joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b197
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
test si, si
jne 0x1000b24c
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1000b24c
mov edx, dword [esi + 0x3c]
test dl, 3
jne 0x1000b24c
cmp dword [edx + esi], 0x4550
jne 0x1000b24c
cmp dword [edx + esi + 0x74], 6
jb 0x1000b24c
push ebx
mov ebx, dword [edx + esi + 0x50]
push edi
mov edi, dword [edx + esi + 0xa8]
lea eax, [ebx - 1]
lea ecx, [edi - 1]
cmp ecx, eax
jae 0x1000b24a
mov eax, dword [edx + esi + 0xac]
mov ecx, ebx
sub ecx, edi
cmp eax, ecx
ja 0x1000b24a
xor edx, edx
add edi, esi
push 0x1c
pop ecx
div ecx
mov edx, eax
test edx, edx
je 0x1000b24a
imul ecx, edx, 0x1c
add ecx, 0x14
add ecx, edi
lea ecx, [ecx - 0x1c]
dec edx
cmp dword [ecx - 8], 2
lea edi, [ecx - 0x14]
jne 0x1000b228
cmp dword [ecx], ebx
jae 0x1000b228
mov eax, ebx
sub eax, dword [ecx]
cmp dword [ecx - 4], eax
jbe 0x1000b22e
test edx, edx
jne 0x1000b20e
jmp 0x1000b24a
push 0x1c
push edi
call dword [sym.imp.kernel32.dll_VirtualLock]
test eax, eax
je 0x1000b24a
mov eax, dword [edi + 0x14]
push dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.kernel32.dll_VirtualLock]
pop edi
pop ebx
pop esi
ret

Function at 0x1000c446
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000c455
pop dword [ebp - 0x30]
mov eax, 0x1000c455
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3d6b1
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x98e187f8
sub ecx, 0x98e12e33
xor edi, edi
add edi, eax
mov ebx, 0x10018600
add ebx, dword [ebp - 0x30]
mov esi, 0x43cbe1dc
sub esi, 0xff5bc58e
xor dword [ebp - 4], 0x1e78f01b
mov edx, dword [ebx]
add dword [ebp - 0x28], esi
sub edx, esi
add dword [ebp - 0x18], ebx
mov dword [edi], edx
sub dword [ebp - 0x24], 0xf866cafb
add edi, 4
add ebx, 4
loop 0x1000c4a6
add eax, 0x159e7
mov ebx, eax
add eax, 0x155409fb
sub eax, 0x155409f6
mov ecx, 0xb95e7d2c
sub ecx, 0xa95e7d2c
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10002930
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10002954
xor eax, eax
jmp 0x100029d4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000296b
xor eax, eax
jmp 0x100029d4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x100029b7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x100029b7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x1000298e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x100029c3
xor eax, eax
jmp 0x100029d4
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x100029d1
xor eax, eax
jmp 0x100029d4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100029e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
test ecx, ecx
je 0x10002a59
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 7
jmp 0x10002a28
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jl 0x10002a4e
mov eax, dword [ebp - 4]
and eax, 1
neg eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
shr ecx, 1
mov edx, dword [ebp - 0x14]
and edx, 0xedb88320
xor ecx, edx
mov dword [ebp - 4], ecx
jmp 0x10002a1f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x100029f4
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x100098b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], ecx
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x28], 0x7a
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x28], 0x49
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x28], 0x65
mov edx, 1
imul eax, edx, 0x14
mov byte [ebp + eax - 0x28], 0x63
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x28], 0x6c
mov eax, 1
imul ecx, eax, 0x17
mov byte [ebp + ecx - 0x28], 0x6f
mov edx, 1
imul eax, edx, 0x15
mov byte [ebp + eax - 0x28], 0x74
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x28], 0x6e
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x28], 0x61
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x28], 0x74
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x28], 0x69
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x28], 0x61
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x28], 0x72
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x28], 0x69
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x28], 0x43
mov edx, 1
imul eax, edx, 0xf
mov byte [ebp + eax - 0x28], 0x63
mov ecx, 1
imul edx, ecx, 0x16
mov byte [ebp + edx - 0x28], 0x69
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x28], 0x74
mov edx, 1
imul eax, edx, 0x18
mov byte [ebp + eax - 0x28], 0x6e
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x28], 0x69
mov edx, 1
imul eax, edx, 0x19
mov byte [ebp + eax - 0x28], 0
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x28], 0x6c
mov eax, 1
imul ecx, eax, 0x12
mov byte [ebp + ecx - 0x28], 0x53
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x28], 0x69
mov ecx, 1
imul edx, ecx, 0x13
mov byte [ebp + edx - 0x28], 0x65
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x28], 0x69
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp - 4]
call fcn.100160f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10009a3c
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
call dword [0x1003b1ac]
call dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1000a260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039f60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x10], ecx
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x30], 0x43
mov edx, 1
imul eax, edx, 0x11
mov byte [ebp + eax - 0x30], 0x74
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x30], 0x65
mov eax, 1
imul ecx, eax, 0x12
mov byte [ebp + ecx - 0x30], 0x69
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x30], 0x63
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x30], 0x69
mov edx, 1
imul eax, edx, 0xe
mov byte [ebp + eax - 0x30], 0x53
mov ecx, 1
imul edx, ecx, 0x14
mov byte [ebp + edx - 0x30], 0x6e
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x30], 0x74
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x30], 0x65
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x30], 0x74
mov edx, 1
imul eax, edx, 0x15
mov byte [ebp + eax - 0x30], 0
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x30], 0x6c
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x30], 0x65
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x30], 0x65
mov eax, 1
imul ecx, eax, 0x13
mov byte [ebp + ecx - 0x30], 0x6f
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x30], 0x69
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x30], 0x72
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x30], 0x63
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x30], 0x61
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x30], 0x6c
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x30], 0x44
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.100160f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000a3cd
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
call dword [0x1003b1ac]
call dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000b970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0xc], 0
mov eax, 2
shl eax, 3
mov ecx, 0x2e
mov word [ebp + eax - 0x3c], cx
mov edx, 2
imul eax, edx, 3
mov ecx, 0x6e
mov word [ebp + eax - 0x3c], cx
mov edx, 2
shl edx, 0
mov eax, 0x65
mov word [ebp + edx - 0x3c], ax
mov ecx, 2
imul edx, ecx, 7
mov eax, 0x32
mov word [ebp + edx - 0x3c], ax
mov ecx, 2
imul edx, ecx, 0xa
mov eax, 0x6c
mov word [ebp + edx - 0x3c], ax
mov ecx, 2
imul edx, ecx, 0xb
mov eax, 0x6c
mov word [ebp + edx - 0x3c], ax
mov ecx, 2
shl ecx, 2
mov edx, 0x65
mov word [ebp + ecx - 0x3c], dx
mov eax, 2
imul ecx, eax, 9
mov edx, 0x64
mov word [ebp + ecx - 0x3c], dx
mov eax, 2
imul ecx, eax, 5
mov edx, 0x6c
mov word [ebp + ecx - 0x3c], dx
mov eax, 2
shl eax, 1
mov ecx, 0x72
mov word [ebp + eax - 0x3c], cx
mov edx, 2
imul eax, edx, 6
mov ecx, 0x33
mov word [ebp + eax - 0x3c], cx
mov edx, 2
imul eax, edx, 0
mov ecx, 0x4b
mov word [ebp + eax - 0x3c], cx
mov edx, 2
imul eax, edx, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x3c], cx
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x20], 0x75
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x20], 0x65
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x20], 0x65
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x20], 0x65
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x20], 0x6f
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x20], 0x6c
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x20], 0x4d
mov ecx, 1
shl ecx, 4
mov byte [ebp + ecx - 0x20], 0x65
mov edx, 1
imul eax, edx, 0x12
mov byte [ebp + eax - 0x20], 0
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x20], 0x64
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x20], 0x46
mov edx, 1
imul eax, edx, 0x11
mov byte [ebp + eax - 0x20], 0x57
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x20], 0x6d
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x20], 0x69
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x20], 0x6c
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x20], 0x4e
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x20], 0x47
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x20], 0x74
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x20], 0x61
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000bb98
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call dword [0x1003b1ac]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1000ed90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
mov dword [ebp - 4], ecx
mov eax, 0x101
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1d0]
push ecx
movzx edx, word [ebp - 0x1c]
push edx
mov eax, dword [0x10063e14]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call dword [0x1003b1ac]
call dword [ebp - 0x20]
push 6
push 1
push 2
mov ecx, dword [0x10063e04]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
call dword [0x1003b1ac]
call dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov dword [edx + 0x78], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x78], 0xffffffff
jne 0x1000ee0b
mov ecx, dword [0x10063e08]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
call dword [0x1003b1ac]
call dword [ebp - 0x28]
xor al, al
jmp 0x1000efa7
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0xc], 0x4e
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0xc], 0x49
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0xc], 0x50
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0xc], 0
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0xc], 0x47
mov eax, 2
mov ecx, dword [ebp - 4]
mov word [ecx + 0x40c0], ax
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x18], 0x2e
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x18], 0x32
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x18], 0x30
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x18], 0x31
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x18], 0x2e
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x18], 0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x18], 0x31
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x18], 0x37
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x18], 0x30
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x18], 0x2e
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x10063e0c]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call dword [0x1003b1ac]
call dword [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x40c4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4170]
add ecx, 0xcee
push ecx
mov edx, dword [0x10063e10]
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 0x30]
call dword [0x1003b1ac]
call dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
mov word [ecx + 0x40c2], ax
push 0x10
mov edx, dword [ebp - 4]
add edx, 0x40c0
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
mov edx, dword [0x10063e18]
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x34]
call dword [0x1003b1ac]
call dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
jne 0x1000ef91
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
mov edx, dword [0x10063e24]
mov dword [ebp - 0x38], edx
mov ecx, dword [ebp - 0x38]
call dword [0x1003b1ac]
call dword [ebp - 0x38]
mov eax, dword [0x10063e08]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call dword [0x1003b1ac]
call dword [ebp - 0x3c]
xor al, al
jmp 0x1000efa7
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.10017630
mov ecx, dword [ebp - 4]
call fcn.10016940
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1000f720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], ecx
mov eax, 1
imul ecx, eax, 0x13
mov byte [ebp + ecx - 0x24], 0x6e
mov edx, 1
imul eax, edx, 0x12
mov byte [ebp + eax - 0x24], 0x6f
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x24], 0x72
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x24], 0x65
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x24], 0x6c
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x24], 0x63
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x24], 0x43
mov edx, 1
imul eax, edx, 0x11
mov byte [ebp + eax - 0x24], 0x69
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x24], 0x63
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x24], 0x6e
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x24], 0x72
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x24], 0x45
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x24], 0x74
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x24], 0x65
mov ecx, 1
imul edx, ecx, 0x14
mov byte [ebp + edx - 0x24], 0
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x24], 0x74
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x24], 0x61
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x24], 0x69
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x24], 0x74
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x24], 0x69
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x24], 0x53
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 4]
call fcn.100160f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000f86b
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
call dword [0x1003b1ac]
call dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1000fb10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], ecx
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x28], 0x31
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x28], 0x31
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x28], 0x37
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x28], 0x30
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x28], 0x2e
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x28], 0x32
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x28], 0x2e
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x28], 0x30
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x28], 0x2e
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x28], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x78]
push edx
mov eax, dword [0x10063e24]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x1003b1ac]
call dword [ebp - 8]
push 6
push 1
push 2
mov ecx, dword [0x10063e04]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
call dword [0x1003b1ac]
call dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [edx + 0x78], eax
mov eax, 2
mov ecx, dword [ebp - 4]
mov word [ecx + 0x40c0], ax
lea edx, [ebp - 0x28]
push edx
mov eax, dword [0x10063e0c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
call dword [0x1003b1ac]
call dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40c4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4170]
add eax, 0xcee
push eax
mov ecx, dword [0x10063e10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call dword [0x1003b1ac]
call dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov word [edx + 0x40c2], ax
push 0x10
mov eax, dword [ebp - 4]
add eax, 0x40c0
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x78]
push edx
mov eax, dword [0x10063e18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call dword [0x1003b1ac]
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x1000fc69
xor al, al
jmp 0x1000fc6b
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10010f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], ecx
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x24], 0x63
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x24], 0x65
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x24], 0x65
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x24], 0x4c
mov ecx, 1
imul edx, ecx, 0x12
mov byte [ebp + edx - 0x24], 0x6f
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x24], 0x43
mov edx, 1
imul eax, edx, 0x14
mov byte [ebp + eax - 0x24], 0
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x24], 0x74
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x24], 0x76
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x24], 0x69
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x24], 0x61
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x24], 0x61
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x24], 0x74
mov ecx, 1
imul edx, ecx, 0x13
mov byte [ebp + edx - 0x24], 0x6e
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x24], 0x69
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x24], 0x6c
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x24], 0x63
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x24], 0x65
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x24], 0x72
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x24], 0x53
mov edx, 1
imul eax, edx, 0x11
mov byte [ebp + eax - 0x24], 0x69
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 4]
call fcn.100160f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1001106b
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
call dword [0x1003b1ac]
call dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10011070
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
movzx eax, byte [0x100459ea]
test eax, eax
jne 0x10011089
jmp 0x100111bb
mov ecx, 2
shl ecx, 0
mov edx, 0x70
mov word [ebp + ecx - 0x18], dx
mov eax, 2
imul ecx, eax, 0
mov edx, 0x55
mov word [ebp + ecx - 0x18], dx
mov eax, 2
shl eax, 2
mov ecx, 0x6d
mov word [ebp + eax - 0x18], cx
mov edx, 2
imul eax, edx, 3
mov ecx, 0x54
mov word [ebp + eax - 0x18], cx
mov edx, 2
shl edx, 1
mov eax, 0x64
mov word [ebp + edx - 0x18], ax
mov ecx, 2
imul edx, ecx, 5
xor eax, eax
mov word [ebp + edx - 0x18], ax
lea ecx, [ebp - 0x18]
push ecx
push 0x5a0
mov ecx, dword [ebp - 8]
call fcn.1000aaf0
test eax, eax
jne 0x1001110b
jmp 0x100111bb
push 0x5a0
mov ecx, dword [ebp - 8]
call fcn.1000b6b0
test eax, eax
jne 0x10011121
jmp 0x100111bb
mov byte [ebp - 1], 0
push str.GlobalRedSpeedupUpdMutex
push 0
push 0x100000
call fcn.1001a520
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10011154
mov edx, dword [ebp - 0xc]
push edx
call fcn.10018350
add esp, 4
mov byte [ebp - 1], 1
jmp 0x10011163
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10011163
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001116d
jmp 0x100111bb
cmp dword [0x100459f4], 0
je 0x10011185
mov ecx, dword [0x100459f4]
push ecx
call fcn.10018350
add esp, 4
call fcn.10001bd0
movzx edx, al
test edx, edx
jne 0x100111bb
call fcn.10001d50
movzx eax, al
test eax, eax
jne 0x100111bb
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x10014f10
push 0
push 0
call fcn.10018ba0
add esp, 0x18
mov dword [0x100459f4], eax
mov esp, ebp
pop ebp
ret