joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100069c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.10025a5e
cmp word [ebp + 0xf1b0], 0x3030
jne 0x100069eb
mov al, byte [ebp + 0xf1b2]
cmp al, 0x31
jne 0x100069eb
mov al, byte [ebp + 0xf1b3]
cmp al, 0x31
jb 0x10006b2b
lea esi, [ebp + 0xf1b0]
mov edi, dword [ebp - 0x4c]
lea edi, [edi + 0x38]
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
ja 0x10006b2b
mov eax, 0x20202020
mov dword [ebp + 0x11d80], eax
mov dword [ebp + 0x11d84], eax
mov dword [ebp + 0x11d88], eax
mov byte [ebp + 0x11d8c], al
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x18]
lea edi, [ebp + 0x11d9b]
call fcn.1002d007
mov eax, 0x20202020
mov dword [ebp + 0x11dac], eax
mov dword [ebp + 0x11db0], eax
mov dword [ebp + 0x11db4], eax
mov dword [ebp + 0x11db8], eax
mov dword [ebp + 0x11dbc], eax
mov dword [ebp + 0x11dc0], eax
mov dword [ebp + 0x11dc4], eax
mov word [ebp + 0x11dc8], ax
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x1d]
lea edi, [ebp + 0x11dd2]
call fcn.1002cf58
mov eax, 0x20202020
mov dword [ebp + 0x11de4], eax
mov dword [ebp + 0x11de8], eax
mov dword [ebp + 0x11dec], eax
mov dword [ebp + 0x11df0], eax
mov dword [ebp + 0x11df4], eax
mov dword [ebp + 0x11df8], eax
mov dword [ebp + 0x11dfc], eax
mov word [ebp + 0x11e00], ax
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x18]
lea edi, [ebp + 0x11d9b]
call fcn.1002d007
mov dword [ebp + 0x11dac], 0x532d3939
mov dword [ebp + 0x11db0], 0x47534d59
mov dword [ebp + 0x11db4], 0x4958452d
mov dword [ebp + 0x11db8], 0x20202054
mov dword [ebp + 0x11dbc], 0x20202020
mov dword [ebp + 0x11dc0], 0x20202020
mov dword [ebp + 0x11dc4], 0x20202020
mov word [ebp + 0x11dc8], 0x2020
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x3c]
lea edi, [ebp + 0x11dd2]
call fcn.1002cf58
call fcn.10024ab3
mov dword [ebp + 0xf1b0], 0x30303030
mov eax, 0x20202020
lea edi, [ebp + 0xf1b4]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov eax, 0x20202020
lea edi, [ebp + 0x11ad4]
mov ecx, 0x39
rep stosd dword es:[edi], eax
mov word [ebp + 0x11bb8], ax
mov word [ebp + 0x104ac], 0
mov word [ebp + 0x1047a], 0
mov dword [ebp + 0x104bc], 0x30303030
ret
Function at 0x10006b7d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov al, byte [ebp + 0x65c]
cmp al, 0x31
je 0x10006cfc
mov byte [ebp + 0x11ac0], 0x30
mov word [ebp + 0x11ac1], 0x3636
mov word [ebp + 0x11ac6], 0x3030
mov byte [ebp + 0x11ac8], 0x30
mov edi, dword [ebp + 0x273dc]
mov al, byte [edi + 0x2a0]
mov byte [ebp + 0x11ac3], al
mov ax, word [edi + 0x2a1]
mov word [ebp + 0x11ac4], ax
mov byte [ebp + 0x11ac9], 0x30
mov word [ebp + 0x11aca], 0x3030
mov byte [ebp + 0x11acc], 0x30
mov word [ebp + 0x11acd], 0x3430
mov byte [ebp + 0x11acf], 0x30
mov word [ebp + 0x11ad0], 0x3130
call fcn.10020cae
mov edi, dword [ebp + 0x273dc]
mov eax, 0x30303030
