joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b12c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b2d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45b2b8
mov dl, 1
mov eax, dword [0x416fa4]
call fcn.004034f4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040430c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45b2a7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00448e74
test al, al
je 0x45b29a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45b2e8
lea eax, [ebp - 0x254]
call fcn.00409430
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45b29a
xor eax, eax
push ebp
push 0x45b293
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45b320
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45b27c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040457c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45b27c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040457c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b29a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45b19d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041b608
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b2de
lea eax, [ebp - 0x260]
call fcn.0040430c
ret

Function at 0x45bc20
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5abb50]
cmp byte [eax + 0xa5], 0
jne 0x45bc91
cmp dword [0x5abb68], 0
jne 0x45bc52
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45bbdc
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x5abb68], eax
cmp dword [0x5abb64], 0
jne 0x45bc6d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x5abb64], eax
cmp dword [0x5abb6c], 0
jne 0x45bc91
push esp
push 0
push 0
push 0x45bb80
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x5abb6c], eax
pop edx
ret
Function at 0x45c324
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x5abb50]
cmp dword [eax + 0x30], 0
je 0x45c3ce
cmp dword [ebx + 0x94], 0
jne 0x45c3c8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45c2b4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45c3c8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45c38e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45c3c8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004191a4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45c39d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45cf2c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45cf61
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004043fc
jmp 0x45cf6e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404360
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45e098
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45e0d9
mov eax, esi
call fcn.004443ec
test al, al
je 0x45e0d9
mov eax, dword [ebx + 0x84]
call fcn.004440e8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45e0d9
push 0
mov eax, dword [ebx + 0x84]
call fcn.004440e8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x46b68c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b74b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x7c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov eax, dword [ebx + 0x3c]
call fcn.004047cc
push eax
call sub.wsock32.dll_inet_addr
mov esi, eax
mov dword [ebx + 0x48], esi
cmp esi, 0xffffffff
je 0x46b6db
lea eax, [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
call fcn.00404360
jmp 0x46b716
mov eax, dword [ebx + 0x3c]
call fcn.004047cc
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x46b6fc
call sub.kernel32.dll_GetLastError
mov dword [ebx + 0x70], eax
jmp 0x46b735
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx + 0x48], eax
lea eax, [ebx + 0x40]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call fcn.00404504
push dword [ebx + 0x48]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 8]
call fcn.00408fb0
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x44]
call fcn.00404360
mov byte [ebx + 0x74], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b752
lea eax, [ebp - 8]
call fcn.0040430c
ret

Function at 0x46b758
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
push edi
test dl, dl
je 0x46b770
add esp, 0xfffffff0
call fcn.0040389c
mov ebx, edx
mov edi, eax
mov dword [edi + 0x14], 0xffffffff
mov dword [edi + 0x54], 0x40
mov dword [edi + 0x50], 0xfa0
mov dword [edi + 0x9c], 0x1e
mov edx, 0x38
mov eax, edi
call fcn.0046bbd8
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x46b7ca
mov ecx, 0x46b8ac
mov dl, 1
mov eax, dword [0x46b630]
call fcn.0040bdd8
call fcn.00403d04
push 0x46b8d8
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [edi + 4], esi
test esi, esi
jne 0x46b7ea
push 0x46b8e8
call sub.kernel32.dll_LoadLibraryA
mov dword [edi + 4], eax
cmp dword [edi + 4], 0
jne 0x46b806
mov ecx, 0x46b8fc
mov dl, 1
mov eax, dword [0x46b630]
call fcn.0040bdd8
call fcn.00403d04
push 0x46b92c
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 8], eax
push 0x46b93c
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xc], eax
push 0x46b94c
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x10], eax
cmp dword [edi + 8], 0
je 0x46b84b
cmp dword [edi + 0xc], 0
je 0x46b84b
cmp dword [edi + 0x10], 0
jne 0x46b861
mov ecx, 0x46b964
mov dl, 1
mov eax, dword [0x46b630]
call fcn.0040bdd8
call fcn.00403d04
call dword [edi + 8]
mov esi, eax
mov dword [edi + 0x14], esi
cmp esi, 0xffffffff
jne 0x46b884
mov ecx, 0x46b998
mov dl, 1
mov eax, dword [0x46b630]
call fcn.0040bdd8
call fcn.00403d04
mov eax, edi
test bl, bl
je 0x46b899
call fcn.004038f4
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4721d8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004047bc
mov eax, dword [ebp - 8]
call fcn.004047bc
xor eax, eax
push ebp
push 0x472281
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 4]
push esi
call sub.kernel32.dll_LoadLibraryW
test eax, eax
push esi
call sub.kernel32.dll_GetModuleHandleW
mov dword [0x5abc58], eax
cmp dword [0x5abc58], 0
je 0x472266
mov eax, dword [ebp - 8]
call fcn.004047cc
push eax
mov eax, dword [0x5abc58]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5abc5c], eax
push 0x5abc60
push 0x40
push 0x55d468d
push 0x5abc5c
call sub.kernel32.dll_VirtualProtect
mov edx, 0x5abc5c
mov eax, sub.kernel32.dll_GetCPInfo
mov ecx, 4
call fcn.004721cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472288
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404330
ret

Function at 0x476620
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004047bc
xor eax, eax
push ebp
push 0x4766ad
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1a8]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.004047cc
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x14], eax
push 2
push 4
lea eax, [ebp - 0x14]
push eax
call sub.wsock32.dll_gethostbyaddr
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x47668b
mov edx, ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00408fb0
jmp 0x476692
mov eax, ebx
call fcn.0040430c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4766b4
lea eax, [ebp - 4]
call fcn.0040430c
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..retplne
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5ccb2fe2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
mov ecx, 0x5a0f2271
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x408f6c
nop
nop
mov ecx, 0xfa14fbe
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e3d0
mov ecx, 0x12ff0799
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1000fa51
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x1000fb05
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.1000f9e1
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x1000fade
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000fb11
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x1000fb2c
test ebp, ebp
je 0x1000fb2c
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x1000fb34
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x1000fb74
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x1000fbd0
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x1000fbcb
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1000fbb6
test dl, dl
je 0x1000fbb2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1000fbb6
add ecx, 2
add eax, 2
test dl, dl
jne 0x1000fb96
xor eax, eax
jmp 0x1000fbbb
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000fbda
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x1000fb83
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x1000fbf1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.1000fa51
test eax, eax
jne 0x1000fc09
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.1000fb11
mov esi, eax
test esi, esi
jne 0x1000fc3f
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x1000fc59
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x1000fd51
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.1000fa51
mov esi, eax
test esi, esi
jne 0x1000fd6f
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.1000fb11
mov dword [esp + 0x18], eax
test eax, eax
je 0x1000fd67
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.1000fb11
mov dword [esp + 0x34], eax
test eax, eax
je 0x1000fd67
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.1000fb11
mov dword [esp + 0x28], eax
test eax, eax
je 0x1000fd67
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.1000fb11
mov dword [esp + 0x30], eax
test eax, eax
je 0x1000fd67
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x1000ff36
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x1000ff36
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x1000fe99
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x1000ff1a
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x1000febc
movzx esi, ax
jmp 0x1000fec1
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x1000fee0
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x1000feef
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x1000ff43
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x1000feb1
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x1000fe76
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x1000ff6c
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x1000ff6c
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x1000ff51
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x1000ff81
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.1000fa51
mov esi, eax
test esi, esi
je 0x1001003d
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.1000fb11
mov ebp, eax
test ebp, ebp
je 0x1001003c
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.1000fb11
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x1001003c
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x1001003c
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x1001003b
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x10010021
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x100102ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100102dd
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100102dd
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100102e7
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10010329
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1001038b
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10010386
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10010371
test dl, dl
je 0x1001036d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10010371
add ecx, 2
add eax, 2
test dl, dl
jne 0x10010351
xor eax, eax
jmp 0x10010376
sbb eax, eax
or eax, 1
test eax, eax
je 0x10010397
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x1001033e
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x1001166f
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x10011723
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.100115ff
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x100116fc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001172f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x1001174a
test ebp, ebp
je 0x1001174a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10011752
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x10011792
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x100117ee
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100117e9
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100117d4
test dl, dl
je 0x100117d0
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100117d4
add ecx, 2
add eax, 2
test dl, dl
jne 0x100117b4
xor eax, eax
jmp 0x100117d9
sbb eax, eax
or eax, 1
test eax, eax
je 0x100117f8
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x100117a1
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret