joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x8627a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2e6000]
push edi
or ebp, 0xffffffff
jmp 0x8627c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8627c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8627b8
mov eax, 1
add ebx, ebx
jne 0x8627db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8627ec
jne 0x86280b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x86280b
dec eax
add ebx, ebx
jne 0x8627f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8627d0
add ebx, ebx
jne 0x862807
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x86285d
xor ecx, ecx
sub eax, 3
jb 0x862823
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x862892
sar eax, 1
mov ebp, eax
jmp 0x86282e
add ebx, ebx
jne 0x86282e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8627fc
inc ecx
add ebx, ebx
jne 0x86283c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8627fc
add ebx, ebx
jne 0x862849
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x86283e
jne 0x86285a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x86283e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x86287c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x86286e
jmp 0x8627be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x86287c
add edi, ecx
jmp 0x8627be
pop esi
mov edi, esi
mov ecx, 0x1154b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x86289a
cmp byte [edi], 0x7a
jne 0x86289a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x86289f
lea edi, [esi + 0x45d000]
mov eax, dword [edi]
or eax, eax
je 0x86290e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x46b50c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x46b674]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8628cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x46b678]
or eax, eax
je 0x862908
mov dword [ebx], eax
add ebx, 4
jmp 0x8628e9
call dword [esi + 0x46b688]
mov ebp, dword [esi + 0x46b67c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x862942
sub esp, 0xffffff80
jmp 0x666f14
Function at 0x13cba00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0xee9015
lea edi, [esi - 0xae8015]
push edi
or ebp, 0xffffffff
jmp 0x13cba22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x13cba29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13cba18
mov eax, 1
add ebx, ebx
jne 0x13cba3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x13cba4c
jne 0x13cba6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13cba6b
dec eax
add ebx, ebx
jne 0x13cba58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x13cba30
add ebx, ebx
jne 0x13cba67
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x13cbabd
xor ecx, ecx
sub eax, 3
jb 0x13cba83
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x13cbaf2
sar eax, 1
mov ebp, eax
jmp 0x13cba8e
add ebx, ebx
jne 0x13cba8e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13cba5c
inc ecx
add ebx, ebx
jne 0x13cba9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13cba5c
add ebx, ebx
jne 0x13cbaa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x13cba9e
jne 0x13cbaba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x13cba9e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x13cbadc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x13cbace
jmp 0x13cba1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x13cbadc
add edi, ecx
jmp 0x13cba1e
pop esi
mov edi, esi
mov ecx, 0x214df
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x13cbafa
cmp byte [edi], 0x4a
jne 0x13cbafa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x13cbaff
lea edi, [esi + 0xfa0000]
mov eax, dword [edi]
or eax, eax
je 0x13cbb6e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xfcb000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xfcb028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x13cbb2c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xfcb030]