cmp ax, word [edi + 0x425]
jne 0x10006c37
lea esi, [ebp + 0x11ad4]
lea edi, [ebp + 0x3f4]
mov ecx, 0x37
rep movsd dword es:[edi], dword [esi]
mov ax, word [ebp + 0x11bb0]
mov word [ebp + 0x4d0], ax
jmp 0x10006c70
mov al, byte [ebp + 0x114ff]
mov byte [ebp + 0x3f4], al
mov ax, word [ebp + 0x11500]
mov word [ebp + 0x3f5], ax
mov eax, 0x20202020
mov byte [ebp + 0x3f7], al
lea edi, [ebp + 0x3f8]
mov ecx, 0x36
rep stosd dword es:[edi], eax
mov word [ebp + 0x4d0], ax
mov byte [ebp + 0x11acf], 0x30
mov word [ebp + 0x11ad0], 0x3230
call fcn.10020cae
mov edi, dword [ebp + 0x273dc]
mov eax, 0x30303030
cmp ax, word [edi + 0x425]
jne 0x10006cbc
lea esi, [ebp + 0x11ad4]
lea edi, [ebp + 0x4d4]
mov ecx, 0x37
rep movsd dword es:[edi], dword [esi]
mov ax, word [ebp + 0x11bb0]
mov word [ebp + 0x5b0], ax
jmp 0x10006cf5
mov al, byte [ebp + 0x114ff]
mov byte [ebp + 0x4d4], al
mov ax, word [ebp + 0x11500]
mov word [ebp + 0x4d5], ax
mov eax, 0x20202020
mov byte [ebp + 0x4d7], al
lea edi, [ebp + 0x4d8]
mov ecx, 0x36
rep stosd dword es:[edi], eax
mov word [ebp + 0x5b0], ax
mov byte [ebp + 0x65c], 0x31
lea eax, [ebp + 0x5e4]
mov dword [ebp + 0x10476], eax
mov byte [ebp + 0x660], 0x30
mov word [ebp + 0x1047c], 0
mov word [ebp + 0x684], 0
mov word [ebp + 0x688], 0
mov byte [ebp + 0x66c], 0x30
mov byte [ebp + 0x670], 0x30
mov byte [ebp + 0x67c], 0x31
mov byte [ebp + 0x680], 0x30
mov dword [ebp + 0x698], 0
mov byte [ebp + 0x69c], 0
mov word [ebp + 0x69d], 0xf00
mov byte [ebp + 0x69f], 0
mov dword [ebp + 0x6a0], 0
mov word [ebp + 0x6a4], 0xf00
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x45]
lea edi, [ebp + 0x6a6]
call fcn.1002cee1
mov word [ebp + 0x690], 0
ret
Function at 0x1000b4da
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp + 0x11ac0], 0x30
mov word [ebp + 0x11ac1], 0x3636
mov edi, dword [ebp + 0x273dc]
mov al, byte [edi + 0x2a0]
mov byte [ebp + 0x11ac3], al
mov ax, word [edi + 0x2a1]
mov word [ebp + 0x11ac4], ax
mov word [ebp + 0x11ac6], 0x3030
mov byte [ebp + 0x11ac8], 0x30
mov byte [ebp + 0x11ac9], 0x30
mov word [ebp + 0x11aca], 0x3030
mov byte [ebp + 0x11acc], 0x30
mov word [ebp + 0x11acd], 0x3330
mov byte [ebp + 0x11acf], 0x30
mov word [ebp + 0x11ad0], 0x3130
call fcn.10020cae
mov edi, dword [ebp + 0x273dc]
mov eax, 0x30303030
cmp ax, word [edi + 0x425]
jne 0x1000b58d
lea esi, [ebp + 0x11ad4]
lea edi, [ebp + 0x533d]
mov ecx, 0x37
rep movsd dword es:[edi], dword [esi]
mov ax, word [ebp + 0x11bb0]
mov word [ebp + 0x5419], ax
jmp 0x1000b5c6
mov al, byte [ebp + 0x114ff]
mov byte [ebp + 0x533d], al
mov ax, word [ebp + 0x11500]
mov word [ebp + 0x533e], ax
mov eax, 0x20202020
lea edi, [ebp + 0x5340]
mov ecx, 0x36
rep stosd dword es:[edi], eax
mov word [ebp + 0x5418], ax
mov byte [ebp + 0x541a], al
mov byte [ebp + 0x11ac0], 0x30
mov word [ebp + 0x11ac1], 0x3636
mov edi, dword [ebp + 0x273dc]
mov al, byte [edi + 0x2a0]
mov byte [ebp + 0x11ac3], al
mov ax, word [edi + 0x2a1]
mov word [ebp + 0x11ac4], ax
mov word [ebp + 0x11ac6], 0x3030
mov byte [ebp + 0x11ac8], 0x30
mov byte [ebp + 0x11ac9], 0x30
mov word [ebp + 0x11aca], 0x3030
mov byte [ebp + 0x11acc], 0x30
mov word [ebp + 0x11acd], 0x3330
mov byte [ebp + 0x11acf], 0x30
mov word [ebp + 0x11ad0], 0x3230
call fcn.10020cae
mov edi, dword [ebp + 0x273dc]
mov eax, 0x30303030
cmp ax, word [edi + 0x425]
jne 0x1000b68c
lea edx, [ebp + 0x11ad4]
lea ecx, [ebp + 0x541b]
mov ebx, 4
mov eax, dword [edx]
mov esi, dword [edx + 4]
add edx, 8
mov dword [ecx], eax
mov dword [ecx + 4], esi
add ecx, 8
dec ebx
jne 0x1000b664
mov eax, dword [edx]
mov dword [ecx], eax
mov al, byte [ebp + 0x11af8]
mov byte [ebp + 0x543f], al
jmp 0x1000b6e2
mov al, byte [ebp + 0x114ff]
mov byte [ebp + 0x541b], al
mov ax, word [ebp + 0x11500]
mov word [ebp + 0x541c], ax
mov eax, 0x20202020
mov word [ebp + 0x541e], ax
mov dword [ebp + 0x5420], eax
mov dword [ebp + 0x5424], eax
mov dword [ebp + 0x5428], eax
mov dword [ebp + 0x542c], eax
mov dword [ebp + 0x5430], eax
mov dword [ebp + 0x5434], eax
mov dword [ebp + 0x5438], eax
mov dword [ebp + 0x543c], eax
mov byte [ebp + 0x5361], 0
mov byte [ebp + 0x53ab], 0
mov byte [ebp + 0x532f], 0x31
ret
Function at 0x1001a8c7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp + 0xad61], 0x30
mov word [ebp + 0xad62], 0x3030
mov byte [ebp + 0xad64], 0x30
mov byte [ebp + 0xad65], 0x30
mov word [ebp + 0xad66], 0x3030
mov byte [ebp + 0xad68], 0x30
mov word [ebp + 0xad69], 0x3030
mov word [ebp + 0xad6b], 0x2020
mov byte [ebp + 0xad6d], 0
mov word [ebp + 0xad6e], 0xf00
mov dword [ebp + 0xad70], 0
mov word [ebp + 0xad74], 0xf00
mov word [ebp + 0xad76], 0
mov dword [ebp + 0xad78], 0xf000000
mov dword [ebp + 0xad7c], 0x30303030
mov dword [ebp + 0xad80], 0x30303030
mov dword [ebp + 0xad84], 0x30303030
mov dword [ebp + 0xad88], 0x30303030
mov eax, 0x20202020
mov dword [ebp + 0xad8c], eax
mov dword [ebp + 0xad90], eax
mov dword [ebp + 0xad94], eax
mov dword [ebp + 0xad98], eax
mov dword [ebp + 0xad9c], eax
mov dword [ebp + 0xada0], eax
mov dword [ebp + 0xada4], eax
mov dword [ebp + 0xada8], eax
mov dword [ebp + 0xadac], eax
mov dword [ebp + 0xadb0], eax
mov dword [ebp + 0xadb4], eax
mov dword [ebp + 0xadb8], eax
mov word [ebp + 0xadbc], ax
ret

Function at 0x1001ca7c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov word [ebp + 0xd4b], 0
mov word [ebp + 0xd4d], 0
mov word [ebp + 0xd4f], 0
mov edi, dword [ebp + 0x273dc]
lea esi, [edi + 0x425]
lea edi, [ebp + 0xd46]
mov ecx, 2
rep movsb byte es:[edi], byte [esi]
call fcn.1001b3d9
mov byte [ebp + 0xb745], 0x30
mov word [ebp + 0xb746], 0x3130
mov dword [ebp + 0xb748], 0x31747a30
mov dword [ebp + 0xb74c], 0x20202020
mov dword [ebp + 0xb750], 0x20202020
mov dword [ebp + 0xb754], 0x20202020
mov dword [ebp + 0xb758], 0x20202020
