joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010a240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4d756654
push eax
push 0x10177330
mov dword [ebp - 0x10], 0x46757462
mov dword [ebp - 0xc], 0x73707373
mov byte [ebp - 8], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177330
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010a290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1014a4f0]
lea eax, [ebp - 0x20]
push 0x1a
push eax
push 0x10177fac
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x7075716a
mov dword [ebp - 0xc], 0x64624573
mov word [ebp - 8], 0x6d
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177fac
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010a2f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1014a4f0]
lea eax, [ebp - 0x20]
push 0x1a
push eax
push 0x10177e38
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x7075716a
mov dword [ebp - 0xc], 0x64625473
mov word [ebp - 8], 0x6d
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177e38
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010a350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x54756654
push eax
push 0x10177988
mov dword [ebp - 0x10], 0x62496575
mov dword [ebp - 0xc], 0x666d656f
mov byte [ebp - 8], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177988
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010a3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x55756654
push eax
push 0x10177d98
mov dword [ebp - 0x10], 0x44757966
mov dword [ebp - 0xc], 0x73706d70
mov byte [ebp - 8], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177d98
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010a450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x6d666954
push eax
push 0x101783bc
mov dword [ebp - 0x10], 0x6679466d
mov dword [ebp - 0xc], 0x66757664
mov word [ebp - 8], 0x42
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101783bc
call fcn.100faee9
mov esp, ebp
pop ebp
ret
Function at 0x1010a550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x6d666954
push eax
push 0x101783ac
mov dword [ebp - 0x10], 0x6679466d
mov dword [ebp - 0xc], 0x66757664
mov word [ebp - 8], 0x58
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101783ac
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010a5b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x78706954
push eax
push 0x10177c74
mov dword [ebp - 0xc], 0x656f6a58
mov word [ebp - 8], 0x7870
mov byte [ebp - 6], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177c74
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010a650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x73627554
push eax
push 0x101780bc
mov dword [ebp - 0x10], 0x73665475
mov dword [ebp - 0xc], 0x66646a77
mov word [ebp - 8], 0x42
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101780bc
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010a6b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x73627554
push eax
push 0x101780cc
mov dword [ebp - 0x10], 0x73665475
mov dword [ebp - 0xc], 0x66646a77
mov word [ebp - 8], 0x58
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101780cc
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010a7b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66737554
push eax
push 0x10177e10
mov dword [ebp - 0xc], 0x43696475
mov word [ebp - 8], 0x756d
mov byte [ebp - 6], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177e10
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010aa30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x6f567055
push eax
push 0x10177a6c
mov dword [ebp - 0xc], 0x6570646a
mov word [ebp - 8], 0x66
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177a6c
call fcn.100faee9
mov esp, ebp
pop ebp
ret
Function at 0x1010ad00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x624e6f56
push eax
push 0x10176d2c
mov dword [ebp - 0x10], 0x656f4271
mov dword [ebp - 0xc], 0x6562704d
mov byte [ebp - 8], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10176d2c
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010ae50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x62657156
push eax
push 0x10177c80
mov dword [ebp - 0x10], 0x6a586675
mov dword [ebp - 0xc], 0x7870656f
mov byte [ebp - 8], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177c80
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010aef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x52736657
push eax
push 0x10176d4c
mov dword [ebp - 0x10], 0x7a736676
mov dword [ebp - 0xc], 0x766d6257
mov word [ebp - 8], 0x4266
mov byte [ebp - 6], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10176d4c
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010af50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x52736657
push eax
push 0x10176d3c
mov dword [ebp - 0x10], 0x7a736676
mov dword [ebp - 0xc], 0x766d6257
mov word [ebp - 8], 0x5866
mov byte [ebp - 6], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10176d3c
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010afb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x10176de4
mov dword [ebp - 0x10], 0x426d6276
mov dword [ebp - 0xc], 0x64706d6d
mov byte [ebp - 8], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10176de4
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010b050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x101773d4
mov dword [ebp - 0x10], 0x476d6276
mov dword [ebp - 0xc], 0x46666673
mov word [ebp - 8], 0x79
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101773d4
call fcn.100faee9
mov esp, ebp
pop ebp
ret
Function at 0x1010b100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x101777e0
mov dword [ebp - 0x10], 0x526d6276
mov dword [ebp - 0xc], 0x7a736676
mov byte [ebp - 8], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101777e0
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010b150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x10177340
mov dword [ebp - 0x10], 0x526d6276
mov dword [ebp - 0xc], 0x7a736676
mov word [ebp - 8], 0x7946
mov byte [ebp - 6], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177340
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010b2f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x756a7358
push eax
push 0x10177998
mov dword [ebp - 0x10], 0x6f704466
mov dword [ebp - 0xc], 0x666d7074
mov word [ebp - 8], 0x42
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177998
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010b350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x756a7358
push eax
push 0x101779bc
mov dword [ebp - 0x10], 0x6f704466
mov dword [ebp - 0xc], 0x666d7074
mov word [ebp - 8], 0x58
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101779bc
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010b3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x756a7358
push eax
push 0x1017711c
mov dword [ebp - 0xc], 0x6d6a4766
mov word [ebp - 8], 0x66
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1017711c
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010b400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1014a300]
lea eax, [ebp - 0x20]
push 0x1b
push eax
push 0x10177674
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x54666d6a
mov dword [ebp - 0xc], 0x6f6a7375
mov word [ebp - 8], 0x4268
mov byte [ebp - 6], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177674
call fcn.100faee9
mov esp, ebp
pop ebp
ret
Function at 0x1010b460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1014a300]
lea eax, [ebp - 0x20]
push 0x1b
push eax
push 0x10177658
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x54666d6a
mov dword [ebp - 0xc], 0x6f6a7375
mov word [ebp - 8], 0x5868
mov byte [ebp - 6], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177658
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010b650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66796a6e
push eax
push 0x10176c6c
mov dword [ebp - 0xc], 0x706d4473
mov word [ebp - 8], 0x6674
mov byte [ebp - 6], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10176c6c
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010b830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66796a6e
push eax
push 0x10176c60
mov dword [ebp - 0xc], 0x66715073
mov word [ebp - 8], 0x6f
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10176c60
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010b930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x666e6a75
push eax
push 0x10176ca0
mov dword [ebp - 0x10], 0x46756654
mov dword [ebp - 0xc], 0x756f6677
mov byte [ebp - 8], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10176ca0
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010b9d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66776278
push eax
push 0x10176c54
mov dword [ebp - 0xc], 0x71506f4a
mov word [ebp - 8], 0x6f66
mov byte [ebp - 6], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10176c54
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010ba70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x71746f78
push eax
push 0x10176b3c
mov dword [ebp - 0xc], 0x756f6a73
mov word [ebp - 8], 0x4267
mov byte [ebp - 6], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10176b3c
call fcn.100faee9
mov esp, ebp
pop ebp
ret
Function at 0x1010bac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x71746f78
push eax
push 0x10176b48
mov dword [ebp - 0xc], 0x756f6a73
mov word [ebp - 8], 0x5867
mov byte [ebp - 6], 0
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10176b48
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010bb10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x73717478
push eax
push 0x10177d08
mov dword [ebp - 0xc], 0x67756f6a
mov word [ebp - 8], 0x42
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177d08
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1010bb60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x73717478
push eax
push 0x10177cf0
mov dword [ebp - 0xc], 0x67756f6a
mov word [ebp - 8], 0x58
call fcn.1010d5a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10177cf0
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x101283e2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10128261

Function at 0x1012d72c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1012d3ec
Function at 0xf07370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xf0738e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xf30074
push ecx
mov edi, eax
call fcn.00f1b198
mov esi, eax
add esp, 8
test esi, esi
jne 0xf073cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00f1b02e
push esi
call fcn.00f1afb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xf0a850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xf0a8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xf35720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xf0a8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00f1b1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xf0a8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xf35720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xf0a92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00f1c082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xf0a957
mov word [eax], si
add eax, 2
push eax
call fcn.00f1c030
add esp, 4
jmp 0xf0a959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xf0a8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xf0a8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xf0aff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xf0b080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0xf0b0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xf30458
push ecx
call fcn.00f1b1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00f1b1e1
add esp, 0x10
jmp 0xf0b0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00f1b20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00f1adff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00f0b050
mov eax, dword [0xf35728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0xf0b13b
push esi
call fcn.00f0afb0
add esp, 4
mov dword [0xf35728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0xf0b14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00f0aff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0xf0e440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0xf0e4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xf0e48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xf0e471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xf0e47e
add edx, ecx
cmp ebx, edx
jb 0xf0e48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0xf0e467
xor ecx, ecx
jmp 0xf0e4a2
test eax, eax
jne 0xf0e492
xor ecx, ecx
jmp 0xf0e4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.00f0e3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0xf0e8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0xf0e921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0xf0e946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0xf0e96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0xf0e993
push ecx
push esi
call fcn.00f0e4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret