joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000be70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov word [esp + 8], 0x6570
push eax
mov dword [esp + 4], 0x61657243
mov byte [esp + 0xe], 0
mov word [esp + 9], 0x5065
mov byte [esp + 8], 0x74
mov byte [esp + 0xb], 0x69
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000bec2
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret

Function at 0x1000bed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov word [esp + 9], 0x6165
push eax
mov word [esp + 0xa], 0x6854
mov word [esp + 0xf], 0x64
mov dword [esp + 5], 0x74616572
mov byte [esp + 0xc], 0x72
mov byte [esp + 4], 0x43
mov byte [esp + 9], 0x65
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000bf31
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x1000bf40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
lea eax, [esp]
mov word [esp + 4], 0x6954
push eax
mov dword [esp + 0xb], 0x536f5465
mov dword [esp + 4], 0x656c6946
mov dword [esp + 0x10], 0x6d657473
mov byte [esp + 0xa], 0x6d
mov dword [esp + 0x15], 0x656d69
mov byte [esp + 0x14], 0x54
mov byte [esp + 0xf], 0x79
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000bf9b
push dword [esp + 0x20]
push dword [esp + 0x20]
call eax
add esp, 0x18
ret
xor eax, eax
add esp, 0x18
ret

Function at 0x1000bfb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp]
mov dword [esp + 0xc], 0x6974616d
push eax
mov dword [esp + 6], 0x6c694674
mov dword [esp + 0x1b], 0x656c64
mov dword [esp + 0x14], 0x79426e6f
mov word [esp + 4], 0x6547
mov word [esp + 0xb], 0x6e49
mov word [esp + 0x19], 0x6e61
mov byte [esp + 0x18], 0x48
mov word [esp + 0xe], 0x726f
mov byte [esp + 0xa], 0x65
mov byte [esp + 0xd], 0x66
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c020
push dword [esp + 0x24]
push dword [esp + 0x24]
call eax
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret

Function at 0x1000c030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov dword [esp], 0x46746547
push eax
mov word [esp + 0xe], 0x65
mov dword [esp + 9], 0x6953656c
mov byte [esp + 8], 0x69
mov byte [esp + 0xd], 0x7a
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c075
push dword [esp + 0x14]
push dword [esp + 0x14]
call eax
add esp, 0xc
ret
or eax, 0xffffffff
add esp, 0xc
ret
Function at 0x1000c080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
lea eax, [esp]
mov dword [esp + 0xf], 0x57656d
push eax
mov word [esp + 6], 0x4d74
mov dword [esp + 0xe], 0x4e656c69
mov byte [esp + 0x12], 0x61
mov word [esp + 0xc], 0x4665
mov word [esp + 9], 0x7564
mov word [esp + 4], 0x6547
mov byte [esp + 0xb], 0x6c
mov byte [esp + 8], 0x6f
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c0e4
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call eax
add esp, 0x14
ret
xor eax, eax
add esp, 0x14
ret

Function at 0x1000c0f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, 1
call fcn.1000b970
mov esi, eax
test esi, esi
je 0x1000c16f
lea eax, [esp + 8]
mov word [esp + 0xc], 0x6365
push eax
push esi
mov dword [esp + 0x1c], 0x6f666e
mov dword [esp + 0x18], 0x49797469
mov word [esp + 0x11], 0x7465
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x13], 0x53
mov word [esp + 0x16], 0x7275
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c168
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret

Function at 0x1000c180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov word [esp + 5], 0x7261
push eax
mov dword [esp + 4], 0x53746547
mov dword [esp + 0xe], 0x6f666e49
mov byte [esp + 8], 0x74
mov word [esp + 0x12], 0x57
mov word [esp + 0xc], 0x7075
mov byte [esp + 0xb], 0x74
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c1cc
push dword [esp + 0x14]
call eax
add esp, 0x10
ret

Function at 0x1000c1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp + 1], 0x79537465
push eax
mov word [esp + 0xa], 0x6574
mov byte [esp + 4], 0x47
mov word [esp + 0x10], 0x65
mov word [esp + 0xd], 0x6954
mov byte [esp + 0xc], 0x6d
mov byte [esp + 9], 0x73
mov byte [esp + 0xf], 0x6d
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c21e
push dword [esp + 0x14]
call eax
add esp, 0x10
ret
Function at 0x1000c230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push esi
push edi
xor esi, esi
call fcn.1000b970
mov edi, eax
test edi, edi
je 0x1000c2ba
lea eax, [esp + 8]
mov dword [esp + 0x16], 0x79746972
push eax
push edi
mov word [esp + 0x11], 0x696e
mov word [esp + 0x14], 0x6169
mov dword [esp + 0x26], 0x74706972
mov dword [esp + 0x22], 0x63736544
mov dword [esp + 0x19], 0x63655365
mov word [esp + 0x2b], 0x72
mov byte [esp + 0x1d], 0x75
mov byte [esp + 0x2a], 0x6f
mov byte [esp + 0x13], 0x74
mov word [esp + 0x17], 0x7a69
mov byte [esp + 0x16], 0x6c
mov byte [esp + 0x10], 0x49
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c2b3
push dword [esp + 0x30]
push dword [esp + 0x30]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x20
ret

Function at 0x1000c310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov word [esp], 0x704f
push eax
mov dword [esp + 7], 0x6f72506e
mov dword [esp + 0xb], 0x73736563
mov byte [esp + 0xf], 0
mov byte [esp + 6], 0x65
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c359
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call eax
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret

Function at 0x1000c360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov word [esp], 0x6550
push eax
mov dword [esp + 0xe], 0x657069
mov dword [esp + 7], 0x6d614e6b
mov word [esp + 0xc], 0x5064
mov byte [esp + 6], 0x65
mov byte [esp + 0xb], 0x65
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c3bc
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x1000c3d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push esi
push edi
xor edi, edi
call fcn.1000b970
mov esi, eax
test esi, esi
je 0x1000c478
lea eax, [esp + 8]
mov word [esp + 0xf], 0x6972
push eax
push esi
mov word [esp + 0x25], 0x6144
mov word [esp + 0x20], 0x7069
mov word [esp + 0x11], 0x7465
mov word [esp + 0x14], 0x6365
mov word [esp + 0x28], 0x6c
mov word [esp + 0x1a], 0x4479
mov byte [esp + 0x13], 0x53
mov word [esp + 0x1d], 0x6373
mov byte [esp + 0x1f], 0x72
mov word [esp + 0x22], 0x6f74
mov byte [esp + 0x10], 0x53
mov byte [esp + 0x19], 0x74
mov byte [esp + 0x16], 0x75
mov byte [esp + 0x24], 0x72
mov byte [esp + 0x27], 0x63
mov byte [esp + 0x1c], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c471
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x1000c510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
push edi
xor esi, esi
call fcn.1000ba60
mov edi, eax
test edi, edi
je 0x1000c561
lea eax, [esp + 8]
mov word [esp + 0x10], 0x57
push eax
push edi
mov dword [esp + 0x11], 0x6f547274
mov word [esp + 0x15], 0x6e49
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x10], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c55a
push dword [esp + 0x18]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x1000c570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
lea eax, [esp]
mov dword [esp + 1], 0x65747379
push eax
mov word [esp + 0x14], 0x6954
mov word [esp + 0xa], 0x6954
mov byte [esp + 9], 0x6d
mov dword [esp + 0xd], 0x466f5465
mov word [esp + 0x11], 0x6c69
mov byte [esp + 0xc], 0x6d
mov byte [esp + 4], 0x53
mov word [esp + 0x17], 0x65
mov byte [esp + 0x13], 0x65
mov byte [esp + 0x16], 0x6d
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c5da
push dword [esp + 0x20]
push dword [esp + 0x20]
call eax
add esp, 0x18
ret
xor eax, eax
add esp, 0x18
ret

Function at 0x1000c5e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov word [esp + 0xa], 0x7268
push eax
mov dword [esp + 9], 0x6574616e
mov word [esp + 0x11], 0x6461
mov word [esp + 7], 0x696d
mov word [esp + 4], 0x6554
mov byte [esp + 0x10], 0x65
mov byte [esp + 6], 0x72
mov byte [esp + 0x13], 0
mov byte [esp + 0xd], 0x54
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c63d
push dword [esp + 0x18]
push dword [esp + 0x18]
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x1000c650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
lea eax, [esp]
mov word [esp + 0xc], 0x4f65
push eax
mov dword [esp + 4], 0x74696157
mov dword [esp + 0x13], 0x7463656a
mov dword [esp + 0xb], 0x676e6953
mov word [esp + 9], 0x726f
mov byte [esp + 0x12], 0x62
mov byte [esp + 0xf], 0x6c
mov byte [esp + 0x17], 0
mov byte [esp + 8], 0x46
call fcn.1000b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c6af
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret
Function at 0x1001db77
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001d837
Function at 0x406752
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406776
xor eax, eax
test eax, eax
je 0x406789
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406789
xor ecx, ecx
jmp 0x40678c
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4068b5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4068ec
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4068c6
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4068c1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40691d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4068ff
pop edi
not eax
pop esi
ret 0xc

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x539213f0
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x58070af
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x73dd4270
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x73da003c]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
lea ecx, [eax + 0x73da0000]
sub esi, 0x73da0000
push edi
cmp esi, dword [ecx + 0x50]
jae 0x73dd42ca
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
xor ebx, ebx
movzx eax, word [ecx + 6]
mov dword [ebp - 4], eax
test eax, eax
je 0x73dd42ca
lea esp, [esp]
mov eax, dword [edx + 0xc]
cmp esi, eax
jb 0x73dd42c1
mov edi, dword [edx + 8]
lea ecx, [eax + edi]
cmp esi, ecx
jb 0x73dd42d1
inc ebx
add edx, 0x28
cmp ebx, dword [ebp - 4]
jb 0x73dd42b0
mov ecx, 5
int 0x29
test dword [edx + 0x24], 0x20000000
jne 0x73dd42ca
mov ecx, dword [ebp - 8]
lea eax, [eax + 0x73da0000]
mov dword [ecx], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x73dd4a77
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x73f3bb68]
cmp eax, 0xffffffff
je 0x73dd4ac2
push esi
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x73dd4a93
mov eax, esi
pop esi
ret
push edi
mov edi, 0x388
mov ecx, edi
call fcn.73dd5d6e
mov esi, eax
test esi, esi
je 0x73dd4ac5
push esi
push dword [0x73f3bb68]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
push edi
push 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
pop edi
jmp 0x73dd4a8f
xor eax, eax
ret
mov esi, 0x73f58540
jmp 0x73dd4abf

Function at 0x73dd554d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x73f3e530]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
test dword [0x73f41984], ecx
je 0x73dd55dc
lea esi, [ebp - 0x10c]
test ecx, ecx
js 0x73dd5594
push 0x73dbe948
mov edx, 0x100
mov ecx, esi
call fcn.73ee457f
pop ecx
lea esi, [ebp - 0x107]
push ebx
lea eax, [ebp - 0xd]
push edi
sub eax, esi
push eax
push esi
call fcn.73de1339
mov eax, dword [0x73f3e670]
xor ecx, ecx
add esp, 0x10
mov byte [ebp - 0xd], cl
sub eax, ecx
je 0x73dd55cf
sub eax, 1
jne 0x73dd55dc
lea eax, [ebp - 0x10c]
push eax
push 0x73dbc304
push ecx
call fcn.73f167e8
add esp, 0xc
jmp 0x73dd55dc
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.73ddffa0
leave
ret
Function at 0x73dd5800
Capabilities:
Query environment variable

Disassembly:
push 0x234
push 0x73f30d50
call fcn.73eed2a0
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x238], eax
and dword [ebp - 4], 0
xor esi, esi
inc esi
cmp dword [0x73f3bcb0], 0
jne 0x73dd5868
mov dword [0x73f3bcb0], esi
and dword [0x73f3bca4], 0
mov ebx, 0x73f3bca8
mov dword [0x73f3bcac], ebx
mov dword [0x73f3bca8], ebx
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
mov ax, word [ebp - 0x244]
mov word [0x73f3dee4], ax
call fcn.73ed6f8a
xor eax, eax
mov word [0x73f3bcbc], ax
push 0x7d1
mov ebx, 0x73f3bcbc
push ebx
push 0x73dbdb98
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
push ebx
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcslwr]
pop ecx
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x234]
push eax
push 0x73dbdbb4
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
je 0x73dd58b5
lea ecx, [ebp - 0x234]
call fcn.73f0ce07
push ebx
lea eax, [ebp - 0x234]
push eax
push 0x73dbdbcc
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
je 0x73dd58d2
mov dword [0x73f3cc78], esi
mov ecx, edi
call fcn.73dd5c89
test eax, eax
je 0x73dd5903
cmp dword [ebp + 0x10], 0
je 0x73dd58ea
push 0x57
jmp 0x73dd59e1
add dword [eax + 0x14], esi
push 6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x73dd59f0
mov ecx, 0x1ac70
call fcn.73dd5d6e
mov ebx, eax
test ebx, ebx
jne 0x73dd591a
push 8
jmp 0x73dd59e1
push 0x1ac70
push 0
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x1a418], 0x58
mov dword [ebx + 0x1a468], 0x7d1
and dword [ebx + 0x1ac44], 0
lea eax, [ebx + 8]
mov dword [ebx + 0xc], eax
mov dword [eax], eax
xor edx, edx
mov ecx, edi
call fcn.73dd5da6
mov dword [ebx + 0x1c], eax
and dword [ebx + 0x1ac64], 0
mov eax, dword [0x73f3bcac]
mov dword [ebx], 0x73f3bca8
mov dword [ebx + 4], eax
mov dword [eax], ebx
mov dword [0x73f3bcac], ebx
inc dword [0x73f3bca4]
push dword [ebp - 0x238]
push edi
call sym.dbghelp.dll_SymSetSearchPathW
test eax, eax
jne 0x73dd599a
push edi
call sym.dbghelp.dll_SymCleanup
jmp 0x73dd59e7
cmp dword [ebp + 0x10], 0
je 0x73dd58f5
push 0
push 0
mov edx, 0x73f14420
mov ecx, edi
call fcn.73f158ad
mov ebx, eax
test ebx, ebx
je 0x73dd58f5
push edi
call sym.dbghelp.dll_SymCleanup
push ebx
jmp 0x73dd59e1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x73dd8b10
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x73f3e530]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
test dword [0x73f41984], eax
je 0x73dd8b9f
lea ecx, [ebp - 0x10c]
test eax, eax
js 0x73dd8b54
push 0x73dbe948
mov edx, 0x100
call fcn.73ee457f
pop ecx
lea ecx, [ebp - 0x107]
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0xd]
push esi
sub eax, ecx
push eax
push ecx
call fcn.73de1339
mov eax, dword [0x73f3e670]
xor ecx, ecx
add esp, 0x10
mov byte [ebp - 0xd], cl
sub eax, ecx
je 0x73dd8b92
sub eax, 1
jne 0x73dd8b9f
lea eax, [ebp - 0x10c]
push eax
push 0x73dbc304
push ecx
call fcn.73f167e8
add esp, 0xc
jmp 0x73dd8b9f
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.73ddffa0
leave
ret
Function at 0x73ddfbf2
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ecx
mov eax, dword [0x73f3bc2c]
push esi
push edi
test eax, eax
jne 0x73ef8a77
xor al, al
pop edi
pop esi
pop ecx
ret
cmp eax, 0xffffffff
je 0x73ddfc04
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov esi, eax
mov edi, 0x73f3bc14
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
cmp dword [0x73f3dee0], 0
je 0x73ef8aeb
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
push 0x1f4
call dword [sym.imp.api_ms_win_core_misc_l1_1_0.dll_Sleep]
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, esi
cmp eax, 0x7530
jb 0x73ef8a8d
cmp dword [0x73f3bc2c], 0
je 0x73ddfc04
call fcn.73dd5c5e
test eax, eax
je 0x73ddfc04
push 0x73dc9800
push 0
call fcn.73f1690b
pop ecx
pop ecx
jmp 0x73ddfc04
mov esi, dword [0x73f3bc34]
test esi, esi
je 0x73ef8aff
mov ecx, esi
call dword [0x73f59474]
call esi
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov al, 1
jmp 0x73ddfc06

Function at 0x73de0791
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x73de07ce
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x73de07c7
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x73de07d3
add edx, 0x28
cmp edx, esi
jne 0x73de07b8
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x73de07d0

Function at 0x73de5d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
movzx edx, byte [ebp + 0x10]
movzx eax, byte [ebp + 0x14]
and edx, 0xfffffffd
add eax, eax
or edx, eax
push esi
mov esi, ecx
shl edx, 0x14
movzx ecx, byte [ebp + 0xc]
and ecx, 0xffffffe1
mov eax, dword [esi + 0x20]
and eax, 0xffc1ffff
mov dword [esi], 0x73da12a0
or edx, eax
mov dword [esi + 4], 0
movzx eax, byte [ebp + 0x18]
and edx, 0xff3fffff
shl eax, 4
or ecx, eax
mov dword [esi + 8], 0
mov eax, dword [ebp + 8]
shl ecx, 0x13
or edx, ecx
mov dword [esi + 0x80], eax
mov dword [esi + 0xc], 0xffffffff
mov eax, esi
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
pop esi
pop ebp
ret 0x14
Function at 0x73de7230
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
or eax, 0xffffffff
lea esi, [ebp + 0xa]
mov edi, 0x1c
movzx edx, byte [esi - 2]
lea esi, [esi + 4]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x73db1bb0]
movzx edx, byte [esi - 5]
movzx ecx, al
xor edx, ecx
shr eax, 8
movzx ecx, byte [esi - 4]
xor eax, dword [edx*4 + 0x73db1bb0]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x73db1bb0]
movzx edx, byte [esi - 3]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x73db1bb0]
sub edi, 4
jne 0x73de7240
pop edi
pop esi
pop ebp
ret 0x1c