joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44221e
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b4da0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100f3710]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, edx
mov eax, dword [0x100f82cc]
and dword [esp + 0x18], 0
mov ecx, 0x100f82cc
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
and dword [esp + 0x30], 0
mov esi, edi
call fcn.00442e08
push dword [ebp + 8]
lea eax, [esp + 0x18]
push 0x100d14b0
call fcn.0044425c
mov eax, dword [esp + 0x1c]
pop ecx
pop ecx
mov esi, ebx
call fcn.004721d9
test eax, eax
je 0x4422a3
push edi
call fcn.004422fe
mov dword [esp + 0x18], 1
add edi, 8
mov eax, edi
call fcn.0044593f
test eax, eax
jne 0x4422d9
push 0x100d1540
lea esi, [esp + 0x20]
call fcn.00442cb7
push eax
call fcn.00443055
push 0x100d1558
lea esi, [esp + 0x20]
call fcn.00442cb7
push eax
call fcn.00443055
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00401ea9
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x44e185
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
push esi
mov esi, edx
jne 0x44e190
xor eax, eax
pop esi
ret
cmp eax, 8
push ebx
not esi
mov edx, 0xff
jb 0x44e242
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100c7f40]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100c7f40]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100c7f40]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100c7f40]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100c7f40]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100c7f40]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100c7f40]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100c7f40]
inc ecx
sub eax, 8
dec edi
jne 0x44e1a7
pop edi
test eax, eax
je 0x44e25b
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100c7f40]
inc ecx
dec eax
jne 0x44e246
mov eax, esi
pop ebx
not eax
pop esi
ret

Function at 0x44e262
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x100c7f40]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x100c7f40]
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x450742
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x100c6760]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x100c6760]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x450e45
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b4a6e
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x100f3710]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x100f82cc]
mov esi, 0x100f82cc
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
and dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
mov edi, 0x100d2000
push edi
call fcn.004010e7
mov eax, dword [0x100f82cc]
pop ecx
pop ecx
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
lea eax, [esp + 0x14]
push eax
call fcn.00471e47
pop ecx
lea eax, [esp + 0x14]
mov byte [esp + 0x30], 2
call fcn.00471da2
push eax
lea eax, [esp + 0x18]
call fcn.00471d78
push eax
lea eax, [esp + 0x1c]
call fcn.00471d50
push eax
push 0x100d2048
lea eax, [esp + 0x1c]
call fcn.004024ae
mov esi, dword [esp + 0x20]
add esp, 0x10
push esi
lea eax, [esp + 0x10]
push eax
call fcn.00402488
test eax, eax
je 0x450f39
push dword [esp + 0xc]
push edi
call fcn.0040215d
push 0
push 0
push 0x100d1f9c
call fcn.00450cd9
add esp, 0x14
push 0
push 0x100d1f70
call fcn.004021ef
push 0x100c8aac
push 0x100d1fd0
call fcn.0040215d
add esp, 0x10
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0x100d131c
call fcn.00401ea9
lea eax, [esi - 0x10]
call fcn.00401ea9
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46f9db
Capabilities:
Hash data with md5

Disassembly:
push esi
xor ecx, ecx
push 0x40
lea esi, [eax + 0x58]
push ecx
push esi
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
call fcn.0048f250
add esp, 0xc
mov byte [esi], 0x80
pop esi
ret

Function at 0x47355d
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
cmp ebx, esi
push edi
mov edi, ecx
jne 0x47357d
push esi
push esi
push 2
xor ecx, ecx
pop eax
call fcn.00474944
xor al, al
jmp 0x473600
push ebp
call fcn.00472fa3
or dword [edi + 8], 0xffffffff
or dword [edi + 4], 0xffffffff
push 2
push esi
push ebx
call fcn.00495165
push ebx
call fcn.00495070
push esi
push esi
push ebx
mov ebp, eax
call fcn.00495165
add esp, 0x1c
cmp ebp, esi
jne 0x4735b1
push esi
push esi
push 0xd
jmp 0x4735de
lea eax, [ebp + 1]
push eax
call fcn.0048e24a
push ebx
push 1
mov esi, eax
push ebp
push esi
mov byte [esi], 0
call fcn.004947e0
add esp, 0x14
cmp eax, 1
je 0x4735ea
push esi
call fcn.0048f36f
pop ecx
push 0
push 0
push 2
xor ecx, ecx
pop eax
call fcn.00474944
xor al, al
jmp 0x4735ff
push edi
mov edi, ebp
mov ecx, esi
call fcn.00473604
push esi
mov bl, al
call fcn.0048f36f
pop ecx
mov al, bl
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4796aa
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0xc
mov dword [esi + 8], eax
call fcn.0048fdf4
pop ecx
xor ecx, ecx
cmp eax, ecx
jne 0x4796c2
xor eax, eax
jmp 0x4796e0
push ecx
push ecx
push eax
push 0x10047e3b
push ecx
push ecx
mov dword [eax], esi
mov dword [eax + 8], ecx
mov dword [eax + 4], 0x1007987e
call fcn.00490352
add esp, 0x18
push eax
add esi, 4
call fcn.0040ca3b
xor eax, eax
pop esi
ret
Function at 0x47a085
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x47a09e
mov eax, dword [ebp - 4]
jmp 0x47a178
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x47a153
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100c58b8]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x100c58b8]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100c58b8]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x100c58b8]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100c58b8]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x100c58b8]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100c58b8]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c58b8]
dec ebp
jne 0x47a0bd
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x47a16f
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x100c58b8]
dec ecx
jne 0x47a15d
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47a72c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp + 8], 0
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x47a749
mov eax, dword [ebp - 4]
jmp 0x47a823
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x47a7fe
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100c54b8]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x100c54b8]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100c54b8]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x100c54b8]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100c54b8]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x100c54b8]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100c54b8]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c54b8]
dec ebp
jne 0x47a768
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x47a81a
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x100c54b8]
dec ecx
jne 0x47a808
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47d403
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100f3710]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push 0x58
xor esi, esi
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0048f250
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], esi
push ebx
lea esi, [ebp - 0x64]
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
call fcn.0047d469
add esp, 0x10
mov edx, edi
mov ecx, esi
call fcn.0047d4ff
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.0048ee95
leave
ret

Function at 0x4809aa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x100d9158
push dword [0x100fa530]
call fcn.00493df1
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4809e6
push esi
push 2
lea eax, [ebp - 4]
push 1
push eax
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], 0xfe
call fcn.004940a1
push esi
call fcn.00493ec6
add esp, 0x14
pop esi
leave
ret
Function at 0x4810b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x24]
push edi
mov edi, dword [esi + 0x34]
sub edi, dword [esi + 0x6c]
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x24]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
cmp eax, ecx
mov dword [ebp - 8], edi
jb 0x48113d
mov eax, dword [esi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00492060
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x3c]
sub dword [esi + 0x68], ebx
sub dword [esi + 0x64], ebx
add esp, 0xc
sub dword [esi + 0x54], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4810fd
mov eax, dword [esi + 0x38]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x48111f
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x4811fa
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x64]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x30]
mov edx, dword [ebp - 8]
cmp ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x481165
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x481170
xor eax, eax
jmp 0x4811bb
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x48118d
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
push edx
call fcn.00480b26
jmp 0x48119e
cmp ecx, 2
jne 0x4811a5
push edx
push dword [edi + 0x30]
mov edx, dword [edi]
call fcn.00480c34
pop ecx
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
pop ecx
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.00492060
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x6c], eax
mov edi, dword [esi + 0x6c]
cmp edi, 3
jb 0x4811e6
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp edi, 0x106
jae 0x4811fa
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4810bb
pop edi
pop ebx
leave
ret
Function at 0x494544
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x494581
cmp dword [ebp + 0x14], edi
je 0x494581
cmp ecx, edi
jne 0x494588
call fcn.004971f3
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0048ffc2
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x49459c
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4945bd
cmp ebx, 0xffffffff
je 0x4945ac
push ebx
push edi
push ecx
call fcn.0048f250
add esp, 0xc
cmp esi, edi
je 0x494569
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x494569
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4945d9
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4945e0
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4946d1
test word [esi + 0xc], 0x10c
je 0x494634
mov eax, dword [esi + 4]
test eax, eax
je 0x494634
jl 0x494732
cmp ebx, eax
mov edi, ebx
jb 0x494605
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4946d9
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0048f2ca
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4946c9
cmp ebx, dword [ebp - 0xc]
jb 0x4946a1
cmp dword [ebp - 0xc], 0
je 0x49465e
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x494653
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x49465a
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x494669
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x494669
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x494705
push eax
push dword [ebp - 8]
push esi
call fcn.004a3508
pop ecx
push eax
call fcn.004a42e4
add esp, 0xc
test eax, eax
je 0x494744
cmp eax, 0xffffffff
je 0x494732
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4946c9
push esi
call fcn.004a3c03
cmp eax, 0xffffffff
pop ecx
je 0x494736
cmp dword [ebp - 4], 0
je 0x494705
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4945e8
mov eax, dword [ebp + 0x14]
jmp 0x494583
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4946f0
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0048f250
add esp, 0xc
call fcn.004971f3
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x494579
cmp dword [ebp + 0xc], 0xffffffff
je 0x49471b
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0048f250
add esp, 0xc
call fcn.004971f3
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x494579
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x494583
or dword [esi + 0xc], 0x10
jmp 0x494736
Function at 0x100012a1
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1007a0b4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x61766441
push eax
xor ebx, ebx
mov dword [ebp - 0x1c], 0x32336970
mov dword [ebp - 0x17], 0x6c6c64
mov byte [ebp - 0x18], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10001494
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp + 0x5c]
push eax
push edi
mov word [ebp + 0x6d], 0x7478
mov dword [ebp + 0x5c], 0x70797243
mov word [ebp + 0x61], 0x6341
mov word [ebp + 0x67], 0x4365
mov word [ebp + 0x6a], 0x746e
mov word [ebp + 0x64], 0x6975
mov word [ebp + 0x6f], 0x41
mov byte [ebp + 0x60], 0x74
mov byte [ebp + 0x6c], 0x65
mov byte [ebp + 0x69], 0x6f
mov byte [ebp + 0x66], 0x72
mov byte [ebp + 0x63], 0x71
call esi
mov dword [0x1007c3e0], eax
lea eax, [ebp + 4]
push eax
push edi
mov dword [ebp + 0xe], 0x73614865
mov word [ebp + 0xa], 0x6572
mov word [ebp + 0x12], 0x68
mov word [ebp + 7], 0x7470
mov byte [ebp + 9], 0x43
mov word [ebp + 4], 0x7243
mov word [ebp + 0xc], 0x7461
mov byte [ebp + 6], 0x79
call esi
mov dword [0x1007c3e4], eax
lea eax, [ebp + 0x44]
push eax
push edi
mov word [ebp + 0x56], 0x74
mov dword [ebp + 0x51], 0x65746e6f
mov word [ebp + 0x45], 0x7972
mov dword [ebp + 0x4a], 0x61656c65
mov word [ebp + 0x48], 0x5274
mov byte [ebp + 0x44], 0x43
mov word [ebp + 0x4f], 0x4365
mov byte [ebp + 0x4e], 0x73
mov byte [ebp + 0x47], 0x70
mov byte [ebp + 0x55], 0x78
call esi
mov dword [0x1007c3e8], eax
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 0xb], 0x68736148
mov dword [ebp - 6], 0x617461
mov dword [ebp - 0xf], 0x74707972
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 7], 0x44
call esi
mov dword [0x1007c3ec], eax
lea eax, [ebp + 0x18]
push eax
push edi
mov word [ebp + 0x24], 0x6148
mov word [ebp + 0x27], 0x68
mov word [ebp + 0x1c], 0x4474
mov word [ebp + 0x19], 0x7972
mov word [ebp + 0x21], 0x6f72
mov byte [ebp + 0x18], 0x43
mov byte [ebp + 0x26], 0x73
mov word [ebp + 0x1e], 0x7365
mov byte [ebp + 0x23], 0x79
mov byte [ebp + 0x20], 0x74
mov byte [ebp + 0x1b], 0x70
call esi
mov dword [0x1007c3f0], eax
mov word [ebp + 0x31], 0x6547
mov word [ebp + 0x39], 0x7261
mov dword [ebp + 0x34], 0x68736148
mov dword [ebp + 0x2c], 0x70797243
mov word [ebp + 0x3c], 0x6d
mov byte [ebp + 0x30], 0x74
mov byte [ebp + 0x33], 0x74
mov byte [ebp + 0x3b], 0x61
lea eax, [ebp + 0x2c]
mov byte [ebp + 0x38], 0x50
push eax
push edi
call esi
mov ecx, eax
mov dword [0x1007c3f4], ecx
pop esi
cmp dword [0x1007c3e0], ebx
je 0x10001494
cmp dword [0x1007c3e4], ebx
je 0x10001494
cmp dword [0x1007c3e8], ebx
je 0x10001494
cmp dword [0x1007c3ec], ebx
je 0x10001494
cmp dword [0x1007c3f0], ebx
je 0x10001494
xor edx, edx
movzx ebx, bl
inc edx
test ecx, ecx
cmovne ebx, edx
mov ecx, dword [ebp + 0x74]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.1002258f
lea esp, [ebp + 0x78]
pop ebp
ret
Function at 0x10001598
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1007a0b4]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x28]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x24]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x2c]
push eax
mov word [esp + 0x14], 0x704f
mov dword [esp + 0x1a], 0x7365636f
mov word [esp + 0x17], 0x506e
mov byte [esp + 0x16], 0x65
mov word [esp + 0x1e], 0x73
mov byte [esp + 0x19], 0x72
call fcn.1005da88
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100015fb
push ebp
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [esp + 0x20]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002258f
add esp, 0x14
ret

Function at 0x10001707
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1007a0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
mov word [ebp - 0x18], 0x7250
mov dword [ebp - 0x15], 0x73736563
mov dword [ebp - 0x11], 0x654e3233
mov word [ebp - 0xd], 0x7478
mov byte [ebp - 0xb], bl
mov byte [ebp - 0x16], 0x6f
call fcn.1005da88
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000175d
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002258f
mov esp, ebp
pop ebp
ret

Function at 0x10001770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1007a0b4]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x2c]
call fcn.10063227
mov esi, eax
test esi, esi
je 0x100017e3
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x636f7250
push eax
push esi
mov dword [esp + 0x18], 0x6e65704f
mov dword [esp + 0x23], 0x656b6f54
mov word [esp + 0x20], 0x7365
mov word [esp + 0x27], 0x6e
mov byte [esp + 0x22], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100017dc
push ebp
push dword [esp + 0x34]
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002258f
add esp, 0x18
ret