joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e3d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
lea ecx, [esp]
mov dword [esp + 5], 0x642e6970
mov dword [esp + 1], 0x61776c68
mov word [esp + 9], 0x6c6c
mov byte [esp + 0xb], 0
mov byte [esp], 0x53
call fcn.1001e650
add esp, 0xc
ret

Function at 0x1001e400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.1001e480
mov edi, eax
test edi, edi
je 0x1001e46d
lea eax, [esp + 0xc]
mov dword [esp + 0xf], 0x78654e6c
push eax
push edi
mov word [esp + 0x1d], 0x6f6f
mov word [esp + 0x15], 0x6c61
mov word [esp + 0x20], 0x7845
mov word [esp + 0x1b], 0x4874
mov byte [esp + 0x22], 0
mov byte [esp + 0x14], 0x43
mov byte [esp + 0x1f], 0x6b
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e466
push dword [esp + 0x24]
push dword [esp + 0x24]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x1001e510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
mov esi, 1
call fcn.1001e610
mov edi, eax
test edi, edi
je 0x1001e57c
lea eax, [esp + 0xc]
mov word [esp + 0x13], 0x654b
push eax
push edi
mov dword [esp + 0x1d], 0x41784579
mov dword [esp + 0x16], 0x65704f67
mov word [esp + 0x14], 0x6552
mov byte [esp + 0x21], 0
mov byte [esp + 0x1a], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e575
push dword [esp + 0x28]
push 0x20019
push 0
push ebx
push 0x80000001
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x1001e590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.1001e610
mov edi, eax
test edi, edi
je 0x1001e602
lea eax, [esp + 0x10]
mov word [esp + 0x15], 0x7265
push eax
push edi
mov dword [esp + 0x19], 0x75516765
mov dword [esp + 0x25], 0x417845
mov dword [esp + 0x20], 0x756c6156
mov byte [esp + 0x18], 0x52
mov byte [esp + 0x24], 0x65
mov byte [esp + 0x1f], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e5fb
push dword [esp + 0x34]
push dword [esp + 0x34]
push 0
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x1001e610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea ecx, [esp]
mov dword [esp + 3], 0x33697061
mov dword [esp + 7], 0x6c642e32
mov word [esp + 1], 0x7664
mov byte [esp], 0x41
mov word [esp + 0xb], 0x6c
call fcn.1001e650
add esp, 0x10
ret
Function at 0x1001e650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
mov dword [esp + 6], 0x694c6461
push eax
mov esi, ecx
mov word [esp + 0x11], 0x7972
mov word [esp + 0xe], 0x7262
mov byte [esp + 0x10], 0x61
mov word [esp + 0x13], 0x41
mov word [esp + 8], 0x6f4c
call fcn.1001e980
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e69c
push esi
call eax
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x1001e6b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 9], 0x75747269
push eax
mov esi, edx
mov dword [esp + 0x18], 0x78457463
mov edi, ecx
mov dword [esp + 0x14], 0x65746f72
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x6c61
mov byte [esp + 0x13], 0x50
mov byte [esp + 0xc], 0x56
call fcn.1001e980
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e712
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x1001e720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
mov dword [esp + 0xc], 0x636f6c6c
push eax
mov esi, ecx
mov dword [esp + 0xc], 0x416c6175
mov dword [esp + 8], 0x74726956
mov byte [esp + 0x14], 0
call fcn.1001e980
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e769
push 0x20
push 0x3000
push 0x6c
push esi
call eax
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x1001e770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov dword [esp + 0xb], 0x6946656c
push eax
mov esi, edx
mov dword [esp + 8], 0x4d746547
mov word [esp + 0x17], 0x656d
mov word [esp + 0x14], 0x4e65
mov word [esp + 0x19], 0x41
mov word [esp + 0xd], 0x7564
mov byte [esp + 0xc], 0x6f
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x13], 0x6c
call fcn.1001e980
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e7d5
push 0x104
push esi
push 0
call eax
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x1001e7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0xe], 0x7274736e
push eax
mov esi, edx
mov dword [esp + 0xd], 0x6873756c
mov edi, ecx
mov dword [esp + 0x1b], 0x6361436e
mov dword [esp + 0x16], 0x69746375
mov byte [esp + 0xc], 0x46
mov byte [esp + 0x11], 0x49
mov word [esp + 0x1f], 0x6568
mov byte [esp + 0x1a], 0x6f
mov byte [esp + 0x21], 0
call fcn.1001e980
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e847
push dword [esp + 0x24]
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x18
ret
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
Function at 0x1001e850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 9], 0x61657268
push eax
mov esi, edx
mov dword [esp + 0x12], 0x654e3233
mov edi, ecx
mov word [esp + 0x16], 0x7478
mov byte [esp + 0xc], 0x54
mov byte [esp + 0x11], 0x64
mov byte [esp + 0x18], 0
call fcn.1001e980
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e89e
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x1001e8b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x12], 0x747372
push eax
mov esi, edx
mov word [esp + 0xf], 0x6165
mov edi, ecx
mov word [esp + 0xc], 0x6854
mov word [esp + 0x14], 0x6946
mov word [esp + 0x11], 0x3364
mov byte [esp + 0x13], 0x32
mov byte [esp + 0xe], 0x72
call fcn.1001e980
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e906
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x1001e910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push esi
lea eax, [esp + 4]
mov dword [esp + 0x17], 0x6f687370
push eax
mov esi, edx
mov dword [esp + 0x17], 0x616e5332
mov dword [esp + 0xd], 0x6f6f5465
mov dword [esp + 8], 0x61657243
mov dword [esp + 0x12], 0x706c6568
mov word [esp + 0x1f], 0x74
mov byte [esp + 0x11], 0x6c
mov byte [esp + 0xc], 0x74
mov byte [esp + 0x16], 0x33
call fcn.1001e980
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e973
push esi
push 4
call eax
pop esi
add esp, 0x1c
ret
or eax, 0xffffffff
pop esi
add esp, 0x1c
ret

Function at 0x1001e980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp], 0x6e72654b
push eax
mov dword [esp + 9], 0x2e32336c
mov dword [esp + 0xd], 0x6c6c64
mov byte [esp + 8], 0x65
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0x10
ret

Function at 0x1001e9b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
lea eax, [esp]
mov word [esp], 0x6547
push eax
mov dword [esp + 0xb], 0x54746e65
mov dword [esp + 7], 0x72727543
mov dword [esp + 0x11], 0x646165
mov word [esp + 0xf], 0x7268
mov byte [esp + 6], 0x74
call fcn.1001e980
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e9f7
call eax
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret
Function at 0x1001ea20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x118
cmp eax, 1
jne 0x1001ead0
push ecx
lea edx, [esp + 0x14]
call fcn.1001e770
add esp, 4
mov dword [esp + 6], 0x75732074
lea edx, [esp]
mov dword [esp + 0xc], 0x74726f
lea ecx, [esp + 0x10]
mov dword [esp + 1], 0x6174736e
mov word [esp + 0xa], 0x7070
mov byte [esp], 0x69
mov byte [esp + 5], 0x6e
call fcn.1001e370
test eax, eax
jne 0x1001eafc
mov edx, sym.gphelper.dll__HookSetWindowPos_28
mov ecx, 0x1004f9b8
call fcn.1001f8a0
test eax, eax
je 0x1001eafc
mov edx, sym.gphelper.dll__HookSetForegroundWindow_4
mov ecx, 0x1004f9a4
call fcn.1001f8a0
test eax, eax
je 0x1001eafc
mov edx, sym.gphelper.dll__HookSetActiveWindow_4
mov ecx, 0x1004f9ec
call fcn.1001f8a0
test eax, eax
je 0x1001eafc
mov edx, sym.gphelper.dll__HookBringWindowToTop_4
mov ecx, 0x1004f9d4
call fcn.1001f8a0
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1001eafc
mov ecx, 0x1004f9b8
call fcn.1001fa90
mov ecx, 0x1004f9a4
call fcn.1001fa90
mov ecx, 0x1004f9ec
call fcn.1001fa90
mov ecx, 0x1004f9d4
call fcn.1001fa90
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1001eca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
push esi
push 0x103
lea eax, [ebp - 0x127]
mov word [ebp - 0x16], 0x4552
push 0
push eax
mov word [ebp - 0x19], 0x5754
mov word [ebp - 0x1c], 0x4f53
mov byte [ebp - 0x1a], 0x46
mov word [ebp - 0x14], 0x5c
mov byte [ebp - 0x17], 0x41
mov word [ebp - 8], 0x7325
mov word [ebp - 5], 0x73
mov byte [ebp - 6], 0x25
mov byte [ebp - 0x128], 0
call fcn.10005f30
add esp, 0xc
mov eax, 0x18
call fcn.10009c40
mov esi, esp
call fcn.100011e0
push eax
push 0x18
mov ecx, esi
call fcn.100011f0
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x128]
push 0x104
push eax
call fcn.1000243f
add esp, 0x18
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x128]
push eax
sub esp, 8
call fcn.1001e510
mov esi, dword [ebp + 8]
add esp, 0xc
test eax, eax
jne 0x1001ee11
push 0x103
lea eax, [ebp - 0x32f]
mov byte [ebp - 0x330], 0
push 0
push eax
call fcn.10005f30
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x24]
add esp, 0xc
mov dword [ebp - 0xe], 0x736c61
lea edx, [ebp - 0x10]
mov word [ebp - 0x10], 0x7668
push eax
lea eax, [ebp - 0x330]
push eax
sub esp, 8
call fcn.1001e590
add esp, 0x10
test eax, eax
jne 0x1001ee09
cmp dword [ebp - 0x24], eax
jbe 0x1001ee09
push 0x103
push eax
mov byte [ebp - 0x22c], al
lea eax, [ebp - 0x22b]
push eax
call fcn.10005f30
push esi
lea eax, [ebp + 8]
mov word [ebp + 8], 0x6425
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x22c]
mov byte [ebp + 0xa], 0
push 0x104
push eax
call fcn.1000243f
add esp, 0x20
lea edx, [ebp - 0x22c]
lea ecx, [ebp - 0x330]
call fcn.1001e370
test eax, eax
je 0x1001ee09
mov ecx, dword [ebp - 0x20]
call fcn.1001e4b0
mov eax, esi
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x20]
call fcn.1001e4b0
push esi
call dword [0x1004f9ec]
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1001ee30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
push esi
push 0x103
lea eax, [ebp - 0x127]
mov dword [ebp - 0x1b], 0x5754464f
push 0
push eax
mov byte [ebp - 0x1c], 0x53
mov word [ebp - 0x14], 0x5c
mov word [ebp - 0x17], 0x5241
mov byte [ebp - 0x15], 0x45
mov dword [ebp - 7], 0x732573
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x128], 0
call fcn.10005f30
add esp, 0xc
mov eax, 0x18
call fcn.10009c40
mov esi, esp
call fcn.100011e0
push eax
push 0x18
mov ecx, esi
call fcn.100011f0
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x128]
push 0x104
push eax
call fcn.1000243f
add esp, 0x18
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x128]
push eax
sub esp, 8
call fcn.1001e510
mov esi, dword [ebp + 8]
add esp, 0xc
test eax, eax
jne 0x1001efa1
push 0x103
lea eax, [ebp - 0x32f]
mov byte [ebp - 0x330], 0
push 0
push eax
call fcn.10005f30
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x24]
add esp, 0xc
mov word [ebp - 0xd], 0x736c
lea edx, [ebp - 0x10]
mov byte [ebp - 0xb], 0
mov word [ebp - 0x10], 0x7668
mov byte [ebp - 0xe], 0x61
push eax
lea eax, [ebp - 0x330]
push eax
sub esp, 8
call fcn.1001e590
add esp, 0x10
test eax, eax
jne 0x1001ef99
cmp dword [ebp - 0x24], eax
jbe 0x1001ef99
push 0x103
push eax
mov byte [ebp - 0x22c], al
lea eax, [ebp - 0x22b]
push eax
call fcn.10005f30
push esi
lea eax, [ebp + 8]
mov word [ebp + 8], 0x6425
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x22c]
mov byte [ebp + 0xa], 0
push 0x104
push eax
call fcn.1000243f
add esp, 0x20
lea edx, [ebp - 0x22c]
lea ecx, [ebp - 0x330]
call fcn.1001e370
test eax, eax
je 0x1001ef99
mov ecx, dword [ebp - 0x20]
call fcn.1001e4b0
mov eax, 1
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x20]
call fcn.1001e4b0
push esi
call dword [0x1004f9a4]
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1001efc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
push esi
push 0x103
lea eax, [ebp - 0x127]
mov dword [ebp - 0x19], 0x52415754
push 0
push eax
mov word [ebp - 0x1b], 0x464f
mov word [ebp - 0x14], 0x5c
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0x1c], 0x53
mov dword [ebp - 8], 0x73257325
mov byte [ebp - 4], 0
mov byte [ebp - 0x128], 0
call fcn.10005f30
add esp, 0xc
mov eax, 0x18
call fcn.10009c40
mov esi, esp
call fcn.100011e0
push eax
push 0x18
mov ecx, esi
call fcn.100011f0
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x128]
push 0x104
push eax
call fcn.1000243f
add esp, 0x18
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x128]
push eax
sub esp, 8
call fcn.1001e510
mov esi, dword [ebp + 8]
add esp, 0xc
test eax, eax
jne 0x1001f131
push 0x103
lea eax, [ebp - 0x32f]
mov byte [ebp - 0x330], 0
push 0
push eax
call fcn.10005f30
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x24]
add esp, 0xc
mov word [ebp - 0xd], 0x736c
lea edx, [ebp - 0x10]
mov word [ebp - 0x10], 0x7668
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xe], 0x61
push eax
lea eax, [ebp - 0x330]
push eax
sub esp, 8
call fcn.1001e590
add esp, 0x10
test eax, eax
jne 0x1001f129
cmp dword [ebp - 0x24], eax
jbe 0x1001f129
push 0x103
push eax
mov byte [ebp - 0x22c], al
lea eax, [ebp - 0x22b]
push eax
call fcn.10005f30
push esi
lea eax, [ebp + 8]
mov word [ebp + 9], 0x64
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x22c]
mov byte [ebp + 8], 0x25
push 0x104
push eax
call fcn.1000243f
add esp, 0x20
lea edx, [ebp - 0x22c]
lea ecx, [ebp - 0x330]
call fcn.1001e370
test eax, eax
je 0x1001f129
mov ecx, dword [ebp - 0x20]
call fcn.1001e4b0
mov eax, 1
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [ebp - 0x20]
call fcn.1001e4b0
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [0x1004f9b8]
lea esp, [ebp - 0x334]
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x1001f160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
call fcn.1001e480
test eax, eax
je 0x1001f1a6
lea ecx, [esp]
mov dword [esp + 3], 0x6957676e
push ecx
push eax
mov dword [esp + 0x13], 0x6f546f54
mov word [esp + 0x17], 0x70
mov dword [esp + 0xf], 0x776f646e
mov word [esp + 8], 0x7242
mov byte [esp + 0xa], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x14
ret
xor eax, eax
add esp, 0x14
ret

Function at 0x1001f1b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
call fcn.1001e480
test eax, eax
je 0x1001f1f4
lea ecx, [esp]
mov dword [esp + 0xb], 0x776f646e
push ecx
push eax
mov dword [esp + 0xf], 0x69576576
mov dword [esp + 0xb], 0x69746341
mov byte [esp + 0x17], 0
mov word [esp + 8], 0x6553
mov byte [esp + 0xa], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret
Function at 0x1001f200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
call fcn.1001e480
test eax, eax
je 0x1001f24c
lea ecx, [esp]
mov dword [esp + 0x10], 0x776f64
push ecx
push eax
mov dword [esp + 0xd], 0x72676572
mov word [esp + 0x11], 0x756f
mov dword [esp + 0x14], 0x6e695764
mov dword [esp + 9], 0x6f467465
mov byte [esp + 8], 0x53
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x14
ret
xor eax, eax
add esp, 0x14
ret

Function at 0x1001f260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
call fcn.1001e480
test eax, eax
je 0x1001f2a7
lea ecx, [esp]
mov dword [esp + 8], 0x736f5077
push ecx
push eax
mov word [esp + 0xb], 0x6957
mov word [esp + 8], 0x6553
mov word [esp + 0xe], 0x6f64
mov byte [esp + 0xa], 0x74
mov byte [esp + 0x14], 0
mov byte [esp + 0xd], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x1001f4d0
Capabilities:
Resume thread

Disassembly:
push ecx
push esi
call fcn.1001e9b0
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [esp + 8], eax
call fcn.1001e9b0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x1004f98c], esi
jbe 0x1001f52f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1001f510
mov eax, dword [0x1004f988]
push dword [eax + esi*4]
call edi
mov eax, dword [0x1004f988]
push dword [eax + esi*4]
call ebx
inc esi
cmp esi, dword [0x1004f98c]
jb 0x1001f510
pop edi
pop ebx
push dword [0x1004f988]
call fcn.1000245e
add esp, 4
mov dword [0x1004f988], 0
mov dword [0x1004f98c], 0
push dword [esp + 4]
call fcn.1001e9b0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop esi
pop ecx
ret

Function at 0x1001f570
Capabilities:
Resume thread
Suspend thread

Disassembly:
sub esp, 0x2cc
push ebx
push esi
push ecx
push 0
push 0x1fffff
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001f616
test esi, esi
je 0x1001f616
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call ebp
cmp eax, 0xffffffff
je 0x1001f633
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10001
push eax
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1001f612
mov edx, dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov ecx, dword [esp + 0xc8]
cmp ecx, ebx
jb 0x1001f612
mov eax, dword [esp + 0x2e0]
add eax, ebx
cmp ecx, eax
jae 0x1001f612
push esi
call edx
cmp edi, 3
jge 0x1001f61f
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call ebp
lea eax, [esp + 0x10]
inc edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x1001f5d0
pop edi
mov eax, esi
pop ebp
pop esi
pop ebx
add esp, 0x2cc
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x2cc
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x2cc
ret
Function at 0x1001f6c0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x40
push edi
xor edi, edi
cmp dword [0x1004f980], 0x40
jae 0x1001f7ba
push esi
mov esi, dword [esp + 0x4c]
add esi, ecx
cmp esi, 0x80000000
jae 0x1001f6e7
lea esi, [edi + 1]
jmp 0x1001f6ed
sub esi, 0x7fff0000
push ebx
mov ebx, dword [esp + 0x58]
add ebx, ecx
cmp ebx, 0x80000000
jae 0x1001f704
add ebx, 0x7ff80000
jmp 0x1001f709
mov ebx, 0xfff80000
xorps xmm0, xmm0
mov dword [esp + 0x28], edi
lea eax, [esp + 0x28]
push eax
movdqu xmmword [esp + 0x30], xmm0
movdqu xmmword [esp + 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, ebx
jae 0x1001f7b8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1c
lea eax, [esp + 0x14]
push eax
push esi
call ebp
test eax, eax
je 0x1001f78a
cmp dword [esp + 0x20], 0x10000
jne 0x1001f77c
mov eax, dword [esp + 0x1c]
cmp eax, 0x6c
jb 0x1001f780
mov ecx, dword [esp + 0x48]
cmp eax, ecx
jb 0x1001f780
lea eax, [ecx - 1]
xor edx, edx
add eax, esi
sub esp, 8
div ecx
imul ecx, eax
call fcn.1001e720
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001f78e
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
add esi, eax
cmp esi, ebx
jb 0x1001f736
test edi, edi
je 0x1001f7b7
xor eax, eax
cmp dword [eax*4 + 0x1004fa10], 0
je 0x1001f7aa
inc eax
cmp eax, 0x40
jb 0x1001f790
pop ebp
pop ebx
pop esi
mov eax, edi
pop edi
add esp, 0x40
ret
inc dword [0x1004f980]
mov dword [eax*4 + 0x1004fa10], edi
pop ebp
pop ebx
pop esi
mov eax, edi
pop edi
add esp, 0x40
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x2843008], 0x8088405
inc edx
mov dword [ebx + 0x2843008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd64
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd95
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd7d
add dl, dl
jne 0x41cda0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cdf1
xor eax, eax
add dl, dl
jne 0x41cdad
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce8e
add dl, dl
jne 0x41cdbc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdc7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdd2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cddd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cde7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd8c
mov eax, 1
add dl, dl
jne 0x41cdff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ce0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdf6
sub eax, ebx
mov ebx, 1
jne 0x41ce3d
mov ecx, 1
add dl, dl
jne 0x41ce23
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce2e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce1a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce54
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce5f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce4b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ceaf
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd8c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret