joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001b60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, ecx
or eax, 0xffffffff
mov cl, byte [edx]
test cl, cl
je 0x10001c06
nop
movzx ecx, cl
lea edx, [edx + 1]
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x10001b70
not eax
ret

Function at 0x100020b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.10005670
mov edi, eax
test edi, edi
je 0x10002129
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], 0x61507265
push eax
push edi
mov word [esp + 0x1e], 0x6c61
mov dword [esp + 0x19], 0x63657053
mov dword [esp + 0x20], 0x646c6f46
mov dword [esp + 0x14], 0x65474853
mov word [esp + 0x29], 0x5768
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x2b], 0
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x28], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002120
push esi
push 0x25
push ebx
push esi
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x10002140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.10027e20
mov edi, eax
test edi, edi
je 0x100021bc
lea eax, [esp + 0x10]
mov dword [esp + 0x1d], 0x577845
push eax
push edi
mov word [esp + 0x1b], 0x7551
mov word [esp + 0x1e], 0x7972
mov word [esp + 0x19], 0x6765
mov dword [esp + 0x21], 0x65756c61
mov byte [esp + 0x18], 0x52
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x20], 0x56
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100021b3
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x10002210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 8], 0x7250
push eax
mov esi, edx
mov dword [esp + 0xf], 0x73736563
mov edi, ecx
mov dword [esp + 0x13], 0x654e3233
mov word [esp + 0x17], 0x7478
mov byte [esp + 0x19], 0
mov byte [esp + 0xe], 0x6f
call fcn.10029070
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002260
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x10002270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 0xf], 0x656d
push eax
mov esi, edx
mov dword [esp + 0x1c], 0x6e6f6974
mov edi, ecx
mov dword [esp + 0xe], 0x6c6f5674
mov dword [esp + 0x16], 0x726f666e
mov word [esp + 0x1a], 0x616d
mov word [esp + 0xc], 0x6547
mov word [esp + 0x20], 0x57
mov byte [esp + 0x12], 0x75
mov byte [esp + 0x15], 0x49
call fcn.10029070
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100022f0
push 0x105
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push 0x105
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x18
ret
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret

Function at 0x10002370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.10027e20
mov edi, eax
test edi, edi
je 0x100023df
lea eax, [esp + 0x10]
mov dword [esp + 0x11], 0x74707972
push eax
push edi
mov word [esp + 0x25], 0x6873
mov dword [esp + 0x20], 0x48657461
mov word [esp + 0x1d], 0x7243
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x24], 0x61
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x27], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100023d6
push dword [esp + 0x2c]
push esi
push esi
push ebx
push ebp
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x100023f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0x626f6c47
push eax
mov esi, ecx
mov word [esp + 0xd], 0x466c
mov word [esp + 0x10], 0x6565
mov byte [esp + 0x12], 0
mov byte [esp + 0xc], 0x61
mov byte [esp + 0xf], 0x72
call fcn.10029070
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002438
push esi
call eax
pop esi
add esp, 0xc
ret
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x10002440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp + 2], 0x63695474
push eax
mov word [esp + 0xb], 0x6f43
mov word [esp + 0xe], 0x746e
mov byte [esp + 0xd], 0x75
mov byte [esp + 0x10], 0
mov word [esp + 4], 0x6547
mov byte [esp + 0xa], 0x6b
call fcn.10029070
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002489
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x10002490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov dword [esp + 1], 0x4c656572
push eax
mov word [esp + 0xe], 0x79
mov dword [esp + 9], 0x61726269
mov byte [esp + 4], 0x46
mov byte [esp + 0xd], 0x72
call fcn.10029070
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100024d2
push dword [esp + 0x10]
call eax
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
Function at 0x100024e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.100056a0
mov edi, eax
test edi, edi
je 0x10002533
lea eax, [esp + 0xc]
mov dword [esp + 0xf], 0x6e496f54
push eax
push edi
mov word [esp + 0x1b], 0x4174
mov word [esp + 0x15], 0x7274
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x1d], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000252a
push ebx
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x100056d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
xor esi, esi
call fcn.10005640
mov edi, eax
test edi, edi
je 0x1000572b
lea eax, [esp + 8]
mov dword [esp + 0x11], 0x41784577
push eax
push edi
mov dword [esp + 0x10], 0x646e6946
mov dword [esp + 0x14], 0x646e6957
mov byte [esp + 0x18], 0x6f
mov byte [esp + 0x1d], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005722
push dword [esp + 0x20]
push dword [esp + 0x20]
push esi
push esi
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x10005740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.10005640
mov edi, eax
test edi, edi
je 0x100057a5
lea eax, [esp + 0xc]
mov word [esp + 0xc], 0x7349
push eax
push edi
mov dword [esp + 0x1a], 0x6956776f
mov word [esp + 0x17], 0x6e69
mov dword [esp + 0x1f], 0x656c6269
mov byte [esp + 0x16], 0x57
mov byte [esp + 0x1e], 0x73
mov byte [esp + 0x19], 0x64
mov byte [esp + 0x23], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000579c
push ebx
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x100057b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
mov esi, 1
call fcn.10027e20
mov edi, eax
test edi, edi
je 0x1000581d
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x78457965
push eax
push edi
mov dword [esp + 0x17], 0x6e65704f
mov word [esp + 0x20], 0x57
mov word [esp + 0x14], 0x6552
mov byte [esp + 0x1b], 0x4b
mov byte [esp + 0x16], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005814
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push ebx
push 0x80000002
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x10005830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.10027e20
mov edi, eax
test edi, edi
je 0x100058ad
lea eax, [esp + 0xc]
mov word [esp + 0x1c], 0x656c
push eax
push edi
mov dword [esp + 0x15], 0x73756a64
mov dword [esp + 0x1d], 0x72506e65
mov byte [esp + 0x14], 0x41
mov word [esp + 0x27], 0x7365
mov byte [esp + 0x26], 0x67
mov word [esp + 0x21], 0x7669
mov dword [esp + 0x19], 0x6b6f5474
mov byte [esp + 0x29], 0
mov byte [esp + 0x23], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100058a4
push esi
push esi
push 0x10
push dword [esp + 0x34]
push esi
push ebx
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x10005970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
mov dword [esp + 8], 0x6c416c61
push eax
mov esi, edx
mov word [esp + 0x11], 0x636f
mov word [esp + 9], 0x6f6c
mov byte [esp + 0x10], 0x6c
mov byte [esp + 8], 0x47
mov byte [esp + 0x13], 0
mov byte [esp + 0xb], 0x62
call fcn.10029070
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100059bf
push esi
push 0x40
call eax
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x100059d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.10027e20
mov edi, eax
test edi, edi
je 0x10005a3d
lea eax, [esp + 0x10]
mov word [esp + 0x11], 0x7972
push eax
push edi
mov dword [esp + 0x21], 0x61746144
mov word [esp + 0x1c], 0x4874
mov byte [esp + 0x18], 0x43
mov word [esp + 0x1f], 0x6873
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x25], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005a34
push esi
push dword [esp + 0x28]
push ebx
push ebp
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x10005a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.10027e20
mov edi, eax
test edi, edi
je 0x10005ab7
lea eax, [esp + 0xc]
mov dword [esp + 0xd], 0x74707972
push eax
push edi
mov dword [esp + 0x19], 0x74736544
mov byte [esp + 0x14], 0x43
mov word [esp + 0x1d], 0x6f72
mov word [esp + 0x20], 0x6148
mov word [esp + 0x23], 0x68
mov byte [esp + 0x22], 0x73
mov byte [esp + 0x1f], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005aae
push ebx
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x10005ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.10027e20
mov edi, eax
test edi, edi
je 0x10005b2a
lea eax, [esp + 0x10]
mov dword [esp + 0x19], 0x50687361
push eax
push edi
mov dword [esp + 0x1d], 0x48746547
mov dword [esp + 0x25], 0x6d617261
mov dword [esp + 0x18], 0x70797243
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x29], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005b21
push esi
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push ebp
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x10005b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp + 9], 0x726f72
push eax
mov dword [esp + 7], 0x7473614c
mov word [esp + 5], 0x7465
mov word [esp + 0xb], 0x7245
mov byte [esp + 4], 0x47
call fcn.10029070
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005b80
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret
Function at 0x10006320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10006376
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10006376
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10006366
cmp esi, edx
jae 0x10006376
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10006354
cmp esi, edx
jae 0x10006376
cmp word [esi], 0
je 0x10006376
pop edi
mov eax, esi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x10007660
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002619a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.1000b52c
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x100076ed
push eax
push esi
call fcn.1000b88a
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
lea ecx, [ebp - 0x1c]
call fcn.100075d0
push 0x10039180
lea eax, [ebp - 0x1c]
push eax
call fcn.1000dfa4
int3
Function at 0x100084f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002629f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0
push esi
mov dword [ebx], 0x1003744c
push edi
mov dword [ebx + 0x50], 0x1003740c
mov dword [ebp - 4], 0
mov eax, dword [ebx]
push 0
push 0
mov dword [ebp - 0x14], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x10037454
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.10007f80
push 8
call fcn.1000c98a
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 2
call fcn.1000b783
mov dword [esi + 4], eax
add ebx, 4
add esp, 4
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], 0
mov dword [ebp - 4], 3
mov esi, dword [esi + 4]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 4
push eax
call fcn.1000ab70
add esp, 4
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
cmp ecx, vtable.std::ctype_char_.0
jne 0x10008716
mov byte [ebp - 0xd], 0x20
mov dword [ebp - 4], 5
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 8]
test eax, eax
je 0x1000862b
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov al, byte [ebp - 0xd]
mov byte [ebp - 4], 1
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x1000864b
mov eax, dword [edi + 0xc]
mov ecx, edi
or eax, 4
push 0
push eax
call fcn.10007f80
mov dword [ebp - 4], 6
mov edi, dword [ebp - 0x18]
push 8
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x100373ec
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
lea eax, [ecx - 0x50]
mov dword [ecx + edi - 4], eax
mov dword [ebx], 0x10037538
call fcn.1000c98a
add esp, 4
mov esi, eax
push 1
mov byte [ebp - 4], 7
call fcn.1000b783
mov dword [esi + 4], eax
lea ecx, [ebx + 8]
lea eax, [ebx + 4]
mov dword [ebx + 0x34], esi
mov dword [ebx + 0xc], eax
add esp, 4
lea eax, [ebx + 0x14]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x18]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x28]
mov dword [ebx + 0x30], eax
mov dword [ecx], 0
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov eax, edi
pop edi
mov dword [ebx], 0x10037410
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 4
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x20
mov ecx, eax
call edx
mov byte [ebp - 0xd], al
jmp 0x10008611
Function at 0x10027bc0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
sub esp, 0x80
push esi
push edi
lea ecx, [esp + 0x34]
mov dword [0x1003a890], 0
mov word [esp + 0x38], 0x7061
mov word [esp + 0x3e], 0x6c
mov word [esp + 0x3b], 0x642e
mov byte [esp + 0x3a], 0x69
mov dword [esp + 0x34], 0x74766577
mov byte [esp + 0x3d], 0x6c
call fcn.10028060
mov esi, eax
test esi, esi
je 0x10027df3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [esp + 0x54]
push eax
push esi
mov dword [esp + 0x5e], 0x65724374
mov word [esp + 0x71], 0x74
mov dword [esp + 0x6c], 0x65746e6f
mov dword [esp + 0x62], 0x52657461
mov dword [esp + 0x67], 0x7265646e
mov word [esp + 0x5c], 0x7645
mov byte [esp + 0x6b], 0x43
mov byte [esp + 0x66], 0x65
mov byte [esp + 0x70], 0x78
call edi
mov dword [0x1003b95c], eax
test eax, eax
je 0x10027dea
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x79726575
push eax
push esi
mov byte [esp + 0x20], 0
mov dword [esp + 0x18], 0x51747645
call edi
mov dword [0x1003b960], eax
test eax, eax
je 0x10027dea
lea eax, [esp + 8]
mov word [esp + 9], 0x7476
push eax
push esi
mov dword [esp + 0x14], 0x747865
mov byte [esp + 0x13], 0x4e
mov byte [esp + 0x10], 0x45
call edi
mov dword [0x1003b958], eax
test eax, eax
je 0x10027dea
lea eax, [esp + 0x28]
mov dword [esp + 0x2e], 0x726564
push eax
push esi
mov word [esp + 0x34], 0x6e65
mov word [esp + 0x31], 0x7476
mov byte [esp + 0x33], 0x52
mov byte [esp + 0x30], 0x45
call edi
mov dword [0x1003b968], eax
test eax, eax
je 0x10027dea
lea eax, [esp + 0x6c]
mov dword [esp + 0x77], 0x65687369
push eax
push esi
mov word [esp + 0x84], 0x654d
mov word [esp + 0x87], 0x6461
mov dword [esp + 0x77], 0x6e65704f
mov word [esp + 0x74], 0x7645
mov word [esp + 0x8a], 0x6174
mov byte [esp + 0x86], 0x74
mov word [esp + 0x7c], 0x6275
mov byte [esp + 0x8c], 0
mov byte [esp + 0x89], 0x61
mov byte [esp + 0x7b], 0x50
mov byte [esp + 0x76], 0x74
mov byte [esp + 0x7e], 0x6c
mov byte [esp + 0x83], 0x72
call edi
mov dword [0x1003b954], eax
test eax, eax
je 0x10027dea
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0x46747645
push eax
push esi
mov dword [esp + 0x51], 0x7373654d
mov dword [esp + 0x55], 0x656761
mov dword [esp + 0x4d], 0x74616d72
mov byte [esp + 0x4c], 0x6f
call edi
mov dword [0x1003b964], eax
test eax, eax
je 0x10027dea
lea eax, [esp + 0x1c]
mov dword [esp + 0x1d], 0x6c437476
push eax
push esi
mov word [esp + 0x2a], 0x6573
mov byte [esp + 0x24], 0x45
mov byte [esp + 0x2c], 0
mov byte [esp + 0x29], 0x6f
call edi
mov dword [0x1003b94c], eax
test eax, eax
je 0x10027dea
pop edi
mov dword [0x1003b950], 1
mov eax, 1
pop esi
add esp, 0x80
ret
push esi
call fcn.10002490
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0x80
ret

Function at 0x10027e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea ecx, [esp]
mov dword [esp], 0x61766441
mov dword [esp + 9], 0x6c6c64
mov word [esp + 7], 0x2e32
mov word [esp + 4], 0x6970
mov byte [esp + 6], 0x33
call fcn.10028060
add esp, 0x10
ret
Function at 0x10027e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov word [esp + 7], 0x4664
push eax
mov esi, ecx
mov word [esp + 0x17], 0x57
mov dword [esp + 0x12], 0x6d756c6f
mov word [esp + 8], 0x6946
mov dword [esp + 0xd], 0x74737269
mov byte [esp + 0x16], 0x65
mov byte [esp + 0xa], 0x6e
mov byte [esp + 0x11], 0x56
call fcn.10029070
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10027ebc
push 0x104
push esi
call eax
pop esi
add esp, 0x14
ret
or eax, 0xffffffff
pop esi
add esp, 0x14
ret

Function at 0x10027ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
lea eax, [esp]
mov word [esp], 0x6547
push eax
mov dword [esp + 0xb], 0x50746e65
mov word [esp + 0xf], 0x6f72
mov dword [esp + 0x12], 0x737365
mov dword [esp + 7], 0x72727543
mov byte [esp + 0x11], 0x63
mov byte [esp + 6], 0x74
call fcn.10029070
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10027f1c
call eax
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret

Function at 0x10027f30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.10005640
mov edi, eax
test edi, edi
je 0x10027f83
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x646e6957
push eax
push edi
mov word [esp + 0x20], 0x776f
mov byte [esp + 0x22], 0
mov dword [esp + 0x18], 0x776f6853
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10027f7a
push ebx
push ebp
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x10027f90
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
xor esi, esi
call fcn.10027e20
mov edi, eax
test edi, edi
je 0x10027ffe
lea eax, [esp + 8]
mov dword [esp + 0xa], 0x70756b6f
push eax
push edi
mov dword [esp + 0x20], 0x65756c61
mov word [esp + 0x24], 0x41
mov dword [esp + 0x16], 0x76697250
mov word [esp + 0x10], 0x6f4c
mov dword [esp + 0x1c], 0x56656765
mov word [esp + 0x1a], 0x6c69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10027ff5
push dword [esp + 0x24]
push str.SeDebugPrivilege
push esi
call eax
mov esi, eax
push edi
call fcn.10002490
add esp, 4
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret

Function at 0x10028060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
mov dword [esp + 5], 0x4c64616f
push eax
mov esi, ecx
mov dword [esp + 0x10], 0x41797261
mov byte [esp + 0x14], 0
mov word [esp + 0xd], 0x6269
mov byte [esp + 8], 0x4c
mov byte [esp + 0xf], 0x72
call fcn.10029070
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100280a9
push esi
call eax
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret