joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c434
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45c44b
add esp, 0xfffffff0
call fcn.00403cc8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041e2d0
mov eax, dword [0x49dc58]
cmp word [eax + 2], 0
jne 0x45c473
mov eax, dword [0x49dc58]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045dbb4
mov eax, dword [0x49dd20]
cmp word [eax + 2], 0
jne 0x45c48d
mov eax, dword [0x49dd20]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045ddac
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4163a0]
call fcn.00403974
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4163a0]
call fcn.00403974
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x420904]
call fcn.00428c64
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45c614
mov eax, dword [0x49db5c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00429034
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45e35c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x49db5c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d4dc
test eax, eax
je 0x45c582
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409684
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d504
test eax, eax
je 0x45c596
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404964
mov eax, dword [0x49d9f8]
cmp byte [eax], 0
jne 0x45c5ca
mov eax, ebx
call fcn.0045c73c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045e538
mov eax, ebx
call fcn.0045eefc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45c60a
call fcn.00403d20
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c9bc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x49ebe0]
cmp dword [eax + 0x30], 0
je 0x45ca66
cmp dword [ebx + 0x94], 0
jne 0x45ca60
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45c94c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45ca60
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45ca26
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45ca60
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041873c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45ca35
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45d5c8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45d5fd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004047e4
jmp 0x45d60a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404748
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45e714
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45e755
mov eax, esi
call fcn.004449c8
test al, al
je 0x45e755
mov eax, dword [ebx + 0x84]
call fcn.004446c4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45e755
push 0
mov eax, dword [ebx + 0x84]
call fcn.004446c4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45f470
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41571c]
call fcn.004050d4
xor eax, eax
push ebp
push 0x45f5b4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49ce24], 0
jne 0x45f4c3
mov ecx, dword [0x49da08]
mov dl, 1
mov eax, dword [0x407c7c]
call fcn.0040c780
call fcn.00404130
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004030e0
mov eax, ebx
call fcn.00404f84
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45f5c4
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040616c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404f94
test eax, eax
jle 0x45f55b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45f554
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0040497c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404964
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408b4c
test eax, eax
jne 0x45f554
mov ebx, 0x15
jmp 0x45f560
mov ebx, 0x10
jmp 0x45f560
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x49ce24]
call fcn.0045f36c
mov eax, dword [ebp - 8]
call fcn.0045f36c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406184
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f5bb
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404718
lea eax, [ebp - 0x10]
mov edx, dword [0x41571c]
call fcn.004051a4
ret

Function at 0x463f78
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x463fa6
mov eax, ebx
call fcn.00464a2c
cmp dword [ebx + 0x40], 0
je 0x463f9f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x464017
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x464009
cmp dword [ebx + 8], 0
je 0x463fc8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x463fda
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x464009
cmp dword [ebx + 8], 0
je 0x463fbb
cmp eax, 3
je 0x463fed
dec eax
jne 0x463fbb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x463fbb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x463fbb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x464035
cmp dword [ebx + 0x14], 0xcc
je 0x464035
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00464040
pop ebx
ret
Function at 0x47482c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov esi, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.004049b4
mov edx, eax
mov eax, ebp
call fcn.00404d40
mov eax, dword [esp]
call fcn.004049b4
mov edi, eax
test edi, edi
jle 0x474890
mov ebx, 1
mov eax, ebp
call fcn.00404c0c
mov edx, dword [esp]
mov dl, byte [edx + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec edi
jne 0x47485c
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x474898
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, edi
call fcn.004049b4
mov edx, eax
mov eax, dword [esp]
call fcn.00404d40
mov eax, edi
call fcn.004049b4
mov ebp, eax
test ebp, ebp
jle 0x4748f7
mov ebx, 1
mov eax, dword [esp]
call fcn.00404c0c
mov dl, byte [edi + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
xor eax, eax
mov al, byte [edi + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec ebp
jne 0x4748c7
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4939f4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce8
push ebx
xor edx, edx
mov dword [ebp - 0x314], edx
mov dword [ebp - 0x318], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x493abd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x318]
mov eax, dword [ebp - 4]
call fcn.00409484
mov eax, dword [ebp - 0x318]
lea edx, [ebp - 0x314]
call fcn.0049432c
mov edx, dword [ebp - 0x314]
lea eax, [ebp - 0x110]
call fcn.004096e0
push 0xff
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0xff
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
jne 0x493a8d
xor ebx, ebx
jmp 0x493a97
mov eax, dword [ebp - 8]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493ac4
lea eax, [ebp - 0x318]
mov edx, 2
call fcn.00404718
lea eax, [ebp - 4]
call fcn.004046f4
ret

Function at 0x493acc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push 0x96
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00409834
add esp, 0x100
pop ebx
ret
Function at 0x4954a4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x495569
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
push esi
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x108]
call fcn.00409834
mov eax, dword [ebp - 0x10c]
mov edx, dword [ebp - 8]
call fcn.00404b00
jne 0x49550e
mov ebx, esi
jmp 0x495548
push 2
push esi
call sub.user32.dll_GetWindow
test eax, eax
je 0x495529
mov ecx, dword [ebp - 8]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004954a4
mov ebx, eax
test ebx, ebx
jne 0x495548
push 5
push esi
call sub.user32.dll_GetWindow
test eax, eax
je 0x495548
mov ecx, dword [ebp - 8]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004954a4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495570
lea eax, [ebp - 0x10c]
call fcn.004046f4
lea eax, [ebp - 8]
call fcn.004046f4
ret

Function at 0x496b1c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x496c8a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.00486a2c
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.00486a4c
jmp 0x496c56
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404964
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409518
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.0040896c
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.0040896c
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404b00
je 0x496c36
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404964
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.0040896c
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.0040896c
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404b00
jne 0x496c4d
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.00486a6c
test eax, eax
jne 0x496b97
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496c91
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404718
lea eax, [ebp - 4]
call fcn.004046f4
ret
Function at 0x42c9b0
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.0042c959
test eax, eax
je 0x42cb09
lea ecx, [esp + 0x18]
call fcn.0042c959
lea ecx, [esp + 0x18]
test eax, eax
je 0x42ca78
call fcn.0042c959
test eax, eax
je 0x42ca3a
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.0042c959
lea edi, [eax + edi*2]
dec ebx
jne 0x42ca10
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x42ca31
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x42ca34
mov byte [edx], 0
inc edx
jmp 0x42cb1b
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x42ca70
test ecx, ecx
je 0x42cb04
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42ca62
jmp 0x42cb00
xor ebp, ebp
inc ebp
jmp 0x42cb04
call fcn.0042c98f
test edi, edi
jne 0x42caad
cmp eax, 2
jne 0x42caa8
lea ecx, [esp + 0x18]
call fcn.0042c98f
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x42cb04
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x42ca9d
jmp 0x42cb00
sub eax, 3
jmp 0x42cab0
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.0042c98f
mov ecx, eax
cmp esi, 0x7d00
jb 0x42cad7
inc ecx
cmp esi, 0x500
jb 0x42cae0
inc ecx
cmp esi, 0x80
jae 0x42caeb
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x42cb04
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42caf7
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x42cb21
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x42c9e0
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42cca6
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x42ccd8
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x42ccb9
jmp 0x42ccdc
mov eax, dword [esp + 0x10]
test edi, edi
je 0x42cce6
xor byte [esi], al
inc esi
dec edi
jne 0x42cce0
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x813139
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7fcccf
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x7fcceb
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x7fccd7
jmp 0x7fccf6
ret
pop edx
mov eax, 0xa4d27dd8
mov ax, word [esp]
call fcn.008130ea
lea esp, [esp + 2]
mov eax, dword [esp + 8]
lea esp, [esp + 0xc]
call 0x813139
sub al, 0xad
cmp eax, 0x3e04b744
mov esi, 0x74c64b2c
setbe byte [ecx]
sal byte [eax - 0x7224147c], 0x64
mov al, 0x84
jmp 0x813114
lea esp, [esp + 4]
jmp 0x7fccc4
lea eax, [ebp - 0x7f]
mov dh, byte [esp + 3]
lea esp, [esp + 3]
lea edx, [esp + edi]
lea edx, [ebx + ebx]
lea esp, [esp + 1]
jmp 0x813105
jmp 0x813164

Function at 0x8db102
Capabilities:
Access peb ldr_data

Disassembly:
lea ebx, [edx + edi]
mov ax, word [esp + 4]
sub esp, 0x10
mov cl, 0x4a
not edx
mov ax, dx
jmp 0x8daf86
setne bh
lea eax, [esi - 0x5d]
xchg word [esp + 3], dx
xchg byte [esp + 3], al
mov dx, word [esp + 0xa]
lea edi, [ebx + ebx]
jmp 0x8daf03
mov eax, dword [esp + 0xd]
xchg bx, bp
xchg word [esp + 3], bx
mov word [esp + 4], bx
jmp 0x8daf21
mov word [esp + 0x18], bx
mov word [esp], bx
mov dword [esp + 0x1b], esi
xchg byte [esp + 1], al
lea ebx, [edi + ebp]
lea ebx, [eax + 0x11]
jmp 0x8dafbc
mov ax, 0x25cd
mov cl, ch
mov eax, dword [esp + 0x13]
push dword [esp + 6]
inc bp
mov eax, 0xf5831d34
jmp 0x8daf61
pop ebx
mov cl, 0x92
sub esp, 4
lea ebp, [eax + ebx]
pop si
mov ax, sp
jmp 0x8db1df
add esp, 5
call fcn.008db062
mov word [esp], bx
lea esp, [esp + 3]
mov byte [esp], dh
push edx
jmp 0x8db0ce
mov word [esp], di
push esp
call 0x8db131
fist dword [ecx - 0x3f]
mov al, byte [0xd25b8553]
inc eax
daa
sar byte [0x8f664ad3], cl
inc esp
and al, 1
mov dword [esp + 0x14], edx
call 0x8db0bc
lea esp, [esp + 2]
mov dword [esp + 0x20], esp
call 0x8db102
in eax, 0xeb
aas
sbb byte [esi + 0x709e6304], dl
mov cl, byte [ebx]
wait
dec byte [0x22ac20e9]
inc ebp
mov ah, 0x5f
cmp dword [eax], ebx
push edx
push word [esp + 3]
push edx
mov word [esp + 4], di
call 0x8db0f4
je 0x8db12a
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
in al, 0x52
int 0x8d
and al, 2
mov dword [esp + 5], esi
lea esp, [esp + 3]
mov dword [esp + 0x18], ebx
jmp 0x8db118
push dword [esp + 2]
pop word [esp + 1]
mov word [esp], di
mov dword [esp], eax
cld
push word [esp + 3]
jmp 0x8db0b4
mov word [esp + 0x12], bx
mov dword [esp + 7], esi
not bh
lea esp, [esp + 0x20]
popal
push edx
jmp 0x8db162
Function at 0x10001210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov word [ebp - 6], 0x7274
mov dword [ebp - 0xb], 0x20657479
mov byte [ebp - 4], 0
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x70
mov word [ebp - 0x15], 0x2064
mov word [ebp - 0x12], 0x7274
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x10], 0
mov word [ebp - 0x17], 0x726f
mov byte [ebp - 0x18], 0x77
mov dword [ebp - 0x22], 0x2064726f
mov word [ebp - 0x1d], 0x7274
mov byte [ebp - 0x1b], 0
mov word [ebp - 0x24], 0x7764
mov byte [ebp - 0x1e], 0x70
mov dword [ebp - 0x41], 0x727470
mov word [ebp - 0x44], 0x6574
mov word [ebp - 0x47], 0x625f
mov byte [ebp - 0x42], 0x20
mov byte [ebp - 0x48], 0x36
mov byte [ebp - 0x45], 0x79
mov word [ebp - 0x2a], 0x7470
mov word [ebp - 0x2d], 0x6472
mov word [ebp - 0x30], 0x7771
mov word [ebp - 0x28], 0x72
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2e], 0x6f
mov dword [ebp - 0x51], 0x65747962
mov dword [ebp - 0x4d], 0x72747020
mov word [ebp - 0x53], 0x5f30
mov byte [ebp - 0x49], 0
mov byte [ebp - 0x54], 0x31
mov word [ebp - 0x5a], 0x2044
mov dword [ebp - 0x60], 0x41564e49
mov word [ebp - 0x57], 0x5254
mov byte [ebp - 0x55], 0
mov word [ebp - 0x5c], 0x494c
mov byte [ebp - 0x58], 0x50
mov dword [ebp - 0x66], 0x54502044
mov dword [ebp - 0x6c], 0x41564e49
mov word [ebp - 0x68], 0x494c
mov word [ebp - 0x62], 0x52
mov dword [ebp - 0x36], 0x727470
mov word [ebp - 0x3b], 0x6f77
mov word [ebp - 0x38], 0x2064
mov byte [ebp - 0x3c], 0x6f
mov byte [ebp - 0x39], 0x72
cmp ecx, 8
ja case.default.0x10001322
jmp dword [ecx*4 + 0x100013f0]
lea eax, [ebp - 0xc]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x48]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x6c]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x3c]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10001420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov word [ebp - 3], 0x73
mov byte [ebp - 4], 0x65
mov word [ebp - 8], 0x7363
mov byte [ebp - 6], 0
mov word [ebp - 0xc], 0x7373
mov byte [ebp - 0xa], 0
mov word [ebp - 0x10], 0x7364
mov byte [ebp - 0xe], 0
mov word [ebp - 0x13], 0x73
mov byte [ebp - 0x14], 0x66
mov word [ebp - 0x17], 0x73
mov byte [ebp - 0x18], 0x67
mov word [ebp - 0x1d], 0x524f
mov word [ebp - 0x20], 0x5245
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1b], 0
mov dword [ebp - 0x26], 0x524f52
mov word [ebp - 0x28], 0x5245
cmp ecx, 7
ja case.default.0x1000148c
jmp dword [ecx*4 + 0x10001544]
lea eax, [ebp - 4]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
push 0x104
push edx
call fcn.10017260
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10009c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 9], 0x6c642e32
push eax
mov word [ebp - 5], 0x6c
mov dword [ebp - 0xf], 0x656e7265
mov word [ebp - 0xb], 0x336c
mov byte [ebp - 0x10], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esp, ebp
pop ebp
ret

Function at 0x10009c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 7], 0x6c6c64
push eax
mov dword [ebp - 0xb], 0x2e323369
mov word [ebp - 0xd], 0x7061
mov word [ebp - 0x10], 0x6441
mov byte [ebp - 0xe], 0x76
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10009ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x3233
push eax
mov dword [ebp - 6], 0x6c6c642e
mov word [ebp - 0xb], 0x6573
mov byte [ebp - 2], 0
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 9], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10009ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x776c6853
push eax
mov dword [ebp - 8], 0x2e697061
mov word [ebp - 3], 0x6c6c
mov byte [ebp - 1], 0
mov byte [ebp - 4], 0x64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret