joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445100
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f811
mov eax, dword fs:[0]
push eax
sub esp, 0x524
mov eax, dword [0x4af280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4b4548
mov dword [ebp - 4], 0
mov dword [ebp - 0x2b0], 0x4b4548
mov byte [ebp - 0x2ac], 0
call fcn.0044c61d
add esp, 4
test eax, eax
jne 0x4452fe
cmp dword [0x4b4574], 0x7fffffff
je 0x445305
mov byte [ebp - 0x2ac], 1
mov dword [ebp - 0x2a8], 0x4b4528
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
mov byte [ebp - 4], 1
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4b4528
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2a0]
push eax
call fcn.00441ed0
mov eax, dword [eax + 4]
test eax, eax
je 0x4452b8
cmp eax, dword [0x4b452c]
je 0x4452b8
cmp dword [ebp + 0x2a8], 0
je 0x445204
lea eax, [ebp + 0x284]
mov ecx, 0x4b4528
push eax
lea eax, [ebp + 8]
push eax
call fcn.00448d00
mov ecx, eax
call fcn.00433820
lea eax, [ebp + 8]
mov ecx, 0x4b4528
push eax
call fcn.00448d00
mov dword [ebp - 0x530], 2
lea esi, [ebp + 0xc]
mov ecx, 0x9e
mov dword [ebp - 0x298], eax
lea edi, [ebp - 0x528]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xa0
lea esi, [ebp - 0x530]
lea edi, [ebp - 0x290]
rep movsd dword es:[edi], dword [esi]
push 0x288
call fcn.0046425d
add esp, 4
test eax, eax
je 0x445267
mov ecx, 0xa2
lea esi, [ebp - 0x298]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x445269
xor eax, eax
mov dword [ebp - 0x2a4], eax
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x442100
push 0
push 0
call fcn.00474e52
add esp, 0x18
mov dword [ebp - 0x2a0], eax
test eax, eax
je 0x44531d
mov ecx, dword [ebp - 0x29c]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x445316
push ecx
push eax
call fcn.0044ca6e
add esp, 8
test eax, eax
jne 0x445316
push 0x4b4548
call fcn.0044c62e
mov ecx, dword [ebp + 0x2a8]
add esp, 4
test ecx, ecx
je 0x4452e3
mov edx, dword [ecx]
lea eax, [ebp + 0x284]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046429b
mov esp, ebp
pop ebp
ret
push 5
call fcn.0044c8a5
push 6
mov dword [0x4b4574], 0x7ffffffe
call fcn.0044c8a5
push 1
call fcn.0044c8a5
push 6
mov dword [ebp - 0x29c], 0
call fcn.0044c8a5
int3
Function at 0x446750
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48fa4c
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4af280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 4], 0
call fcn.00444790
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x446826
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0044a3d0
add esp, 8
push 0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
push eax
push str.LUNA_VNR_HOOKMAN_
push ecx
call fcn.00441840
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.00442b10
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 2
test eax, eax
je 0x4467e0
cmp eax, 0xffffffff
je 0x4467e0
push eax
call dword [0x4942c8]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0040a160
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x446863
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x10
movups xmmword [ecx], xmm0
push str.already_injected
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00412350
call fcn.004445e0
add esp, 0x18
mov ecx, dword [ebp + 0x20]
cmp ecx, 7
jbe 0x446900
mov edx, dword [ebp + 0xc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4468f6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44691a
jmp 0x4468f6
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], esi
push eax
lea ecx, [ebp - 0x28]
call fcn.00408ab0
push 0x1c
mov byte [ebp - 4], 3
call fcn.0046425d
mov esi, eax
add esp, 4
mov dword [ebp - 0x38], esi
mov byte [ebp - 4], 4
test esi, esi
je 0x4468a0
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov dword [esi], ecx
lea ecx, [esi + 4]
push eax
call fcn.00408ab0
jmp 0x4468a2
xor esi, esi
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 5
push eax
push 0
push esi
push 0x442200
push 0
push 0
call fcn.00474e52
add esp, 0x18
mov dword [ebp - 0x34], eax
test eax, eax
je 0x446926
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 4], 6
test ecx, ecx
je 0x44691f
push ecx
push eax
call fcn.0044ca6e
add esp, 8
test eax, eax
jne 0x44691f
xorps xmm0, xmm0
lea ecx, [ebp - 0x2c]
movlpd qword [ebp - 0x34], xmm0
call fcn.0043b110
jmp 0x446826
push ecx
push edx
call fcn.0046428d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046429b
mov esp, ebp
pop ebp
ret
call fcn.00469c3f
push 1
call fcn.0044c8a5
push 6
mov dword [ebp - 0x30], 0
call fcn.0044c8a5
int3
Function at 0x446940
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48faa6
mov eax, dword fs:[0]
push eax
mov eax, 0x1444
call fcn.004646c0
mov eax, dword [0x4af280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4b4548
mov dword [ebp - 0xa40], 0x4b4548
mov byte [ebp - 0xa3c], 0
call fcn.0044c61d
add esp, 4
test eax, eax
jne 0x446af3
cmp dword [0x4b4574], 0x7fffffff
je 0x446afa
mov byte [ebp - 0xa3c], 1
mov dword [ebp - 0xa38], 0x4b4528
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4b4528
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.00441ed0
mov eax, dword [eax + 4]
test eax, eax
je 0x446acb
cmp eax, dword [0x4b452c]
je 0x446acb
lea eax, [ebp + 8]
mov ecx, 0x4b4528
push eax
call fcn.00448d00
mov dword [ebp - 0x1450], 0
lea esi, [ebp + 0xc]
mov ecx, 0x282
mov dword [ebp - 0xa28], eax
lea edi, [ebp - 0x1448]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x284
lea esi, [ebp - 0x1450]
lea edi, [ebp - 0xa20]
rep movsd dword es:[edi], dword [esi]
push 0xa18
call fcn.0046425d
add esp, 4
test eax, eax
je 0x446a7e
mov ecx, 0x286
lea esi, [ebp - 0xa28]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x446a80
xor eax, eax
mov dword [ebp - 0xa34], eax
lea ecx, [ebp - 0xa2c]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x4421c0
push 0
push 0
call fcn.00474e52
add esp, 0x18
mov dword [ebp - 0xa30], eax
test eax, eax
je 0x446b12
mov ecx, dword [ebp - 0xa2c]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x446b0b
push ecx
push eax
call fcn.0044ca6e
add esp, 8
test eax, eax
jne 0x446b0b
push 0x4b4548
call fcn.0044c62e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046429b
mov esp, ebp
pop ebp
ret
push 5
call fcn.0044c8a5
push 6
mov dword [0x4b4574], 0x7ffffffe
call fcn.0044c8a5
push 1
call fcn.0044c8a5
push 6
mov dword [ebp - 0xa2c], 0
call fcn.0044c8a5
int3
Function at 0x446c70
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48fb1d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4af280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4b4548
mov dword [ebp - 0x2c], 0x4b4548
mov byte [ebp - 0x28], 0
call fcn.0044c61d
add esp, 4
test eax, eax
jne 0x446dda
cmp dword [0x4b4574], 0x7fffffff
je 0x446de1
mov byte [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x4b4528
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4b4528
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00441ed0
mov eax, dword [eax + 4]
test eax, eax
je 0x446dbe
cmp eax, dword [0x4b452c]
je 0x446dbe
lea eax, [ebp + 8]
mov ecx, 0x4b4528
push eax
call fcn.00448d00
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
movups xmm0, xmmword [ebp - 0x20]
push 0x18
mov dword [ebp - 0x44], eax
movups xmmword [ebp - 0x3c], xmm0
call fcn.0046425d
add esp, 4
test eax, eax
je 0x446d7d
movups xmm0, xmmword [ebp - 0x44]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x34]
movq qword [eax + 0x10], xmm0
jmp 0x446d7f
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x442180
push 0
push 0
call fcn.00474e52
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x446df9
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x446df2
push ecx
push eax
call fcn.0044ca6e
add esp, 8
test eax, eax
jne 0x446df2
push 0x4b4548
call fcn.0044c62e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 5
call fcn.0044c8a5
push 6
mov dword [0x4b4574], 0x7ffffffe
call fcn.0044c8a5
push 1
call fcn.0044c8a5
push 6
mov dword [ebp - 0x14], 0
call fcn.0044c8a5
int3
Function at 0x447990
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48fcd0
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x4af280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x496740
push str.kernel32.dll
push ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], 0
call fcn.00445330
push edx
push eax
push ebx
call fcn.00445630
mov ecx, dword [0x4b43b0]
mov dword [ebp - 0x458], eax
or eax, edx
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0xffffffff
mov dword [ebp - 0x448], ecx
jne 0x447adc
test ebx, ebx
mov eax, ebx
cmove eax, dword [0x4b43ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x447aa2
push 0x424
lea eax, [ebp - 0x434]
mov dword [ebp - 0x438], 0x428
push 0
push eax
call fcn.00466560
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x447a9b
lea eax, [ebp - 0x418]
push str.kernel32.dll
push eax
call fcn.00475034
add esp, 8
test eax, eax
je 0x447aff
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x447a72
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movlpd qword [ebp - 0x440], xmm0
mov eax, dword [ebp - 0x440]
mov edx, dword [ebp - 0x43c]
push 0x496740
push edx
push eax
push ebx
call fcn.00445ac0
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x448], 0
cmp dword [edi + 0x14], 7
mov dword [ebp - 4], 0
jbe 0x447aeb
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x460]
call fcn.00441950
or eax, edx
je 0x447b0f
mov bl, 1
jmp 0x447b11
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x41c]
cdq
jmp 0x447ab9
xor bl, bl
mov esi, dword [ebp - 0x45c]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x447b57
mov edx, dword [esi + 8]
mov eax, edx
mov ecx, dword [esi + 0xc]
or eax, ecx
mov dword [ebp - 4], 1
je 0x447b4c
cmp dword [esi], 0
je 0x447b4c
push 0x4000
push dword [esi + 0x10]
push ecx
push edx
push dword [esi + 4]
call fcn.00447d10
push 0x18
push esi
call fcn.0046428d
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046429b
mov esp, ebp
pop ebp
ret
Function at 0x44c373
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x44c39a
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x44c39d
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0044c34f
pop esi
leave
ret 8

Function at 0x44fca9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x455ef3
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x455f01
mov eax, edx
xor edx, edx
div dword [ebp + 0xc]
pop esi
mov eax, edx
pop ebp
ret

Function at 0x45bf97
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b8a0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4af280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov ebx, str.advapi32.dll
push 0x800
push eax
push ebx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x45c009
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x45c091
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x45c091
push str.RegisterTraceGuidsW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00450019
mov dword [esp], str.UnregisterTraceGuids
push edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00450019
mov dword [esp], str.TraceEvent
push edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00450019
mov dword [esp], str.GetTraceLoggerHandle
push edi
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00450019
mov dword [esp], str.GetTraceEnableLevel
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00450019
mov dword [esp], str.GetTraceEnableFlags
push edi
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00450019
pop ecx
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47bac0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047b75b

Function at 0x47bacb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047b8ea

Function at 0x47d8da
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49bd84
push 0x49bd7c
push str.FlsAlloc
push 0x1e
call fcn.0047d764
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47d90e
push dword [ebp + 8]
mov ecx, esi
call dword [0x492388]
call esi
jmp 0x47d914
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x47d958
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49bd94
push 0x49bd8c
push str.FlsGetValue
push 0x20
call fcn.0047d764
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47d98f
push dword [ebp + 8]
mov ecx, esi
call dword [0x492388]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x102f6058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.102f61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x102f607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102f606a
add dl, dl
jne 0x102f6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102f60dc
xor eax, eax
add dl, dl
jne 0x102f6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102f617d
add dl, dl
jne 0x102f60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102f60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102f60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102f60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x102f60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x102f6075
mov eax, 1
add dl, dl
jne 0x102f60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102f60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102f60e1
sub eax, ebx
mov ebx, 1
jne 0x102f6128
mov ecx, 1
add dl, dl
jne 0x102f610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x102f6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102f6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102f6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x102f613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x102f614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102f6136
cmp eax, 0x7d00
jae 0x102f616d
cmp eax, 0x500
jb 0x102f6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102f6075
cmp eax, 0x7f
ja 0x102f6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102f6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x102f619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x102f6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x100018b0
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24cc
call fcn.100b2020
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp loc.1026d209

Function at 0x10003450
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push esi
mov esi, dword [0x10148b80]
cmp byte [esi + 0x30d5c], 0
jne 0x10003596
mov ecx, dword [ebp + 8]
lea eax, [esi + 4]
push eax
mov eax, dword [0x1012f57c]
mov dword [esi], ecx
push ecx
mov eax, dword [eax + 0x528]
call eax
mov edx, dword [esi]
push 0
mov eax, dword [edx]
mov ecx, dword [eax + 0x5c]
lea eax, [esi + 0xc]
push eax
push 0
push 0x15
push 1
push 1
push 0x200
push 0x200
push edx
call ecx
test eax, eax
je 0x10003540
movaps xmm0, xmmword [0x100ed4f0]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], 0x4552480a
push eax
movups xmmword [ebp - 0x30], xmm0
lea eax, [ebp - 0x24c]
mov dword [ebp - 0xc], 0x544c5553
movaps xmm0, xmmword [str._render_target._rSFF__s__d.sff___s_r_nErrorID:___d._r_nRequested_ScrItemListInfo_Could_not_load__SFF_scr__d.sffHeadersCanvas1.DonationCanvas1DonationCanvas2CPortalUI_Tier::CItemsPreviews::_font._r_nHRESULT:]
push eax
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x3025203a
mov word [ebp - 4], 0x5838
mov byte [ebp - 2], 0
call fcn.10003fa0
movaps xmm0, xmmword [0x100ed680]
lea eax, [ebp - 0x58]
add esp, 0xc
mov byte [ebp - 0x38], 0
movups xmmword [ebp - 0x58], xmm0
movaps xmm0, xmmword [0x100ed500]
push 0x50010
push eax
lea eax, [ebp - 0x24c]
push eax
push 0
movups xmmword [ebp - 0x48], xmm0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esi + 8]
push eax
mov eax, dword [0x10129a90]
push str.Arial
push 0
push 5
lea ecx, [eax*8]
sub ecx, eax
mov eax, 0x38e38e39
neg ecx
push 0
add ecx, ecx
imul ecx
push 1
push 0
push 1
sar edx, 4
push 0x2bc
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0
push eax
mov eax, dword [0x1012f57c]
push dword [esi]
mov eax, dword [eax + 0x530]
call eax
mov byte [esi + 0x30d5c], 1
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10003630
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push esi
mov esi, dword [0x10148b80]
cmp byte [esi + 0x30d5c], 0
jne 0x10003650
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1000365d
mov eax, dword [ecx]
push ecx
call dword [eax + 0x34]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1000366a
mov eax, dword [ecx]
push ecx
call dword [eax + 0x44]
mov edx, dword [esi]
push 0
mov eax, dword [edx]
mov ecx, dword [eax + 0x5c]
lea eax, [esi + 0xc]
push eax
push 0
push 0x15
push 1
push 1
push 0x200
push 0x200
push edx
call ecx
test eax, eax
je 0x1000364b
movaps xmm0, xmmword [0x100ed4f0]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], 0x4552480a
push eax
movups xmmword [ebp - 0x30], xmm0
lea eax, [ebp - 0x24c]
mov dword [ebp - 0xc], 0x544c5553
movaps xmm0, xmmword [str._render_target._rSFF__s__d.sff___s_r_nErrorID:___d._r_nRequested_ScrItemListInfo_Could_not_load__SFF_scr__d.sffHeadersCanvas1.DonationCanvas1DonationCanvas2CPortalUI_Tier::CItemsPreviews::_font._r_nHRESULT:]
push eax
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x3025203a
mov word [ebp - 4], 0x5838
mov byte [ebp - 2], 0
call fcn.10003fa0
movaps xmm0, xmmword [0x100ed680]
lea eax, [ebp - 0x58]
add esp, 0xc
mov byte [ebp - 0x38], 0
movups xmmword [ebp - 0x58], xmm0
movaps xmm0, xmmword [0x100ed500]
push 0x50010
push eax
lea eax, [ebp - 0x24c]
push eax
push 0
movups xmmword [ebp - 0x48], xmm0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000b9d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x600
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp loc.102abb13

Function at 0x1000c730
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp loc.1028e585

Function at 0x1000cc70
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f54
call fcn.100b2020
mov dword [ebp - 0x10], ecx
push 0x100e8a8e
jmp loc.1027e8a4

Function at 0x1000e620
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov dword [ebp - 0x50], ecx
push 0x100e8a8e
jmp loc.1026608b