joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102121aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x103df134], 0x19fb
mov dword [ebp - 0x10], eax
call fcn.10212c0f
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x102121f0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x103df138], 0x2095
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x103df134], 0x1408
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x10212323
jmp 0x10212266
mov eax, dword [ebp - 0x38]
add eax, 1
mov cl, byte [ebp - 0x39]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x3a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x40], eax
jne 0x1021229a
jmp 0x102122c7
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x103df134], 0x19fb
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x54]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x39], bh
mov byte [ebp - 0x3a], cl
jne 0x1021223c
mov al, byte [ebp - 0x3a]
test al, 1
jne 0x102122f6
jmp 0x102122d0
xor eax, eax
mov ecx, dword [ebp - 0x50]
add ecx, 2
mov edx, dword [ebp - 0x4c]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x34], eax
jb 0x10212276
jmp 0x10212323
mov eax, dword [ebp - 0x50]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov dword [0x103df134], 0x15e2
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x103df138], 0x1c9b
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x34]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10212683
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.10212683]
mov ecx, dword [0x103df134]
add ecx, 0xffffe07c
mov dword [0x103df134], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
jne 0x102126c8
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x102126c8
mov eax, dword [ebp - 8]
add esp, 8
pop ebp
ret
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov ecx, dword [0x103df138]
add ecx, 0x1d03
mov dword [0x103df138], ecx
mov dword [ebp - 4], eax
jmp 0x102126a4

Function at 0x10212a63
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x103df13c], 0
mov dword [0x103df140], 0
mov dword [0x103df14c], 0
mov dword [0x103df134], 0x2398
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x10212aca
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x103df13c], edx
mov dword [0x103df134], 0x5d3
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x103df140], edx
mov esi, dword [0x103df138]
add esi, 0xffffe713
mov dword [0x103df138], esi
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x103df144], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x103df134]
add edx, 0x177d
mov dword [0x103df134], edx
mov cl, byte [0x103df144]
mov edx, dword [0x103df140]
mov byte [edi + edx], cl
mov edx, dword [0x103df13c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x103df140]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x103df14c], ebx
mov dword [0x103df138], 0x1220
mov dword [0x103df134], 0x790
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov byte [ebx + edx], cl
mov dword [0x103df134], 0x339
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x38], edx
je 0x10212ac2
mov eax, dword [0x103df13c]
mov ecx, dword [0x103df140]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
jmp 0x10212aca
Function at 0x10212d73
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x38
mov eax, dword [0x103df134]
add eax, 0xfffff2a4
mov dword [0x103df134], eax
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov ecx, 0x141f
xor edx, edx
mov dword [0x103df134], 0x141f
mov esi, dword [ebp - 0xc]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + 0x3c]
mov dword [0x103df138], 0x265b
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
jmp 0x10212e20
mov eax, 1
mov dword [0x103df138], 0x7ef
mov dword [ebp - 0x20], eax
jmp 0x10212f4c
mov eax, dword [ebp - 0x24]
add eax, 0xfffff4cc
mov dword [0x103df138], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x18], 0x6f
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edx
je 0x10212ed0
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
add eax, 0x3e
mov dword [0x103df134], eax
mov dword [ebp - 0x20], ecx
jmp 0x10212f4c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2], 0
mov esi, eax
mov edi, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], edi
je 0x10212e6c
jmp 0x10212e9c
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff6
shl eax, 1
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
cmp word [eax], 0x64
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
je 0x10212eee
jmp 0x10212e09
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov dword [0x103df138], 0x1ecf
mov edx, dword [ebp - 0x14]
cmp word [edx + ecx*2 - 0x1a], 0x6c
mov esi, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
je 0x10212de3
jmp 0x10212e09
mov eax, dword [ebp - 0x34]
add eax, 0xfffff7c5
mov dword [0x103df134], eax
mov ecx, dword [ebp - 0x30]
add ecx, 1
cmp ecx, 0x104
mov edx, eax
mov esi, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x3c], eax
jl 0x10212e20
jmp 0x10212e6c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x16], 0x61
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edx
je 0x10212e43
jmp 0x10212e09
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x12], 0x64
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edx
jne 0x10212e09
mov eax, 0x26c5
mov dword [0x103df134], 0x26c5
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x2c], eax
jne 0x10212e09
mov eax, 0x26c5
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x2c], eax
je 0x10212dcc
jmp 0x10212e09
mov eax, dword [ebp - 0x20]
add esp, 0x38
pop esi
pop edi
pop ebp
ret
Function at 0x418d50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x420b80], ecx
inc edx
cmp edx, 0x100
jb 0x418d52
cmp edx, 0x800
jae 0x418e29
lea esp, [esp]
mov eax, dword [edx*4 + 0x420780]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x420b80]
inc edx
mov dword [edx*4 + 0x420b7c], eax
cmp edx, 0x800
jb 0x418e00
mov eax, 0x419630
mov dword [0x420b74], eax
mov dword [0x422b80], eax
mov dword [0x420b70], 0x419550
call fcn.00419060
test eax, eax
jne 0x418e55
mov dword [0x422b80], 0x419550
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x1004d740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x444], ecx
mov dword [ebp - 0x440], 0
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov byte [ebp - 0x28], 0x25
mov byte [ebp - 0x27], 0x30
mov byte [ebp - 0x26], 0x32
mov byte [ebp - 0x25], 0x64
mov byte [ebp - 0x24], 0x3a
mov byte [ebp - 0x23], 0x25
mov byte [ebp - 0x22], 0x30
mov byte [ebp - 0x21], 0x32
mov byte [ebp - 0x20], 0x64
mov byte [ebp - 0x1f], 0x3a
mov byte [ebp - 0x1e], 0x25
mov byte [ebp - 0x1d], 0x30
mov byte [ebp - 0x1c], 0x32
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x20
mov byte [ebp - 0x19], 0x2d
mov byte [ebp - 0x18], 0x20
mov byte [ebp - 0x17], 0x25
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x32
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x30
mov byte [ebp - 0x10], 0x32
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x3a
mov byte [ebp - 0xd], 0x25
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x20
mov byte [ebp - 0xa], 0x3a
mov byte [ebp - 9], 0x3a
mov byte [ebp - 8], 0x20
mov byte [ebp - 7], 0
movzx ecx, word [ebp - 0x438]
push ecx
movzx edx, word [ebp - 0x436]
push edx
movzx eax, word [ebp - 0x432]
push eax
movzx ecx, word [ebp - 0x42c]
push ecx
movzx edx, word [ebp - 0x42e]
push edx
movzx eax, word [ebp - 0x430]
push eax
movzx ecx, byte [ebp - 0x439]
push ecx
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x468]
call fcn.1004e190
mov ecx, eax
call fcn.1004dfc0
push eax
push 0x2000
lea eax, [ebp - 0x428]
push eax
call fcn.1009dec0
add esp, 0x24
lea ecx, [ebp - 0x428]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10006700
mov edx, dword [ebp - 0x440]
or edx, 1
mov dword [ebp - 0x440], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret 4
Function at 0x1004f480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp + 8], 0
jne 0x1004f49e
jmp 0x1004f544
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 0xa8]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
call dword [0x100e7c9c]
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x102
je 0x1004f544
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x4b
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x20
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d37bf
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret 4

Function at 0x1004f560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp + 8], 0
jne 0x1004f57e
jmp 0x1004f62f
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 0xac]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
call dword [0x100e7c9c]
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1004f62f
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x20
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x63
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d37d5
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret 4
Function at 0x1005a880
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x1005ab60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], ecx
mov ecx, dword [ebp - 0x408]
call fcn.1005a880
nop
push 0x100e470c
mov eax, dword [ebp + 8]
push eax
call fcn.100ac5ae
add esp, 8
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jne 0x1005abb8
mov ecx, dword [ebp + 8]
push ecx
push str._s_cant_be_opened_n
call fcn.10051d30
add esp, 8
jmp 0x1005ac1a
mov edx, dword [ebp - 0x40c]
push edx
push 0x400
push 1
lea eax, [ebp - 0x404]
push eax
call fcn.100aedc6
add esp, 0x10
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
je 0x1005ac00
mov ecx, dword [ebp - 0x410]
push ecx
lea edx, [ebp - 0x404]
push edx
mov ecx, dword [ebp - 0x408]
call fcn.1005a900
nop
jmp 0x1005abb8
mov ecx, dword [ebp - 0x408]
call fcn.1005aa50
mov eax, dword [ebp - 0x40c]
push eax
call fcn.100ae2bb
add esp, 4
mov eax, dword [ebp - 0x408]
add eax, 0x68
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret 4
Function at 0x1005b230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x30], 0x6d
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2d], 0x33
mov byte [ebp - 0x2c], 0x32
mov byte [ebp - 0x2b], 0x2e
mov byte [ebp - 0x2a], 0x64
mov byte [ebp - 0x29], 0x6c
mov byte [ebp - 0x28], 0x6c
mov byte [ebp - 0x27], 0
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x6d
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], pe_nt_image_headers32
mov byte [ebp - 8], 0
mov byte [ebp - 0x14], 0x2e
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x6d
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x66
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100a7930
add esp, 8
test eax, eax
jne 0x1005b325
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100a7930
add esp, 8
test eax, eax
jne 0x1005b325
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100a7930
add esp, 8
test eax, eax
jne 0x1005b325
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100a7930
add esp, 8
test eax, eax
jne 0x1005b325
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100a7930
add esp, 8
test eax, eax
jne 0x1005b325
mov dword [ebp - 0x34], 0
jmp 0x1005b32c
mov dword [ebp - 0x34], 1
movzx eax, byte [ebp - 0x34]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10063d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x55
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x45
mov byte [ebp - 0x19], pe_nt_image_headers32
mov byte [ebp - 0x18], 0x63
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [0x101034a0]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [0x101034a4]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
call dword [0x100e7c9c]
call dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x10063e27
mov edx, dword [ebp - 0x2c]
movzx eax, byte [edx]
cmp eax, 0xe8
je 0x10063dc4
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
jmp 0x10063dac
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 1]
mov ecx, dword [ebp - 0x2c]
lea edx, [eax + ecx + 5]
mov dword [0x1010357c], edx
mov eax, 0x10063bd0
sub eax, dword [ebp - 0x2c]
sub eax, 5
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x28]
push ecx
push 0x40
push 0x1000
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [0x101034a4]
mov ecx, dword [eax + 0x70]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
call dword [0x100e7c9c]
call dword [ebp - 0x34]
push 4
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x2c]
add eax, 1
push eax
call fcn.1009e300
add esp, 0xc
mov dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10069210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100ea6d0
push 0x100a5b10
mov eax, dword fs:[0]
push eax
add esp, 0xfffff778
mov eax, dword [0x100ed440]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x848], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 0x38], 0x6b
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x72
mov byte [ebp - 0x35], 0x6e
mov byte [ebp - 0x34], 0x65
mov byte [ebp - 0x33], 0x6c
mov byte [ebp - 0x32], 0x33
mov byte [ebp - 0x31], 0x32
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x6c
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x28], 0x6e
mov byte [ebp - 0x27], 0x74
mov byte [ebp - 0x26], 0x64
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0x6c
mov byte [ebp - 0x23], 0x2e
mov byte [ebp - 0x22], 0x64
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0x6c
mov byte [ebp - 0x1f], 0
push 0
push 0x101035b4
lea eax, [ebp - 0x38]
push eax
push 2
call fcn.1006a5f0
add esp, 0x10
push 0
push 0x101035b4
lea ecx, [ebp - 0x28]
push ecx
push 3
call fcn.1006a5f0
add esp, 0x10
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x83c], 0
jmp 0x10069301
mov edx, dword [ebp - 0x83c]
add edx, 1
mov dword [ebp - 0x83c], edx
mov ecx, 0x101035b4
call fcn.1006a330
cmp dword [ebp - 0x83c], eax
jae 0x100693c8
push 1
mov eax, dword [ebp - 0x83c]
push eax
mov ecx, 0x101035b4
call fcn.1006a3d0
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x83c]
push edx
mov ecx, 0x101035b4
call fcn.1006a3d0
mov eax, dword [eax + 4]
push eax
call fcn.10069ed0
add esp, 0xc
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 1
je 0x100693c3
mov ecx, dword [ebp - 0x840]
push ecx
mov edx, dword [ebp - 0x83c]
push edx
movzx eax, byte [ebp - 0x841]
push eax
push str.Pre_hook_check_failed1__Step:__d_Error:__d
lea ecx, [ebp - 0x898]
call fcn.1006ac50
mov ecx, eax
call fcn.1006aa80
push eax
push 0x2000
lea ecx, [ebp - 0x438]
push ecx
call fcn.1009dec0
add esp, 0x14
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d46ab
push 0
lea edx, [ebp - 0x438]
push edx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
jmp 0x100692f2
push 0x101035b4
call fcn.1006a170
add esp, 4
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 1
je 0x10069447
mov eax, dword [ebp - 0x840]
push eax
movzx ecx, byte [ebp - 0x842]
push ecx
push str.Module_check_failed1__Error:__d
lea ecx, [ebp - 0x86c]
call fcn.1006b160
mov ecx, eax
call fcn.1000d760
push eax
push 0x2000
lea edx, [ebp - 0x838]
push edx
call fcn.1009dec0
add esp, 0x10
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d46b2
push 0
lea eax, [ebp - 0x838]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov dword [ebp - 4], 0xfffffffe
jmp 0x10069460
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret