joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fe08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040eee4
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040ef16
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040eecb
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040ef06
in al, 0x75
js 0x40fef1
les ecx, [ecx + ecx*4]
test dword [esp + edi*8], ebp
invalid
push 0x104
invalid
test esp, edx
invalid

Function at 0x410388
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
push edx
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0040ef06
loope 0x4103c6
inc edx
xchg ecx, eax
lea eax, [ebp - 0x72c]
push eax
call fcn.0040ef16
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040eecb
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.0040ef06
push ebp
push 0xffffffffffffffec
ret 0x858d
Function at 0x41148a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00409d45
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
cmp dword [0x417bdc], ebx
jne 0x411563
push ebx
push ebx
push 0x402a28
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
jne 0x4114ce
xor eax, eax
jmp 0x411627
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402a1c
push edi
call esi
cmp eax, ebx
je 0x4114c7
push eax
call fcn.00409ccd
mov dword [esp], 0x402a0c
push edi
mov dword [0x417bdc], eax
call esi
push eax
call fcn.00409ccd
mov dword [esp], 0x4029f8
push edi
mov dword [0x417be0], eax
call esi
push eax
call fcn.00409ccd
mov dword [0x417be4], eax
lea eax, [ebp - 8]
push eax
call fcn.00409a70
pop ecx
pop ecx
test eax, eax
je 0x411531
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c94b
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x411563
push 0x4029dc
push edi
call esi
push eax
call fcn.00409ccd
pop ecx
mov dword [0x417bec], eax
cmp eax, ebx
je 0x411563
push 0x4029c4
push edi
call esi
push eax
call fcn.00409ccd
pop ecx
mov dword [0x417be8], eax
mov eax, dword [0x417be8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4115dc
cmp dword [0x417bec], esi
je 0x4115dc
push eax
call fcn.00409d53
pop ecx
call eax
cmp eax, ebx
je 0x4115a9
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x417bec]
call fcn.00409d53
pop ecx
call eax
test eax, eax
je 0x4115a9
test byte [ebp - 0x18], 1
jne 0x4115dc
lea eax, [ebp - 0xc]
push eax
call fcn.00409ab1
pop ecx
test eax, eax
je 0x4115c4
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c94b
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4115d3
or dword [ebp + 0x10], 0x200000
jmp 0x41160d
or dword [ebp + 0x10], 0x40000
jmp 0x41160d
mov eax, dword [0x417be0]
cmp eax, esi
je 0x41160d
push eax
call fcn.00409d53
pop ecx
call eax
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x41160d
mov eax, dword [0x417be4]
cmp eax, esi
je 0x41160d
push dword [ebp - 4]
push eax
call fcn.00409d53
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x417bdc]
call fcn.00409d53
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x10002840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10008894
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100122f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push 0x1000a5f0
lea eax, [esi + 0x50]
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x1c], 0
call fcn.10001200
mov edi, dword [esp + 0x38]
push edi
push eax
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x3c], 0
call fcn.10001200
add esp, 0x18
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push ecx
push edi
mov ecx, eax
mov byte [esp + 0x34], 1
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
mov ecx, esi
call sym.RTMUI.dll_public:_void___thiscall_CLocalizationManager::CompareFileSystemHelper_char_const___char_const___char_const___unsigned_long_int__unsigned_long_int__
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push str._____d_file_s__total
push eax
mov dword [esp + 0x30], 2
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
push 0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.LocalizationDifferences.log
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 1
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
mov byte [esp + 0x3c], 3
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov ecx, esi
mov byte [esp + 0x38], 2
call sym.RTMUI.dll_public:_void___thiscall_CLocalizationManager::AppendLog_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char_____int__class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char_____int__unsigned_long_int_
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 0xc

Function at 0x100031c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.10002dd6
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
pop ebp
xchg esp, eax

Function at 0x100031d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
xchg esp, eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
Function at 0x100031e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10002e21
push eax
push esi
push dword [ebp + 8]
call fcn.10002dd6
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
fsub dword [edi - 0x3a]
inc ebp
fld dword [esi + eax*8 + 0x45]
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x100032ac
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10002e21
push eax
push esi
push dword [ebp + 8]
call fcn.10002dd6
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10002e11
les esi, [eax]
ror dword [esi - 0x78], 0x9d
jl 0x10003296
invalid
invalid

Function at 0x100032b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.10002e11
je 0x100032b5
inc ebp
and byte [edx - 0x3a], 0x45
sbb dword [ebx - 0x3a], 0x45
test byte [ecx - 0x3a], bh
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
xchg esp, eax
call 0xf7cb88a
invalid
Function at 0x10003570
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100034e8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10003506
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10003564
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
or al, 0x66
cmp ecx, dword [eax + 6]
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x100034ca
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x10003670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc esi
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.10002e21
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10002dd6
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
invalid
invalid
invalid

Function at 0x10003710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
invalid
test dword [esp + edi*8 - 1], eax
invalid

Function at 0x100038d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.10002e21
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10002dd6
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.10002e11
dec edi
ficomp word [ebx]
and byte [ebp - 0x664], 0
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
invalid
invalid
movsd dword es:[edi], dword [esi]
Function at 0x10004140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x6d8], 0x81
mov byte [ebp - 0x6d7], 0xb6
mov byte [ebp - 0x6d6], 0xb2
mov byte [ebp - 0x6d5], 0xb7
mov byte [ebp - 0x6d4], 0x95
mov byte [ebp - 0x6d3], 0xba
mov byte [ebp - 0x6d2], 0xbf
mov byte [ebp - 0x6d1], 0xb6
mov byte [ebp - 0x6d0], 0xd3
call fcn.10002e11
jp 0x10004207
push ss
push edx
lea eax, [ebp - 0x6dc]
push eax
call fcn.10002e21
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10002dd6
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x10004fa4
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.10002d82
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x1000421e
or al, 0x83
movsd dword es:[edi], dword [esi]
add cl, bh
invalid
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x10004267
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x10004211
call fcn.10002e11
xchg esi, eax
mov dl, 0xdf
push edx
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
out 0xf8, al
invalid
invalid
cmp eax, 0xffeb17e8
invalid
jmp 0x10004280
salc
clc
invalid
Function at 0x10006500
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x10009000
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x100122f8]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
push edi
mov eax, dword [0x100122f8]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov esi, dword [esp + 0x234]
mov edi, dword [esp + 0x238]
push 0x104
lea eax, [esp + 0x1c]
push eax
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
push edi
lea edx, [esp + 0x14]
push str.ID__s
push edx
mov dword [esp + 0x238], 0
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_310]
push str.HelpMap
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x238], 1
call fcn.10001200
add esp, 0xc
mov ecx, eax
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
push 0x104
lea edx, [esp + 0x124]
push edx
push edi
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
push 0x1000b15c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0xc]
mov byte [esp + 0x22c], 0
call dword [sym.imp.mfc90.dll_Ordinal_601]
push str.Help_
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_310]
lea ecx, [esp + 0x11c]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x238], 2
call fcn.10001200
add esp, 0xc
mov ecx, eax
mov byte [esp + 0x22c], 3
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call sym.RTMUI.dll_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_GetResourceFilePath_char_const___char_const__
add esp, 0xc
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, esi
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.10007bce
add esp, 0x224
ret 8

Function at 0x10007bce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100122f8]
jne 0x10007bd8
repz ret
jmp fcn.1000818c
Function at 0x600f43
Capabilities:
Encode data using xor

Disassembly:
mov es, word [eax - 0x29940e73]
salc
insb byte es:[edi], dx
mov eax, 0x23b991cb
sub ebp, dword [0x5e0bf81b]
push ecx
push ebx
dec ecx
ficom word [ecx + 0x72]
fist word [ecx + 0x2f665e18]
cmp dword [edi], eax
xchg ecx, eax
xor byte [eax], 0x7e
inc esi
jb 0x600f48
push es
dec ecx
and bh, al
add ch, byte [eax - 6]
cmp byte [esi + 0x40cb1b0f], ah
push 0x14
mov esp, 0xdd4c7d18
add al, 0xd7
lahf
fst dword [esi - 0x44]
std
dec esp
rcr dword [edi + 0x57], 0xb0
add eax, ebx
std
xor ebx, dword [esi - 0x1ba30c7e]
xchg esi, eax
imul eax, dword [edx + 0x1016213b], 0x73
int1
jmp 0x600fd2
scasb al, byte es:[edi]
sbb al, 0x80
mov ch, 0x91
sbb dword [edx + 0x327dac8c], esi
xchg ebx, eax
jno 0x600fe1
mov bl, 0xad
lodsd eax, dword [esi]
pop edi
stosd dword es:[edi], eax
ret 0x10f9
Function at 0x10001000
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x1000976b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2b4
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
push 0x1000c190
mov dword [esp + 0x2d0], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x38], ebx
jne 0x100010a9
call fcn.10005670
push 0x5c
push str.F:RC50WSSC50SCap24_srcdrviCertManager.cpp
mov esi, eax
call sub.MSVCRT.dll_strrchr
add esp, 8
inc eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0x39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1000c158
push esi
call fcn.100014b0
add esp, 0xc
cmp ebx, ebp
je 0x100010a2
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x10001208
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000c134
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x10001097
push 0x1000c118
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x10001097
push 0x1000c108
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x18], eax
je 0x10001097
push 0x1000c0f0
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x1c], eax
je 0x10001097
push 0x1000c0d0
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x20], eax
je 0x10001097
push 0x1000c0b0
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x28], eax
je 0x10001097
push 0x1000c094
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x2c], eax
je 0x10001097
push 0x1000c074
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x10001097
push 0x1000c064
push ebx
call esi
mov edi, eax
cmp edi, ebp
mov dword [esp + 0x34], edi
je 0x10001097
push 0x1000c050
push ebx
call esi
mov ecx, dword [esp + 0x2d4]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0x24], eax
lea eax, [esp + 0xbc]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push ebp
push ebp
call esi
mov eax, dword [esp + 0x2d8]
lea edx, [esp + 0x3c]
push 0x40
push edx
push 0xffffffffffffffff
push eax
push ebp
push ebp
call esi
lea ecx, [esp + 0x3c]
push ecx
push 0x20000
push ebp
push ebp
push 0xa
call edi
lea edx, [esp + 0xbc]
mov ebp, eax
push edx
push 0x8000
push 0
push 0x10001
push 8
call edi
test ebp, ebp
mov edi, eax
je 0x100011e6
test edi, edi
je 0x100011f1
push 0
push edi
call dword [esp + 0x34]
mov esi, eax
test esi, esi
je 0x100011e6
push 0
push 3
push esi
push ebp
call dword [esp + 0x20]
push esi
push edi
call dword [esp + 0x34]
mov esi, eax
test esi, esi
jne 0x100011d0
test edi, edi
je 0x100011f1
push 1
push edi
call dword [esp + 0x20]
test ebp, ebp
je 0x100011fc
push 1
push ebp
call dword [esp + 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov ecx, dword [esp + 0x2c4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c0
ret
Function at 0x10001240
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x1000978b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1ac
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
push 0x1000c190
mov dword [esp + 0x1c8], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x38], ebx
jne 0x100012e4
call fcn.10005670
push 0x5c
push str.F:RC50WSSC50SCap24_srcdrviCertManager.cpp
mov esi, eax
call sub.MSVCRT.dll_strrchr
add esp, 8
inc eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0x39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1000c158
push esi
call fcn.100014b0
add esp, 0xc
cmp ebx, ebp
je 0x10001451
jmp 0x1000144a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000c134
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x100012d7
push 0x1000c118
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x100012d7
push 0x1000c108
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x18], eax
je 0x100012d7
push 0x1000c0f0
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x1c], eax
je 0x100012d7
push 0x1000c0d0
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x20], eax
je 0x100012d7
push 0x1000c0b0
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x28], eax
je 0x100012d7
push 0x1000c094
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x2c], eax
je 0x100012d7
push 0x1000c074
push ebx
call esi
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x100012d7
push 0x1000c064
push ebx
call esi
mov edi, eax
cmp edi, ebp
mov dword [esp + 0x34], edi
je 0x100012d7
push 0x1000c050
push ebx
call esi
mov ecx, dword [esp + 0x1d0]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x3c]
push 0x40
push eax
push 0xffffffffffffffff
push ecx
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x3c]
push edx
push 0x20000
push ebp
push ebp
push 0xa
call edi
mov ebp, eax
test ebp, ebp
je 0x1000144a
push 0
push ebp
call dword [esp + 0x34]
mov esi, eax
test esi, esi
je 0x10001443
lea eax, [esp + 0xbc]
push 0x80
push eax
push 0
push 0
push 4
push esi
call dword [esp + 0x3c]
test eax, eax
je 0x10001437
mov ecx, dword [esp + 0x1cc]
lea edx, [esp + 0xbc]
push ecx
push edx
call sub.MSVCRT.dll__mbscmp
add esp, 8
test eax, eax
jne 0x10001437
push esi
call dword [esp + 0x34]
mov edi, eax
test edi, edi
je 0x10001432
mov eax, dword [esi + 0xc]
mov ecx, dword [edi + 0xc]
push eax
push ecx
push 1
call dword [esp + 0x28]
test eax, eax
je 0x10001432
push edi
call dword [esp + 0x24]
test eax, eax
jne 0x10001437
push esi
call dword [esp + 0x24]
push esi
push ebp
call dword [esp + 0x34]
mov esi, eax
test esi, esi
jne 0x100013d4
push 1
push ebp
call dword [esp + 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1bc]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1b8
ret