joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100701b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c6e6c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push 0x40
call fcn.100c27e9
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
lea ecx, [esi + 4]
mov dword [esi], vtable.CSVCMsg_GameEvent_key_t.0
call fcn.10097c70
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x34], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0x100ec018
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x20], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0x100ec018
mov dword [esi + 0x38], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10078740
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c6cfc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
mov eax, dword [edi + 8]
cmp ecx, eax
jge 0x1007877e
mov eax, dword [edi]
mov eax, dword [eax + ecx*4]
inc ecx
mov dword [edi + 4], ecx
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0xc]
cmp eax, ecx
jne 0x10078793
lea eax, [ecx + 1]
mov ecx, edi
push eax
call fcn.10091080
mov eax, dword [edi + 8]
push esi
inc eax
push 0x34
mov dword [edi + 8], eax
call fcn.100c27e9
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
lea ecx, [esi + 4]
mov dword [esi], vtable.CSVCMsg_SendTable_sendprop_t.0
call fcn.10097c70
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0x100ec018
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0x100ec018
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [eax + ecx*4], esi
mov eax, esi
inc dword [edi + 4]
mov ecx, dword [ebp - 0xc]
pop esi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10078830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c6e6c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
mov eax, dword [edi + 8]
cmp ecx, eax
jge 0x1007886e
mov eax, dword [edi]
mov eax, dword [eax + ecx*4]
inc ecx
mov dword [edi + 4], ecx
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0xc]
cmp eax, ecx
jne 0x10078883
lea eax, [ecx + 1]
mov ecx, edi
push eax
call fcn.10091080
mov eax, dword [edi + 8]
push esi
inc eax
push 0x40
mov dword [edi + 8], eax
call fcn.100c27e9
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
lea ecx, [esi + 4]
mov dword [esi], vtable.CSVCMsg_GameEvent_key_t.0
call fcn.10097c70
mov dword [esi + 0x34], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0x100ec018
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x20], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0x100ec018
mov dword [esi + 0x38], 0
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [eax + ecx*4], esi
mov eax, esi
inc dword [edi + 4]
mov ecx, dword [ebp - 0xc]
pop esi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100792b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [eax]
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100792c0
sub ecx, edx
mov esi, 0x811c9dc5
mov edx, 0
je 0x100792e6
movzx eax, byte [edx + edi]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x100792d5
and esi, 0x7fffffff
xor edx, edx
mov eax, esi
mov ecx, 0x1f31d
div ecx
pop edi
imul eax, eax, 0xb14
imul ecx, edx, 0x41a7
pop esi
sub ecx, eax
lea eax, [ecx + 0x7fffffff]
cmovns eax, ecx
pop ebp
ret 4
Function at 0x1007c8b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c760d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100ec084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::DescriptorProto.0
call fcn.10097c70
mov dword [esi + 0xc], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x60], 0
mov dword [esi + 8], 0x100ec018
mov dword [esi + 0x5c], 0
mov dword [esi + 0x64], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1007cd90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c760d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100ec084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::FileDescriptorProto.0
call fcn.10097c70
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x80], 0
mov dword [esi + 8], 0x100ec018
mov dword [esi + 0xc], 0x100ec018
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x84], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007d340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c760d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100ec084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::SourceCodeInfo_Location.0
call fcn.10097c70
mov dword [esi + 8], 0
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x28], 0x100ec018
mov dword [esi + 0x2c], 0x100ec018
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1007d3e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c760d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100ec084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
call fcn.10097c70
mov dword [esi + 8], 0
xorps xmm0, xmm0
mov dword [esi + 0xc], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x18], 0x100ec018
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
movsd qword [esi + 0x30], xmm0
mov dword [esi + 0x38], 0x100ec018
mov dword [esi + 0x3c], 0x100ec018
mov dword [esi + 0x44], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1009b550
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8fcb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100ec084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [edi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 1
push 0x14
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100c27e9
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x44], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0xf
mov byte [edi + 0x48], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1009c7a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0x10
jb 0x1009c7b0
mov esi, dword [esi]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1009c7b5
sub ecx, edx
mov edi, 0x811c9dc5
mov edx, 0
je 0x1009c7e1
nop word [eax + eax]
movzx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1009c7d0
and edi, 0x7fffffff
xor edx, edx
mov eax, edi
mov ecx, 0x1f31d
div ecx
pop edi
imul eax, eax, 0xb14
imul ecx, edx, 0x41a7
pop esi
sub ecx, eax
lea eax, [ecx + 0x7fffffff]
cmovns eax, ecx
pop ebp
ret 4
Function at 0x100a6710
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0x10
jb 0x100a6723
mov esi, dword [esi]
lea ebx, [ecx + 0xa4]
mov dword [ebp + 8], esi
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100a6731
push edi
sub ecx, edx
mov edi, 0x811c9dc5
mov edx, 0
je 0x100a6758
movzx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100a6747
and edi, 0x7fffffff
xor edx, edx
mov ecx, 0x1f31d
mov eax, edi
div ecx
imul eax, eax, 0xb14
imul ecx, edx, 0x41a7
sub ecx, eax
lea eax, [ecx + 0x7fffffff]
cmovns eax, ecx
mov ecx, ebx
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10078b30
pop edi
mov eax, dword [eax + 4]
test eax, eax
je 0x100a67a8
cmp eax, dword [ebx + 8]
je 0x100a67a8
mov eax, dword [eax + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100a6ad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x14], 0x10
jb 0x100a6ae3
mov esi, dword [esi]
lea ebx, [ecx + 0x80]
mov dword [ebp + 0xc], esi
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100a6af1
push edi
sub ecx, edx
mov edi, 0x811c9dc5
mov edx, 0
je 0x100a6b18
movzx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100a6b07
and edi, 0x7fffffff
xor edx, edx
mov ecx, 0x1f31d
mov eax, edi
div ecx
imul eax, eax, 0xb14
imul ecx, edx, 0x41a7
sub ecx, eax
lea eax, [ecx + 0x7fffffff]
cmovns eax, ecx
mov ecx, ebx
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10078b30
pop edi
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x100a6b5d
mov esi, dword [ebx + 8]
jmp 0x100a6b62
mov ecx, dword [ebx + 8]
mov esi, ecx
xor edx, edx
lea eax, [ecx + 0xc]
cmp ecx, esi
pop esi
cmovne edx, eax
mov eax, dword [ebp + 8]
pop ebx
test edx, edx
jne 0x100a6b8c
mov ecx, dword [0x100ee540]
mov edx, dword [0x100ee544]
mov dword [eax + 4], edx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [eax + 4], edx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x855ac8
Capabilities:
Encode data using xor

Disassembly:
popfd
fcomp qword [edi - 0x21]
loope 0x855ae9
pop ebp
test eax, 0xa55b7d8c
idiv byte [eax + esi*8]
mov eax, dword [0x7aec9ea7]
cmpsb byte [esi], byte es:[edi]
je 0x855ad6
add byte [eax], al
add bl, ch
jmp 0x855ad2
add byte [edx + 7], bh
jmp 0x855ad2
add byte [eax], al
add byte [eax], al
add byte [eax - 0x18], ah
pushal
call 0x855ad8
add byte [eax], al
add byte [eax], al
pop ebp
sub ebp, 0x10
sub ebp, 0x455ac8
jmp 0x855aee
add byte [edi + ebp*4 + 0x48], cl
aam 0xb8
enter 0x455a, 0
mov eax, 0x455ac8
add eax, ebp
add eax, 0x4c
mov ecx, 0x609
mov edx, 0xbe6aa8a
xor byte [eax], dl
inc eax
dec ecx
jne 0x855b05
jmp 0x855b18
add dword [edi + 1], eax
add esi, dword [esi + 0xb8a8a8a]
dec ebx
jb 0x855aae
mov cl, byte [edx - 0x71cdb877]
mov cl, byte [edx - 0x755dcf76]
mov cl, byte [edx + 0x4289687d]
add dword [ebx], ecx
xchg byte [edx + 0x4f898a8a], cl
pop es
out dx, al
scasb al, byte es:[edi]
jbe 0x855b46
mov gs, word [esi + 0x76aeee07]
add ecx, dword [esi + 0x2d6e2ae]
test byte [edx - 0x43a71c1e], cl
out dx, al
scasb al, byte es:[edi]
jbe 0x855b4d
mov gs, word [esi - 0x7bfd291e]
mov ah, dl
jecxz 0x855bac
salc
add al, byte [edx + ecx*4 - 0x43a71c1e]
mov esp, 0xaea68b8a
loop 0x855bcb
mov cl, byte [ebx + 0x70e2aea6]
sub al, 0xfe
wait
bound ecx, qword [edi + 0x638a8a8a]
mov edx, 0x78a8a8a
out dx, al
scasb al, byte es:[edi]
jbe 0x855b70
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
pop es
out 0xae, al
mov al, byte [ecx]
jb 0x20fe604
pop ds
xchg byte [edx + 0x7018a8a], cl
lcall 0x8863, 0x4b8a8a8a
mov ebx, 0x8e480988
ret
invalid
mov cl, byte [edx - 0x757dc8ff]
mov cl, byte [edx + 0x780b43b9]
out dx, eax
scasb al, byte es:[edi]
sub al, 0xa7
or edi, dword [eax - 0x11]
scasb al, byte es:[edi]
sub al, 0xa7
mov ecx, 0x8f620958
ret 0xe85
Function at 0x1001113
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001080
call fcn.01001338
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x100114e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100114e
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1001166
cmp eax, 0x20b
je 0x1001153
mov dword [ebp - 0x1c], edi
jmp 0x100117a
cmp dword [ecx + 0x84], 0xe
jbe 0x100114e
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1001174
cmp dword [ecx + 0x74], 0xe
jbe 0x100114e
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1002018], 0xffffffff
or dword [0x100201c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1002014]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1002010]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1002020], eax
call fcn.01001330
cmp dword [section..data], edi
jne 0x10011d7
push fcn.01001330
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01001319
push 0x1001058
push 0x1001054
call sub.msvcrt.dll__initterm
mov eax, dword [0x100200c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1002008]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x38], eax
push 0x1001050
push 0x100104c
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x100123d
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x10012f7
mov dword [ebp - 0x20], esi
cmp word [esi], 0x22
jne 0x100128b
add esi, ebx
mov dword [ebp - 0x20], esi
mov ax, word [esi]
cmp ax, di
je 0x1001259
cmp ax, 0x22
jne 0x1001246
cmp word [esi], 0x22
jne 0x1001264
add esi, ebx
mov dword [ebp - 0x20], esi
mov ax, word [esi]
cmp ax, di
je 0x1001272
cmp ax, 0x20
jbe 0x100125f
mov dword [ebp - 0x54], edi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x54], 1
je 0x1001298
movzx eax, word [ebp - 0x50]
jmp 0x100129b
cmp word [esi], 0x20
jbe 0x1001264
add esi, ebx
mov dword [ebp - 0x20], esi
jmp 0x100128b
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], edi
jne 0x10012bc
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x10012f1
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01001373
ret
Function at 0x4070c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00406dcc
mov dl, 0xb8
or al, 0x68
lea eax, [ebp - 0x40]
push eax
call fcn.00406ddc
push eax
push esi
push dword [ebp + 8]
call fcn.00406d91
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00406dcc
neg dword [ecx + 0x458d3336]
call 0x5128cec2
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00406ddc
push eax
push esi
push dword [ebp + 8]
call fcn.00406d91
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00406ddc
push eax
push esi
push dword [ebp + 8]
call fcn.00406d91
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00406ddc
push eax
push esi
push dword [ebp + 8]
call fcn.00406d91
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00406dcc
js 0x4071f2
fldenv [eax + ecx*4]
popfd
jl 0x407251
invalid
invalid
Function at 0x407aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x398], 0
je 0x407ac0
cmp dword [ebp - 0x398], 0
je 0x407c8a
cmp dword [ebp + 0xc], 1
je 0x407c8a
cmp dword [ebp + 0xc], 8
jne 0x407c52
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.00406ddc
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00406d91
or eax, 0x83fffff2
les ecx, [ecx + ecx*4]
test dword [eax - 7], esi
invalid
inc esi
test dword [eax - 7], esp
invalid
dec dword [ebx - 0x69e7280]
invalid
invalid
inc esi
test dword [edx - 7], esp
invalid
call dword [ebp - 0x3a]
test dword [ebx - 7], esp
invalid
dec dword [ebx - 0x69b7a3a]
invalid
invalid
in al, dx
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.00406dcc
scasb al, byte es:[edi]
cmp edi, dword [esp]
push dword [ebp - 0x698]
lea eax, [ebp - 0x6c0]
push eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00406fa8
add esp, 0x14
call fcn.00406dcc
xlatb
retf
call fcn.00406dcc
fidiv dword [ebx - 0x21]
dec edi
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.00406dcc
and eax, 0x8064d1ad
movsd dword es:[edi], dword [esi]
sar ch, 1
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00406daa
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
invalid
movsd dword es:[edi], dword [esi]
xchg ebp, eax
cld