joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002300
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x30]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0x10]
mov dword [esp + 0x18], edx
test esi, esi
jne 0x10002344
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x1000233d
mov esi, dword [eax + 0x20]
jmp 0x10002344
test bl, bl
jns 0x10002344
mov esi, dword [eax + 0x24]
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x24]
mov dword [esp + 0x20], esi
mov esi, 1
add ecx, 0x28
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], 1
cmp si, word [eax + 6]
jae 0x10002424
lea ebx, [ecx + 0x24]
mov esi, dword [edi + 0x30]
mov ebp, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ebp
test edi, edi
jne 0x10002399
mov ecx, dword [ebx]
test cl, 0x40
je 0x10002392
mov edi, dword [eax + 0x20]
jmp 0x10002399
test cl, cl
jns 0x10002399
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x100023d2
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add eax, ecx
cmp eax, esi
ja 0x100023d2
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.10002260
test eax, eax
je 0x10002447
mov eax, dword [ebx]
mov edx, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
jmp 0x100023fe
mov eax, dword [ebx]
test eax, 0x2000000
je 0x100023eb
test dword [esp + 0x20], 0x2000000
je 0x100023eb
or dword [esp + 0x20], eax
jmp 0x100023f8
or eax, dword [esp + 0x20]
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
sub edi, dword [esp + 0x14]
add edi, ebp
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
cmp ecx, esi
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
jl 0x10002374
lea ecx, [esp + 0x14]
mov edx, edi
mov dword [esp + 0x24], 1
call fcn.10002260
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 4
Function at 0x10002d21
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000f090]
jne 0x10002d2b
repz ret
jmp fcn.100038ca

Function at 0x100099ed
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10005dc8
and dword [ebp - 4], 0
cmp dword [0x100109d8], 0
mov ebx, eax
jne 0x10009a9e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10009b4f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000ca6c
push edi
call esi
test eax, eax
je 0x10009b4f
push eax
call fcn.10005d56
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100109d8], eax
call esi
push eax
call fcn.10005d56
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100109dc], eax
call esi
push eax
call fcn.10005d56
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100109e0], eax
call esi
push eax
call fcn.10005d56
pop ecx
mov dword [0x100109e8], eax
test eax, eax
je 0x10009a9e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10005d56
pop ecx
mov dword [0x100109e4], eax
mov eax, dword [0x100109e4]
cmp eax, ebx
je 0x10009af6
cmp dword [0x100109e8], ebx
je 0x10009af6
push eax
call fcn.10005dd1
push dword [0x100109e8]
mov esi, eax
call fcn.10005dd1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10009af6
test edi, edi
je 0x10009af6
call esi
test eax, eax
je 0x10009aed
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10009aed
test byte [ebp - 0xc], 1
jne 0x10009af6
or dword [ebp + 0x10], 0x200000
jmp 0x10009b2f
mov eax, dword [0x100109dc]
cmp eax, ebx
je 0x10009b2f
push eax
call fcn.10005dd1
pop ecx
test eax, eax
je 0x10009b2f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10009b2f
mov eax, dword [0x100109e0]
cmp eax, ebx
je 0x10009b2f
push eax
call fcn.10005dd1
pop ecx
test eax, eax
je 0x10009b2f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100109d8]
call fcn.10005dd1
pop ecx
test eax, eax
je 0x10009b4f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10009b51
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x74dc35
Capabilities:
Encode data using xor

Disassembly:
mov edi, eax
mov esi, edx
mov eax, 0x41363233
xor al, byte [esi]
call fcn.0074dc6c
mov ebx, eax
xor ah, byte [esi]
call fcn.0074dc6c
shr ecx, 2
mov edx, ecx
xor dword [edi], eax
mov cl, al
add edi, 4
rol ebx, cl
xor eax, ebx
mov cl, bh
ror eax, cl
add ebx, eax
dec edx
jne 0x74dc53
ret

Function at 0x74dc6c
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edx
xor edx, edx
dec esi
inc esi
xor ah, byte [esi]
xor al, dl
add eax, 0x6e203cc5
add eax, 0x21424a6
mov cl, al
ror eax, cl
xor eax, 0x8372a5a7
dec dx
jne 0x74dc75
cmp byte [esi], 0
jne 0x74dc72
pop edx
pop esi
pop ecx
ret

Function at 0x74dcbd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
add edx, 0x89421025
bswap edx
mov eax, dword [esi]
sub eax, edx
xor eax, ebx
mov ebx, dword [esi]
mov dword [edi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x74dcd1
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x74ff03
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
pushal
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
imul eax, dword [ebp + 0x10], 0x9e3779b9
cmp dword [ebp + 0x10], 0
jbe 0x74ff63
mov edx, ebx
shl edx, 4
sub ecx, edx
mov edx, dword [esi + 8]
xor edx, ebx
sub ecx, edx
mov edx, ebx
shr edx, 5
xor edx, eax
sub ecx, edx
sub ecx, dword [esi + 0xc]
mov edx, ecx
shl edx, 4
sub ebx, edx
mov edx, dword [esi]
xor edx, ecx
sub ebx, edx
mov edx, ecx
shr edx, 5
xor edx, eax
sub ebx, edx
sub ebx, dword [esi + 4]
sub eax, 0x9e3779b9
dec dword [ebp + 0x10]
jmp 0x74ff19
mov dword [edi], ebx
mov dword [edi + 4], ecx
popal
leave
ret 0xc
Function at 0x10003580
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100505fb
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x1005a030]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xcc], ecx
jmp fcn.1012caea

Function at 0x100040e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
movzx eax, byte [0x1005c273]
test eax, eax
je 0x1000416d
mov dword [ebp - 0xc], 0
jmp 0x10004106
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x100
jge 0x10004166
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 8
jmp 0x10004127
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x10004157
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x1000414d
mov edx, dword [ebp - 4]
shr edx, 1
xor edx, 0xedb88320
mov dword [ebp - 4], edx
jmp 0x10004155
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
jmp 0x1000411e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx*4 + 0x100735d0], edx
jmp 0x100040fd
mov byte [0x1005c273], 0
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
test eax, eax
je 0x100041e0
mov edx, dword [0x10072f2c]
add edx, 1
mov dword [0x10072f2c], edx
cmp dword [0x10072f2c], 0x1388
jbe 0x100041b1
mov dword [0x10072f2c], 0
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
shr eax, 8
and eax, 0xffffff
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
xor edx, dword [ebp - 8]
and edx, 0xff
xor eax, dword [edx*4 + 0x100735d0]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x10004174
jmp 0x10114942
Function at 0x100069f0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push 0
push 0
push 3
push 0
push 1
push closesocket
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10006a22
xor al, al
jmp 0x10006b4b
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf00000
jb 0x10006a4b
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x10006b4b
push 0x1000
call fcn.1001a634
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10006a6e
xor al, al
jmp 0x10006b4b
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x1000
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10006aa0
cmp dword [ebp - 0x1c], 0x1000
je 0x10006ab9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.1001a93a
add esp, 4
xor al, al
jmp 0x10006b4b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10006ae3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.1001a93a
add esp, 4
xor al, al
jmp 0x10006b4b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0x4550
je 0x10006b10
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.1001a93a
add esp, 4
xor al, al
jmp 0x10006b4b
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x34]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x50]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.1001a93a
add esp, 4
mov dword [ebp - 4], 0
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000ff20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100509b0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x1005a030]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx + 4]
cmp byte [eax + 0x31], 0
mov edi, ecx
jne 0x1000ff76
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
cmp dword [eax + 0xc], ecx
jae 0x1000ff6c
mov eax, dword [eax + 8]
jmp 0x1000ff70
mov edi, eax
mov eax, dword [eax]
cmp byte [eax + 0x31], 0
je 0x1000ff62
mov esi, dword [ebx]
mov edx, dword [ebx + 0x18]
mov dword [esp + 0x14], edx
test esi, esi
je 0x1000ff87
cmp esi, esi
je 0x1000ff8c
call fcn.1001a92a
cmp edi, dword [esp + 0x14]
je 0x1000ff9c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
cmp ecx, dword [edi + 0xc]
jae 0x10010002
lea edx, [esp + 0x18]
push edx
call fcn.10010900
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x68], 0
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x40], ecx
call fcn.100114c0
push edi
push esi
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, ebx
mov byte [esp + 0x78], 1
call fcn.10010580
mov esi, dword [eax]
mov edi, dword [eax + 4]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x68], 0
call fcn.1000f960
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0xffffffff
call fcn.1000f960
test esi, esi
jne 0x1001002d
call fcn.1001a92a
cmp edi, dword [esi + 0x18]
jne 0x10010015
call fcn.1001a92a
lea eax, [edi + 0x10]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esi]
jmp 0x1001000b
Function at 0x10014e60
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esp, [esp + 0x20]
jp 0x100f03e2
push esi
push dword [esp]
lea esp, [esp + 8]
jmp 0x102104e8
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1005a030]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x1000cd21
push edi
pop edx
bswap cx
mov dword [ebp - 0x110], eax
jmp 0x1011866d
pushal
pushfd
lea esp, [esp + 0x24]
jmp 0x102104e8
jmp 0x10128ac3
mov cx, word [0x10054924]
pushal
movsx dx, al
not dx
lea edx, [ebx*4 + 0x691eac97]
mov word [ebp - 0x10c], cx
setb dh
mov dword [esp + 0x1c], 0xfe
push dword [esp]
mov word [esp], dx
not dl
push dword [esp + 4]
mov dword [esp + 0x20], 0
mov byte [esp + 0x1c], 0xe9
lea edx, [ebp - 0x10a]
push dword [esp]
mov dword [esp + 0x20], edx
mov byte [esp], cl
push 0xb752946
jmp 0x1017e9f9
or ebp, esp
invalid
call fcn.100fc99e
stc
lodsb al, byte [esi]
lahf
adc esp, dword [0x2cbdeb18]
sbb cl, byte [ecx + edx*2 + 0x21f52328]
test dl, ch
shr edx, 0x1f
xchg ebp, eax
idiv dword [edi + 0x30341650]
test byte [ebx + 0x1f], al
xor dword [eax + 0x75], eax
daa
popfd
and byte [eax + 0x38063447], dh
sub dword [esp + ebp*4], 0xffffffd7
pop ds
jp 0x1017ea01
jbe 0x1017e9cb
inc ebx
push eax
and ecx, dword [edi + 0x28947160]
aaa
adc ah, ch
mov eax, 0x77b7f5c9
cdq
out dx, al
mov dl, 0x85
push esp
sub esp, dword [esi + 0x5efcd15b]
sub dword [ebx - 0x21fb4adf], edi
xchg ebp, eax
not byte [ecx + 0x5e]
mov byte [0x69f889c4], bh
sahf
dec edx
les ecx, [ecx + 0x369e69f8]
dec edx
sbb dl, 0x30
push es
jl 0x1017ea5a
push 0xffcfb43f
xor eax, sym.imp.KERNEL32.dll_GetProcAddress
pop dword [esp + 0x28]
mov byte [esp], 0x86
mov byte [esp + 4], 0x1e
push dword [esp + 0x28]
ret 0x2c
not dl
mov eax, dword [str.vokea]
jmp 0x100bf206

Function at 0x10015660
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov ecx, dword [0x10054938]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
and edx, 4
jne 0x1001569f
push 0
push 0
push 0
push 4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x100156b6
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10018641
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x28], 0x10105162
pushfd
jmp fcn.101f319d

Function at 0x1001a63f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005a030]
jne 0x1001a649
repz ret
jmp fcn.1001c466

Function at 0x1002530d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1001ca5c
and dword [ebp - 4], 0
cmp dword [0x1005cf7c], 0
mov ebx, eax
jne 0x100253be
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002546f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1002546f
push eax
call fcn.1001c9ea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1005cf7c], eax
call esi
push eax
call fcn.1001c9ea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1005cf80], eax
call esi
push eax
call fcn.1001c9ea
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1005cf84], eax
call esi
push eax
call fcn.1001c9ea
pop ecx
mov dword [0x1005cf8c], eax
test eax, eax
je 0x100253be
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001c9ea
pop ecx
mov dword [0x1005cf88], eax
mov eax, dword [0x1005cf88]
cmp eax, ebx
je 0x10025416
cmp dword [0x1005cf8c], ebx
je 0x10025416
push eax
call fcn.1001ca65
push dword [0x1005cf8c]
mov esi, eax
call fcn.1001ca65
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10025416
test edi, edi
je 0x10025416
call esi
test eax, eax
je 0x1002540d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1002540d
test byte [ebp - 0xc], 1
jne 0x10025416
or dword [ebp + 0x10], 0x200000
jmp 0x1002544f
mov eax, dword [0x1005cf80]
cmp eax, ebx
je 0x1002544f
push eax
call fcn.1001ca65
pop ecx
test eax, eax
je 0x1002544f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1002544f
mov eax, dword [0x1005cf84]
cmp eax, ebx
je 0x1002544f
push eax
call fcn.1001ca65
pop ecx
test eax, eax
je 0x1002544f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1005cf7c]
call fcn.1001ca65
pop ecx
test eax, eax
je 0x1002546f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10025471
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002a4b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x394
mov eax, dword [0x1005a030]
xor eax, esp
mov dword [esp + 0x390], eax
push ebx
push ebp
mov ebp, dword [esp + 0x3a8]
push esi
mov esi, dword [esp + 0x3a4]
push edi
mov edi, dword [esp + 0x3ac]
mov eax, 0x53
xor ebx, ebx
push 0x103
mov word [esp + 0x1c], ax
mov dword [esp + 0x28], ecx
lea eax, [esp + 0x19d]
mov ecx, 0x4e
mov edx, 0x43
push ebx
push eax
mov word [esp + 0x28], cx
mov word [esp + 0x2c], dx
mov byte [esp + 0x1a4], bl
call fcn.1001c970
mov ecx, dword [str._s_s]
mov dl, byte [0x100548c0]
push edi
push ebp
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], ecx
push eax
lea ecx, [esp + 0x1b0]
push ecx
mov byte [esp + 0x48], dl
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x103
lea edx, [esp + 0xb5]
push ebx
push edx
mov byte [esp + 0xbc], bl
call fcn.1001c970
lea eax, [esp + 0x1c0]
add esp, 0x28
lea edi, [eax + 1]
jmp 0x1002a570
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1002a570
sub eax, edi
push eax
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x1a0]
push ecx
call fcn.10048cc0
push 0x103
lea edx, [esp + 0x2ad]
push ebx
push edx
mov byte [esp + 0x2b4], bl
call fcn.1001c970
push 0x63
lea ecx, [esp + 0x4d]
xor eax, eax
push ebx
push ecx
mov byte [esp + 0x38], bl
mov word [esp + 0x39], ax
mov byte [esp + 0x54], bl
call fcn.1001c970
mov edi, dword [esp + 0x48]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0x24
add edi, 0x13868
push edi
push 0x64
lea eax, [esp + 0x38]
push eax
mov edx, 0x30
lea ecx, [esp + 0x1c]
mov word [esp + 0x1c], dx
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0xa8]
push eax
call ebx
push edi
push 0x104
lea ecx, [esp + 0x2a4]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xa8]
push ecx
call ebx
push edi
push 3
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0xa8]
push edx
call ebx
lea eax, [esp + 0x30]
push eax
call fcn.1001af29
lea ecx, [esp + 0x2a0]
xor eax, 0x2e3f851c
push ecx
mov dword [esi], eax
call fcn.1001af13
cdq
mov dword [esi + 0xc], edx
lea edx, [esp + 0x18]
mov dword [esi + 8], eax
push edx
lea eax, [esp + 0x20]
push eax
call fcn.10027b75
neg eax
sbb eax, eax
neg eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 4]
push 0x14
push ecx
call fcn.10031af0
mov ecx, dword [esp + 0x3b8]
add esp, 0x18
xor edx, edx
cmp eax, dword [esi]
pop edi
sete dl
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, edx
call fcn.1001a63f
add esp, 0x394
ret 0xc
Function at 0x1002fd60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1005a030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x70
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1002ff6c
mov byte [ebp - 0x2c], 0x47
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x4d
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], 0x75
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x46
mov byte [ebp - 0x22], 0x69
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x4e
mov byte [ebp - 0x1e], 0x61
mov byte [ebp - 0x1d], 0x6d
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x45
mov byte [ebp - 0x1a], 0x78
mov byte [ebp - 0x19], 0x41
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x40], 0x45
mov byte [ebp - 0x3f], 0x6e
mov byte [ebp - 0x3e], 0x75
mov byte [ebp - 0x3d], 0x6d
mov byte [ebp - 0x3c], 0x50
mov byte [ebp - 0x3b], 0x72
mov byte [ebp - 0x3a], 0x6f
mov byte [ebp - 0x39], 0x63
mov byte [ebp - 0x38], 0x65
mov byte [ebp - 0x37], 0x73
mov byte [ebp - 0x36], 0x73
mov byte [ebp - 0x35], 0x4d
mov byte [ebp - 0x34], 0x6f
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x32], 0x75
mov byte [ebp - 0x31], 0x6c
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10072e58], eax
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10072e54], eax
cmp dword [0x10072e58], 0
je 0x1002ff6c
cmp dword [0x10072e54], 0
je 0x1002ff6c
mov edx, dword [ebp - 0x44]
mov dword [edx + 0x108], 0
mov eax, 1
jmp 0x10030040
mov eax, dword [ebp - 0x44]
mov dword [eax + 0x108], 1
xor eax, eax
jmp 0x10030040
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001a63f
mov esp, ebp
pop ebp
ret

Function at 0x100306a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
test eax, eax
je 0x100306c8
mov dword [ebp - 4], 1
jmp 0x100306cf
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x1003079f
mov al, 1
jmp 0x1003086a
xor al, al
jmp 0x1003086a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret