joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d4c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x4601fc
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x37
mov byte [ebp - 3], 0x3c
mov byte [ebp - 2], 0x2f
mov byte [ebp - 1], 0x49
push 4
lea ecx, [ebp - 4]
push ecx
push 0x460200
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x44
mov byte [ebp - 3], 0x3e
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x460204
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x46020c
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x34
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x3c
mov byte [ebp - 1], 0x2f
push 4
lea ecx, [ebp - 4]
push ecx
push 0x460210
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x49
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x3e
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x460214
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x46021c
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x31
mov byte [ebp - 1], 0x3c
push 4
lea ecx, [ebp - 4]
push ecx
push 0x460220
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x2f
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea edx, [ebp - 4]
push edx
push 0x460224
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x46022c
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x35
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x33
mov byte [ebp - 1], 0x3c
push 4
lea ecx, [ebp - 4]
push ecx
push 0x460230
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x2f
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea edx, [ebp - 4]
push edx
push 0x460234
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x46023c
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x34
mov byte [ebp - 2], 0x3c
mov byte [ebp - 1], 0x2f
push 4
lea ecx, [ebp - 4]
push ecx
push 0x460240
call fcn.00403f60
add esp, 0xc
mov byte [ebp - 4], 0x49
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x3e
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x460244
call fcn.00403f60
add esp, 0xc
call fcn.0042d430
mov esp, ebp
pop ebp
ret 4
Function at 0x42d6e0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x42d733
mov dword [ebp - 0x14], 0xffffffff
jmp 0x42d7fd
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
jmp 0x42d74e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jae 0x42d7f6
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 5
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x42d78c
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x42d7f6
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
cmp edx, dword [ebp - 4]
jne 0x42d7b4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x45f6a0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42d7db
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x45f698]
shl eax, 8
add eax, 0x45f7a0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [0x45f698]
add ecx, 1
mov dword [0x45f698], ecx
cmp dword [ebp - 0x10], 0
je 0x42d7f1
mov edx, dword [ebp - 0x10]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x10], 0
jmp 0x42d745
jmp 0x42d7fd
cmp dword [ebp - 0x10], 0
je 0x42d80c
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 0x18], 0
je 0x42d81b
mov ecx, dword [ebp - 0x18]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x42dae0
Capabilities:
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], str.Accept:___r_nPragma:_no_cache_r_nCache_Control:_no_cache_r_n
mov dword [ebp - 0x20], str.Content_Type:_application_x_www_form_urlencoded_r_n
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0x4431e4
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x42db36
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
cmp dword [ebp + 0x10], 0
je 0x42db5c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 8], eax
mov eax, dword [0x447030]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x248
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x42dba4
mov dword [ebp - 0x1c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x42dc05
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x42dbdb
mov dword [ebp - 0x1c], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x42dc05
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x42dbfe
mov dword [ebp - 0x1c], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x42dc05
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42dcc0
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [0x447030], 0x100
push 0
push 0
push 0
push 0
push str.UserAgent_1.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x42dd13
mov dword [ebp - 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x42de5a
cmp dword [ebp + 0x10], 0
je 0x42dd2d
push 4
lea eax, [ebp + 0x10]
push eax
push 3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x3c
mov ecx, dword [ebp + 8]
add ecx, 0x48
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0x100
mov ecx, dword [ebp + 8]
add ecx, 0x248
mov edx, dword [ebp + 8]
mov dword [edx + 0x38], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 0x800
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x42dd9d
mov dword [ebp - 8], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x42de5a
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 2
jne 0x42ddd3
mov dword [ebp - 0xc], 0xa00
push 4
lea edx, [ebp - 0xc]
push edx
push 0x54
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov edx, dword [0x447030]
or edx, 0x800000
mov dword [0x447030], edx
mov dword [0x45e9bc], 1
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [0x45f690], eax
mov ecx, dword [ebp + 8]
add ecx, 0x248
mov dword [0x45f694], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x24]
mov dword [0x458100], eax
push 0
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x24]
push edx
mov eax, dword [ebp + 8]
add eax, 0x48
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x42de53
mov dword [ebp - 8], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov dword [0x45e9bc], 0
mov dword [0x45f694], 0
jmp 0x42de5a
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42f970
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x42f9bf
mov dword [ebp - 0x18], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42fafc
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jge 0x42f9e2
mov dword [ebp - 0x18], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42faf6
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42fa0e
mov dword [ebp - 0x18], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42fa99
lea edx, [ebp - 8]
push edx
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42fa34
mov dword [ebp - 0x18], 0xfffffffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42fa99
lea eax, [ebp - 4]
push eax
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42fa5a
mov dword [ebp - 0x18], 0xfffffffb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42fa99
cmp dword [ebp - 0x10], 0
je 0x42fa6f
push 0x45f2c0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 8], 0
je 0x42fa84
push 0x45f3c0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 4], 0
je 0x42fa99
push 0x45f4c0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 4], 0
je 0x42fab1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax + 0x14]
call edx
cmp dword [ebp - 8], 0
je 0x42fac9
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 0x14]
call ecx
cmp dword [ebp - 0x10], 0
je 0x42fae1
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 0x14]
call eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 8]
call ecx
jmp 0x42faf6
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 4
Function at 0x430fe0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4462a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x214], 0x100
mov dword [ebp - 0x218], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x43105a
mov dword [ebp - 4], 0
jmp 0x4310a3
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4310a3
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00402850
mov esp, ebp
pop ebp
ret 0xc
Function at 0x431370
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4462a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x110], 0x7c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [0x447840], eax
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00402860
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00402860
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x4314c6
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x21c], 0
jmp 0x431419
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
test edx, edx
je 0x431472
mov eax, dword [ebp - 0x21c]
movzx ecx, word [ebp + eax*2 - 0x218]
cmp ecx, 0x61
jl 0x431470
mov edx, dword [ebp - 0x21c]
movzx eax, word [ebp + edx*2 - 0x218]
cmp eax, 0x7a
jg 0x431470
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
sub edx, 0x20
mov eax, dword [ebp - 0x21c]
mov word [ebp + eax*2 - 0x218], dx
jmp 0x43140a
lea ecx, [ebp - 0x218]
push ecx
push str.ADMINISTRATOR
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x431493
xor edx, edx
mov word [0x45e9c0], dx
jmp 0x4314c6
lea eax, [ebp - 0x218]
push eax
push 0x4433d0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4314b4
xor ecx, ecx
mov word [0x45e9c0], cx
jmp 0x4314c6
lea edx, [ebp - 0x108]
push edx
push 0x45e9c0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
call fcn.004310c0
push 0x4433e0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x43150f
push 0x4433fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x43150f
mov dword [0x447844], 2
jmp 0x431549
cmp dword [ebp - 0x10c], 0
je 0x431542
push str.AddAccessAllowedAceEx
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x447844], eax
cmp dword [0x447844], 0
jne 0x431542
mov dword [0x447844], 3
jmp 0x431549
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402850
mov esp, ebp
pop ebp
ret 4
Function at 0x1001ca56
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1001ca65
pop dword [ebp - 0x50]
mov eax, 0x1001ca65
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x2d046f86
sub dword [ebp - 0x60], 0xdeb22a3b
mov dword [ebp - 0x5c], 0xb9a6a100
sub dword [ebp - 0x5c], 0x877354bb
mov dword [ebp - 0x58], 0x4b05535b
sub dword [ebp - 0x58], 0xfeb90f2d
mov dword [ebp - 0x54], 0x5b35ab8f
sub dword [ebp - 0x54], 0x5b35ab8f
lea eax, [ebp - 0x60]
push eax
mov eax, 0x63f407df
add eax, 0xac0ee9ad
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xb8eaa016
add dword [ebp - 0x60], 0xbb87c940
mov dword [ebp - 0x5c], 0xb1e83d70
sub dword [ebp - 0x5c], 0x707bdbfb
mov dword [ebp - 0x58], 0xc6aae96c
sub dword [ebp - 0x58], 0x633b7d00
mov dword [ebp - 0x54], 0x9b5c4896
sub dword [ebp - 0x54], 0x9b5c4896
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x77f0d6ea
add eax, 0x98121a02
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x456d5
push 0
call eax
mov ecx, 0x4bb0
xor edx, edx
add edx, eax
mov edi, 0xc6730c74
add edi, 0x4991578c
add edi, dword [ebp - 0x50]
mov esi, 0xacb3f707
xor dword [ebp - 0x14], 0x3215e4c2
mov ebx, dword [edi]
add dword [ebp - 0x18], 0x99d3a38d
sub ebx, esi
xor dword [ebp - 0x28], ebx
mov dword [edx], ebx
mov dword [ebp - 0x14], 0xe8b960c4
add edx, 0xe8efeedf
sub edx, 0xe8efeedb
add edi, 4
loop 0x1001cb78
add eax, 0x12193
xor ebx, ebx
add ebx, eax
add eax, 0x489f385b
sub eax, 0x489f3856
mov ecx, 0x7aba0597
sub ecx, 0x6aba0597
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10002f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10002f2f
pop dword [ebp - 0x4c]
mov eax, 0x10002f2f
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3bedb
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4b21
xor ebx, ebx
add ebx, eax
mov edi, 0x33cf68b
add edi, 0xcc6c975
add edi, dword [ebp - 0x4c]
mov edx, 0x544840f4
add dword [ebp - 0x30], 0x3348555d
mov esi, dword [edi]
add dword [ebp - 0x24], 0xfa83f0a
xor esi, edx
xor dword [ebp - 0x44], 0x346e2c0
mov dword [ebx], esi
xor dword [ebp - 0x3c], edx
add ebx, 0xf2ffc0d
sub ebx, 0xf2ffc09
add edi, 4
loop 0x10002f7a
add eax, 0x11f57
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9d8c1bdb
add ecx, 0x7273e425
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x100085e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [0x100351ec], 0x10008580
mov eax, dword [0x10034e40]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x24], 0
je 0x10008610
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
push eax
call fcn.10002f20
add esp, 4
push 0x34
call fcn.1000f203
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10008630
push str.out_of_memory.
call fcn.10002f20
add esp, 4
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
call fcn.10002f20
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
jne 0x10008666
push str.lacks_overlay_support.
call fcn.10002f20
add esp, 4
xor eax, eax
mov al, byte [0x10030640]
push eax
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [0x10034cd0]
push eax
call fcn.10002f20
add esp, 0x10
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x100086a1
push 0x1003096c
call fcn.10002f20
add esp, 4
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x1c
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10002f20
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [0x10034cd0]
push eax
call fcn.10002f20
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x70]
and ecx, 0x28030
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 8]
cmp dword [edx + 0x5c], 0
je 0x10008723
push 3
push 0
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x68], 1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x24], edx
push 1
call fcn.10002f20
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x1000877f
push 0x404
call dword [sym.imp.OPENGL32.dll_glDrawBuffer]
push 0x404
call dword [sym.imp.OPENGL32.dll_glReadBuffer]
mov esp, ebp
pop ebp
ret

Function at 0x10008a30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10034e40]
cmp dword [eax + 0x24], 0
jne 0x10008a4d
push str.glutHideOverlay:_window_has_no_overlay_established
call fcn.10002f20
add esp, 4
jmp 0x10008a72
push 0
mov ecx, dword [0x10034e40]
mov edx, dword [ecx + 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x10034e40]
mov edx, dword [ecx + 0x24]
mov dword [edx + 0x20], 0
pop ebp
ret