or eax, eax
je 0x13cbb68
mov dword [ebx], eax
add ebx, 4
jmp 0x13cbb49
call dword [esi + 0xfcb02c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x13cbba8
cmp al, 0xef
ja 0x13cbb92
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x13cbb74
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
or eax, eax
jne 0x13cbb81
mov eax, dword [edi]
add edi, 4
jmp 0x13cbb81
mov ebp, dword [esi + 0xfcb034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x13cbbdc
sub esp, 0xffffff80
jmp 0x46e350
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40645d
pop dword [ebp - 0x1c]
mov eax, 0x40645d
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xcb4f14b4
add dword [ebp - 0x2c], 0x83033097
mov dword [ebp - 0x28], 0x957e0cbe
sub dword [ebp - 0x28], 0x634ac079
mov dword [ebp - 0x24], 0x2b14121a
sub dword [ebp - 0x24], 0xdec7cdec
mov dword [ebp - 0x20], 0x7d487b46
add dword [ebp - 0x20], 0x82b784ba
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x5442e13
add dword [ebp - 0x2c], 0x6f2e3b43
mov dword [ebp - 0x28], 0x31241dbd
sub dword [ebp - 0x28], 0xefb7bc48
mov dword [ebp - 0x24], 0x4a1a4775
sub dword [ebp - 0x24], 0xe6aadb09
mov dword [ebp - 0x20], 0x7d736f05
sub dword [ebp - 0x20], 0x7d736f05
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x929b1751
add eax, 0x6da5692b
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x33d6b
push 0
call eax
mov ecx, 0x3b25
xor edi, edi
add edi, eax
mov edx, 0x459200
add edx, dword [ebp - 0x1c]
mov esi, 0xeb4e73c7
mov dword [ebp - 0xc], 0x28fd28b0
mov ebx, dword [edx]
add dword [ebp - 4], 0xfeb90685
xor ebx, esi
sub dword [ebp - 0x18], eax
mov dword [edi], ebx
mov dword [ebp - 0x10], 0x46dc8e93
add edi, 0x9253dd6c
add edi, 0x6dac2298
add edx, 4
loop 0x406565
add eax, 0xdf67
mov ebx, eax
add eax, 0x117e946
add eax, 0xfee816bf
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x401810
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00401d70
call sym.___main
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x401848
jmp 0x4018e6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x401847
cmp cl, 0x22
je 0x4018a0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x4018c0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x4018c0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x401880
jmp 0x4018c0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x4018a0
cmp cl, 0x22
je 0x401922
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x4018e0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x4018d0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x401904
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x4018c0

Function at 0x4020a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x10003890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov al, 0x45
mov cl, 0x6c
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov al, 0x4c
mov byte [esp + 0x1a], cl
mov byte [esp + 0x15], al
mov byte [esp], al
mov byte [esp + 4], al
mov byte [esp + 0x1b], cl
mov al, 0x72
mov cl, 0x61
push ebp
mov byte [esp + 0xb], al
mov byte [esp + 0xd], al
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov byte [esp + 0xa], cl
mov byte [esp + 0x10], cl
lea eax, [esp + 8]
push edi
lea ecx, [esp + 0x1c]
mov dl, 0x64
push eax
push ecx
mov byte [esp + 0x24], 0x4b
mov byte [esp + 0x26], 0x52
mov byte [esp + 0x27], 0x4e
mov byte [esp + 0x2a], 0x33
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x2c], 0x2e
mov byte [esp + 0x2d], dl
mov byte [esp + 0x30], 0
mov byte [esp + 0x15], 0x6f
mov byte [esp + 0x17], dl
mov byte [esp + 0x19], 0x69
mov byte [esp + 0x1a], 0x62
mov byte [esp + 0x1e], 0x79
mov byte [esp + 0x1f], 0x41
mov byte [esp + 0x20], 0
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
mov edi, eax
mov eax, dword [esp + 0x30]
test eax, eax
je 0x1000394b
mov edx, dword [esp + 0x38]
push edx
push eax
call ebp
pop edi
pop esi
pop ebp
add esp, 0x20
ret
mov eax, dword [esp + 0x34]
push eax
call esi
test eax, eax
jne 0x10003961
mov ecx, dword [esp + 0x34]
push ecx
call edi
test eax, eax
je 0x10003970
mov edx, dword [esp + 0x38]
push edx
push eax
call ebp
pop edi
pop esi
pop ebp
add esp, 0x20
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x10003980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x38
mov al, 0x45
push ebx
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov al, 0x73
push esi
mov byte [esp + 0x38], al
mov byte [esp + 0x39], al
lea eax, [esp + 0x30]
push edi
lea ecx, [esp + 0x24]
push eax
mov bl, 0x65
push ecx
push 0
mov byte [esp + 0x30], 0x4b
mov byte [esp + 0x32], 0x52
mov byte [esp + 0x33], 0x4e
mov byte [esp + 0x35], 0x4c
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], 0x6c
mov byte [esp + 0x3c], 0
mov byte [esp + 0x40], 0x47
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x74
mov byte [esp + 0x43], 0x50
mov byte [esp + 0x44], 0x72
mov byte [esp + 0x45], 0x6f
mov byte [esp + 0x46], 0x63
mov byte [esp + 0x47], bl
mov byte [esp + 0x4a], 0x48
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], 0x61
mov byte [esp + 0x4d], 0x70
mov byte [esp + 0x4e], 0
call fcn.10003890
mov esi, eax
lea edx, [esp + 0x24]
lea eax, [esp + 0x30]
push edx
push eax
push 0
mov byte [esp + 0x30], 0x48
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x61
mov byte [esp + 0x33], 0x70
mov byte [esp + 0x34], 0x52
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x41
mov byte [esp + 0x37], 0x6c
mov byte [esp + 0x38], 0x6c
mov byte [esp + 0x39], 0x6f
mov byte [esp + 0x3a], 0x63
mov byte [esp + 0x3b], 0
call fcn.10003890
lea ecx, [esp + 0x24]
lea edx, [esp + 0x3c]
push ecx
push edx
push 0
mov edi, eax
mov byte [esp + 0x30], 0x48
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x61
mov byte [esp + 0x33], 0x70
mov byte [esp + 0x34], 0x41
mov byte [esp + 0x35], 0x6c
mov byte [esp + 0x36], 0x6c
mov byte [esp + 0x37], 0x6f
mov byte [esp + 0x38], 0x63
mov byte [esp + 0x39], 0
call fcn.10003890
mov ebx, eax
mov eax, dword [esp + 0x6c]
add esp, 0x24
test eax, eax
je 0x10003ad4
mov ecx, dword [esp + 0x4c]
push ecx
push eax
push 0
call esi
push eax
call edi
pop edi
pop esi
pop ebx
add esp, 0x38
ret
mov edx, dword [esp + 0x4c]
push edx
push 0
call esi
push eax
call ebx
pop edi
pop esi
pop ebx
add esp, 0x38
ret
Function at 0x10003af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov al, 0x45
push ebx
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov al, 0x6c
push esi
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
mov al, 0x73
push edi
mov byte [esp + 0x30], al
mov byte [esp + 0x31], al
lea eax, [esp + 0x28]
lea ecx, [esp + 0x18]
push eax
mov bl, 0x65
push ecx
push 0
mov byte [esp + 0x24], 0x4b
mov byte [esp + 0x26], 0x52
mov byte [esp + 0x27], 0x4e
mov byte [esp + 0x29], 0x4c
mov byte [esp + 0x2a], 0x33
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x2c], 0x2e
mov byte [esp + 0x2d], 0x64
mov byte [esp + 0x30], 0
mov byte [esp + 0x34], 0x47
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], 0x50
mov byte [esp + 0x38], 0x72
mov byte [esp + 0x39], 0x6f
mov byte [esp + 0x3a], 0x63
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3e], 0x48
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 0x61
mov byte [esp + 0x41], 0x70
mov byte [esp + 0x42], 0
call fcn.10003890
mov esi, eax
lea edx, [esp + 0x18]
lea eax, [esp + 0x24]
push edx
push eax
push 0
mov byte [esp + 0x24], 0x48
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x61
mov byte [esp + 0x27], 0x70
mov byte [esp + 0x28], 0x46
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0
call fcn.10003890
mov ecx, dword [esp + 0x54]
add esp, 0x18
mov edi, eax
push ecx
push 0
call esi
push eax
call edi
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x10003e70
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
sub esp, 0x28
mov al, 0x45
push ebx
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov al, 0x6c
push ebp
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], al
mov byte [esp + 0x16], al
mov byte [esp + 0x18], al
mov byte [esp + 0x19], al
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
mov byte [esp + 0x2c], 0x4b
mov byte [esp + 0x2e], 0x52
mov byte [esp + 0x2f], 0x4e
mov byte [esp + 0x31], 0x4c
mov byte [esp + 0x32], 0x33
mov byte [esp + 0x33], 0x32
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x35], 0x64
mov byte [esp + 0x38], 0
mov byte [esp + 0x1c], 0x56
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x1e], 0x72
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], 0x75
mov byte [esp + 0x21], 0x61
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x26], 0x6f
mov byte [esp + 0x27], 0x63
mov byte [esp + 0x28], 0
call fcn.10003890
mov ebx, eax
mov eax, dword [esp + 0x48]
xor edx, edx
add esp, 0xc
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebp, [edx + eax + 0x18]
jbe 0x10003fcb
push esi
push edi
add ebp, 0x10
jmp 0x10003f3f
mov ecx, dword [esp + 0x14]
mov eax, dword [ebp]
test eax, eax
jne 0x10003f7a
mov eax, dword [esp + 0x40]
mov esi, dword [eax + 0x38]
test esi, esi
jle 0x10003fa9
mov edx, dword [ebp - 4]
push 4
push 0x1000
add edx, ecx
push esi
push edx
call ebx
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebp - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x10003fa9
push 4
push 0x1000
push eax
mov eax, dword [ebp - 4]
add eax, ecx
push eax
call ebx
mov ecx, dword [ebp]
mov esi, dword [ebp + 4]
mov edi, dword [esp + 0x3c]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 8], eax
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
inc eax
add ebp, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x10003f3b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x10003fe0
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
sub esp, 0x38
mov al, 0x45
push ebx
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
lea eax, [esp + 0x10]
push esi
lea ecx, [esp + 0x20]
push eax
mov bl, 0x74
push ecx
push 0
mov byte [esp + 0x2c], 0x4b
mov byte [esp + 0x2e], 0x52
mov byte [esp + 0x2f], 0x4e
mov byte [esp + 0x31], 0x4c
mov byte [esp + 0x32], 0x33
mov byte [esp + 0x33], 0x32
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x35], 0x64
mov byte [esp + 0x36], 0x6c
mov byte [esp + 0x37], 0x6c
mov byte [esp + 0x38], 0
mov byte [esp + 0x20], 0x56
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x72
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0x75
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], 0x6c
mov byte [esp + 0x27], 0x46
mov byte [esp + 0x28], 0x72
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], 0
call fcn.10003890
mov dword [esp + 0x14], eax
lea edx, [esp + 0x3c]
lea eax, [esp + 0x2c]
push edx
push eax
push 0
mov byte [esp + 0x48], 0x56
mov byte [esp + 0x49], 0x69
mov byte [esp + 0x4a], 0x72
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], 0x75
mov byte [esp + 0x4d], 0x61
mov byte [esp + 0x4e], 0x6c
mov byte [esp + 0x4f], 0x50
mov byte [esp + 0x50], 0x72
mov byte [esp + 0x51], 0x6f
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], 0x65
mov byte [esp + 0x54], 0x63
mov byte [esp + 0x55], bl
mov byte [esp + 0x56], 0
call fcn.10003890
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebx, ebx
add esp, 0x18
mov esi, dword [ecx]
mov dword [esp + 0xc], eax
mov dx, word [esi + 0x14]
cmp word [esi + 6], bx
lea eax, [edx + esi + 0x18]
jbe 0x1000418b
push ebp
push edi
lea ebp, [eax + 0x24]
mov eax, dword [ebp]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov edi, eax
and ecx, 1
and edx, 1
shr edi, 0x1f
test eax, 0x2000000
je 0x1000412b
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x1c]
jmp 0x10004171
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [edi + edx*2]
mov edi, dword [ecx*4 + 0x10139180]
je 0x10004145
or edi, 0x200
mov edx, dword [ebp - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x10004160
test al, 0x40
je 0x10004157
mov ecx, dword [esi + 0x20]
jmp 0x1000415e
test al, al
jns 0x10004171
mov ecx, dword [esi + 0x24]
test ecx, ecx
jbe 0x10004171
mov ecx, dword [ebp - 0x1c]
lea eax, [esp + 0x18]
push eax
push edi
push edx
push ecx
call dword [esp + 0x24]
mov edx, dword [esp + 0x4c]
xor eax, eax
inc ebx
add ebp, 0x28
mov esi, dword [edx]
mov ax, word [esi + 6]
cmp ebx, eax
jl 0x100040f9
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x38
ret
Function at 0x10004220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov al, 0x45
push ebx
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov al, 0x6c
mov cl, 0x52
push ebp
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
push esi
mov byte [esp + 0x1a], cl
mov byte [esp + 0x2d], cl
lea eax, [esp + 0x28]
push edi
lea ecx, [esp + 0x1c]
push eax
mov bl, 0x61
push ecx
push 0
mov byte [esp + 0x28], 0x4b
mov byte [esp + 0x2b], 0x4e
mov byte [esp + 0x2d], 0x4c
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], 0
mov byte [esp + 0x38], 0x49
mov byte [esp + 0x39], 0x73
mov byte [esp + 0x3a], 0x42
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0x64
mov byte [esp + 0x3e], 0x65
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 0x64
mov byte [esp + 0x41], 0x50
mov byte [esp + 0x42], 0x74
mov byte [esp + 0x43], 0x72
mov byte [esp + 0x44], 0
call fcn.10003890
mov ebp, eax
lea edx, [esp + 0x48]
lea eax, [esp + 0x28]
push edx
push eax
push 0
mov dword [esp + 0x30], ebp
mov byte [esp + 0x54], 0x4c
mov byte [esp + 0x55], 0x6f
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], 0x64
mov byte [esp + 0x58], 0x4c
mov byte [esp + 0x59], 0x69
mov byte [esp + 0x5a], 0x62
mov byte [esp + 0x5b], 0x72
mov byte [esp + 0x5c], bl
mov byte [esp + 0x5d], 0x72
mov byte [esp + 0x5e], 0x79
mov byte [esp + 0x5f], 0x41
mov byte [esp + 0x60], 0
call fcn.10003890
mov edi, dword [esp + 0x68]
mov dword [esp + 0x2c], eax
add esp, 0x18
mov ecx, 1
mov eax, dword [edi]
mov ebx, dword [edi + 4]
add eax, 0x80
mov edx, dword [eax + 4]
test edx, edx
jbe 0x10004409
mov esi, dword [eax]
push 0x14
add esi, ebx
push esi
mov dword [esp + 0x18], esi
call ebp
test eax, eax
jne 0x10004413
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10004413
add eax, ebx
push eax
call dword [esp + 0x18]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x100043ff
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 8]
lea edx, [ecx*4 + 4]
push edx
push eax
call fcn.10003980
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x100043ff
mov ecx, dword [edi + 0xc]
mov dword [eax + ecx*4], ebp
mov edx, dword [edi + 0xc]
inc edx
mov dword [edi + 0xc], edx
mov eax, dword [esi]
test eax, eax
je 0x100043a2
mov esi, dword [esi + 0x10]
lea edi, [eax + ebx]
add esi, ebx
jmp 0x100043aa
mov edx, dword [esi + 0x10]
lea edi, [edx + ebx]
mov esi, edi
mov eax, dword [edi]
test eax, eax
je 0x100043dc
jns 0x100043b9
and eax, 0xffff
jmp 0x100043bd
lea eax, [eax + ebx + 2]
push eax
push 0
push ebp
call fcn.10003890
add esp, 0xc
mov dword [esi], eax
test eax, eax
je 0x100043ff
mov eax, dword [edi + 4]
add edi, 4
add esi, 4
test eax, eax
jne 0x100043b0
mov eax, dword [esp + 0x10]
push 0x14
add eax, 0x14
push eax
mov dword [esp + 0x18], eax
call dword [esp + 0x20]
test eax, eax
jne 0x10004413
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x50]
jmp 0x1000434a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x3c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c
ret