mov dword [ebp + 0xb75c], 0x20202020
mov dword [ebp + 0xb760], 0x20202020
mov dword [ebp + 0xb764], 0x20202020
mov dword [ebp + 0xb768], 0x20202020
mov byte [ebp + 0xb76c], 0x20
mov word [ebp + 0xb76d], 0x270f
mov byte [ebp + 0xb76f], 0
mov word [ebp + 0xb770], 0xf00
call fcn.1001b3ac
mov dword [ebp + 0xd64], 0x30313030
mov dword [ebp + 0xd68], 0x2031747a
mov dword [ebp + 0xd6c], 0x20202020
mov dword [ebp + 0xd70], 0x20202020
mov dword [ebp + 0xd74], 0x20202020
mov dword [ebp + 0xd78], 0x20202020
mov dword [ebp + 0xd7c], 0x20202020
mov dword [ebp + 0xd80], 0x20202020
mov dword [ebp + 0xd84], 0x20202020
mov dword [ebp + 0xd88], 0x20202020
mov word [ebp + 0xd8c], 0x270f
call fcn.1001be89
mov edi, dword [ebp + 0x273dc]
lea esi, [ebp + 0xd46]
lea edi, [edi + 0x425]
mov ecx, 2
rep movsb byte es:[edi], byte [esi]
ret
Function at 0x1001cbd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, dword [ebp + 0x273dc]
lea esi, [edi + 0x425]
lea edi, [ebp + 0xd46]
mov ecx, 2
rep movsb byte es:[edi], byte [esi]
call fcn.1001b33d
mov byte [ebp + 0xb709], 0x30
mov word [ebp + 0xb70a], 0x3130
mov dword [ebp + 0xb70c], 0x31747a30
mov dword [ebp + 0xb710], 0x20202020
mov dword [ebp + 0xb714], 0x20202020
mov dword [ebp + 0xb718], 0x20202020
mov dword [ebp + 0xb71c], 0x20202020
mov dword [ebp + 0xb720], 0x20202020
mov dword [ebp + 0xb724], 0x20202020
mov dword [ebp + 0xb728], 0x20202020
mov dword [ebp + 0xb72c], 0x20202020
mov byte [ebp + 0xb730], 0x20
mov word [ebp + 0xb731], 0x270f
mov byte [ebp + 0xb733], 0
mov word [ebp + 0xb734], 0xf00
call fcn.1001b310
mov edi, dword [ebp + 0x273dc]
lea esi, [ebp + 0xd46]
lea edi, [edi + 0x425]
mov ecx, 2
rep movsb byte es:[edi], byte [esi]
call fcn.1001dff4
ret
Function at 0x10020757
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp + 0xf820], 0x302e3032
mov dword [ebp + 0xf824], 0x38312e34
mov dword [ebp + 0xf828], 0x204c554a
mov dword [ebp + 0xf82c], 0x202c3230
mov dword [ebp + 0xf830], 0x34323032
mov ax, word [ebp + 0xf820]
mov word [ebp + 0x946d], ax
mov al, byte [ebp + 0xf823]
mov byte [ebp + 0x946f], al
mov al, byte [ebp + 0xf824]
mov byte [ebp + 0x9470], al
mov eax, dword [ebp + 0xf830]
mov dword [ebp + 0x9465], eax
mov ax, word [ebp + 0xf82c]
mov word [ebp + 0x946b], ax
mov ax, word [ebp + 0xf829]
shl eax, 0x10
mov ah, byte [ebp + 0xf828]
cmp eax, 0x4e414a00
jne 0x100207f7
mov byte [ebp + 0x9469], 0x30
mov byte [ebp + 0x946a], 0x31
jmp 0x100209d1
mov ax, word [ebp + 0xf829]
shl eax, 0x10
mov ah, byte [ebp + 0xf828]
cmp eax, 0x42454600
jne 0x10020825
mov byte [ebp + 0x9469], 0x30
mov byte [ebp + 0x946a], 0x32
jmp 0x100209d1
mov ax, word [ebp + 0xf829]
shl eax, 0x10
mov ah, byte [ebp + 0xf828]
cmp eax, 0x52414d00
jne 0x10020853
mov byte [ebp + 0x9469], 0x30
mov byte [ebp + 0x946a], 0x33
jmp 0x100209d1
mov ax, word [ebp + 0xf829]
shl eax, 0x10
mov ah, byte [ebp + 0xf828]
cmp eax, 0x52504100
jne 0x10020881
mov byte [ebp + 0x9469], 0x30
mov byte [ebp + 0x946a], 0x34
jmp 0x100209d1
mov ax, word [ebp + 0xf829]
shl eax, 0x10
mov ah, byte [ebp + 0xf828]
cmp eax, 0x59414d00
jne 0x100208af
mov byte [ebp + 0x9469], 0x30
mov byte [ebp + 0x946a], 0x35
jmp 0x100209d1
mov ax, word [ebp + 0xf829]
shl eax, 0x10
mov ah, byte [ebp + 0xf828]
cmp eax, 0x4e554a00
jne 0x100208dd
mov byte [ebp + 0x9469], 0x30
mov byte [ebp + 0x946a], 0x36
jmp 0x100209d1
mov ax, word [ebp + 0xf829]
shl eax, 0x10
mov ah, byte [ebp + 0xf828]
cmp eax, 0x4c554a00
jne 0x1002090b
mov byte [ebp + 0x9469], 0x30
mov byte [ebp + 0x946a], 0x37
jmp 0x100209d1
mov ax, word [ebp + 0xf829]
shl eax, 0x10
mov ah, byte [ebp + 0xf828]
cmp eax, 0x47554100
jne 0x10020939
mov byte [ebp + 0x9469], 0x30
mov byte [ebp + 0x946a], 0x38
jmp 0x100209d1
mov ax, word [ebp + 0xf829]
shl eax, 0x10
mov ah, byte [ebp + 0xf828]
cmp eax, 0x50455300
jne 0x10020967
mov byte [ebp + 0x9469], 0x30
mov byte [ebp + 0x946a], 0x39
jmp 0x100209d1
mov ax, word [ebp + 0xf829]
shl eax, 0x10
mov ah, byte [ebp + 0xf828]
cmp eax, 0x54434f00
jne 0x10020995
mov byte [ebp + 0x9469], 0x31
mov byte [ebp + 0x946a], 0x30
jmp 0x100209d1
mov ax, word [ebp + 0xf829]
shl eax, 0x10
mov ah, byte [ebp + 0xf828]
cmp eax, 0x564f4e00
jne 0x100209c3
mov byte [ebp + 0x9469], 0x31
mov byte [ebp + 0x946a], 0x31
jmp 0x100209d1
mov byte [ebp + 0x9469], 0x31
mov byte [ebp + 0x946a], 0x32
mov eax, dword [ebp + 0xf828]
mov ecx, dword [ebp + 0xf82c]
mov dword [ebp + 0x93fc], eax
mov eax, dword [ebp + 0xf830]
mov dword [ebp + 0x9400], ecx
mov dword [ebp + 0x9404], eax
mov ecx, dword [ebp + 0xf820]
mov eax, dword [ebp + 0xf824]
mov dword [ebp + 0x940a], ecx
mov dword [ebp + 0x940e], eax
ret
Function at 0x10020a0e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp + 0x11bc0], 0
mov dword [ebp + 0x11bc4], 0x30303030
mov dword [ebp + 0x11bc8], 0x30303030
mov dword [ebp + 0x11bcc], 0x30303030
mov dword [ebp + 0x11bd0], 0x30303030
mov word [ebp + 0x104c0], 0x45
lea eax, [ebp + 0x11bc4]
mov dword [ebp + 0x11bbc], eax
mov dword [ebp + 0x11bc0], 8
push 0x10007
push 0xc
lea eax, [ebp + 0xfcbc]
push eax
lea eax, [ebp + 0x70]
push eax
mov dword [ebp + 0x9c], esp
call sub.carclw60.dll_CARC__GetDynamicCallAddress
add esp, 0x10
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0x94]
mov ecx, dword [ebp + 0x273dc]
push ecx
lea edx, [ebp + 0x104e0]
push edx
lea ecx, [ebp + 0x104e0]
push ecx
lea edx, [ebp + 0x104e0]
push edx
lea ecx, [ebp + 0x104e0]
push ecx
lea edx, [ebp + 0x11bbc]
push edx
lea ecx, [ebp + 0x104c0]
push ecx
push 0x10007
mov dword [ebp + 0x9c], esp
mov byte [ebp + 0x8b], 1
call eax
add esp, 0x20
mov byte [ebp + 0x8b], 0
mov edi, dword [ebp - 0x4c]
mov al, byte [edi + 0xac]
cmp al, 0x38
jne 0x10020b08
mov ecx, dword [ebp + 0x11bc4]
mov eax, dword [ebp + 0x11bc8]
mov dword [ebp + 0xf844], ecx
mov dword [ebp + 0xf848], eax
jmp 0x10020b3c
mov edi, dword [ebp - 0x4c]
mov al, byte [edi + 0xad]
cmp al, 0x38
jne 0x10020b3c
mov word [ebp + 0xf844], 0x3030
mov ax, word [ebp + 0x11bc6]
mov word [ebp + 0xf846], ax
mov eax, dword [ebp + 0x11bc8]
mov dword [ebp + 0xf848], eax
mov ecx, dword [ebp + 0xf844]
mov eax, dword [ebp + 0xf848]
mov dword [ebp + 0xf854], ecx
mov dword [ebp + 0xf858], eax
ret

Function at 0x10020b55
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp + 0x11bc0], 0
mov dword [ebp + 0x11bc4], 0x30303030
mov dword [ebp + 0x11bc8], 0x30303030
mov dword [ebp + 0x11bcc], 0x30303030
mov dword [ebp + 0x11bd0], 0x30303030
mov word [ebp + 0x104c0], 0x46
lea eax, [ebp + 0x11bcc]
mov dword [ebp + 0x11bbc], eax
mov dword [ebp + 0x11bc0], 8
push 0x10007
push 0xc
lea eax, [ebp + 0xfcbc]
push eax
lea eax, [ebp + 0x70]
push eax
mov dword [ebp + 0x9c], esp
call sub.carclw60.dll_CARC__GetDynamicCallAddress
add esp, 0x10
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0x94]
mov ecx, dword [ebp + 0x273dc]
push ecx
lea edx, [ebp + 0x104e0]
push edx
lea ecx, [ebp + 0x104e0]
push ecx
lea edx, [ebp + 0x104e0]
push edx
lea ecx, [ebp + 0x104e0]
push ecx
lea edx, [ebp + 0x11bbc]
push edx
lea ecx, [ebp + 0x104c0]
push ecx
push 0x10007
mov dword [ebp + 0x9c], esp
mov byte [ebp + 0x8b], 1
call eax
add esp, 0x20
mov byte [ebp + 0x8b], 0
mov edi, dword [ebp - 0x4c]
mov al, byte [edi + 0xac]
cmp al, 0x38
jne 0x10020c4f
mov ecx, dword [ebp + 0x11bcc]
mov eax, dword [ebp + 0x11bd0]
mov dword [ebp + 0xf85c], ecx
mov dword [ebp + 0xf860], eax
jmp 0x10020c83
mov edi, dword [ebp - 0x4c]
mov al, byte [edi + 0xad]
cmp al, 0x38
jne 0x10020c83
mov word [ebp + 0xf85c], 0x3030
mov eax, dword [ebp + 0x11bcc]
mov dword [ebp + 0xf85e], eax
mov ax, word [ebp + 0x11bd0]
mov word [ebp + 0xf862], ax
ret
Function at 0x10022d28
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x20202020
lea edi, [ebp + 0xf1b4]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0x90]
lea esi, [edi + 8]
lea edi, [ebp - 0x40]
mov edx, 0x205
mov dword [ebp + 0x9c], esp
call sub.carclw60.dll_GOL_59
lea esi, [ebp - 0x40]
lea edi, [ebp + 0xf1bc]
call fcn.1002cb9f
mov edi, dword [ebp + 0x90]
mov ax, word [edi + 8]
mov word [ebp + 0xff85], ax
call fcn.10022ec4
mov dword [ebp + 0xf1b0], 0x35353730
mov eax, 0x20202020
mov dword [ebp + 0x11d80], eax
mov dword [ebp + 0x11d84], eax
mov dword [ebp + 0x11d88], eax
mov byte [ebp + 0x11d8c], al
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x18]
lea edi, [ebp + 0x11d9b]
call fcn.1002d007
mov eax, 0x20202020
mov dword [ebp + 0x11dac], eax
mov dword [ebp + 0x11db0], eax
mov dword [ebp + 0x11db4], eax
mov dword [ebp + 0x11db8], eax
mov dword [ebp + 0x11dbc], eax
mov dword [ebp + 0x11dc0], eax
mov dword [ebp + 0x11dc4], eax
mov word [ebp + 0x11dc8], ax
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x1d]
lea edi, [ebp + 0x11dd2]
call fcn.1002cf58
mov eax, 0x20202020
mov dword [ebp + 0x11de4], eax
mov dword [ebp + 0x11de8], eax
mov dword [ebp + 0x11dec], eax
mov dword [ebp + 0x11df0], eax
mov dword [ebp + 0x11df4], eax
mov dword [ebp + 0x11df8], eax
mov dword [ebp + 0x11dfc], eax
mov word [ebp + 0x11e00], ax
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0xb4]
lea edi, [ebp + 0x11d9b]
call fcn.1002d007
mov dword [ebp + 0x11dac], 0x41432d39
mov dword [ebp + 0x11db0], 0x45564c4c
mov dword [ebp + 0x11db4], 0x4f2d5752
mov dword [ebp + 0x11db8], 0x46524556
mov dword [ebp + 0x11dbc], 0x20574f4c
mov dword [ebp + 0x11dc0], 0x20202020
mov dword [ebp + 0x11dc4], 0x20202020
mov word [ebp + 0x11dc8], 0x2020
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0xb9]
lea edi, [ebp + 0x11dd2]
call fcn.1002cf58
call fcn.10024ab3
mov ecx, dword [ebp + 0xff69]
mov eax, dword [ebp + 0xff6d]
mov dword [ebp + 0xf1b4], ecx
mov dword [ebp + 0xf1b8], eax
ret
Function at 0x10025767
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp + 0x14da9], 0x30
mov byte [ebp + 0x14daa], 0x30
mov eax, 0x20202020
mov byte [ebp + 0x14dab], al
lea edi, [ebp + 0x14dac]
mov ecx, 0x3f
rep stosd dword es:[edi], eax
mov byte [ebp + 0x14ea8], al
mov word [ebp + 0x14ea9], ax
mov eax, 0x20202020
mov byte [ebp + 0x14eab], al
lea edi, [ebp + 0x14eac]
mov ecx, 0x3f
rep stosd dword es:[edi], eax
mov byte [ebp + 0x14fa8], al
mov word [ebp + 0x14fa9], ax
mov byte [ebp + 0x150cd], 0x30
mov word [ebp + 0x150ce], 0x3030
mov byte [ebp + 0x150d0], 0x30
mov byte [ebp + 0x150d1], 0x30
mov word [ebp + 0x150d2], 0x3030
mov byte [ebp + 0x150d4], 0x30
mov byte [ebp + 0x150d5], 0x30
ret

Function at 0x100258d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp + 0x14da9], 0x30
mov byte [ebp + 0x14daa], 0x30
mov eax, 0x20202020
mov byte [ebp + 0x14dab], al
lea edi, [ebp + 0x14dac]
mov ecx, 0x3f
rep stosd dword es:[edi], eax
mov byte [ebp + 0x14ea8], al
mov word [ebp + 0x14ea9], ax
mov eax, 0x20202020
mov byte [ebp + 0x14eab], al
lea edi, [ebp + 0x14eac]
mov ecx, 0x3f
rep stosd dword es:[edi], eax
mov byte [ebp + 0x14fa8], al
mov word [ebp + 0x14fa9], ax
mov byte [ebp + 0x151f5], 0x30
mov word [ebp + 0x151f6], 0x3030
mov byte [ebp + 0x151f8], 0x30
mov byte [ebp + 0x151f9], 0x30
mov word [ebp + 0x151fa], 0x3030
mov byte [ebp + 0x151fc], 0x30
ret
Function at 0x4055c1
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x41ed80
call fcn.00414b54
sub esp, 0x5a4
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [eax], ebx
push edi
cmp byte [edi], 0x30
jne 0x4055f9
mov esi, dword [sym.imp.USER32.dll_CharNextA]
call esi
mov cl, byte [eax]
cmp cl, 0x78
je 0x405638
cmp cl, 0x58
je 0x405638
push edi
call fcn.00414770
pop ecx
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
push 0x452
call fcn.00401754
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00401797
test eax, eax
je 0x405701
mov ecx, dword [ebp + 0x10]
call fcn.0040d944
test eax, eax
je 0x405643
push 0x428774
jmp 0x40564c
push eax
call esi
push eax
call fcn.0040557e
jmp 0x4055fe
mov ecx, dword [ebp + 0x10]
call fcn.0040d041
push eax
lea eax, [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
and byte [ebp - 0x5b0], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x5af]
rep stosd dword es:[edi], eax
push dword [0x424f48]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x5b0]
push eax
call fcn.0040f821
lea eax, [ebp - 0x5b0]
mov esi, 0x4244fc
push eax
push ebx
push 0x4244f4
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
xor edi, edi
test ebx, ebx
jbe 0x405701
push edi
push 0x4244f0
lea eax, [ebp - 0xac]
push 0x4244e8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x2c]
push 0x13
push eax
lea eax, [ebp - 0xac]
push 0x428770
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x405701
lea eax, [ebp - 0x2c]
push eax
call fcn.0040557e
pop ecx
mov ecx, dword [ebp + 8]
cmp ecx, eax
je 0x405720
inc edi
cmp edi, ebx
jb 0x4056ac
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040178c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov eax, dword [ebp + 0xc]
push 1
pop esi
mov dword [eax], ecx
jmp 0x405703
Function at 0x405a81
Capabilities:
Delete file
Get common file path
Read .ini file

Disassembly:
mov eax, 0x41edb3
call fcn.00414b54
sub esp, 0x730
push esi
lea eax, [ebp - 0x33c]
push edi
mov esi, 0x104
push eax
mov edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x110]
push eax
push 0
lea eax, [ebp - 0x33c]
push 0x424538
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x73c]
push 0x400
push eax
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x73c]
lea ecx, [ebp - 0x238]
push eax
call fcn.0040e61f
and dword [ebp - 4], 0
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x238]
push dword [0x424f48]
call fcn.0040e87a
test eax, eax
je 0x405b38
lea eax, [ebp - 0x110]
add edi, 4
push eax
push esi
push edi
push 0x428770
push 0x42452c
push 0x424528
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.0040e75d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x405b55
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x424550
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405bac
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push 0x42941c
push 0
push 0
push 0x42453c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405ba3
mov byte [0x42a41c], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x405cd1
Capabilities:
Hide graphical window

Disassembly:
push dword [0x42a438]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x405cfd
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x42a438]
call esi
push 0
push dword [0x42a42c]
call esi
pop esi
ret