joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026b70
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x1005a690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1005c4c8]
cmp eax, 0xffffffff
jne 0x10026d63
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.MSVCR110.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x10026bfa
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
push 0x1004eb9c
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10026c5b
mov dword [0x1005c4c8], 1
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e328
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [0x1005c4c8], 0
call sub.MSVCR110.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x20c]
call fcn.10026aa0
test eax, eax
je 0x10026d5e
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call sub.MSVCR110.dll_memset
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0x24
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10026d23
lea eax, [ebp - 0x824]
push eax
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0x10048468
push str.promote
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x61c]
push 0x1004ebc4
push eax
call dword [sym.imp.MSVCR110.dll__wcsicmp]
mov ecx, dword [0x1005c4c8]
add esp, 8
test eax, eax
mov edx, 1
cmove ecx, edx
mov dword [0x1005c4c8], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e328
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1005c4c8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e328
mov esp, ebp
pop ebp
ret
Function at 0x10027170
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1005a690]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
mov edi, edx
mov ebx, ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x207
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x100272ba
push esi
lea esi, [ebp - 0x414]
mov edx, 0x3a
mov ecx, dword [edi]
mov ax, word [esi]
imul ecx, ecx, 0x418
mov word [ecx + ebx], ax
mov eax, dword [edi]
imul eax, eax, 0x418
xor ecx, ecx
mov word [eax + ebx + 2], dx
mov eax, dword [edi]
imul eax, eax, 0x418
push 0x208
mov word [eax + ebx + 4], cx
mov ecx, dword [edi]
imul ecx, ecx, 0x418
add ecx, ebx
lea eax, [ecx + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x100272a0
mov eax, dword [edi]
imul eax, eax, 0x418
mov ecx, 0x5c
mov word [eax + ebx + 4], cx
mov eax, dword [edi]
imul eax, eax, 0x418
xor ecx, ecx
mov word [eax + ebx + 6], cx
mov edx, dword [edi]
mov eax, edx
imul eax, eax, 0x418
add eax, 8
add eax, ebx
mov ecx, eax
mov dword [ebp - 0x418], eax
lea eax, [ecx + 2]
mov dword [ebp - 0x41c], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10027261
sub ecx, dword [ebp - 0x41c]
imul edx, edx, 0x20c
sar ecx, 1
add edx, ecx
cmp word [ebx + edx*2 + 6], 0x5c
je 0x1002729d
push 0x1004846c
push 0x208
push dword [ebp - 0x418]
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0xc
inc dword [edi]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100272a0
mov edx, 0x3a
cmp word [esi], ax
jne 0x100271d3
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.1003e328
mov esp, ebp
pop ebp
ret
Function at 0x100275f0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x82a4
call fcn.1003fff0
mov eax, dword [0x1005a690]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
mov esi, ecx
push eax
mov dword [ebp - 0x82a4], esi
mov bl, 1
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x8298]
push eax
push 0x1000
lea eax, [ebp - 0x8294]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x10027660
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e328
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x8298]
shr eax, 2
push edi
mov dword [ebp - 0x82a0], eax
xor eax, eax
push 0x6a68
push eax
mov word [ebp - 0x7294], ax
mov dword [ebp - 0x7292], eax
mov word [ebp - 0x728e], ax
lea eax, [ebp - 0x728c]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea edx, [ebp - 0x829c]
lea ecx, [ebp - 0x7294]
mov dword [ebp - 0x829c], 0
call fcn.10027170
xor edi, edi
cmp dword [ebp - 0x82a0], edi
jbe 0x100277c0
jmp 0x100276d0
push dword [ebp - 0x829c]
mov ecx, dword [ebp + edi*4 - 0x8294]
lea eax, [ebp - 0x7294]
push eax
lea edx, [ebp - 0x414]
call fcn.10027550
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x822]
push eax
call sub.MSVCR110.dll_memset
add esp, 0x14
lea eax, [ebp - 0x824]
push 0x208
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x414]
push 0x208
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0xc
push dword [esi + 0x10]
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
call fcn.1000a1b0
push eax
call dword [sym.imp.MSVCR110.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x100277b3
push dword [ebp + edi*4 - 0x8294]
push eax
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100277a5
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x7d0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x1002779c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100277ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
mov esi, dword [ebp - 0x82a4]
inc edi
cmp edi, dword [ebp - 0x82a0]
jb 0x100276d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1003e328
mov esp, ebp
pop ebp
ret

Function at 0x10027d60
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10027d91
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 8], esi
call fcn.1003fe40
mov dword [esp + 0xc], eax
test esi, esi
jne 0x10027d99
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x1004ee50
lea ecx, [esp + 8]
call fcn.10027c00
int3
Function at 0x10027de0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044ef0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1005a690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_class_std::exception_const__]
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.1000af40
mov dword [ebp - 4], 1
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x10027e6b
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10028260
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10043a58
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1005a690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_class_std::exception_const__]
mov dword [ebp - 4], 0
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea ecx, [edi + 0x14]
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.1000af40
mov dword [edi + 0x2c], vtable.boost::exception.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10029aa0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [0x1005cb28]
test eax, eax
je 0x10029b07
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call esi
test eax, eax
je 0x10029b06
mov eax, dword [0x1005cb28]
test eax, eax
jne 0x10029ac5
xor ecx, ecx
jmp 0x10029acf
push eax
call esi
mov ecx, eax
mov eax, dword [0x1005cb28]
cmp byte [ecx + 0x18], 0
je 0x10029b06
test eax, eax
je 0x10029b06
push eax
call esi
test eax, eax
je 0x10029b06
mov eax, dword [0x1005cb28]
test eax, eax
je 0x10029aec
push eax
call esi
push 0
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10029b06
mov eax, dword [0x1005cb28]
test eax, eax
jne 0x10029b09
jmp 0x10029b0c
pop esi
pop ecx
ret
push eax
call esi
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x10053818
lea eax, [esp + 0xb]
push eax
mov byte [esp + 0xf], 0
call sub.MSVCR110.dll__CxxThrowException
int3
Function at 0x10029d20
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10040118
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1005a690]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1005cb28]
test eax, eax
jne 0x10029d52
xor ebx, ebx
jmp 0x10029d5b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [esp + 0x14], ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
or ecx, 0xffffffff
mov dword [esp + 0x20], 0
test ebx, ebx
je 0x10029d9f
jmp 0x10029d86
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [ebx + 0x14], 0
mov edi, dword [ebx + 0x10]
jne 0x10029dd9
test edi, edi
jne 0x10029de0
push edi
call fcn.10029e80
add esp, 4
or ecx, 0xffffffff
mov dword [esp + 0x20], 0xffffffff
test ebx, ebx
je 0x10029dc5
lea eax, [ebx + 4]
lock xadd dword [eax], ecx
dec ecx
jne 0x10029dc5
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax]
push ebx
push 0
call esi
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test edi, edi
je 0x10029e18
lea ecx, [ecx]
mov eax, dword [edi + 4]
mov dword [ebx + 0x10], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x10029e09
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
push 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebp
push edi
push 0
call esi
push eax
call ebp
mov edi, dword [ebx + 0x10]
test edi, edi
jne 0x10029de0
mov esi, dword [ebx + 0x14]
test esi, esi
je 0x10029d80
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x14], eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10029e38
mov eax, dword [ecx]
push dword [esi + 0xc]
call dword [eax + 4]
mov edi, dword [esi + 8]
test edi, edi
je 0x10029e65
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10029e65
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
lea eax, [edi + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x10029e65
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov esi, dword [ebx + 0x14]
test esi, esi
jne 0x10029e23
jmp 0x10029d80

Function at 0x10029e80
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10040148
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1005a690]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x10029030
push 0x1005cb20
call fcn.10028bc0
mov eax, dword [0x1005cb28]
add esp, 8
test eax, eax
je 0x10029ed9
push dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
lea ecx, [esp + 4]
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_void_]
mov dword [esp + 0x10], 0
mov dword [esp + 4], vtable.boost::thread_resource_error.0
lea eax, [esp + 4]
push eax
mov dword [esp + 0x20], 0
call fcn.1000b9c0
int3
Function at 0x10029f10
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x10040178
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1005a690]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x1c]
push eax
push 4
push edx
push 0x1002a110
push 0
push 0
call dword [sym.imp.MSVCR110.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x10029f7d
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_void_]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x2c], ebx
call fcn.1000b9c0
mov ecx, dword [esi]
add ecx, 4
mov eax, 1
lock xadd dword [ecx], eax
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x10029fa0
cmp eax, 0xffffffff
je 0x10029fa0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x10033de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10040c09
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1005a690]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 1
push 0x1005cb84
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0
call fcn.1003e1f0
xor ecx, ecx
cmp byte [esp + 0x10], cl
lea eax, [esp + 0xc]
cmove eax, ecx
mov dword [esp + 0x28], 1
test eax, eax
je 0x10033e72
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
call fcn.10031e30
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 4], 1
mov byte [esp + 0x28], 0
call fcn.1003e210
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], str.Error_in_thread_safety_code:_could_not_acquire_a_lock
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
mov dword [esp + 0x14], vtable.std::runtime_error.0
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x2c], 2
call fcn.100194d0
int3
Function at 0x1003dbd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov dword [esp], 0x10049b78
mov dword [esp + 4], 0x100479d8
mov dword [esp + 8], 0x100479dc
mov dword [esp + 0xc], 0x100479e0
mov dword [esp + 0x10], 0x100479e4
mov dword [esp + 0x14], 0x100479e8
mov dword [esp + 0x18], 0x100479d4
mov dword [esp + 0x1c], 0x100479ec
mov dword [esp + 0x20], 0x100479f0
mov dword [esp + 0x24], 0x100479f4
mov dword [esp + 0x28], 0x100479f8
mov dword [esp + 0x2c], 0x100479fc
mov dword [esp + 0x30], 0x10047a00
mov dword [esp + 0x34], 0x10047a04
mov dword [esp + 0x38], 0x10047a08
mov dword [esp + 0x3c], 0x10047a0c
mov dword [esp + 0x40], 0x10047a10
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], str.bBafnrtvcEQXZGpPNKR
mov dword [esp + 0x4c], 0x1004760c
mov dword [esp + 0x50], 0x10047a14
mov dword [esp + 0x54], 0x10047a18
mov dword [esp + 0x58], 0x10049b78
mov dword [esp + 0x5c], 0x10049b78
mov dword [esp + 0x60], 0x10047a1c
mov dword [esp + 0x64], 0x10047a20
mov dword [esp + 0x68], 0x1004ee54
mov dword [esp + 0x6c], 0x10047a24
mov dword [esp + 0x70], 0x10047610
mov dword [esp + 0x74], 0x10047614
mov dword [esp + 0x78], 0x10047618
mov dword [esp + 0x7c], 0x1004761c
mov dword [esp + 0x80], 0x10047620
mov dword [esp + 0x84], 0x10047624
mov dword [esp + 0x88], 0x1004ed58
mov dword [esp + 0x8c], 0x10047628
mov dword [esp + 0x90], 0x10047a28
mov dword [esp + 0x94], 0x10047a2c
mov dword [esp + 0x98], 0x1004ed54
mov dword [esp + 0x9c], 0x10049b78
mov dword [esp + 0xa0], 0x10049b78
mov dword [esp + 0xa4], 0x10049b78
mov dword [esp + 0xa8], 0x10049b78
mov dword [esp + 0xac], 0x10049b78
mov dword [esp + 0xb0], 0x10049b78
mov dword [esp + 0xb4], 0x10049b78
mov dword [esp + 0xb8], 0x10049b78
mov dword [esp + 0xbc], 0x1004762c
mov dword [esp + 0xc0], 0x10047630
mov dword [esp + 0xc4], 0x10047634
mov dword [esp + 0xc8], str.C___._______:_
mov dword [esp + 0xcc], 0x10047638
mov dword [esp + 0xd0], 0x1004763c
mov dword [esp + 0xd4], 0x10047a30
mov dword [esp + 0xd8], 0x10047640
mov dword [esp + 0xdc], 0x10047644
mov dword [esp + 0xe0], 0x10047648
mov dword [esp + 0xe4], 0x10047a34
mov dword [esp + 0xe8], 0x1004764c
mov dword [esp + 0xec], 0x10047650
cmp cl, 0x3c
jb 0x1003de1a
mov eax, 0x10049b78
add esp, 0xf0
ret
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x1003de30
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x9c
mov eax, dword [0x1005a690]
xor eax, esp
mov dword [esp + 0x98], eax
push esi
mov si, cx
movzx edx, si
mov dword [esp + 4], 0x3610300
mov dword [esp + 8], 0x4860483
mov dword [esp + 0xc], 0x9030903
mov dword [esp + 0x10], 0x940093e
mov dword [esp + 0x14], 0x94c0949
mov dword [esp + 0x18], 0x9830982
mov dword [esp + 0x1c], 0x9c009be
mov dword [esp + 0x20], 0x9cc09c7
mov dword [esp + 0x24], 0x9d709d7
mov dword [esp + 0x28], 0xa400a3e
mov dword [esp + 0x2c], 0xa830a83
mov dword [esp + 0x30], 0xac00abe
mov dword [esp + 0x34], 0xacc0ac9
mov dword [esp + 0x38], 0xb030b02
mov dword [esp + 0x3c], 0xb3e0b3e
mov dword [esp + 0x40], 0xb400b40
mov dword [esp + 0x44], 0xb4c0b47
mov dword [esp + 0x48], 0xb570b57
mov dword [esp + 0x4c], 0xb830b83
mov dword [esp + 0x50], 0xbbf0bbe
mov dword [esp + 0x54], 0xbcc0bc1
mov dword [esp + 0x58], 0xbd70bd7
mov dword [esp + 0x5c], 0xc030c01
mov dword [esp + 0x60], 0xc440c41
mov dword [esp + 0x64], 0xc830c82
mov dword [esp + 0x68], 0xcbe0cbe
mov dword [esp + 0x6c], 0xcc40cc0
mov dword [esp + 0x70], 0xccb0cc7
mov dword [esp + 0x74], 0xcd60cd5
mov dword [esp + 0x78], 0xd030d02
mov dword [esp + 0x7c], 0xd400d3e
mov dword [esp + 0x80], 0xd4c0d46
mov dword [esp + 0x84], 0xd570d57
mov dword [esp + 0x88], 0xf7f0f7f
mov dword [esp + 0x8c], 0x20e120d0
mov dword [esp + 0x90], 0x309a3099
mov dword [esp + 0x94], 0xfe23fe20
mov dword [esp + 0x98], 0xffffffff
lea eax, [esp + 6]
cmp edx, 0x361
jle 0x1003dfab
lea esp, [esp]
movzx ecx, word [eax + 4]
add eax, 4
cmp ecx, edx
jl 0x1003dfa0
sub eax, 2
cmp si, word [eax]
jb 0x1003dfd1
cmp si, word [eax + 2]
ja 0x1003dfd1
mov al, 1
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.1003e328
add esp, 0x9c
ret
mov ecx, dword [esp + 0x9c]
pop esi
xor ecx, esp
xor al, al
call fcn.1003e328
add esp, 0x9c
ret
Function at 0x407458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x407467
pop dword [ebp - 0x1c]
mov eax, 0x69a62e14
add eax, 0x969a4653
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x501911f
sub dword [ebp - 0x2c], 0xb6af4bd4
mov dword [ebp - 0x28], 0xcf01ae46
add dword [ebp - 0x28], 0x63319dff
mov dword [ebp - 0x24], 0xc1729dd0
add dword [ebp - 0x24], 0x8ad9a65e
mov dword [ebp - 0x20], 0x9a28151e
add dword [ebp - 0x20], 0x65d7eae2
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x637ddf7f
sub dword [ebp - 0x2c], 0xef0b7629
mov dword [ebp - 0x28], 0x933d9cec
sub dword [ebp - 0x28], 0x51d13b77
mov dword [ebp - 0x24], 0x569601f
sub dword [ebp - 0x24], 0xa1f9f3b3
mov dword [ebp - 0x20], 0x251f077
sub dword [ebp - 0x20], 0x251f077
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xc15ff662
add eax, 0x3ee08a1a
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ae10
push 0
call eax
mov ecx, 0x2dc9701b
add ecx, 0xd236e701
mov esi, eax
mov edx, 0x451400
add edx, dword [ebp - 0x1c]
mov edi, 0x728baf27
add edi, 0xe8cc02a1
add dword [ebp - 4], edi
mov ebx, dword [edx]
sub dword [ebp - 8], 0x8a9260b0
xor ebx, edi
xor dword [ebp - 0xc], 0x4dd4f867
mov dword [esi], ebx
mov dword [ebp - 0x14], 0x77b03875
add esi, 0xba7457cd
add esi, 0x458ba837
add edx, 0x5b01ec47
add edx, 0xa4fe13bd
loop 0x40757e
add eax, 0x14f43
mov ebx, eax
add eax, 5
mov ecx, 0xfeb96928
sub ecx, 0xfe796928
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret