joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a050
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486648
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x4a4b34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
fld1
fstp qword [ebp - 0x4c]
lea eax, [esi + 0x30]
fldz
push eax
fstp qword [ebp - 0x44]
push 0
fld qword [ebp + 8]
lea ecx, [esi + 0x18]
fstp qword [ebp - 0x2c]
push ecx
fld qword [ebp + 0x10]
lea edi, [esi + 0x10]
fstp qword [ebp - 0x24]
push edi
fld qword [ebp + 0x18]
lea ebx, [esi + 8]
fstp qword [ebp - 0x5c]
push ebx
fld qword [ebp + 0x20]
lea edx, [ebp - 0x3c]
fstp qword [ebp - 0x54]
push edx
fld qword [ebp + 0x28]
lea eax, [ebp - 0x5c]
fstp qword [ebp - 0x3c]
push eax
fld qword [ebp + 0x30]
lea ecx, [ebp - 0x2c]
push ecx
fstp qword [ebp - 0x34]
mov dword [ebp - 4], 0
mov dword [esi], vtable.ArcPath.0
call fcn.00403021
add esp, 0x20
test eax, eax
jns 0x43a0f9
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_void_]
push 0x49fc48
lea edx, [ebp - 0x1c]
push edx
call sub.MSVCR100.dll__CxxThrowException
fld qword [ebp - 0x2c]
lea eax, [esi + 0x20]
fsub qword [ebx]
push eax
lea ecx, [ebp - 0x2c]
push ecx
fstp qword [ebp - 0x2c]
lea edx, [ebp - 0x4c]
fld qword [ebp - 0x24]
push edx
fsub qword [edi]
fstp qword [ebp - 0x24]
call fcn.00401e0b
add esp, 0xc
test al, al
jne 0x43a138
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_void_]
push 0x49fc48
lea eax, [ebp - 0x1c]
push eax
call sub.MSVCR100.dll__CxxThrowException
fld qword [ebp - 0x3c]
lea ecx, [esi + 0x28]
fsub qword [ebx]
push ecx
lea edx, [ebp - 0x3c]
push edx
fstp qword [ebp - 0x3c]
lea eax, [ebp - 0x4c]
fld qword [ebp - 0x34]
push eax
fsub qword [edi]
fstp qword [ebp - 0x34]
call fcn.00401e0b
add esp, 0xc
test al, al
jne 0x43a177
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_void_]
push 0x49fc48
lea ecx, [ebp - 0x1c]
push ecx
call sub.MSVCR100.dll__CxxThrowException
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x4739f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ad38
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4a4b34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0
call dword [sym.imp.MSVCR100.dll__time64]
add esp, 4
mov dword [ebp - 0x220], eax
push str._Y_m_d__H_M_S
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x21c], edx
call fcn.00402180
lea ecx, [ebp - 0x210]
push ecx
push esi
mov dword [ebp - 4], 0
call fcn.00401023
add esp, 8
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov edx, dword [ebp - 0x218]
push edx
lea eax, [ebp - 0x210]
push eax
push edi
lea ecx, [ebp - 0x214]
push str._s_s__s.prg
push ecx
mov byte [ebp - 4], 1
call dword [sym.imp.mfc100.dll_Ordinal_4283]
add esp, 0x14
push 0
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x473ae3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x110]
push 0x499704
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
lea eax, [ebp - 0x110]
push eax
push 0x8c42b4
call fcn.00401857
add esp, 0x14
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x218]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047e7ac
mov esp, ebp
pop ebp
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x10001f8b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1001c7f1
call fcn.1001c3b8
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1000219d
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x10001fdd
sub edx, ecx
sar edx, 1
inc edx
push ecx
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x41c], edx
call fcn.10001357
test eax, eax
js 0x1000219d
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x1000202e
mov ecx, esi
call fcn.10001387
test al, al
je 0x1000202e
mov eax, esi
call fcn.1001c519
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000203a
push esi
lea ecx, [ebp - 0x428]
call fcn.1001507c
push 3
push esi
mov edx, edi
mov ecx, eax
call fcn.1001507c
mov edi, eax
test edi, edi
je 0x10002197
push 0x60
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], esi
test esi, esi
jne 0x10002088
push 2
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], eax
test esi, esi
jne 0x10002088
call fcn.10001543
mov edi, eax
jmp 0x1000217c
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100020ab
call fcn.10001543
jmp 0x1000216f
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x100020a1
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x424], edi
lea ecx, [edi + 1]
cmp ecx, edi
jae 0x100020de
mov edi, 0x8007000e
jmp 0x10002171
mov byte [ebp - 4], 2
call fcn.10005d4e
cmp eax, 0x400
jbe 0x100020fc
push eax
lea ecx, [ebp - 0x418]
call fcn.1001507c
jmp 0x10002108
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x1000212c
cmp dword [ebp - 0x418], 0
je 0x100020d4
mov ecx, dword [ebp - 0x418]
mov edx, edi
push edi
push dword [ebp - 0x420]
call fcn.1001507c
pop ecx
pop ecx
mov ecx, eax
call fcn.100014e5
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
push dword [ebp + 0x14]
mov byte [eax + edi], bl
push dword [ebp - 0x418]
call fcn.1001507c
mov edi, eax
test esi, esi
je 0x1000217c
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x100021b7
lea ecx, [ebp - 0x418]
call fcn.100058b0
jmp 0x100021b7
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x100021b2
lea ecx, [ebp - 0x418]
call fcn.100058b0
mov edi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.10005668
mov eax, edi
lea esp, [ebp - 0x440]
call fcn.1001c309
ret 0x10
Function at 0x1001507c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1001508b
pop dword [ebp - 0x44]
mov eax, 0x1001508b
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x9c290bda
add dword [ebp - 0x54], 0xb2293971
mov dword [ebp - 0x50], 0x7ba4de35
add dword [ebp - 0x50], 0xb68e6e10
mov dword [ebp - 0x4c], 0x2d91ebc7
sub dword [ebp - 0x4c], 0xe145a799
mov dword [ebp - 0x48], 0xfc2133f8
sub dword [ebp - 0x48], 0xfc2133f8
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x8871e4e
add dword [ebp - 0x54], 0x6beb4b08
mov dword [ebp - 0x50], 0x4a17f202
add dword [ebp - 0x50], 0xf7546f73
mov dword [ebp - 0x4c], 0xb6d2b022
sub dword [ebp - 0x4c], 0x536343b6
mov dword [ebp - 0x48], 0x2c5b6c7f
sub dword [ebp - 0x48], 0x2c5b6c7f
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xb7b39b7c
add eax, 0x584e44b4
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3ca90
push 0
call eax
mov ecx, 0xd96bf75f
add ecx, 0x2694514f
mov esi, eax
mov edx, 0x4716f480
add edx, 0xc8ebe780
add edx, dword [ebp - 0x44]
mov ebx, 0x230e9c0d
add ebx, 0x1c55dbe2
add dword [ebp - 0x18], 0x9d9f2f26
mov edi, dword [edx]
add edi, ebx
add dword [ebp - 0x38], edi
mov dword [esi], edi
xor dword [ebp - 0x20], 0x4e650a8f
add esi, 0x4637c466
add esi, 0xb9c83b9e
add edx, 0xa09fddbc
add edx, 0x5f602248
loop 0x100151a3
add eax, 0x231062d5
sub eax, 0x230f4d4a
xor ebx, ebx
add ebx, eax
add eax, 0xee9abd73
sub eax, 0xee9abd6e
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1e7a6860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1e7a686f
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1e7a6581
push eax
fst qword [edi]
wait
lea eax, [ebp - 0x40]
push eax
call fcn.1e7a6591
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a6546
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.1e7a6581
inc ebx
or ecx, dword [edx - 0x17ba7277]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1e7a6591
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a6546
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33

Function at 0x1e7a6970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1e7a6591
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a6546
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a6591
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a6546
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a6581
shr dword [0x9d885317], cl
jl 0x1e7a6a06
invalid
invalid
Function at 0x1e7a6a90
Capabilities:
Inspect section memory permissions

Disassembly:
jne 0x1e7a6a9e
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x1e7a6d7a
test bh, dl
add al, byte [eax]
add bh, bh
mov ch, 0x4c
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.1e7a64f2
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x1e7a6af1
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.1e7a64f2
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x1e7a6abe
call fcn.1e7a6581
jb 0x1e7a6b2f
xchg edx, eax
mov dh, 0x8b
jle 0x1e7a6b39
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x1e7a6d70
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x1e7a6b26
cmp dword [eax + 0xc], ebx
je 0x1e7a6bc9
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.1e7a6581
fidivr word [edi + 0x5d3989ef]
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
invalid
invalid
call fcn.1e7a6581
jae 0x1e7a6c39
aas
movsd dword es:[edi], dword [esi]
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x1e7a6c35
add eax, esi
cmp dword [eax], ebx
je 0x1e7a6c35
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1e7a6c30
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1e7a6c1a
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1e7a6c22
cmp edx, ebx
jne 0x1e7a6d70
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1e7a6bf1
add eax, dword [eax + 4]
jmp 0x1e7a6bde
mov dword [ebp + 0xc], ebx
jmp 0x1e7a6c40
push es
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a6c58
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
leave
mov edi, 0x60000000
jmp 0x1e7a6c76
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a6cd4
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a6cbb
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a6cc4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a6cce
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a6cb0
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x1e7a6c3a
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x1e7a6da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov dl, 0xfc
invalid
call dword [ecx - 0x3a]
test dword [ebx + 0x75fffffc], esi
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax

Function at 0x1e7a6e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.1e7a6591
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a6546
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
invalid
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]
invalid

Function at 0x1e7a71d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.1e7a6591
jge 0x1e7a7205
invalid
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a6546
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.1e7a6581
sub byte [ecx + 0x4689e65], dl
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x1e7a724a
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x1e7a7275
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
cmp dword [ebp - 0x398], 0
je 0x1e7a743f
cmp dword [ebp + 0xc], 1
je 0x1e7a743f
cmp dword [ebp + 0xc], 8
jne 0x1e7a7407
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
push ecx
stc
invalid
push dword [esi + eax*8]
test dword [edx - 7], edx
invalid
call dword [esi]
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
invalid
invalid
pop edx
Function at 0x1e7a7460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1e7a655f
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
invalid
movsd dword es:[edi], dword [esi]
xchg esp, eax
cld
invalid
invalid

Function at 0x1e7a74f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
invalid
invalid

Function at 0x1e7a7960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ebx + 0x448dfc4d]
add ebx, esp
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.1e7a64f2
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x1e7a798e
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x1e7a79d7
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
add eax, 0xfffffc6c
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x1e7a7981
call fcn.1e7a6581
lcall 0xfff8, 0xd4a58024
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
invalid

Function at 0x1e7a8600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1e7a6546
invalid
invalid

Function at 0x1e7a8730
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x1e7a8745
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.1e7a6581
mov esp, 0x8b369172
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
Function at 0x10001000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
push edi
mov byte [ebp - 0xc], 0x2f
mov byte [ebp - 0xb], 0x41
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x61
mov byte [ebp - 7], 0x49
mov byte [ebp - 6], 0x44
mov byte [ebp - 5], 0x3a
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
xor eax, eax
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push eax
call sub.MSVCRT.dll_strlen
add eax, esi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10007734
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
mov ecx, 0x12d
add esp, 0x18
cmp eax, ecx
ja 0x10001196
je 0x10001173
cmp eax, 0x12
ja case.default.0x100011ab
jmp dword [eax*4 + 0x10001265]
push 0x1000932c
jmp 0x10001158
push 0x10009320
jmp 0x10001158
push 0x10009314
jmp 0x10001158
push 0x10009308
jmp 0x10001158
push 0x100092fc
push 0x1000a944
call fcn.10007734
pop ecx
mov dword [0x1000ad38], 1
pop ecx
mov dword [0x1000ad50], ebx
jmp 0x10001260
push 0x100092f0
jmp 0x10001158
push 0x100092e4
jmp 0x10001158
push 0x100092d8
jmp 0x10001158
push 0x100092cc
jmp 0x10001158
push 0x100092c0
jmp 0x10001158
push 0x100092b0
jmp 0x10001158
push 0x100092a0
jmp 0x1000113c
push 0x10009290
jmp 0x1000113c
push 0x10009280
jmp 0x1000113c
push 0x10009270
jmp 0x1000113c
push 0x10009260
jmp 0x1000113c
push 0x10009250
jmp 0x1000113c
push 0x10009240
push 0x1000a944
call fcn.10007734
pop ecx
mov dword [0x1000ad38], ebx
pop ecx
jmp 0x10001260
push 0x10009230
push 0x1000a944
call fcn.10007734
pop ecx
mov dword [0x1000ad38], 1
pop ecx
jmp 0x10001260
push 0x1000921c
push 0x1000a944
call fcn.10007734
pop ecx
pop ecx
push 1
pop eax
mov dword [0x1000ad40], eax
mov dword [0x1000ad44], eax
jmp 0x10001260
mov ecx, 0x1f7
cmp eax, ecx
ja 0x1000120f
je 0x10001208
add eax, 0xfffffed2
cmp eax, 0xa
ja case.default.0x100011ab
jmp dword [eax*4 + 0x100012b1]
push 0x10009208
jmp 0x10001254
push 0x100091e8
jmp 0x10001254
push 0x100091c8
jmp 0x10001254
push 0x100091a8
jmp 0x10001254
push 0x10009188
jmp 0x10001254
push 0x10009170
jmp 0x10001254
push 0x1000915c
jmp 0x10001254
push 0x10009144
jmp 0x10001254
push 0x10009130
jmp 0x10001254
push 0x1000911c
jmp 0x10001254
push 0x10009108
jmp 0x10001254
push 0x100090f4
jmp 0x10001254
sub eax, 0x384
je 0x1000124f
dec eax
je 0x10001248
dec eax
je 0x10001241
dec eax
je 0x1000123a
dec eax
je 0x10001233
dec eax
je 0x1000122c
push 0x100090e8
jmp 0x10001254
push 0x100090d0
jmp 0x10001254
push 0x100090bc
jmp 0x10001254
push 0x100090ac
jmp 0x10001254
push 0x10009098
jmp 0x10001254
push 0x10009080
jmp 0x10001254
push 0x10009068
push 0x1000a944
call fcn.10007734
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret