joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435d60
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 4], eax
cmp dword [0x4427d4], 0
jne 0x435d8c
push 0x1019
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x435d8c
xor eax, eax
jmp 0x435dc0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp eax, 0xfffffffe
je 0x435d9b
xor eax, eax
jmp 0x435dc0
push 0x10022
call dword [ebp - 4]
test eax, eax
jne 0x435db8
mov ecx, section..text
sub ecx, 0x51615
mov dword [0x4427d8], ecx
mov eax, dword [0x4427d8]
add eax, 4
mov esp, ebp
pop ebp
ret

Function at 0x436500
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x436518
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x4365bc
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x4365b7
mov ecx, dword [ebp - 8]
push ecx
call fcn.004364e0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x436576
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x436576
xor eax, eax
jmp 0x4365bc
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x43650f
mov esp, ebp
pop ebp
ret
Function at 0x4145af
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x422b70
cmp edx, dword [eax]
je 0x4145d1
add eax, 8
inc ecx
cmp eax, 0x422c00
jl 0x4145c2
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x422b70]
jne 0x4146ff
mov eax, dword [0x4296dc]
cmp eax, 1
je 0x4146d9
test eax, eax
jne 0x414602
cmp dword [0x420194], 1
je 0x4146d9
cmp edx, 0xfc
je 0x4146ff
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x414639
lea eax, [ebp - 0x1a4]
push 0x41c1d8
push eax
call fcn.0040bb60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040c050
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41467c
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040c050
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41c1ac
push edi
call fcn.0040ca50
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x41ca48
push eax
call fcn.0040bb60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040bb70
lea eax, [ebp - 0xa0]
push 0x41c1a8
push eax
call fcn.0040bb70
push dword [esi + 0x422b74]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040bb70
push 0x12010
lea eax, [ebp - 0xa0]
push 0x41c1b0
push eax
call fcn.00412420
add esp, 0x2c
pop edi
jmp 0x4146ff
lea eax, [ebp + 8]
lea esi, [esi + 0x422b74]
push 0
push eax
push dword [esi]
call fcn.0040c050
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
pop esi
leave
ret

Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x558db4
push eax
push dword fs:[0]
push ebp
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xe7
mov dword [0x98c0ec09], eax
mov eax, dword [0xf6a8b15c]
jecxz 0x401003
xor dword [ecx], ecx
iretd
ljmp 0x2bdb:0xc41a7522
jne 0x40109c
invalid
mov ch, byte [edx + 0x477bf67f]
jle 0x4010d4
salc
rcr cl, 1
cwde
add al, 0x60
sub byte [ecx + 0x485b75a6], bh
adc byte [eax], cl
xor eax, 0x4156615a
clc
or edi, dword [esi + 0x54]
xchg byte [ebx + 0x456a3141], bl
adc dword [edx + 0x30], ecx
jno 0x401110
sbb ebx, edi
cmp al, 0x6e
jae 0x40107e
out dx, al
aad 0x69
sub dword [edi + 0x33], ebx
retf
push ebp
mov cs, edx
mov bl, byte [edx + 0x3812e7a7]
adc eax, 0x31bdc80d
movsd dword es:[edi], dword [esi]
fild qword [eax]
add ch, al
cmpsd dword [esi], dword es:[edi]
dec eax
ret
Function at 0x401031
Capabilities:
Create thread
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x460288], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x46028c], eax
push 0xa
push dword [0x46028c]
push 0
push dword [0x460288]
call 0x401031
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffa8
push 0
call sub.gdi32.dll_CreateSolidBrush
mov dword [0x460224], eax
push 0xc0c0c0
call sub.gdi32.dll_CreateSolidBrush
mov dword [0x46023c], eax
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], 0x4011b2
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x1e
push dword [0x460288]
pop dword [ebp - 0x18]
push 0x64
push dword [ebp + 8]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x10], eax
push dword [0x460224]
pop dword [ebp - 0xc]
mov dword [ebp - 4], 0x4090c8
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_RegisterClassA
push 0
push 0
push 0
push 0x4090c8
push dword [ebp + 8]
call sub.user32.dll_CreateDialogParamA
mov dword [0x460240], eax
mov dword [ebp - 0x48], eax
push 0x6e
push dword [ebp + 8]
call sub.user32.dll_LoadBitmapA
push eax
push 0
push 0xf7
push 0x3ea
push dword [ebp - 0x48]
call sub.user32.dll_SendDlgItemMessageA
push 0x6f
push dword [ebp + 8]
call sub.user32.dll_LoadBitmapA
push eax
push 0
push 0xf7
push 0x3ef
push dword [ebp - 0x48]
call sub.user32.dll_SendDlgItemMessageA
push 0x70
push dword [ebp + 8]
call sub.user32.dll_LoadBitmapA
push eax
push 0
push 0xf7
push 0x3f0
push dword [ebp - 0x48]
call sub.user32.dll_SendDlgItemMessageA
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x48]
call sub.user32.dll_GetWindowRect
mov dword [0x460258], 0x19
mov dword [0x460250], 5
mov dword [0x46024c], 5
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x58]
sub eax, ecx
sub eax, 5
mov dword [0x460254], eax
push 0
push 0
push 0
push 0x401339
push 0
push 0
call sub.kernel32.dll_CreateThread
push dword [ebp + 0x14]
push dword [ebp - 0x48]
call sub.user32.dll_ShowWindow
push 0
push 0
push 0
lea eax, [ebp - 0x44]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x4011ab
lea eax, [ebp - 0x44]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x44]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x401184
mov eax, dword [ebp - 0x3c]
leave
ret 0x10
Function at 0x1000224a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.10002316
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x78
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 8], 0x41
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], bl
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6e
mov dword [ebp - 0xa8], 0x94
call fcn.10002345
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
lea ecx, [ebp - 0xa8]
push ecx
call eax
test eax, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
jne 0x100022d6
call fcn.10002316
add esp, 0xc
xor eax, eax
jmp 0x10002313
call fcn.10002316
mov eax, dword [ebp - 0x98]
add esp, 0xc
sub eax, ebx
je 0x10002310
dec eax
je 0x100022f0
dec eax
je 0x10002302
jmp 0x100022d2
cmp dword [ebp - 0xa0], ebx
jne 0x100022fc
push 4
jmp 0x10002312
jbe 0x10002302
push 5
jmp 0x10002312
cmp dword [ebp - 0xa4], 5
sbb eax, eax
add eax, 7
jmp 0x10002313
push 3
pop eax
pop ebx
leave
ret

Function at 0x10002345
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10002316
mov eax, dword [0x10008c6c]
and byte [ebp - 8], 0
add esp, 0xc
cmp eax, 1
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
jne 0x100023a8
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [0x10008c6c], eax
leave
ret
Function at 0x10002fd3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x14
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.10002316
and byte [ebp - 0x17], 0
add esp, 0xc
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x54
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x18], 0x65
call fcn.10002345
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x1000303b
lea ecx, [ebp - 0x10]
push ecx
call eax
push esi
push 0x14
movzx esi, word [ebp - 0x10]
movzx eax, word [ebp - 0xe]
imul esi, esi, 0xd
add esi, eax
push 0
movzx eax, word [ebp - 0xa]
imul esi, esi, 0x1e
add esi, eax
movzx eax, word [ebp - 8]
imul esi, esi, 0x1a
imul eax, eax, 0x3d
add esi, eax
movzx eax, word [ebp - 6]
add esi, eax
movzx eax, word [ebp - 4]
imul esi, esi, 0x3c
add esi, eax
movzx eax, word [ebp - 2]
imul esi, esi, 0x4d2
add esi, eax
lea eax, [ebp - 0x24]
push eax
call fcn.10002316
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x1000308e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
xor ebx, ebx
push 0x11
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.10002316
add esp, 0xc
mov byte [ebp - 0x20], 0x2a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x1f], 0x89
mov byte [ebp - 0xf], 0x21
mov byte [ebp - 0x1e], 0xed
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0x1d], 0x5e
mov byte [ebp - 0xd], 0xa4
mov byte [ebp - 0x1c], 0x49
mov byte [ebp - 0xc], 0x10
mov byte [ebp - 0x1b], 0x26
mov byte [ebp - 0xb], 0x7e
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0xa], 0x51
mov byte [ebp - 0x19], 0x19
mov byte [ebp - 9], 0x25
mov byte [ebp - 0x18], pe_nt_image_headers32
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 7], bl
mov byte [ebp - 0x16], 0xe2
mov byte [ebp - 6], bl
mov byte [ebp - 0x15], 0x51
mov byte [ebp - 5], 0x2d
mov byte [ebp - 0x14], 0xaa
mov byte [ebp - 4], bl
mov byte [ebp - 0x13], 0xfa
mov byte [ebp - 3], bl
mov byte [ebp - 0x12], 0xdb
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x79
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], bl
call fcn.10002345
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
lea ecx, [ebp - 0x58]
push ecx
call eax
mov ax, word [ebp - 0x58]
xor ecx, ecx
mov cl, ah
mov byte [ebp - 7], al
mov ax, word [ebp - 0x56]
mov byte [ebp - 6], cl
xor ecx, ecx
mov byte [ebp - 4], al
mov cl, ah
lea eax, [ebp - 0xc8]
push eax
mov byte [ebp - 5], 0x2d
mov byte [ebp - 3], cl
call fcn.10003208
lea eax, [ebp - 0x20]
push 0x1e
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.10003230
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.100032ce
add esp, 0x18
xor eax, eax
cmp byte [eax + ebp - 0x48], bl
lea ecx, [eax + ebp - 0x48]
jne 0x100031ca
mov byte [ecx], 1
inc eax
cmp eax, 0x10
jl 0x100031bd
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10003f14
movzx ax, byte [ebp + 8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.10003cba
push dword [ebp + 0xc]
call fcn.10003ee1
push 0x1e
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.10002316
add esp, 0x20
xor eax, eax
pop ebx
leave
ret

Function at 0x10003208
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x10003d13
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
push edi
xor ecx, ecx
movzx eax, byte [ecx + str.80_]
mov esi, dword [ebp + 8]
mov edx, eax
sar edx, 3
and eax, 7
mov dl, byte [esi + edx]
test byte [eax*2 + 0x10008384], dl
setne al
mov byte [ecx + ebp - 0x74], al
inc ecx
cmp ecx, 0x38
jl 0x10003d21
and dword [ebp + 8], 0
mov dword [ebp - 4], 0x1e
cmp word [ebp + 0xc], 1
jne 0x10003d61
mov eax, dword [ebp - 4]
jmp 0x10003d66
mov eax, dword [ebp + 8]
add eax, eax
and dword [ebp + eax*4 - 0xf0], 0
and dword [ebp + eax*4 - 0xf4], 0
lea ecx, [ebp + eax*4 - 0xf0]
lea esi, [ebp + eax*4 - 0xf4]
mov eax, dword [ebp + 8]
xor edx, edx
movzx eax, byte [eax + 0x1000842c]
mov edi, eax
cmp edi, 0x1c
jge 0x10003d9d
mov bl, byte [edi + ebp - 0x74]
jmp 0x10003da4
mov bl, byte [edi + ebp - 0x90]
mov byte [edx + ebp - 0x3c], bl
inc edx
inc edi
cmp edx, 0x1c
jl 0x10003d92
push 0x1c
pop edi
add eax, edi
cmp eax, 0x38
jge 0x10003dbf
mov dl, byte [eax + ebp - 0x74]
jmp 0x10003dc6
mov dl, byte [eax + ebp - 0x90]
mov byte [edi + ebp - 0x3c], dl
inc edi
inc eax
cmp edi, 0x38
jl 0x10003db4
xor edi, edi
mov edx, 0x10008394
movzx ebx, byte [edi + 0x1000843c]
lea eax, [edi + 0x10008454]
cmp byte [ebx + ebp - 0x3c], 0
je 0x10003df0
mov ebx, dword [edx]
or dword [esi], ebx
movzx eax, byte [eax]
cmp byte [eax + ebp - 0x3c], 0
je 0x10003dfe
mov eax, dword [edx]
or dword [ecx], eax
add edx, 4
inc edi
cmp edx, str.80_
jl 0x10003dd8
sub dword [ebp - 4], 2
inc dword [ebp + 8]
cmp dword [ebp - 4], 0xfffffffe
jg 0x10003d55
lea eax, [ebp - 0xf4]
push eax
call fcn.10003e2d
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10004085
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push 0x11
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.10002316
lea eax, [ebp - 0xc8]
mov byte [ebp - 0x20], 0x2a
push eax
mov byte [ebp - 0x10], 0x89
mov byte [ebp - 0x1f], 0x2f
mov byte [ebp - 0xf], 0x21
mov byte [ebp - 0x1e], 0xed
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0x1d], 0x5e
mov byte [ebp - 0xd], 0xa4
mov byte [ebp - 0x1c], 0x55
mov byte [ebp - 0xc], 0x10
mov byte [ebp - 0x1b], 0x26
mov byte [ebp - 0xb], 0x7e
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0xa], 0x51
mov byte [ebp - 0x19], 0x19
mov byte [ebp - 9], 0x22
mov byte [ebp - 0x18], 0x60
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 7], 0x11
mov byte [ebp - 0x16], 0xe2
mov byte [ebp - 6], 0x2b
mov byte [ebp - 0x15], 0x78
mov byte [ebp - 5], 0x3c
mov byte [ebp - 0x14], 0xee
mov byte [ebp - 4], 0x46
mov byte [ebp - 0x13], 0xfa
mov byte [ebp - 3], 0x5e
mov byte [ebp - 0x12], 0xdb
mov byte [ebp - 0x11], 0xcb
call fcn.10003208
lea eax, [ebp - 0x20]
push 0x1e
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.10003230
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.100032ce
add esp, 0x24
xor ecx, ecx
cmp byte [ecx + ebp - 0x48], 0
lea eax, [ecx + ebp - 0x48]
jne 0x10004154
mov byte [eax], 1
inc ecx
cmp ecx, 0x10
jl 0x10004146
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10003f14
movzx ax, byte [ebp + 8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.10003cba
push dword [ebp + 0xc]
call fcn.10003ee1
push 0x1e
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.10002316
and byte [ebp - 0x27], 0
add esp, 0x20
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x79
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
call fcn.10002345
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
lea ecx, [ebp - 0x58]
push ecx
call eax
mov cx, word [ebp - 0x58]
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dl, ch
mov byte [eax], cl
mov cx, word [ebp - 0x56]
mov byte [eax + 1], dl
xor edx, edx
mov byte [eax + 2], cl
mov dl, ch
mov byte [eax + 3], dl
leave
ret
Function at 0x100041fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x4c
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 0xb], 0x31
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
call fcn.10004c76
test eax, eax
je 0x1000434e
mov al, byte [0x10008c9c]
cmp al, 4
jae 0x10004319
mov esi, pe_nt_image_headers32
push 0x1388
add al, 0x30
push dword [0x10008c98]
mov byte [ebp - 0xb], al
call fcn.100045de
pop ecx
cmp eax, ebx
pop ecx
jne 0x1000432e
push ebx
push esi
push 3
push ebx
push 7
lea eax, [ebp - 0x14]
push 0xc0000000
push eax
call fcn.10004355
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x100042ed
lea eax, [ebp - 4]
push ebx
push eax
push esi
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 0x9c406418
push edi
call fcn.100043e0
add esp, 0x20
test eax, eax
je 0x1000433b
call fcn.100044f7
cmp eax, 0x57
push edi
je 0x1000433c
call fcn.1000447e
push dword [0x10008c98]
call fcn.10004571
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.1000466d
add esp, 0x10
cmp eax, ebx
je 0x10004337
jmp 0x10004305
call fcn.100044f7
push dword [0x10008c98]
mov edi, eax
call fcn.10004571
cmp edi, 2
pop ecx
jne 0x10004324
mov al, byte [0x10008c9c]
inc al
cmp al, 4
mov byte [0x10008c9c], al
jb 0x1000425d
cmp al, 3
jbe 0x10004324
mov byte [0x10008c9c], 1
mov eax, 0x4f1a
pop edi
pop esi
pop ebx
leave
ret
cmp eax, esi
mov eax, 0x4f1b
jmp 0x10004329
xor eax, eax
jmp 0x10004329
push edi
call fcn.1000447e
push dword [0x10008c98]
call fcn.10004571
pop ecx
pop ecx
mov eax, 0x753c
jmp 0x10004329

Function at 0x10004355
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10002316
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xb], 0x65
call fcn.10002345
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
jne 0x100043b1
leave
ret
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10002316
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x100043e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10002316
and byte [ebp - 5], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x49
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 8], 0x72
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 6], 0x6c
call fcn.10002345
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
jne 0x1000444c
leave
ret
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10002316
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x1000447e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10002316
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x48
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6c
call fcn.10002345
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
jne 0x100044da
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10002316
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x100044f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10002316
and byte [ebp - 8], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x72
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x45
mov byte [ebp - 0x11], 0x4c
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x72
call fcn.10002345
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
jne 0x10004557
leave
ret
push esi
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10002316
add esp, 0xc
mov eax, esi
pop esi
leave
ret