joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41df28
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x42b028]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x30]
call fcn.0041d970
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [esp + 0x20]
xor ebx, ebx
push edx
mov eax, esi
mov dword [esp + 0x48], ebx
call fcn.0040d070
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
cmp edi, ebx
je 0x40cde6
cmp edi, dword [esi + 4]
je 0x40cde6
cmp edi, dword [esi]
je 0x40cde6
mov esi, dword [edi + 4]
cmp esi, ebx
jne 0x40cc95
xor esi, esi
mov eax, edi
jmp 0x40cc9d
xor eax, eax
cmp dword [esi], ebx
je 0x40cc9d
mov eax, dword [esi]
mov byte [esp + 0x18], bl
cmp esi, ebx
jne 0x40ccc6
mov ecx, dword [eax + 8]
mov dword [esp + 0x14], ecx
cmp ecx, ebx
jne 0x40ccb4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov byte [esp + 0x18], 1
call fcn.0040e5e0
mov esi, dword [esp + 0x14]
mov eax, dword [edi + 8]
mov dword [esp + 0x1c], eax
cmp eax, ebx
jne 0x40ccd5
mov dword [esp + 0x1c], edi
lea eax, [esp + 0x1c]
mov byte [esp + 0x20], 1
call fcn.0040e5e0
mov edi, dword [edi + 0x14]
mov eax, dword [edi + 8]
mov cl, byte [edi + 0x18]
mov byte [esp + 0x13], cl
cmp eax, ebx
je 0x40cd00
push eax
call fcn.0041b22a
add esp, 4
mov dword [edi + 8], ebx
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x40cd13
push eax
call fcn.0041b22a
add esp, 4
mov dword [edi + 0x10], ebx
mov edx, dword [edi]
push edi
mov dword [0x42bff0], edx
mov ebx, 1
call fcn.0041af84
add esp, 4
lea esp, [esp]
cmp dword [esp + 0x1c], esi
je 0x40cd91
mov edi, dword [esi + 0x14]
mov eax, dword [edi + 8]
test eax, eax
je 0x40cd50
push eax
call fcn.0041b22a
add esp, 4
mov dword [edi + 8], 0
mov eax, dword [edi]
mov dword [ebx*4 + 0x42bff0], eax
push edi
inc ebx
call fcn.0041af84
add esp, 4
cmp byte [esp + 0x18], 0
jne 0x40cd75
mov eax, dword [esi + 4]
test eax, eax
je 0x40cd75
mov esi, eax
jmp 0x40cd30
cmp dword [esi + 0x10], 0
mov byte [esp + 0x18], 0
jne 0x40cd8c
mov esi, dword [esi]
test esi, esi
je 0x40cd30
cmp dword [esi + 0x10], 0
je 0x40cd80
mov esi, dword [esi + 0x10]
jmp 0x40cd30
mov edi, dword [ebp + 8]
lea ecx, [esp + 0x24]
push ecx
mov ecx, edi
call fcn.0040e500
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push edx
push eax
push edi
lea esi, [esp + 0x30]
call fcn.0040e730
cmp byte [esp + 0x13], 0
je 0x40cdc2
mov ecx, edi
call fcn.0040d8c0
xor esi, esi
test ebx, ebx
jle 0x40cde6
jmp 0x40cdd0
mov ecx, dword [esi*4 + 0x42bff0]
push 1
push ecx
mov eax, edi
call fcn.0040cb70
inc esi
cmp esi, ebx
jl 0x40cdd0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x40], 0xffffffff
call fcn.0041d9a0
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40d170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41df28
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x42b028]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 0xc]
push eax
lea ecx, [esp + 0x30]
call fcn.0041d970
xor ebx, ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x1c], ebx
cmp dword [ebp + 8], ebx
jne 0x40d1c9
mov ecx, dword [edi + 0x6c]
mov esi, dword [edi + 0x68]
mov dword [esp + 0x20], ecx
jmp 0x40d288
mov ecx, dword [edi + 0x68]
mov eax, dword [ecx + 4]
cmp eax, ebx
jne 0x40d1d7
xor eax, eax
jmp 0x40d1df
xor ecx, ecx
cmp dword [eax], ebx
je 0x40d1df
mov ecx, dword [eax]
mov esi, eax
mov byte [esp + 0x18], bl
cmp eax, ebx
jne 0x40d20a
mov eax, dword [ecx + 8]
mov dword [esp + 0x14], eax
cmp eax, ebx
jne 0x40d1f8
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x14]
mov byte [esp + 0x18], 1
call fcn.0040e5e0
mov esi, dword [esp + 0x14]
mov eax, dword [edi + 0x68]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov dword [esp + 0x14], ecx
cmp ecx, ebx
jne 0x40d224
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov byte [esp + 0x18], 1
call fcn.0040e5e0
mov edx, dword [esp + 0x14]
mov cl, byte [esp + 0x28]
lea ebx, [ebx]
cmp edx, esi
je 0x40d284
mov eax, dword [esi + 0x14]
mov edi, dword [ebp + 8]
cmp dword [eax], edi
je 0x40d278
cmp cl, bl
jne 0x40d25d
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x40d25d
mov esi, eax
jmp 0x40d240
xor cl, cl
mov byte [esp + 0x28], cl
cmp dword [esi + 0x10], ebx
jne 0x40d273
mov esi, dword [esi]
cmp esi, ebx
je 0x40d240
cmp dword [esi + 0x10], ebx
je 0x40d268
mov esi, dword [esi + 0x10]
jmp 0x40d240
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], eax
mov esi, dword [esp + 0x1c]
mov ecx, 1
call fcn.0040e830
lea ecx, [eax + 0x14]
cmp ecx, ebx
je 0x40d29e
mov edx, dword [ebp + 0xc]
mov dword [ecx], edx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax], esi
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x40d2b2
mov dword [ecx + 0x10], eax
jmp 0x40d2b5
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov dword [eax + 0xc], ecx
mov dword [esi + 8], eax
lea ecx, [esp + 0x2c]
mov dword [eax + 0x10], ebx
mov dword [esp + 0x40], 0xffffffff
call fcn.0041d9a0
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10001210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov word [ebp - 6], 0x7274
mov dword [ebp - 0xb], 0x20657479
mov byte [ebp - 4], 0
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x70
mov word [ebp - 0x15], 0x2064
mov word [ebp - 0x12], 0x7274
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x10], 0
mov word [ebp - 0x17], 0x726f
mov byte [ebp - 0x18], 0x77
mov dword [ebp - 0x22], 0x2064726f
mov word [ebp - 0x1d], 0x7274
mov byte [ebp - 0x1b], 0
mov word [ebp - 0x24], 0x7764
mov byte [ebp - 0x1e], 0x70
mov dword [ebp - 0x41], 0x727470
mov word [ebp - 0x44], 0x6574
mov word [ebp - 0x47], 0x625f
mov byte [ebp - 0x42], 0x20
mov byte [ebp - 0x48], 0x36
mov byte [ebp - 0x45], 0x79
mov word [ebp - 0x2a], 0x7470
mov word [ebp - 0x2d], 0x6472
mov word [ebp - 0x30], 0x7771
mov word [ebp - 0x28], 0x72
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2e], 0x6f
mov dword [ebp - 0x51], 0x65747962
mov dword [ebp - 0x4d], 0x72747020
mov word [ebp - 0x53], 0x5f30
mov byte [ebp - 0x49], 0
mov byte [ebp - 0x54], 0x31
mov word [ebp - 0x5a], 0x2044
mov dword [ebp - 0x60], 0x41564e49
mov word [ebp - 0x57], 0x5254
mov byte [ebp - 0x55], 0
mov word [ebp - 0x5c], 0x494c
mov byte [ebp - 0x58], 0x50
mov dword [ebp - 0x66], 0x54502044
mov dword [ebp - 0x6c], 0x41564e49
mov word [ebp - 0x68], 0x494c
mov word [ebp - 0x62], 0x52
mov dword [ebp - 0x36], 0x727470
mov word [ebp - 0x3b], 0x6f77
mov word [ebp - 0x38], 0x2064
mov byte [ebp - 0x3c], 0x6f
mov byte [ebp - 0x39], 0x72
cmp ecx, 8
ja case.default.0x10001322
jmp dword [ecx*4 + 0x100013f0]
lea eax, [ebp - 0xc]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x48]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x6c]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x3c]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10001420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov word [ebp - 3], 0x73
mov byte [ebp - 4], 0x65
mov word [ebp - 8], 0x7363
mov byte [ebp - 6], 0
mov word [ebp - 0xc], 0x7373
mov byte [ebp - 0xa], 0
mov word [ebp - 0x10], 0x7364
mov byte [ebp - 0xe], 0
mov word [ebp - 0x13], 0x73
mov byte [ebp - 0x14], 0x66
mov word [ebp - 0x17], 0x73
mov byte [ebp - 0x18], 0x67
mov word [ebp - 0x1d], 0x524f
mov word [ebp - 0x20], 0x5245
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1b], 0
mov dword [ebp - 0x26], 0x524f52
mov word [ebp - 0x28], 0x5245
cmp ecx, 7
ja case.default.0x1000148c
jmp dword [ecx*4 + 0x10001544]
lea eax, [ebp - 4]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
push 0x104
push edx
call fcn.10016aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10009c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 9], 0x6c642e32
push eax
mov word [ebp - 5], 0x6c
mov dword [ebp - 0xf], 0x656e7265
mov word [ebp - 0xb], 0x336c
mov byte [ebp - 0x10], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esp, ebp
pop ebp
ret

Function at 0x10009c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 7], 0x6c6c64
push eax
mov dword [ebp - 0xb], 0x2e323369
mov word [ebp - 0xd], 0x7061
mov word [ebp - 0x10], 0x6441
mov byte [ebp - 0xe], 0x76
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10009ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x3233
push eax
mov dword [ebp - 6], 0x6c6c642e
mov word [ebp - 0xb], 0x6573
mov byte [ebp - 2], 0
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 9], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10009ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x776c6853
push eax
mov dword [ebp - 8], 0x2e697061
mov word [ebp - 3], 0x6c6c
mov byte [ebp - 1], 0
mov byte [ebp - 4], 0x64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret
Function at 0x10009ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 0x18]
mov word [ebp - 0xa], 0x6e6f
push eax
mov esi, edx
mov dword [ebp - 0xf], 0x74637572
mov edi, ecx
mov word [ebp - 7], 0x6361
mov word [ebp - 0x12], 0x736e
mov word [ebp - 4], 0x65
mov byte [ebp - 8], 0x43
mov dword [ebp - 0x17], 0x6873756c
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0x18], 0x46
mov byte [ebp - 5], 0x68
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0xb], 0x69
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009f3b
push dword [ebp + 8]
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10009f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.10009ca0
mov edi, eax
test edi, edi
je 0x10009fb0
lea eax, [ebp - 0x10]
mov word [ebp - 4], 0x7845
push eax
push edi
mov byte [ebp - 2], 0
mov dword [ebp - 9], 0x6f6f4874
mov dword [ebp - 0xd], 0x78654e6c
mov word [ebp - 0xf], 0x6c61
mov byte [ebp - 5], 0x6b
mov byte [ebp - 0x10], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009fa9
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x14]
mov word [ebp - 0xb], 0x6946
push eax
mov esi, edx
mov dword [ebp - 0x10], 0x6c75646f
mov dword [ebp - 0x14], 0x4d746547
mov word [ebp - 6], 0x6d61
mov byte [ebp - 0xc], 0x65
mov word [ebp - 3], 0x41
mov word [ebp - 8], 0x4e65
mov byte [ebp - 9], 0x6c
mov byte [ebp - 4], 0x65
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a01e
push 0x104
push esi
push 0
call eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
mov esi, 1
call fcn.10009c60
mov edi, eax
test edi, edi
je 0x1000a097
lea eax, [ebp - 0x10]
mov dword [ebp - 6], 0x417845
push eax
push edi
mov word [ebp - 0x10], 0x6552
mov dword [ebp - 0xd], 0x6e65704f
mov word [ebp - 9], 0x654b
mov byte [ebp - 0xe], 0x67
mov byte [ebp - 7], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a090
push dword [ebp + 0x10]
push 0x20019
push 0
push ebx
push OleUIEditLinksA
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1000a85e
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xf], 0x69577465
push ecx
push eax
mov dword [ebp - 8], 0x736f5077
mov word [ebp - 0xb], 0x646e
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 4], 0
mov byte [ebp - 9], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a8b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
push 0x104
lea eax, [ebp - 0x130]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x10], esi
call fcn.1000e490
add esp, 0xc
mov dword [ebp - 5], 0x73255c45
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xa], 0x41575446
mov word [ebp - 0xc], 0x4f53
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x52
call fcn.1000ba70
cmp dword [eax + 0x14], 0x10
jb 0x1000a901
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x130]
push 0x104
push eax
call fcn.1000b970
mov edx, dword [ebp - 0x14]
add esp, 0x14
cmp edx, 0x10
jb 0x1000a94c
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a942
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a961
push edx
push ecx
call fcn.1000c2db
add esp, 8
lea eax, [ebp - 0x130]
mov ecx, esi
push eax
call fcn.1000bb10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1001f5d7
int3

Function at 0x1000a9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x118
cmp eax, 1
jne 0x1000aa54
push ecx
lea edx, [esp + 0x14]
call fcn.10009fc0
add esp, 4
mov dword [esp + 6], 0x75732074
lea eax, [esp]
mov dword [esp + 0xc], 0x74726f
mov dword [esp + 1], 0x6174736e
mov word [esp + 0xa], 0x7070
push eax
lea eax, [esp + 0x14]
mov byte [esp + 4], 0x69
push eax
mov byte [esp + 0xd], 0x6e
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1000aa80
mov edx, sym.drvhlp.dll_udh41v
mov ecx, 0x1006e568
call fcn.1000ac00
test eax, eax
je 0x1000aa80
mov edx, sym.drvhlp.dll_fn4gbn
mov ecx, 0x1006e528
call fcn.1000ac00
test eax, eax
je 0x1000aa80
mov edx, sym.drvhlp.dll_lelh1j
mov ecx, 0x1006e558
call fcn.1000ac00
test eax, eax
je 0x1000aa80
mov edx, sym.drvhlp.dll_t9z1iz
mov ecx, 0x1006e550
call fcn.1000ac00
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1000aa80
mov ecx, 0x1006e568
call fcn.1000add0
mov ecx, 0x1006e528
call fcn.1000add0
mov ecx, 0x1006e558
call fcn.1000add0
mov ecx, 0x1006e550
call fcn.1000add0
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000b300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1000b34f
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x11], 0x65726f46
push ecx
push eax
mov dword [ebp - 5], 0x776f646e
mov dword [ebp - 0xa], 0x57646e75
mov word [ebp - 0x14], 0x6553
mov word [ebp - 0xd], 0x7267
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xb], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000b3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1000b3e1
lea ecx, [ebp - 0x10]
mov dword [ebp - 5], 0x776f646e
push ecx
push eax
mov dword [ebp - 0xb], 0x65766974
mov dword [ebp - 0x10], 0x41746553
mov word [ebp - 7], 0x6957
mov byte [ebp - 1], 0
mov byte [ebp - 0xc], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1002b173
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002aa1f

Function at 0x1002b17e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002ac5a

Function at 0x10035ade
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003591c

Function at 0x1003bcc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1003bd03
lea ecx, [ebp - 0x14]
mov word [ebp - 0xf], 0x6957
push ecx
push eax
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 0xd], 0x776f646e
mov dword [ebp - 7], 0x706f54
mov byte [ebp - 0x10], 0x67
mov word [ebp - 9], 0x6f54
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003c1b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [0x1006e56c], 0
jne 0x1003c1d7
call fcn.1000a100
mov edx, 0x100
mov ecx, 0x1006e570
call fcn.1000a730
mov dword [0x1006e56c], 1
jmp fcn.1000a790

Function at 0xdc1e04
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdc1e0e
pushal
call 0xdc1e14
pop ebp
sub ebp, 0x10
sub ebp, 0x9c1e04
jmp 0xdc1e2a
mov eax, 0x9c1e04
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b6
mov edx, 0xc32271ee
xor byte [eax], dl
inc eax
dec ecx
jne 0xdc1e41
jmp 0xdc1e54
and esp, dword gs:[ebp + 0x67]
shr dh, cl
out dx, al
out dx, al
outsd dx, dword [esi]
das
push ss
out dx, al
out dx, al
out dx, al
in eax, dx
and edx, dword [esi - 0x16]
out dx, al
out dx, al
out dx, al
push esp
invalid
Function at 0x4038c5
Capabilities:
Encode data using xor

Disassembly:
cmp dword [str.shlwapi.dll], 0
jne 0x4038d3
call fcn.0040389b
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x403900
test cl, 7
je 0x403900
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
dec esi
inc ecx
jmp 0x4038e1
cmp esi, 8
jb 0x403984
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4141c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
dec edi
jne 0x40390a
xor edx, edx
test esi, esi
jbe 0x4039a4
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4141c0]
inc edx
cmp edx, esi
jb 0x40398b
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x40a5a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 8], ecx
call fcn.0040aeb6
xor eax, eax
push 4
xor ecx, ecx
mov dword [ebp + 8], eax
xor ebx, ebx
pop edx
cmp eax, 0xa
jg 0x40a6b0
cmp ebx, edx
jge 0x40a5f7
lea esi, [ebp + ebx*4 - 0x28]
mov dword [ebp - 4], esi
cmp ecx, edx
jge 0x40a5f9
mov edi, dword [ebp - 8]
lea esi, [ecx + eax*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, dword [ebp - 4]
add dword [ebp - 4], edx
inc ebx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40a5dc
cmp ecx, edx
jne 0x40a601
inc eax
mov dword [ebp + 8], eax
xor ecx, ecx
cmp ebx, edx
jl 0x40a5c8
cmp eax, 0xa
jg 0x40a6b0
mov dword [ebp - 4], 0x418ca8
movzx esi, byte [ebp - 0x1b]
mov al, byte [ebp - 0x28]
xor al, byte [esi + 0x418dc8]
movzx esi, byte [ebp - 0x1a]
mov bl, byte [esi + 0x418dc8]
movzx esi, byte [ebp - 0x19]
xor byte [ebp - 0x27], bl
mov bl, byte [esi + 0x418dc8]
movzx esi, byte [ebp - 0x1c]
xor byte [ebp - 0x26], bl
mov bl, byte [esi + 0x418dc8]
mov esi, dword [ebp - 4]
xor al, byte [esi]
xor byte [ebp - 0x25], bl
inc dword [ebp - 4]
push 3
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x24]
pop edi
xor esi, esi
mov bl, byte [eax + esi - 4]
xor byte [eax + esi], bl
inc esi
cmp esi, edx
jl 0x40a65c
add eax, edx
dec edi
jne 0x40a65a
xor ebx, ebx
cmp dword [ebp + 8], 0xa
jg 0x40a6b0
cmp ebx, edx
jge 0x40a699
lea eax, [ebp + ebx*4 - 0x28]
cmp ecx, edx
jge 0x40a69b
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
lea esi, [ecx + esi*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ebx
add eax, edx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40a67d
cmp ecx, edx
jne 0x40a6a2
inc dword [ebp + 8]
xor ecx, ecx
cmp ebx, edx
jl 0x40a66f
cmp dword [ebp + 8], 0xa
jle 0x40a615
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40a6b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
add ecx, 0x24
push 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 9
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 8], edi
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x415ca8]
xor dl, byte [eax + ebx*4 + 0x4164a8]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x4168a8]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x4160a8]
add ecx, edi
mov byte [esi], dl
add esi, edi
dec dword [ebp - 8]
jne 0x40a6df
inc eax
cmp eax, edi
jl 0x40a6d2
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0040aeb6
add dword [ebp - 4], 0x10
dec dword [ebp - 0xc]
jne 0x40a6d0
pop edi
pop esi
pop ebx
leave
ret