joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f005
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0046ef81
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x46f17d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x46f17d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x46f12c
jg 0x46f05e
test eax, eax
je 0x46f122
push 1
push 0x1000
call fcn.004653a9
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x46f084
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x46f119
push 0x8000
push ebx
call fcn.004633b4
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x46f0b0
jg 0x46f0ab
cmp ecx, 0x1000
jb 0x46f0b0
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004680b8
add esp, 0x10
cmp eax, 0xffffffff
je 0x46f0f5
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x46f0ab
jl 0x46f0dc
test ecx, ecx
jne 0x46f09d
push dword [ebp - 0xc]
push ebx
call fcn.004633b4
push esi
call fcn.004659e8
add esp, 0xc
xor edi, edi
jmp 0x46f18e
cmp byte [edi + 0x24], 0
je 0x46f10c
cmp dword [edi + 0x20], 5
jne 0x46f10c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x46f117
mov edi, dword [edi + 0x18]
jmp 0x46f119
xor edi, edi
push esi
call fcn.004659e8
pop ecx
jmp 0x46f18e
test ecx, ecx
jg 0x46f0ee
jl 0x46f12c
test eax, eax
jae 0x46f0ee
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004640e9
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x46f14f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x46f0ee
jmp 0x46f186
push ebx
call fcn.0046a8b7
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x46f0ee
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x46f18e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x46f18b
mov edi, dword [edi + 0x18]
jmp 0x46f18e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004640e9
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x471300
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47132d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47132d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3a8451a4
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x57fa2b57
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10002340
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10002364
xor eax, eax
jmp 0x100023e4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000237b
xor eax, eax
jmp 0x100023e4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x100023c7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x100023c7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x1000239e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x100023d3
xor eax, eax
jmp 0x100023e4
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x100023e1
xor eax, eax
jmp 0x100023e4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100023f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
test ecx, ecx
je 0x10002469
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 7
jmp 0x10002438
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jl 0x1000245e
mov eax, dword [ebp - 4]
and eax, 1
neg eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
shr ecx, 1
mov edx, dword [ebp - 0x14]
and edx, 0xedb88320
xor ecx, edx
mov dword [ebp - 4], ecx
jmp 0x1000242f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x10002404
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x100086a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], ecx
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x24], 0x7a
mov ecx, 1
imul ecx, ecx, 0
mov byte [ebp + ecx - 0x24], 0x49
mov edx, 1
imul edx, edx, 9
mov byte [ebp + edx - 0x24], 0x65
mov eax, 1
imul eax, eax, 0x14
mov byte [ebp + eax - 0x24], 0x63
mov ecx, 1
imul ecx, ecx, 6
mov byte [ebp + ecx - 0x24], 0x6c
mov edx, 1
imul edx, edx, 0x17
mov byte [ebp + edx - 0x24], 0x6f
mov eax, 1
imul eax, eax, 0x15
mov byte [ebp + eax - 0x24], 0x74
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x24], 0x6e
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x24], 0x61
mov eax, 1
imul eax, eax, 3
mov byte [ebp + eax - 0x24], 0x74
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x24], 0x69
mov edx, 1
imul edx, edx, 5
mov byte [ebp + edx - 0x24], 0x61
mov eax, 1
imul eax, eax, 0xb
mov byte [ebp + eax - 0x24], 0x72
mov ecx, 1
imul ecx, ecx, 7
mov byte [ebp + ecx - 0x24], 0x69
mov edx, 1
imul edx, edx, 0xa
mov byte [ebp + edx - 0x24], 0x43
mov eax, 1
imul eax, eax, 0xf
mov byte [ebp + eax - 0x24], 0x63
mov ecx, 1
imul ecx, ecx, 0x16
mov byte [ebp + ecx - 0x24], 0x69
mov edx, 1
imul edx, edx, 0xd
mov byte [ebp + edx - 0x24], 0x74
mov eax, 1
imul eax, eax, 0x18
mov byte [ebp + eax - 0x24], 0x6e
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x24], 0x69
mov edx, 1
imul edx, edx, 0x19
mov byte [ebp + edx - 0x24], 0
mov eax, 1
imul eax, eax, 0x11
mov byte [ebp + eax - 0x24], 0x6c
mov ecx, 1
imul ecx, ecx, 0x12
mov byte [ebp + ecx - 0x24], 0x53
mov edx, 1
imul edx, edx, 0xc
mov byte [ebp + edx - 0x24], 0x69
mov eax, 1
imul eax, eax, 0x13
mov byte [ebp + eax - 0x24], 0x65
mov ecx, 1
imul ecx, ecx, 0xe
mov byte [ebp + ecx - 0x24], 0x69
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp - 4]
call fcn.100169b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000881d
mov eax, dword [ebp - 4]
push eax
call dword [ebp - 8]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10008fe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov eax, 1
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x43
mov ecx, 1
imul ecx, ecx, 0x11
mov byte [ebp + ecx - 0x20], 0x74
mov edx, 1
imul edx, edx, 5
mov byte [ebp + edx - 0x20], 0x65
mov eax, 1
imul eax, eax, 0x12
mov byte [ebp + eax - 0x20], 0x69
mov ecx, 1
imul ecx, ecx, 0xb
mov byte [ebp + ecx - 0x20], 0x63
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x20], 0x69
mov eax, 1
imul eax, eax, 0xe
mov byte [ebp + eax - 0x20], 0x53
mov ecx, 1
imul ecx, ecx, 0x14
mov byte [ebp + ecx - 0x20], 0x6e
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x20], 0x74
mov eax, 1
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul ecx, ecx, 9
mov byte [ebp + ecx - 0x20], 0x74
mov edx, 1
imul edx, edx, 0x15
mov byte [ebp + edx - 0x20], 0
mov eax, 1
imul eax, eax, 0xd
mov byte [ebp + eax - 0x20], 0x6c
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x20], 0x65
mov edx, 1
imul edx, edx, 0xf
mov byte [ebp + edx - 0x20], 0x65
mov eax, 1
imul eax, eax, 0x13
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
imul ecx, ecx, 0xa
mov byte [ebp + ecx - 0x20], 0x69
mov edx, 1
imul edx, edx, 7
mov byte [ebp + edx - 0x20], 0x72
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x20], 0x63
mov ecx, 1
imul ecx, ecx, 0xc
mov byte [ebp + ecx - 0x20], 0x61
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x20], 0x6c
mov eax, 1
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x44
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 4]
call fcn.100169b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10009129
mov edx, dword [ebp - 4]
push edx
call dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1000aa20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 8], 0
mov eax, 2
shl eax, 3
mov ecx, 0x2e
mov word [ebp + eax - 0x38], cx
mov edx, 2
imul edx, edx, 3
mov eax, 0x6e
mov word [ebp + edx - 0x38], ax
mov ecx, 2
shl ecx, 0
mov edx, 0x65
mov word [ebp + ecx - 0x38], dx
mov eax, 2
imul eax, eax, 7
mov ecx, 0x32
mov word [ebp + eax - 0x38], cx
mov edx, 2
imul edx, edx, 0xa
mov eax, 0x6c
mov word [ebp + edx - 0x38], ax
mov ecx, 2
imul ecx, ecx, 0xb
mov edx, 0x6c
mov word [ebp + ecx - 0x38], dx
mov eax, 2
shl eax, 2
mov ecx, 0x65
mov word [ebp + eax - 0x38], cx
mov edx, 2
imul edx, edx, 9
mov eax, 0x64
mov word [ebp + edx - 0x38], ax
mov ecx, 2
imul ecx, ecx, 5
mov edx, 0x6c
mov word [ebp + ecx - 0x38], dx
mov eax, 2
shl eax, 1
mov ecx, 0x72
mov word [ebp + eax - 0x38], cx
mov edx, 2
imul edx, edx, 6
mov eax, 0x33
mov word [ebp + edx - 0x38], ax
mov ecx, 2
imul ecx, ecx, 0
mov edx, 0x4b
mov word [ebp + ecx - 0x38], dx
mov eax, 2
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x38], cx
mov edx, 1
imul edx, edx, 6
mov byte [ebp + edx - 0x1c], 0x75
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x65
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x1c], 0x65
mov edx, 1
imul edx, edx, 0xc
mov byte [ebp + edx - 0x1c], 0x65
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x6f
mov ecx, 1
imul ecx, ecx, 0xb
mov byte [ebp + ecx - 0x1c], 0x6c
mov edx, 1
imul edx, edx, 3
mov byte [ebp + edx - 0x1c], 0x4d
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x1c], 0x65
mov ecx, 1
imul ecx, ecx, 0x12
mov byte [ebp + ecx - 0x1c], 0
mov edx, 1
imul edx, edx, 5
mov byte [ebp + edx - 0x1c], 0x64
mov eax, 1
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x46
mov ecx, 1
imul ecx, ecx, 0x11
mov byte [ebp + ecx - 0x1c], 0x57
mov edx, 1
imul edx, edx, 0xf
mov byte [ebp + edx - 0x1c], 0x6d
mov eax, 1
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x69
mov ecx, 1
imul ecx, ecx, 7
mov byte [ebp + ecx - 0x1c], 0x6c
mov edx, 1
imul edx, edx, 0xd
mov byte [ebp + edx - 0x1c], 0x4e
mov eax, 1
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x47
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x1c], 0x74
mov edx, 1
imul edx, edx, 0xe
mov byte [ebp + edx - 0x1c], 0x61
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000ac39
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1000dec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov dword [ebp - 4], ecx
mov eax, 0x101
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1b0]
push ecx
movzx edx, word [ebp - 0x1c]
push edx
call dword [0x1007172c]
push 6
push 1
push 2
call dword [0x1007171c]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x78], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x78], 0xffffffff
jne 0x1000df0f
call dword [0x10071720]
xor al, al
jmp 0x1000e060
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0xc], 0x4e
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0xc], 0x49
mov edx, 1
imul edx, edx, 0
mov byte [ebp + edx - 0xc], 0x50
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0xc], 0
mov ecx, 1
imul ecx, ecx, 3
mov byte [ebp + ecx - 0xc], 0x47
mov edx, 2
mov eax, dword [ebp - 4]
mov word [eax + 0x40c0], dx
mov ecx, 1
imul ecx, ecx, 5
mov byte [ebp + ecx - 0x18], 0x2e
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x18], 0x32
mov eax, 1
imul eax, eax, 6
mov byte [ebp + eax - 0x18], 0x30
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x18], 0x31
mov edx, 1
imul edx, edx, 3
mov byte [ebp + edx - 0x18], 0x2e
mov eax, 1
imul eax, eax, 9
mov byte [ebp + eax - 0x18], 0
mov ecx, 1
imul ecx, ecx, 0
mov byte [ebp + ecx - 0x18], 0x31
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x18], 0x37
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x18], 0x30
mov ecx, 1
imul ecx, ecx, 7
mov byte [ebp + ecx - 0x18], 0x2e
lea edx, [ebp - 0x18]
push edx
call dword [0x10071724]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40c4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4170]
add eax, 0xcee
push eax
call dword [0x10071728]
mov ecx, dword [ebp - 4]
mov word [ecx + 0x40c2], ax
push 0x10
mov edx, dword [ebp - 4]
add edx, 0x40c0
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
call dword [0x10071730]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x1000e04a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x78]
push eax
call dword [0x1007173c]
call dword [0x10071720]
xor al, al
jmp 0x1000e060
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.100184b0
mov ecx, dword [ebp - 4]
call fcn.10017070
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1000e7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov eax, 1
imul eax, eax, 0x13
mov byte [ebp + eax - 0x20], 0x6e
mov ecx, 1
imul ecx, ecx, 0x12
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul edx, edx, 6
mov byte [ebp + edx - 0x20], 0x72
mov eax, 1
imul eax, eax, 0xe
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul ecx, ecx, 0xc
mov byte [ebp + ecx - 0x20], 0x6c
mov edx, 1
imul edx, edx, 0xa
mov byte [ebp + edx - 0x20], 0x63
mov eax, 1
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x43
mov ecx, 1
imul ecx, ecx, 0x11
mov byte [ebp + ecx - 0x20], 0x69
mov edx, 1
imul edx, edx, 0xf
mov byte [ebp + edx - 0x20], 0x63
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x20], 0x6e
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x20], 0x72
mov edx, 1
imul edx, edx, 0
mov byte [ebp + edx - 0x20], 0x45
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x20], 0x74
mov ecx, 1
imul ecx, ecx, 3
mov byte [ebp + ecx - 0x20], 0x65
mov edx, 1
imul edx, edx, 0x14
mov byte [ebp + edx - 0x20], 0
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x20], 0x74
mov ecx, 1
imul ecx, ecx, 0xb
mov byte [ebp + ecx - 0x20], 0x61
mov edx, 1
imul edx, edx, 7
mov byte [ebp + edx - 0x20], 0x69
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x20], 0x74
mov ecx, 1
imul ecx, ecx, 9
mov byte [ebp + ecx - 0x20], 0x69
mov edx, 1
imul edx, edx, 0xd
mov byte [ebp + edx - 0x20], 0x53
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
call fcn.100169b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000e91c
mov ecx, dword [ebp - 4]
push ecx
call dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1000f250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x31
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x14], 0x31
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x14], 0x37
mov eax, 1
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x30
mov ecx, 1
imul ecx, ecx, 3
mov byte [ebp + ecx - 0x14], 0x2e
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x14], 0x32
mov eax, 1
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x2e
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x14], 0x30
mov edx, 1
imul edx, edx, 5
mov byte [ebp + edx - 0x14], 0x2e
mov eax, 1
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x78]
push edx
call dword [0x1007173c]
push 6
push 1
push 2
call dword [0x1007171c]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x78], eax
mov edx, 2
mov eax, dword [ebp - 4]
mov word [eax + 0x40c0], dx
lea ecx, [ebp - 0x14]
push ecx
call dword [0x10071724]
mov edx, dword [ebp - 4]
mov dword [edx + 0x40c4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4170]
add ecx, 0xcee
push ecx
call dword [0x10071728]
mov edx, dword [ebp - 4]
mov word [edx + 0x40c2], ax
push 0x10
mov eax, dword [ebp - 4]
add eax, 0x40c0
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x78]
push edx
call dword [0x10071730]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000f362
xor al, al
jmp 0x1000f364
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10011120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov eax, 1
imul eax, eax, 0xf
mov byte [ebp + eax - 0x20], 0x63
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x20], 0x65
mov edx, 1
imul edx, edx, 0xe
mov byte [ebp + edx - 0x20], 0x65
mov eax, 1
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x4c
mov ecx, 1
imul ecx, ecx, 0x12
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul edx, edx, 5
mov byte [ebp + edx - 0x20], 0x43
mov eax, 1
imul eax, eax, 0x14
mov byte [ebp + eax - 0x20], 0
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x20], 0x74
mov edx, 1
imul edx, edx, 3
mov byte [ebp + edx - 0x20], 0x76
mov eax, 1
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x69
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x20], 0x61
mov edx, 1
imul edx, edx, 0xb
mov byte [ebp + edx - 0x20], 0x61
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x20], 0x74
mov ecx, 1
imul ecx, ecx, 0x13
mov byte [ebp + ecx - 0x20], 0x6e
mov edx, 1
imul edx, edx, 7
mov byte [ebp + edx - 0x20], 0x69
mov eax, 1
imul eax, eax, 0xc
mov byte [ebp + eax - 0x20], 0x6c
mov ecx, 1
imul ecx, ecx, 0xa
mov byte [ebp + ecx - 0x20], 0x63
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x20], 0x65
mov eax, 1
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x72
mov ecx, 1
imul ecx, ecx, 0xd
mov byte [ebp + ecx - 0x20], 0x53
mov edx, 1
imul edx, edx, 0x11
mov byte [ebp + edx - 0x20], 0x69
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
call fcn.100169b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1001125c
mov ecx, dword [ebp - 4]
push ecx
call dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10011260
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
movzx eax, byte [0x100532a1]
test eax, eax
jne 0x10011279
jmp 0x10011393
mov ecx, 2
shl ecx, 0
mov edx, 0x70
mov word [ebp + ecx - 0x18], dx
mov eax, 2
imul eax, eax, 0
mov ecx, 0x55
mov word [ebp + eax - 0x18], cx
mov edx, 2
shl edx, 2
mov eax, 0x6d
mov word [ebp + edx - 0x18], ax
mov ecx, 2
imul ecx, ecx, 3
mov edx, 0x54
mov word [ebp + ecx - 0x18], dx
mov eax, 2
shl eax, 1
mov ecx, 0x64
mov word [ebp + eax - 0x18], cx
mov edx, 2
imul edx, edx, 5
xor eax, eax
mov word [ebp + edx - 0x18], ax
lea ecx, [ebp - 0x18]
push ecx
push 0x5a0
mov ecx, dword [ebp - 8]
call fcn.10009ff0
test eax, eax
jne 0x100112fb
jmp 0x10011393
push 0x5a0
mov ecx, dword [ebp - 8]
call fcn.1000a7c0
test eax, eax
jne 0x10011311
jmp 0x10011393
mov byte [ebp - 1], 0
push str.GlobalChronoSpeedupUpdMutex
push 0
push 0x100000
call fcn.1001b9b0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10011344
mov edx, dword [ebp - 0xc]
push edx
call fcn.10019020
add esp, 4
mov byte [ebp - 1], 1
jmp 0x10011353
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10011353
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001135d
jmp 0x10011393
cmp dword [0x100532ac], 0
je 0x10011375
mov ecx, dword [0x100532ac]
push ecx
call fcn.10019020
add esp, 4
push 0
push 0
mov edx, dword [ebp - 8]
push edx
push 0x10015600
push 0
push 0
call fcn.10019800
add esp, 0x18
mov dword [0x100532ac], eax
mov esp, ebp
pop ebp
ret

Function at 0x10018ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 1
call fcn.10018b80
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001900d
mov eax, 1
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x53
mov ecx, 1
imul ecx, ecx, 0xf
mov byte [ebp + ecx - 0x1c], 0
mov edx, 1
imul edx, edx, 0xc
mov byte [ebp + edx - 0x1c], 0x69
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x44
mov ecx, 1
imul ecx, ecx, 3
mov byte [ebp + ecx - 0x1c], 0x49
mov edx, 1
imul edx, edx, 0
mov byte [ebp + edx - 0x1c], 0x43
mov eax, 1
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x72
mov ecx, 1
imul ecx, ecx, 0xd
mov byte [ebp + ecx - 0x1c], 0x6e
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x1c], 0x53
mov eax, 1
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x74
mov ecx, 1
imul ecx, ecx, 0xe
mov byte [ebp + ecx - 0x1c], 0x67
mov edx, 1
imul edx, edx, 0xb
mov byte [ebp + edx - 0x1c], 0x72
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x4c
mov ecx, 1
imul ecx, ecx, 5
mov byte [ebp + ecx - 0x1c], 0x46
mov edx, 1
imul edx, edx, 7
mov byte [ebp + edx - 0x1c], 0x6f
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x6d
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10019003
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret