btc edi, edi
mov dx, 0xfdb9
push dword [esp + 6]
jmp 0x6fba4b
pushal
pop dword [esp + 0x1e]
setg ah
mov word [esp + 2], di
lea edx, [eax - 0x63385857]
xchg dword [esp + 0xf], edi
jmp 0x6fbb25
lea esp, [esp + 3]
xchg word [esp + 4], di
mov edx, dword [esp]
mov dword [esp], eax
clc
shl edi, 0x1f
jmp 0x6fba9e
inc dh
lea edi, [ebx*4]
mov dx, word [esp + 0xc]
rdtsc
pop edx
lea edi, [esi - 0xe5]
jmp 0x6fbac0
mov dx, sp
mov word [esp + 0x1c], di
add esp, 0x23
mov di, 0xcfad
bsf di, si
xchg word [esp], di
jmp 0x6fbb6d
add esp, 9
lea edi, [ecx - 0xbb]
cmc
dec eax
mov word [esp + 0x10], bx
pushal
jmp 0x6fbb00
pop di
lea edx, [edx + edi]
bswap eax
neg edi
mov edi, 0xd93dbbf4
mov edi, eax
jmp 0x6fbae7
lea edx, [esi - 0x1d]
call fcn.006fbb9d
lea esp, [esp + 0x45]
mov dl, 0xd4
xor edx, esi
push edx
xor dl, ch
mov ax, 0x915d
jmp 0x6fbb84
mov dh, byte [esp + 0xf]
mov dword [esp + 8], ecx
pop di
mov dh, byte [esp + 0xf]
push dword [esp + 0xc]
sub esp, 8
jmp 0x6fbb4f
mov di, word [esp + 2]
rcr edx, 0x19
pop di
xchg edx, eax
bsr di, cx
jmp 0x6fbbd6
mov dh, 0x70
lea edi, [eax*4]
neg dx
xchg edi, eax
mov al, 0x5e
bsr ax, cx
jmp 0x6fbe30
mov word [esp], bx
inc di
xchg ah, dh
lea edi, [esi*4]
mov di, 0xbc9d
stc
jmp 0x6fbbb0
lea eax, [ecx + 0x4f83029b]
mov dh, bh
lea esp, [esp + 7]
ror dh, 7
mov edx, 0x3548b20a
mov di, ax
jmp 0x6fbb3d
lea edi, [ecx*4]
call fcn.006fbd3f
mov edi, 0x4172b3c
mov di, word [esp + 2]
lea edi, [ecx + ebx]
xchg dx, di
push dword [esp]
pop dword [esp]
jmp 0x6fbed8
sub esp, 0xe
bswap edi
push dword [esp + 0xc]
stc
bt edi, edx
jmp 0x6fbf65
mov dx, 0x2bc3
bsr dx, cx
rdtsc
lea esp, [esp + 3]
mov dh, ch
jmp 0x6fbeab
mov eax, dword [esp + 3]
mov dword [esp], esi
mov dword [esp], ecx
lea edi, [ebp + 0x61391c27]
xchg word [esp + 1], di
xchg dh, al
jmp 0x6fbec1
pop di
xchg dword [esp + 9], edi
push dword [esp + 0xb]
bswap eax
push word [esp + 0xc]
cld
jmp 0x6fbfe5
mov eax, 0x2922e606
setl dh
mov byte [esp + 0x11], dh
mov byte [esp + 0xd], bh
lea esp, [esp + 2]
mov ax, word [esp + 0xd]
jmp 0x6fbf3c
dec edx
not di
push dword [esp + 4]
inc dx
push esp
xchg byte [esp + 0x22], al
jmp 0x6fbfb4
mov dword [esp + 0x26], ecx
bsr di, cx
pop dword [esp + 0x10]
push dword [esp + 0xb]
jmp 0x6fd22f
mov eax, ebp
mov dh, byte [esp + 1]
sub esp, 0xe
xchg ah, dh
mov dh, byte [esp + 0xa]
push dword [esp + 0xe]
jmp 0x6fbf9f
mov eax, dword [esp + 1]
btc edx, ebx
pop edx
clc
bswap edi
not dh
jmp 0x6fbfca
btr edi, esp
rdtsc
bsf ax, si
mov dx, si
pushal
setae ah
call fcn.006fc0d9
mov byte [esp + 0x1f], ch
mov eax, edx
sub esp, 0x18
lea edi, [eax + edi]
call fcn.006fc344
sub esp, 0x14
mov byte [esp + 0x2b], dh
push word [esp + 0x24]
lea esp, [esp + 0x41]
not dx
mov edx, 0xe8029788
jmp 0x6fc12a
Function at 0x6fbd85
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], sp
jmp 0x6fbded
shr edi, 0xb
lea esp, [esp + 3]
mov di, word [esp]
sub esp, 0x1c
clc
inc edx
jmp 0x6fbef6
mov dx, 0x6de3
mov di, bx
mov dh, byte [esp + 3]
inc dh
jmp 0x6fbe3c
sub esp, 0x1a
rol di, cl
lea esp, [esp + 0x33]
lea edi, [esi*4]
lea eax, [ebx*4]
jmp 0x6fbe58
mov eax, 0xb3c12cda
lea edx, [esp + ebx]
lea edx, [ebx*4]
xchg dword [esp + 7], edi
mov edx, dword [esp + 0xa]
stc
jmp 0x6fbe70
btc edi, ebx
mov word [esp + 5], sp
xor eax, esi
lea eax, [ecx - 0xfb]
mov dh, byte [esp + 5]
cmc
jmp 0x6fbe91

Function at 0x6fc0f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp]
push dword [esp + 2]
mov byte [esp + 7], ch
lea esp, [esp + 9]
jmp 0x6fc0f6
inc edi
jmp 0x6fc0db
push word [esp + 1]
xchg dword [esp], edi
lea edi, [ebx*4]
jmp 0x6fcb37
mov word [esp + 0x17], sp
push dword [esp + 0x1d]
mov byte [esp + 0x11], dh
mov dh, bh
mov ax, bx
xchg byte [esp + 0xa], dh
jmp 0x6fc13f
lea esp, [esp]
mov edi, 0x156d80fc
not dh
lea edi, [ebp*4]
pushal
rdtsc
jmp 0x6fc160
mov ax, dx
lea esp, [esp + 3]
mov di, 0xe11d
add esp, 0
not eax
rdtsc
jmp 0x6fc495

Function at 0x6fc22e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 3
jmp 0x6fc25a
lea eax, [esp + esi]
not dh
rdtsc
mov di, 0x849
mov word [esp], di
mov word [esp], sp
jmp 0x6fc308
bswap edx
bswap edx
lea esp, [esp + 3]
neg ax
cmc
push edx
jmp 0x6fc319
rdtsc
mov byte [esp + 3], dh
setl dh
pop edx
pop eax
lea edi, [eax*4]
jmp 0x6fc2d5
sub esp, 0x10
rdtsc
pop word [esp + 1]
not edi
pop eax
mov edx, ebp
jmp 0x6fc2ec
mov dh, byte [esp + 4]
btc edi, edi
push word [esp + 3]
lea edi, [edi*4]
lea edi, [ecx - 0x93]
mov edi, 0x53a65fee
jmp 0x6fc44c
mov edx, 0x98d1982e
pop edx
clc
sub esp, 0x1e
mov dword [esp + 0x2d], eax
add esp, 0x3b
jmp 0x6fc3a8
xchg di, ax
bswap edi
mov dword [esp], esi
pushal
mov dh, 0x50
xchg byte [esp + 0x1c], dh
jmp 0x6fc350
stc
btr edi, edx
xchg word [esp], dx
mov al, ah
pop dx
xchg edi, eax
jmp 0x6fc41c
bsr di, bp
lea edi, [ecx + 0x1b]
setno dh
lea edx, [ecx + edx]
mov di, sp
lea edx, [edx*4]
jmp 0x6fc382
xchg dword [esp], edi
mov dh, byte [esp]
pop word [esp]
mov di, cx
neg dh
rcl edi, 0x1b
jmp 0x6fc405
setl dh
xor dl, ch
lea edi, [eax - 0x1f76de0f]
push esp
bsf di, ax
mov edx, esp
jmp 0x6fc3c1
mov di, ax
setle dh
sub esp, 6
xchg ah, dh
neg di
jmp 0x6fc430
lea edi, [eax - 0x1873409f]
mov di, ax
push word [esp]
rol di, cl
jmp 0x6fc3ef
btc eax, edi
inc dh
mov di, word [esp]
mov al, ah
setb dh
mov di, word [esp]
jmp 0x6fc3db
mov al, 0x2e
call fcn.006fc47e
mov ecx, 0x28d9be28
invalid
mov di, word [esp + 1]
inc dx
rcr dh, 5
lea esp, [esp + 3]
bsr di, cx
mov al, 0xe
jmp 0x6fc372
Function at 0x6feda0
Capabilities:
Parse pe header

Disassembly:
call fcn.006fe014
pop dword [esp]
lea esp, [esp + 3]
mov dword [esp + 0x54], esp
call fcn.006fed2c
or byte [ebp + 0xca7540d], bl
insb byte es:[edi], dx
jg 0x6fedff
int1
pop dword [esp + 6]
push word [esp + 1]
mov word [esp], bx
mov dword [esp], ecx
lea esp, [esp + 2]
jmp 0x6fee2b
mov byte ds:[edi + 0x241c8966], ah
jmp 0x6fede9
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x6fee8f
mov dword [esp + 0x80], edi
lea esp, [esp + 0x80]
jmp 0x6fee08
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x6fe00f

Function at 0x6fee02
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.006fe014
pop dword [esp]
lea esp, [esp + 3]
mov dword [esp + 0x54], esp
call fcn.006fed2c
or byte [ebp + 0xca7540d], bl
insb byte es:[edi], dx
jg 0x6fedff
int1
pop dword [esp + 6]
push word [esp + 1]
mov word [esp], bx
mov dword [esp], ecx
lea esp, [esp + 2]
jmp 0x6fee2b
mov byte ds:[edi + 0x241c8966], ah
jmp 0x6fede9
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x6fee8f
mov dword [esp + 0x80], edi
lea esp, [esp + 0x80]
jmp 0x6fee08
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x6fe00f
Function at 0x4029b6
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x404034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x20c]
push 0x208
push edi
push eax
mov esi, ecx
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
call sub.msvcrt.dll_memset
add esp, 0xc
test esi, esi
je 0x402aaf
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push edi
push 0x4013b8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402a9b
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x206
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push 0x4011fc
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402a9b
cmp dword [ebp - 0x218], 2
lea eax, [ebp - 0x20c]
jne 0x402a7f
push 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x214], eax
jmp 0x402a9b
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402a9b
push ecx
lea eax, [ebp - 0x20c]
push eax
push ecx
mov ecx, esi
call fcn.00401b20
cmp dword [ebp - 0x210], edi
je 0x402aaf
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00403430
leave
ret
Function at 0x403190
Capabilities:
Terminate process

Disassembly:
call fcn.0040383b
jmp 0x4031a0
push 0x58
push 0x403a30
call fcn.00403900
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x4043b4
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x4031f2
cmp eax, esi
jne 0x4031e5
xor esi, esi
inc esi
mov edi, esi
jmp 0x4031f5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4031c9
xor esi, esi
inc esi
cmp dword [0x4043b8], esi
jne 0x403207
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x403241
cmp dword [0x4043b8], ebx
jne 0x40323b
mov dword [0x4043b8], esi
push 0x4011b4
push 0x4011a8
call fcn.00403385
pop ecx
pop ecx
test eax, eax
je 0x403241
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40336f
mov dword [0x404044], esi
cmp dword [0x4043b8], esi
jne 0x403264
push 0x4011a4
push 0x40119c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x4043b8], 2
test edi, edi
jne 0x403271
xor eax, eax
mov ecx, 0x4043b4
xchg dword [ecx], eax
cmp dword [0x4043bc], 0
je 0x40329d
push 0x4043bc
call fcn.00403730
pop ecx
test eax, eax
je 0x40329d
push ebx
push 2
push ebx
mov esi, dword [0x4043bc]
mov ecx, esi
call dword [0x405130]
call esi
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x4032fb
test cl, cl
je 0x4032ca
test edi, edi
jne 0x4032fb
test cl, cl
je 0x4032ca
cmp cl, 0x20
ja 0x4032ca
inc esi
mov dword [ebp - 0x1c], esi
mov cl, byte [esi]
jmp 0x4032b9
test byte [ebp - 0x3c], 1
je 0x4032d6
movzx eax, word [ebp - 0x38]
jmp 0x4032d9
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x404040], eax
cmp dword [0x404058], 0
jne 0x403354
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x40330c
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x40331f
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4032aa
cmp dword [0x404044], 0
jne 0x403368
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x404040]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403600
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x403a50
call fcn.00403900
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x403660
cmp eax, 0xffffffff
je 0x403660
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x403659
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x403659
cmp edx, 0x10000000
jae 0x403659
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x403656
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4036e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40371e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x403716
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x403720
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x403706
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403800
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x403831
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x403831
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x403831
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x5e01fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x5e01fb
lcall 0x5de5, 0x8b10c483
jmp loc.00eeb8cc
Function at 0xef2502
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0xeee650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0xef2520
push eax
call dword [fcn.00eee020]
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
movzx eax, word [ebx + 0x14]
push dword [ebx + 0x88]
lea eax, [eax + ebx + 0x18]
push ebx
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], eax
call fcn.00eefa97
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
je 0xef25e4
movzx eax, word [ebx + 6]
and dword [ebp - 0x14], 0
test eax, eax
push esi
push edi
jle 0xef258f
mov edi, dword [ebp - 0x10]
push 2
pop ecx
lea esi, [ebp - 0xc]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0xef258f
add dword [ebp - 0x10], 0x28
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0xef2574
cmp dword [ebp - 0x14], eax
je 0xef25e2
mov eax, dword [ebp - 0x10]
mov edx, dword [ebx + 0x34]
add edx, dword [eax + 0xc]
push 4
pop ecx
mov edi, 0xeeff78
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0xef25e2
push 4
pop ecx
mov edi, 0xeeff78
lea esi, [edx + 0x140]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0xef25e2
cmp dword [edx + 0x124], eax
je 0xef25d0
push 0xef2304
jmp 0xef25d5
push 0xef24ea
push ebx
push dword [ebp - 0x18]
push edx
call fcn.00ef20db
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00ef3534
leave
ret
Function at 0xf05d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
xor ebp, ebp
test esi, esi
je 0xf05db0
mov eax, dword [esi + 0x3c]
push ebx
push edi
mov edi, dword [eax + esi + 0x78]
add edi, esi
xor ebx, ebx
cmp dword [edi + 0x18], ebx
jbe 0xf05da9
mov edi, edi
mov ecx, dword [edi + 0x20]
lea edx, [ecx + ebx*4]
mov eax, dword [edx + esi]
mov ecx, dword [esp + 0x18]
add eax, esi
test eax, 0xffff0000
je 0xf05d7f
test ecx, 0xffff0000
je 0xf05d7f
push ecx
push eax
call dword [0x10078068]
neg eax
sbb eax, eax
add eax, 1
jmp 0xf05d88
xor edx, edx
cmp eax, ecx
sete dl
mov eax, edx
test eax, eax
je 0xf05da1
mov eax, dword [edi + 0x24]
lea ecx, [eax + ebx*2]
movzx edx, word [ecx + esi]
mov eax, dword [edi + 0x1c]
lea ecx, [eax + edx*4]
mov ebp, dword [ecx + esi]
add ebp, esi
add ebx, 1
cmp ebx, dword [edi + 0x18]
jb 0xf05d50
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
ret
pop esi
mov eax, ebp
pop ebp
ret
Function at 0xf17920
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], 0x1007aa44
lea esi, [edi + 4]
push 0x100
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.00f05960
mov dword [esi], eax
mov ecx, 0x20
mov dword [esi + 4], ebx
add esp, 8
mov byte [eax], bl
mov eax, 1
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xac], ecx
push 0x1007829c
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0x10000
mov dword [esp + 0x24], 0x1007aa3c
mov dword [esp + 0x28], 0x20000
mov dword [esp + 0x2c], 0x1007aa2c
mov dword [esp + 0x30], 0x100000
mov dword [esp + 0x34], 0x1007aa20
mov dword [esp + 0x38], 0x40000
mov dword [esp + 0x3c], 0x1007aa14
mov dword [esp + 0x40], 0x80000
mov dword [esp + 0x44], 0x1007aa08
mov dword [esp + 0x48], 0x80000000
mov dword [esp + 0x4c], 0x1007a9f8
mov dword [esp + 0x50], 0x40000000
mov dword [esp + 0x54], 0x1007a9e8
mov dword [esp + 0x58], 0x20000000
mov dword [esp + 0x5c], 0x1007a9d8
mov dword [esp + 0x60], 0x10000000
mov dword [esp + 0x64], 0x1007a9cc
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x1007a9bc
mov dword [esp + 0x70], 0x80
mov dword [esp + 0x74], 0x1007a9a4
mov dword [esp + 0x78], 8
mov dword [esp + 0x7c], 0x1007a994
mov dword [esp + 0x80], 2
mov dword [esp + 0x84], 0x1007a984
mov dword [esp + 0x88], 0x100
mov dword [esp + 0x8c], 0x1007a96c
mov dword [esp + 0x90], 0x10
mov dword [esp + 0x94], 0x1007a95c
mov dword [esp + 0x98], 4
mov dword [esp + 0x9c], 0x1007a948
mov dword [esp + 0xa4], 0x1007a938
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], 0x1007a924
mov dword [esp + 0xb4], 0x1007a914
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00f06370
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.00f06370
cmp ebp, ebx
je 0xf17adf
push ebp
call fcn.00f05a10
add esp, 4
xor ebp, ebp
mov eax, dword [esp + ebp*8 + 0x1c]
test dword [esp + 0x120], eax
je 0xf17b14
not eax
and dword [esp + 0x120], eax
cmp dword [edi + 8], ebx
je 0xf17b08
push 0x1007a910
mov ecx, esi
call fcn.00f088d0
mov eax, dword [esp + ebp*8 + 0x20]
push eax
mov ecx, esi
call fcn.00f088d0
add ebp, 1
cmp ebp, 0x13
jb 0xf17ae1
cmp dword [edi + 8], ebx
jne 0xf17b63
push 0x1007a908
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00f06370
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.00f06370
cmp ebp, ebx
je 0xf17b9f
push ebp
call fcn.00f05a10
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
mov eax, dword [esp + 0x120]
cmp eax, ebx
je 0xf17b9f
push eax
lea ecx, [esp + 0x20]
push 0x1007a900
push ecx
call dword [0x10078248]
add esp, 0xc
cmp dword [edi + 8], ebx
je 0xf17b93
push 0x1007a910
mov ecx, esi
call fcn.00f088d0
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.00f088d0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
Function at 0xf180f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x17c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], 0x1007aa44
lea esi, [edi + 4]
push 0x100
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.00f05960
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
push 0x1007829c
lea ecx, [esp + 0x14]
mov byte [eax], bl
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x1007acb4
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x2c], 0x1007ac9c
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], 0x1007ac88
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], 0x1007ac70
mov dword [esp + 0x40], 0x800
mov dword [esp + 0x44], 0x1007ac5c
mov dword [esp + 0x48], 8
mov dword [esp + 0x4c], 0x1007ac3c
mov dword [esp + 0x50], 0x10
mov dword [esp + 0x54], 0x1007ac20
mov dword [esp + 0x58], 0x20
mov dword [esp + 0x5c], 0x1007ac00
mov dword [esp + 0x60], 0x80
mov dword [esp + 0x64], 0x1007abe4
mov dword [esp + 0x68], 0x100
mov dword [esp + 0x6c], 0x1007abc8
mov dword [esp + 0x70], 0x200
mov dword [esp + 0x74], 0x1007abb0
mov dword [esp + 0x78], 0x1000
mov dword [esp + 0x7c], 0x1007ab98
mov dword [esp + 0x80], 0x2000
mov dword [esp + 0x84], 0x1007ab80
mov dword [esp + 0x88], 0x4000
mov dword [esp + 0x8c], 0x1007ab64
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00f06370
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.00f06370
cmp ebp, ebx
je 0xf18247
push ebp
call fcn.00f05a10
add esp, 4
mov ebx, dword [esp + 0x190]
xor ebp, ebp
mov eax, dword [esp + ebp*8 + 0x1c]
test ebx, eax
je 0xf1827a
not eax
and ebx, eax
cmp dword [edi + 8], 0
je 0xf1826e
push 0x1007a910
mov ecx, esi
call fcn.00f088d0
mov eax, dword [esp + ebp*8 + 0x20]
push eax
mov ecx, esi
call fcn.00f088d0
add ebp, 1
cmp ebp, 0xe
jb 0xf18250
xor ebp, ebp
cmp dword [edi + 8], ebp
jne 0xf182cb
push 0x1007a908
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.00f06370
mov ebx, dword [esp + 0x10]
push ebx
mov ecx, esi
call fcn.00f06370
cmp ebx, ebp
je 0xf18306
push ebx
call fcn.00f05a10
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret 4
cmp ebx, ebp
je 0xf18306
push ebx
lea ecx, [esp + 0x90]
push 0x1007a900
push ecx
call dword [0x10078248]
add esp, 0xc
cmp dword [edi + 8], ebp
je 0xf182f7
push 0x1007a910
mov ecx, esi
call fcn.00f088d0
lea edx, [esp + 0x8c]
push edx
mov ecx, esi
call fcn.00f088d0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret 4
Function at 0xf391d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov dx, word [eax]
shr dx, 1
push esi
movzx esi, dx
xor ecx, ecx
test si, si
push edi
mov word [esp + 8], 0x5c
mov word [esp + 0xa], 0x2f
mov word [esp + 0xc], 0x3a
mov word [esp + 0xe], 0x2a
mov word [esp + 0x10], 0x3f
mov word [esp + 0x12], 0x22
mov word [esp + 0x14], 0x3c
mov word [esp + 0x16], 0x3e
mov word [esp + 0x18], 0x7c
jbe 0xf39257
mov edi, dword [eax + 4]
jmp 0xf39230
movzx edx, cx
movzx edx, word [edi + edx*2]
xor eax, eax
lea esp, [esp]
cmp dx, word [esp + eax*2 + 8]
je 0xf39262
add eax, 1
cmp eax, 9
jb 0xf39240
add ecx, 1
cmp cx, si
jb 0xf39230
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0xf793a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 8], 1
push 0x10087b98
push 0x10087ba8
call dword [0x10078210]
push eax
call dword [0x10078218]
mov dword [0x10176b68], eax
push 0x10087bbc
push 0x10087bcc
call dword [0x10078210]
push eax
call dword [0x10078218]
mov dword [0x10176b64], eax
push 0x10087be0
push 0x10087bf4
call dword [0x10078210]
push eax
call dword [0x10078218]
mov dword [0x10176b60], eax
push 0
call dword [0x10078210]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], 0
jmp 0xf7944d
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x18], edx
jge 0xf79529
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x28
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
push 9
lea ecx, [ebp - 0x3c]
push ecx
call dword [0x10176b68]
push 8
mov edx, dword [ebp - 0x30]
push edx
lea eax, [ebp - 0x3c]
push eax
call dword [0x10176b64]
mov byte [ebp - 0x28], 0xac
mov byte [ebp - 0x27], 5
mov byte [ebp - 0x26], 0x45
mov byte [ebp - 0x25], 0x67
mov byte [ebp - 0x24], 0x89
mov byte [ebp - 0x23], 0
mov byte [ebp - 0x22], 0xff
mov byte [ebp - 0x21], 0xfa
mov byte [ebp - 0x20], 0x15
mov byte [ebp - 0x1f], 6
mov byte [ebp - 0x1e], 2
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + edx - 0xb]
mov dword [ebp - 0x40], ecx
jmp 0xf794de
mov edx, dword [ebp - 0x40]
sub edx, 1
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x2c]
jb 0xf79524
push 0xb
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x40]
push edx
call dword [0x10176b60]
cmp eax, 0xb
jne 0xf79522
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax - 4]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x40]
sub edx, 4
sub edx, dword [ebp - 0x44]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.00f784d0
mov dword [ebp - 8], eax
jmp 0xf79524
jmp 0xf794d5
jmp 0xf79444
mov esp, ebp
pop ebp
ret