joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cd360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
dec eax
push ebp
mov ebp, edx
lea eax, [edx + eax*4]
mov dword [esp + 0x14], eax
cmp edx, eax
mov eax, dword [esp + 0x24]
jae 0x100cd52f
push esi
mov esi, dword [esp + 0x2c]
push ebx
push edi
nop dword [eax]
test esi, esi
je 0x100cd39c
cmp eax, esi
jae 0x100cd528
mov cl, byte [eax]
mov byte [esp + 0x2c], cl
test cl, cl
je 0x100cd528
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, esi
movsx ecx, byte [ecx + 0x10128788]
test ecx, ecx
mov dword [esp + 0x18], ecx
sete bl
add ebx, ecx
mov dword [esp + 0x1c], ebx
test esi, esi
jne 0x100cd3d1
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [esp + 0x2c]
mov byte [esp + 0x13], cl
cmp esi, edx
jae 0x100cd3e8
mov bh, byte [esi]
jmp 0x100cd3ea
xor bh, bh
lea esi, [eax + 2]
mov byte [esp + 0x12], bh
cmp esi, edx
jae 0x100cd3f9
mov ch, byte [esi]
jmp 0x100cd3fb
xor ch, ch
lea esi, [eax + 3]
mov byte [esp + 0x11], ch
cmp esi, edx
jae 0x100cd40a
mov bl, byte [esi]
jmp 0x100cd40c
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [esp + 0x2c], bl
mov ebx, dword [esp + 0x18]
mov ebx, dword [ebx*4 + 0x101287a8]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [esp + 0x14], ebx
shl dword [esp + 0x14], 6
and esi, 0xc0
or dword [esp + 0x14], ecx
mov ecx, edx
shl dword [esp + 0x14], 6
and ecx, 0x3f
or dword [esp + 0x14], ecx
and edx, 0xc0
shl dword [esp + 0x14], 6
mov ecx, edi
mov ebx, dword [esp + 0x14]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [esp + 0x18]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x101287d0]
shr ebx, cl
mov esi, ebx
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x18]
cmp esi, dword [ebx*4 + 0x101287bc]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0x10ffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x101287e4]
mov ebx, dword [esp + 0x1c]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x100cd50e
xor edx, edx
mov esi, 0xfffd
cmp byte [esp + 0x2c], dl
setne dl
xor ecx, ecx
cmp byte [esp + 0x11], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x12], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x13], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
jmp 0x100cd514
add eax, ebx
test esi, esi
je 0x100cd528
mov dword [ebp], esi
add ebp, 4
mov esi, dword [esp + 0x34]
cmp ebp, dword [esp + 0x20]
jb 0x100cd390
mov edx, dword [esp + 0x28]
pop edi
pop ebx
pop esi
mov ecx, dword [esp + 0x2c]
mov dword [ebp], 0
test ecx, ecx
je 0x100cd540
mov dword [ecx], eax
sub ebp, edx
sar ebp, 2
mov eax, ebp
pop ebp
add esp, 0x14
ret
Function at 0x100d2660
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x3748], 0
lea esi, [edi + 0x374c]
je 0x100d26da
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x100d2694
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.100e7ec0
push dword [esp + 0x14]
mov ecx, esi
mov dword [esi], 0
push dword [esp + 0x14]
call fcn.100e7600
mov edx, dword [esi]
mov ecx, 0x1015fb70
push dword [edi + 0x3748]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x3754]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
ret
push dword [esp + 0x14]
mov ecx, esi
push dword [esp + 0x14]
call fcn.100e7600
pop edi
pop esi
ret
Function at 0x100dcfa0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x1015fb6c]
push esi
mov esi, dword [esp + 8]
mov dword [eax + 0x36fc], 0
test esi, esi
je 0x100dcffb
lea eax, [esp + 8]
mov dword [esp + 8], 0
push edi
push eax
call fcn.100dd000
push 0x1012b83c
push esi
mov edi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100dcffa
push esi
push dword [esp + 0x10]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
ret
Function at 0x100e6c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100e6c5d
mov dword [esi + 4], 0
mov dword [esi], 0
mov eax, dword [0x1015fb6c]
test eax, eax
je 0x100e6c46
dec dword [eax + 0x36c]
push dword [0x1015fb74]
push ecx
call dword [0x1015f6f4]
add esp, 8
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100e6c98
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov eax, dword [0x1015fb6c]
test eax, eax
je 0x100e6c81
dec dword [eax + 0x36c]
push dword [0x1015fb74]
push ecx
call dword [0x1015f6f4]
add esp, 8
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100e6cd3
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov eax, dword [0x1015fb6c]
test eax, eax
je 0x100e6cbc
dec dword [eax + 0x36c]
push dword [0x1015fb74]
push ecx
call dword [0x1015f6f4]
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x100e6d2a
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov eax, dword [0x1015fb6c]
test eax, eax
je 0x100e6d13
dec dword [eax + 0x36c]
push dword [0x1015fb74]
push ecx
call dword [0x1015f6f4]
add esp, 8
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x100e6d65
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov eax, dword [0x1015fb6c]
test eax, eax
je 0x100e6d4e
dec dword [eax + 0x36c]
push dword [0x1015fb74]
push ecx
call dword [0x1015f6f4]
add esp, 8
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x100e6da0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov eax, dword [0x1015fb6c]
test eax, eax
je 0x100e6d89
dec dword [eax + 0x36c]
push dword [0x1015fb74]
push ecx
call dword [0x1015f6f4]
add esp, 8
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100c5540
Function at 0x100ec010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
push esi
mov esi, dword [esp + 0x34]
push edi
movq xmm0, qword [esi + 0x70]
mov esi, dword [esi + 0x78]
movq qword [esp + 0x18], xmm0
mov edi, dword [esp + 0x18]
test esi, esi
jns 0x100ec053
push 0x46c
push str.C:UsersFrank.cargo_registry_srcgithub.com_1ecc6299db9ec823imgui_sys_0.8.2_third_partyimguiimstb_truetype.h
push str.__o___b__size__o___0_
call ebp
add esp, 0xc
mov dword [esp + 0x1c], esi
mov edx, esi
jmp 0x100ec070
xor edx, edx
mov dword [esp + 0x1c], 0
test esi, esi
jle 0x100ec070
mov al, byte [edi]
mov ecx, 1
mov ebx, ecx
mov edx, ecx
test al, al
jne 0x100ec0b4
mov eax, dword [esp + 0x3c]
lea ebx, [eax + edx]
cmp ebx, esi
jg 0x100ec07f
test ebx, ebx
jns 0x100ec093
push 0x46c
push str.C:UsersFrank.cargo_registry_srcgithub.com_1ecc6299db9ec823imgui_sys_0.8.2_third_partyimguiimstb_truetype.h
push str.__o___b__size__o___0_
call ebp
add esp, 0xc
cmp ebx, esi
jg 0x100ec0aa
test ebx, ebx
js 0x100ec0aa
cmp ebx, esi
jge 0x100ec0aa
mov al, byte [edi + ebx]
movzx eax, al
jmp 0x100ec15e
xor al, al
movzx eax, al
jmp 0x100ec15e
cmp al, 3
jne 0x100ec15b
cmp ebx, esi
jl 0x100ec0c4
xor al, al
jmp 0x100ec0c8
mov al, byte [edi + ecx]
inc ecx
movzx edx, al
cmp ecx, esi
jl 0x100ec0d3
xor al, al
jmp 0x100ec0d7
mov al, byte [edi + ecx]
inc ecx
shl edx, 8
movzx eax, al
or edx, eax
mov dword [esp + 0x10], edx
cmp ecx, esi
jl 0x100ec0eb
xor al, al
jmp 0x100ec0ef
mov al, byte [edi + ecx]
inc ecx
movzx ebp, al
cmp ecx, esi
jl 0x100ec0fa
xor al, al
jmp 0x100ec0fe
mov al, byte [edi + ecx]
inc ecx
shl ebp, 8
xor ebx, ebx
movzx eax, al
or ebp, eax
test edx, edx
je 0x100ec15b
nop dword [eax]
cmp ecx, esi
jl 0x100ec118
xor al, al
jmp 0x100ec11c
mov al, byte [edi + ecx]
inc ecx
movzx eax, al
mov dword [esp + 0x14], eax
cmp ecx, esi
jl 0x100ec12b
xor al, al
jmp 0x100ec12f
mov al, byte [edi + ecx]
inc ecx
movzx edx, al
cmp ecx, esi
jl 0x100ec13a
xor al, al
jmp 0x100ec13e
mov al, byte [edi + ecx]
inc ecx
shl edx, 8
movzx eax, al
or edx, eax
mov eax, dword [esp + 0x3c]
cmp eax, ebp
jl 0x100ec152
cmp eax, edx
jl 0x100ec1d1
inc ebx
mov ebp, edx
cmp ebx, dword [esp + 0x10]
jl 0x100ec110
or eax, 0xffffffff
mov ebp, dword [esp + 0x38]
push eax
sub esp, 0xc
mov ecx, esp
movq xmm0, qword [ebp + 0x64]
mov eax, dword [ebp + 0x6c]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea eax, [esp + 0x28]
push eax
call fcn.100ebcf0
add esp, 8
mov ecx, esp
sub esp, 0xc
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ecx], xmm0
movq xmm0, qword [ebp + 0x34]
mov dword [ecx + 8], eax
mov ecx, esp
mov eax, dword [ebp + 0x3c]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea eax, [esp + 0x3c]
push eax
call fcn.100ecfe0
mov edx, dword [esp + 0x50]
add esp, 0x1c
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop edi
pop esi
pop ebp
movq qword [edx], xmm0
mov dword [edx + 8], ecx
pop ebx
add esp, 0x20
ret
mov eax, dword [esp + 0x14]
jmp 0x100ec15e
Function at 0x100f0540
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [0x1015fb6c]
push ebx
push ebp
push esi
mov esi, dword [eax + 0x1b94]
mov eax, dword [esp + 0x10]
add esi, 0xc4
push edi
mov dword [esp + 0x14], eax
cmp dword [esi], 0
jg 0x100d8c4a
push 0x6ba
push str.C:UsersFrank.cargo_registry_srcgithub.com_1ecc6299db9ec823imgui_sys_0.8.2_third_partyimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ebp, dword [esi]
lea edx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edi, 4
mov ebx, dword [eax + ebp*4 - 4]
not ebx
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10124410]
sub edi, 1
jne 0x100d8c60
mov edi, dword [esi + 4]
not ebx
cmp ebp, edi
jne 0x100d8ca7
lea ecx, [ebp + 1]
test edi, edi
je 0x100d8c95
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
jmp 0x100d8c9a
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.100e7fc0
mov ecx, dword [esi]
mov eax, dword [esi + 8]
pop edi
mov dword [eax + ecx*4], ebx
inc dword [esi]
pop esi
pop ebp
pop ebx
ret
jmp 0x100d8c10
Function at 0x100f6020
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1006c720
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x101242c4
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x100f6086
mov esi, eax
push 0x101242e5
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x100f6086
mov ebx, eax
push 0x101242f3
push esi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x100f6086
mov esi, eax
mov eax, 1
jmp 0x100f60f8
push 0x10124307
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x100f6180
mov edi, eax
push 0x10124311
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x100f6180
mov ebx, eax
push 0x10124324
push edi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x100f6180
mov esi, eax
push 0x10124338
push edi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x100f6180
mov edi, eax
lea eax, [ebp - 0x38]
push 0
push 0
push 0xc0000000
push eax
call ebx
test eax, eax
jne 0x100f6180
mov ebx, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
push 4
push 0x10
call fcn.1001d510
add esp, 8
test eax, eax
je 0x100f61a4
movsd xmm0, qword [ebp - 0x30]
movsd xmm1, qword [ebp - 0x28]
mov ecx, eax
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
xor eax, eax
lock cmpxchg dword [0x1015fb68], ecx
je 0x100f616d
cmp dword [ecx], 0
mov esi, eax
mov dword [ebp - 0x20], ecx
jne 0x100f615c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 2
mov eax, dword [eax + 4]
push eax
mov dword [ebp - 0x34], esi
call sub.KERNEL32.dll_CloseHandle
mov esi, dword [ebp - 0x34]
push 4
push 0x10
push dword [ebp - 0x20]
call fcn.1001d520
add esp, 0xc
mov ecx, esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0
push 0x101242b4
push 0x5b
push str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:UsersFrank.cargo_registry_srcgithub.com_1ecc6299db9ec823parking_lot_core_0.8.5_src_thread_parkerwindowsmod.rs
call fcn.100f6220
add esp, 0xc
jmp 0x100f61b7
mov dword [ebp - 0x10], 1
push 4
push 0x10
call fcn.100f97e0
add esp, 8
ud2
Function at 0x100f87c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100904f0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x10133a94
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100f8829
mov esi, eax
push 0x10133ab5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100f8829
mov ebx, eax
push 0x10133ac3
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100f8829
mov esi, eax
mov eax, 1
jmp 0x100f889f
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100f8928
mov edi, eax
push 0x10133ae1
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100f8928
mov ebx, eax
push 0x10133af4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100f8928
mov esi, eax
push 0x10133b08
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100f8928
mov edi, eax
lea eax, [ebp - 0x38]
push 0
push 0
push 0xc0000000
push eax
call ebx
test eax, eax
jne 0x100f8928
mov ebx, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
push 4
push 0x10
call fcn.1001d510
add esp, 8
test eax, eax
je 0x100f894c
movsd xmm0, qword [ebp - 0x30]
movsd xmm1, qword [ebp - 0x28]
mov ecx, eax
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
xor eax, eax
lock cmpxchg dword [0x1015fba4], ecx
je 0x100f8915
cmp dword [ecx], 0
mov esi, eax
mov dword [ebp - 0x20], ecx
jne 0x100f8904
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 2
mov eax, dword [eax + 4]
push eax
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
push 4
push 0x10
push dword [ebp - 0x20]
call fcn.1001d520
add esp, 0xc
mov ecx, esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0
push 0x10133a84
push 0x5b
push str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:UsersFrank.cargo_registry_srcgithub.com_1ecc6299db9ec823parking_lot_core_0.9.3_src_thread_parkerwindowsmod.rs
call fcn.100f89d0
add esp, 0xc
jmp 0x100f895f
mov dword [ebp - 0x10], 1
push 4
push 0x10
call fcn.100f97e0
add esp, 8
ud2
Function at 0x1000451d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1000419b
push eax
push esi
push dword [ebp + 8]
call fcn.10004150
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
sahf
sub eax, 0x119f45c6

Function at 0x10004570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1000419b
push eax
push esi
push dword [ebp + 8]
call fcn.10004150
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1000419b
push eax
push esi
push dword [ebp + 8]
call fcn.10004150
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1000418b
mov edx, 0x88c40200
popfd
jl 0x10004610
invalid
invalid

Function at 0x10005550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x1000631e
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.100040fc
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x10005598
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x100055e1
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x1000558b
cld
invalid
call fcn.1000418b
clc
je 0x100055ac
adc eax, dword [eax - 0x72b5b]
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
invalid
Function at 0x1000633e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fdivp st(7)
jmp [edx - 0x77]
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x1000634f
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.1000418b
loop 0x100063a0
fisubr word [ebx - 0x75]
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.1000418b
xchg edi, eax
int 0xaa
ror byte [ecx - 0x75], 1
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x10006378
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x10006378
call fcn.1000418b
mov dl, 0x38
jbe 0x10006333
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ecx, dword [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.1000418b
jg 0x1000639a
invalid
Function at 0x100ed992
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101ba1e8]
jne 0x100ed99c
repz ret
jmp fcn.100f6f7b

Function at 0x100f86ef
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100eb2d6
and dword [ebp - 4], 0
cmp dword [0x101bc014], 0
mov ebx, eax
jne 0x100f87a0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100f8851
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100f8851
push eax
call fcn.100eb264
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101bc014], eax
call esi
push eax
call fcn.100eb264
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101bc018], eax
call esi
push eax
call fcn.100eb264
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101bc01c], eax
call esi
push eax
call fcn.100eb264
pop ecx
mov dword [0x101bc024], eax
test eax, eax
je 0x100f87a0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100eb264
pop ecx
mov dword [0x101bc020], eax
mov eax, dword [0x101bc020]
cmp eax, ebx
je 0x100f87f8
cmp dword [0x101bc024], ebx
je 0x100f87f8
push eax
call fcn.100eb2df
push dword [0x101bc024]
mov esi, eax
call fcn.100eb2df
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100f87f8
test edi, edi
je 0x100f87f8
call esi
test eax, eax
je 0x100f87ef
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100f87ef
test byte [ebp - 0xc], 1
jne 0x100f87f8
or dword [ebp + 0x10], 0x200000
jmp 0x100f8831
mov eax, dword [0x101bc018]
cmp eax, ebx
je 0x100f8831
push eax
call fcn.100eb2df
pop ecx
test eax, eax
je 0x100f8831
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100f8831
mov eax, dword [0x101bc01c]
cmp eax, ebx
je 0x100f8831
push eax
call fcn.100eb2df
pop ecx
test eax, eax
je 0x100f8831
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101bc014]
call fcn.100eb2df
pop ecx
test eax, eax
je 0x100f8851
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100f8853
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100fb7b9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [0x101b9648]
add ecx, 0x205c
mov dword [0x101b9644], ecx
mov dword [0x101b9648], 0x879
mov dword [ebp - 0x10], eax
call fcn.100fcb9b
xor ecx, ecx
mov edx, eax
mov dword [0x101b9644], 0xfffff7a8
mov esi, dword [eax + 0x3c]
mov dword [0x101b9648], 0x2416
mov dword [0x101b9644], 0x1348
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x101b9644], 0x254a
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
jne 0x100fb84e
mov eax, dword [ebp - 0x28]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
je 0x100fb8c9
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x40], eax
jne 0x100fb878
mov al, byte [ebp - 0x46]
test al, 1
jne 0x100fb909
jmp 0x100fb8d2
xor eax, eax
mov dword [0x101b9644], 0x150d
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x34]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jb 0x100fb85e
jmp 0x100fb843
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov dword [0x101b9648], 0x2552
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101b9644], 0xfffff15b
mov dword [ebp - 0x28], edi
jmp 0x100fb843