joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404fc0
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4165e0]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx], ax
push 4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x4172b4]
add eax, 0x14
push eax
call fcn.004017f0
add esp, 0xc
movzx ecx, word [ebp - 0x10]
test ecx, ecx
je 0x405048
lea edx, [ebp - 0x14]
push edx
push 0x20019
push 0
push str.SoftwareEFSoftware
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405048
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x40505c
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x405145
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00404f60
add esp, 8
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
test edx, edx
jne 0x405089
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, dword [ebp + 8]
movzx eax, word [edx]
test eax, eax
jne 0x405112
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [ebp + 8]
push eax
call fcn.00401a40
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401c90
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.004072d4
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.Programme
call fcn.00401b20
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.00401530
add esp, 4
test eax, eax
je 0x405112
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov word [eax + edx*2], cx
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.Program_Files
call fcn.00401b20
add esp, 0xc
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x405145
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401c90
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x4172b4]
add eax, 0x18
push eax
call fcn.00401d60
add esp, 0xc
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040716f
mov esp, ebp
pop ebp
ret
Function at 0x405160
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4165e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [0x4172b4]
add ecx, 0x14
push ecx
call fcn.004017f0
add esp, 0xc
movzx edx, word [ebp - 0xc]
test edx, edx
je 0x4051f4
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x4051f4
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareEFSoftware
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4051f4
mov ecx, dword [ebp + 8]
push ecx
call fcn.004072d4
add esp, 4
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040716f
mov esp, ebp
pop ebp
ret
Function at 0x405210
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x4165e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [0x4172b4]
add ecx, 0x18
push ecx
call fcn.004017f0
add esp, 0xc
push 0x200
lea edx, [ebp - 0x450]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
call fcn.004017f0
add esp, 0xc
push 0x200
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.00401b20
add esp, 0xc
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x4c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [ebp - 0x450]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x405371
lea edx, [ebp - 0x48]
push edx
call fcn.004072d4
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 1
push 0
push str.DisplayName
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
push eax
call fcn.004072d4
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 8]
push edx
push 1
push 0
push str.UninstallString
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004072d4
add esp, 4
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
push str.DisplayIcon
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x416312
call fcn.004072d4
add esp, 4
lea edx, [eax + eax + 2]
push edx
push 0x416312
push 1
push 0
push str.Publisher
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.https:__www.efsoftware.com
call fcn.004072d4
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push str.https:__www.efsoftware.com
push 1
push 0
push str.URLInfoAbout
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040716f
mov esp, ebp
pop ebp
ret

Function at 0x405860
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x4165e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4172b4]
movzx ecx, word [eax + 0x10ba]
test ecx, ecx
je 0x4058d7
push 0x400
lea edx, [ebp - 0x808]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00403eb0
add esp, 0xc
lea ecx, [ebp - 0x808]
push ecx
mov edx, dword [0x4172b4]
add edx, 0x10ba
push edx
call fcn.004097dd
add esp, 8
test eax, eax
je 0x4058d7
push 1
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [0x4172b4]
add ecx, 0x10ba
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040716f
mov esp, ebp
pop ebp
ret
Function at 0x405c10
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00408f70
mov eax, dword [0x4165e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
lea eax, [ebp - 0x1008]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401da0
add esp, 0xc
push 0x400
lea edx, [ebp - 0x1008]
push edx
call fcn.00401c90
add esp, 8
push 0x400
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x1008]
push ecx
call fcn.00401da0
add esp, 0xc
push 0x400
lea edx, [ebp - 0x1008]
push edx
push str.PSAPI.DLL
call fcn.00401b20
add esp, 0xc
push 0x400
lea eax, [ebp - 0x808]
push eax
push 0x41650c
call fcn.00401b20
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x808]
push ecx
push str.PSAPI.DLL
call fcn.00401b20
add esp, 0xc
lea edx, [ebp - 0x808]
push edx
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040716f
mov esp, ebp
pop ebp
ret

Function at 0x405ce0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa60
mov eax, dword [0x4165e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401da0
add esp, 0xc
push 0x400
lea edx, [ebp - 0x808]
push edx
push 0x412a94
call fcn.00401cf0
add esp, 0xc
push 0x400
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401d60
add esp, 0xc
push 0x400
lea edx, [ebp - 0x808]
push edx
push 0x412a9c
call fcn.00401b20
add esp, 0xc
lea eax, [ebp - 0xa58]
push eax
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0xa5c], 0xffffffff
je 0x405e41
lea edx, [ebp - 0xa2c]
push edx
call fcn.004072d4
add esp, 4
mov dword [ebp - 0xa60], eax
cmp dword [ebp - 0xa60], 6
jle 0x405e18
push str..LNG
mov eax, dword [ebp - 0xa60]
lea ecx, [ebp + eax*2 - 0xa34]
push ecx
call fcn.004097dd
add esp, 8
test eax, eax
je 0x405dd8
push str..CHM
mov edx, dword [ebp - 0xa60]
lea eax, [ebp + edx*2 - 0xa34]
push eax
call fcn.004097dd
add esp, 8
test eax, eax
jne 0x405e18
push 0x400
lea ecx, [ebp - 0x808]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401da0
add esp, 0xc
push 0x400
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0xa2c]
push ecx
call fcn.00401cf0
add esp, 0xc
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xa58]
push eax
mov ecx, dword [ebp - 0xa5c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405d7c
mov edx, dword [ebp - 0xa5c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040716f
mov esp, ebp
pop ebp
ret
Function at 0x406670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x4165e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
lea eax, [ebp - 0x808]
push eax
call fcn.00404fc0
add esp, 8
lea ecx, [ebp - 0x808]
push ecx
push 0x408
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
call fcn.00403500
test eax, eax
jne 0x4066ce
push 0
push 0x413
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x808]
push ecx
call fcn.00401530
add esp, 4
test eax, eax
je 0x406716
push 1
push 0x411
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 1
push 0x412
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 1
push 0x413
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x406729
lea edx, [ebp - 0x808]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00406540
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040716f
mov esp, ebp
pop ebp
ret

Function at 0x40716f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4165e0]
jne 0x407179
repz ret
jmp fcn.0040aec2
Function at 0x40ecb8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a6d0
and dword [ebp - 4], 0
cmp dword [0x417c4c], 0
mov ebx, eax
jne 0x40ed69
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ee1a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40ee1a
push eax
call fcn.0040a65e
mov dword [esp], 0x413c4c
push edi
mov dword [0x417c4c], eax
call esi
push eax
call fcn.0040a65e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x417c50], eax
call esi
push eax
call fcn.0040a65e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x417c54], eax
call esi
push eax
call fcn.0040a65e
pop ecx
mov dword [0x417c5c], eax
test eax, eax
je 0x40ed69
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a65e
pop ecx
mov dword [0x417c58], eax
mov eax, dword [0x417c58]
cmp eax, ebx
je 0x40edc1
cmp dword [0x417c5c], ebx
je 0x40edc1
push eax
call fcn.0040a6d9
push dword [0x417c5c]
mov esi, eax
call fcn.0040a6d9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40edc1
test edi, edi
je 0x40edc1
call esi
test eax, eax
je 0x40edb8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40edb8
test byte [ebp - 0xc], 1
jne 0x40edc1
or dword [ebp + 0x10], 0x200000
jmp 0x40edfa
mov eax, dword [0x417c50]
cmp eax, ebx
je 0x40edfa
push eax
call fcn.0040a6d9
pop ecx
test eax, eax
je 0x40edfa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40edfa
mov eax, dword [0x417c54]
cmp eax, ebx
je 0x40edfa
push eax
call fcn.0040a6d9
pop ecx
test eax, eax
je 0x40edfa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x417c4c]
call fcn.0040a6d9
pop ecx
test eax, eax
je 0x40ee1a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ee1c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
push 2
push 0
push 0x10001d80
mov ecx, dword [0x1006724c]
call fcn.10026040
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001fed
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x10066828]
call fcn.100014a0
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x1006682c]
call fcn.10014bc0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10003220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 5
mov dword [ebp - 8], 0
jmp 0x10003242
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x33
jge 0x10003281
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x779227d4]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000327c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10003239
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x33], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100041c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100407a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x10]
call fcn.10014b50
mov dword [ebp - 4], 0
mov byte [ebp - 0x3c], 0x44
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x62
mov byte [ebp - 0x39], 0x75
mov byte [ebp - 0x38], 0x67
mov byte [ebp - 0x37], 0x67
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x44
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3b
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x45
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0x30
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x39
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x36
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x10066824]
mov edx, dword [ecx + 0x2cc]
call edx
cmp dword [ebp - 0x14], 0
je 0x100042d1
mov ecx, dword [0x10066828]
call fcn.100014a0
push eax
push 0
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [0x1006682c]
call fcn.10014bc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10014ba0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100042f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
pushal
mov eax, dword fs:[0xc0]
mov dword [ebp - 8], eax
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
mov byte [ebp - 2], al
popal
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1000432e
mov eax, 1
jmp 0x1000435b
cmp dword [ebp - 8], 0
je 0x10004359
pushal
mov eax, dword fs:[0x18]
sub eax, 0x2000
mov eax, dword [eax + 0x60]
mov al, byte [eax + 2]
mov byte [ebp - 1], al
popal
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x10004359
mov eax, 2
jmp 0x1000435b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100046b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
mov esp, ebp
pop ebp
ret

Function at 0x100046d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x25
mov byte [ebp - 5], 0x73
mov byte [ebp - 4], 0x25
mov byte [ebp - 3], 0x73
mov byte [ebp - 2], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x10066824]
mov edx, dword [ecx + 0x2d0]
call edx
mov esp, ebp
pop ebp
ret

Function at 0x10004750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10040788
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x14]
call fcn.10014b50
mov dword [ebp - 4], 0
mov byte [ebp - 0x3c], 0x44
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x62
mov byte [ebp - 0x39], 0x75
mov byte [ebp - 0x38], 0x67
mov byte [ebp - 0x37], 0x67
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x44
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3b
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x45
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0x30
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x39
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x34
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x10], 0
push 0
push 4
lea eax, [ebp - 0x10]
push eax
push 7
push 0xffffffffffffffff
mov ecx, dword [0x10066824]
mov edx, dword [ecx + 0xd8]
call edx
test eax, eax
jl 0x1000486b
cmp dword [ebp - 0x10], 0
je 0x1000486b
mov ecx, dword [0x10066828]
call fcn.100014a0
push eax
push 0
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [0x1006682c]
call fcn.10014bc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10014ba0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10004910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100407a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x10]
call fcn.10014b50
mov dword [ebp - 4], 0
mov byte [ebp - 0x38], 0x44
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x62
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x67
mov byte [ebp - 0x33], 0x67
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x44
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x45
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x20
mov byte [ebp - 0x22], 0x43
mov byte [ebp - 0x21], 0x6f
mov byte [ebp - 0x20], 0x64
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x3a
mov byte [ebp - 0x1d], 0x20
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x78
mov byte [ebp - 0x1a], 0x39
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x12], 0
call fcn.10004890
movzx eax, al
test eax, eax
je 0x10004a08
mov ecx, dword [0x10066828]
call fcn.100014a0
push eax
push 0
lea ecx, [ebp - 0x38]
push ecx
push 1
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [0x1006682c]
call fcn.10014bc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10014ba0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret