joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54c873
Capabilities:
Encode data using xor

Disassembly:
fild qword [edx - 0x7f915627]
invalid
retf
jp 0x54c800
shl dword [ebx + 0xcafd9e1], 0x1c
fisubr word [eax - 0x7c]
and dword [eax - 6], ebp
mov edi, 0xa18b1550
loope 0x54c85f
lock sbb dword [esi + 0x2f], edx
push edi
scasd eax, dword es:[edi]
xlatb
mov ch, 0x75
invalid
jne 0x54c7e8
push ecx
cmp al, 0xd2
pop ds
add esi, dword [esi + esi*8 - 0xc]
iretd
je 0x54c857
hlt
and eax, 0x593f72ae
sahf
mov dword [esi + 0x2a], esp
sub ah, byte [edx - 0x2460aaa5]
sub ah, byte [edx - 0x2460aaa5]
in al, 0x57
adc bh, ah
shr dword [ebp + 0x2f], 3
movd mm7, dword [edi]
loope 0x54c86b
clc
jg 0x54c838
mov ebx, 0x588befc8
add eax, 0xa4449df7
je 0x54c8cb
or eax, 0xdfc75e94
and edx, dword [ebx - 0x29]
or ecx, dword [esi - 0x187057a3]
out dx, al
sti
out dx, al
lahf
sub ah, byte [edi + 0x4e]
jo 0x54c91c
xlatb
jge 0x54c8e8
sbb al, 0x87
or eax, 0x325d7a9a
ret
mov ecx, 0xfa4be579
in eax, 0x4b
cli
push es
inc esp
cld
bound edi, qword [ebx - 0x663f86b1]
xlatb
test al, 0x82
lahf
push ebx
and cl, 0x99
push ss
adc al, byte [ebx]
dec edi
seto byte [ebx]
into
sbb esp, dword [ebx + esi*2 + 0x643ba7de]
pushfd
push edi
movsb byte es:[edi], byte [esi]
jae 0x54c8c9
cmpsd dword [esi], dword es:[edi]
cmp esp, dword [esp + ebx*4 + 0x57]
stosb byte es:[edi], al
movsd dword es:[edi], dword [esi]
fnstsw word [esi - 0x42]
aad 0xf5
mov ch, 0xcd
xor al, 0xb7
push esp
outsd dx, dword [esi]
cmp ebp, dword [ecx]
popfd
rcr dword [edi - 0x79770e2], 0xaa
jne 0x54c93e
lodsd eax, dword [esi]
mov bl, 0xe5
lea edx, [ebx]
mov cl, 0xa8
pop ds
push edi
call 0xf5ea9f95
mov bl, 0x11
lds eax, [edi]
mov eax, dword [edi]
pop es
xor eax, 0xa4485476
ja 0x54c90a
mov ah, 0x56
add ah, byte [eax + 0x63]
invalid
pushal
arpl word [edi + 0x5106177b], cx
mov ecx, dword [ebp - 0x63]
and byte [edi], bl
fbld tbyte [esi - 0x5a52bbd3]
mov ebp, 0x1dc5d10e
jmp 0x54c9ae
sbb eax, 0xb4ec6deb
out dx, al
pop edx
cmp dword [ebp - 0x74], ebx
fsub dword [edi + ebx + 0x10]
jae 0x54c928
stosd dword es:[edi], eax
ljmp 0xf1df
xor dword [edi + ebx - 0x3e7228c0], ecx
in eax, dx
and dl, byte [ebp + 0x179e4cf5]
int 0x5c
inc eax
mov byte [edi + 0x39], 0xdb
aaa
int 0x85
cmp byte [ebp - 0x2c505145], dh
out dx, al
out 0xfe, al
xor dword [ebx], edx
inc ebp
mov esp, dword [0x6528533c]
fstp dword [0xbb431584]
sub al, 0xfd
wait
aam 0xe
aad 0x3d
xchg ebp, eax
mov esi, 0x74237c9d
cmp al, 0xf7
mov eax, 0x7b218baf
cdq
inc ebp
call 0x4d95bd4c
xor eax, 0xfb58c1b8
aas
call 0xaab7825a
xchg al, dl
xlatb
movsb byte es:[edi], byte [esi]
mov edx, 0x5f95cc01
mov cl, 0x3f
cli
mov dh, 0x69
fbld tbyte [ebp + 0x17]
dec esi
div byte [ebp + 0x5f]
lodsb al, byte [esi]
invalid
Function at 0x1000e695
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 9], 0x6c642e32
push eax
mov word [ebp - 5], 0x6c
mov dword [ebp - 0xf], 0x656e7265
mov word [ebp - 0xb], 0x336c
mov byte [ebp - 0x10], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
leave
ret

Function at 0x1000e6c5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 7], 0x6c6c64
push eax
mov dword [ebp - 0xb], 0x2e323369
mov word [ebp - 0xd], 0x7061
mov word [ebp - 0x10], 0x6441
mov byte [ebp - 0xe], 0x76
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x1000e6f5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x3233
push eax
mov dword [ebp - 6], 0x6c6c642e
mov word [ebp - 0xb], 0x6573
mov byte [ebp - 2], 0
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 9], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x1000e726
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x776c6853
push eax
mov dword [ebp - 8], 0x2e697061
mov word [ebp - 3], 0x6c6c
mov byte [ebp - 1], 0
mov byte [ebp - 4], 0x64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x1000e754
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 8], 0x746f6873
push eax
or esi, 0xffffffff
mov dword [ebp - 0x1a], 0x65746165
mov word [ebp - 0xe], 0x3233
mov word [ebp - 0x14], 0x6c6f
mov word [ebp - 0x1c], 0x7243
mov word [ebp - 0x11], 0x6c65
mov word [ebp - 0xb], 0x616e
mov word [ebp - 0x16], 0x6f54
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 9], 0x70
mov byte [ebp - 4], 0
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xc], 0x53
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e7c2
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret

Function at 0x1000e7c7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0xd], 0x33646165
push eax
xor ebx, ebx
mov word [ebp - 7], 0x7269
mov word [ebp - 4], 0x74
mov word [ebp - 9], 0x4632
mov word [ebp - 0xf], 0x7268
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 5], 0x73
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e815
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret
Function at 0x1000e81a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 0x10]
mov word [ebp - 9], 0x4e32
push eax
xor ebx, ebx
mov word [ebp - 0xc], 0x6461
mov dword [ebp - 7], 0x747865
mov byte [ebp - 0xa], 0x33
mov word [ebp - 0xf], 0x7268
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x10], 0x54
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e866
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x1000e86b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor edi, edi
inc edi
call fcn.1000e6c5
mov esi, eax
test esi, esi
je 0x1000e8d9
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x41784565
push eax
push esi
mov dword [ebp - 0xc], 0x756c6156
mov word [ebp - 0x11], 0x7551
mov word [ebp - 0x14], 0x6552
mov word [ebp - 0xf], 0x7265
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x12], 0x67
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e8d2
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x1000e8df
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
lea eax, [ebp - 0x18]
mov word [ebp - 0xa], 0x6e6f
push eax
xor ebx, ebx
mov dword [ebp - 0xf], 0x74637572
mov word [ebp - 7], 0x6361
mov word [ebp - 0x12], 0x736e
mov word [ebp - 4], 0x65
mov byte [ebp - 8], 0x43
mov dword [ebp - 0x17], 0x6873756c
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0x18], 0x46
mov byte [ebp - 5], 0x68
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0xb], 0x69
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e947
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x1000e94c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
call fcn.1000e6f5
mov esi, eax
test esi, esi
je 0x1000e9ac
lea eax, [ebp - 0x10]
mov word [ebp - 4], 0x7845
push eax
push esi
mov byte [ebp - 2], bl
mov dword [ebp - 9], 0x6f6f4874
mov dword [ebp - 0xd], 0x78654e6c
mov word [ebp - 0xf], 0x6c61
mov byte [ebp - 5], 0x6b
mov byte [ebp - 0x10], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e9a5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1000e9b2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0x14]
mov word [ebp - 0xb], 0x6946
push eax
xor ebx, ebx
mov dword [ebp - 0x10], 0x6c75646f
mov dword [ebp - 0x14], 0x4d746547
mov word [ebp - 6], 0x6d61
mov byte [ebp - 0xc], 0x65
mov word [ebp - 3], 0x41
mov word [ebp - 8], 0x4e65
mov byte [ebp - 9], 0x6c
mov byte [ebp - 4], 0x65
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ea0e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x1000ea13
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
inc edi
call fcn.1000e6c5
mov esi, eax
test esi, esi
je 0x1000ea74
lea eax, [ebp - 0x10]
mov dword [ebp - 6], 0x417845
push eax
push esi
mov word [ebp - 0x10], 0x6552
mov dword [ebp - 0xd], 0x6e65704f
mov word [ebp - 9], 0x654b
mov byte [ebp - 0xe], 0x67
mov byte [ebp - 7], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ea6d
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x1000ead4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 0x65536c61
push eax
mov dword [ebp - 6], 0x6e6f69
mov dword [ebp - 0x16], 0x657a696c
mov dword [ebp - 0x1a], 0x61697469
mov word [ebp - 8], 0x7463
mov word [ebp - 0x11], 0x6972
mov word [ebp - 0x1c], 0x6e49
mov word [ebp - 0xe], 0x6369
mov byte [ebp - 0x12], 0x43
mov byte [ebp - 0xf], 0x74
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000eb2f
push dword [ebp + 8]
call eax
leave
ret

Function at 0x1000eb31
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov word [ebp - 5], 0x64
push eax
or esi, 0xffffffff
mov dword [ebp - 0xe], 0x656d7573
mov dword [ebp - 0xa], 0x65726854
mov word [ebp - 0x10], 0x6552
mov byte [ebp - 6], 0x61
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000eb74
push dword [ebp + 8]
call eax
mov esi, eax
mov eax, esi
pop esi
leave
ret

Function at 0x1000ebe7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x12], 0x61757472
push eax
xor ebx, ebx
mov dword [ebp - 7], 0x784574
mov dword [ebp - 0xd], 0x746f7250
mov word [ebp - 0x14], 0x6956
mov word [ebp - 9], 0x6365
mov byte [ebp - 0xe], 0x6c
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ec3c
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret
Function at 0x1000ec41
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x11], 0x65726854
push eax
xor ebx, ebx
mov dword [ebp - 7], 0x747865
mov word [ebp - 0x14], 0x6547
mov dword [ebp - 0xc], 0x6e6f4364
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x61
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ec8f
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x1000ec94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 0xc]
mov word [ebp - 7], 0x7268
xor ebx, ebx
mov word [ebp - 4], 0x6461
push eax
mov dword [ebp - 0xc], 0x6e65704f
mov byte [ebp - 2], bl
mov byte [ebp - 8], 0x54
mov byte [ebp - 5], 0x65
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ecdc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x1000ece1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0xb], 0x6d657473
push eax
mov word [ebp - 0xd], 0x7953
mov word [ebp - 0x10], 0x6547
mov word [ebp - 4], 0x6f
mov word [ebp - 7], 0x6e49
mov byte [ebp - 5], 0x66
mov byte [ebp - 0xe], 0x74
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ed27
push dword [ebp + 8]
call eax
leave
ret

Function at 0x1000ed29
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0xf], 0x64616572
push eax
xor ebx, ebx
mov word [ebp - 7], 0x6972
mov word [ebp - 4], 0x79
mov word [ebp - 0xa], 0x6972
mov byte [ebp - 5], 0x74
mov byte [ebp - 0xb], 0x50
mov dword [ebp - 0x14], 0x54746553
mov byte [ebp - 8], 0x6f
mov byte [ebp - 0x10], 0x68
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ed80
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x1000edd5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0x14]
mov word [ebp - 5], 0x64
push eax
xor ebx, ebx
mov dword [ebp - 0xe], 0x746e6572
mov word [ebp - 0x14], 0x6547
mov word [ebp - 0x11], 0x7543
mov dword [ebp - 0xa], 0x65726854
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 6], 0x61
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ee22
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret
Function at 0x1000ee27
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 0x10]
mov word [ebp - 5], 0x79
push eax
xor ebx, ebx
mov word [ebp - 8], 0x6575
mov word [ebp - 0xb], 0x6c61
mov dword [ebp - 0x10], 0x74726956
mov byte [ebp - 6], 0x72
mov byte [ebp - 9], 0x51
mov byte [ebp - 0xc], 0x75
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ee76
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x1000eecd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 0x10]
mov word [ebp - 0x10], 0x6956
push eax
xor ebx, ebx
mov dword [ebp - 7], 0x636f6c
mov dword [ebp - 0xd], 0x6c617574
mov word [ebp - 9], 0x6c41
mov byte [ebp - 0xe], 0x72
call fcn.1000e695
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ef18
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x1000f1b1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
call fcn.1000e6f5
test eax, eax
je 0x1000f1ef
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xf], 0x69577465
push ecx
push eax
mov dword [ebp - 8], 0x736f5077
mov word [ebp - 0xb], 0x646e
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 4], bl
mov byte [ebp - 9], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x1000f21e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
call fcn.1000e6f5
test eax, eax
je 0x1000f26d
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x11], 0x65726f46
push ecx
push eax
mov dword [ebp - 5], 0x776f646e
mov dword [ebp - 0xa], 0x57646e75
mov word [ebp - 0x14], 0x6553
mov word [ebp - 0xd], 0x7267
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 1], bl
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xb], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x1000f29c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
call fcn.1000e6f5
test eax, eax
je 0x1000f2dd
lea ecx, [ebp - 0x10]
mov dword [ebp - 5], 0x776f646e
push ecx
push eax
mov dword [ebp - 0xb], 0x65766974
mov dword [ebp - 0x10], 0x41746553
mov word [ebp - 7], 0x6957
mov byte [ebp - 1], bl
mov byte [ebp - 0xc], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret
Function at 0x1000f30c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
call fcn.1000e6f5
test eax, eax
je 0x1000f350
lea ecx, [ebp - 0x14]
mov word [ebp - 0xf], 0x6957
push ecx
push eax
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 0xd], 0x776f646e
mov dword [ebp - 7], 0x706f54
mov byte [ebp - 0x10], 0x67
mov word [ebp - 9], 0x6f54
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x1000f3aa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
lea eax, [ebp - 0x1c]
mov word [ebp - 0xa], 0x5446
push eax
push 0x20019
xor ebx, ebx
mov word [ebp - 4], 0x5c
push ebx
push str.RSpeedupTab
lea ecx, [ebp - 0x10]
mov word [ebp - 7], 0x5241
mov word [ebp - 0xc], 0x4f53
mov byte [ebp - 5], 0x45
mov byte [ebp - 8], 0x57
call fcn.1000fbc2
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000fc8d
add esp, 0xc
mov ecx, eax
call fcn.1000fc8a
push eax
push 0x80000001
call fcn.1000ea13
add esp, 0x14
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.1000fc38
lea ecx, [ebp - 0x10]
call fcn.1000fc38
test esi, esi
jne 0x1000f50b
push 0x104
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.10011f30
lea eax, [ebp - 0x20]
mov dword [ebp - 6], 0x736c61
push eax
lea eax, [ebp - 0x124]
mov word [ebp - 8], 0x7668
push eax
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x1c]
call fcn.1000e86b
add esp, 0x24
test eax, eax
jne 0x1000f502
cmp dword [ebp - 0x20], ebx
jbe 0x1000f502
lea ecx, [ebp - 0x14]
call fcn.1000fc0d
push dword [ebp + 8]
lea eax, [ebp - 0x18]
mov word [ebp - 0x18], 0x6425
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 0x16], bl
push eax
call fcn.1000ff68
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.1000fc0d
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x10]
push 0x10029d7c
push eax
call fcn.1000ff68
add esp, 0xc
lea ecx, [ebp - 0x14]
push ebx
call fcn.1000fc8a
push eax
lea ecx, [ebp - 0x10]
call fcn.1000fe98
test eax, eax
js 0x1000f4f2
push dword [ebp - 0x1c]
call fcn.1000ea7a
pop ecx
lea ecx, [ebp - 0x10]
call fcn.1000fc38
lea ecx, [ebp - 0x14]
call fcn.1000fc38
xor eax, eax
inc eax
jmp 0x1000f526
lea ecx, [ebp - 0x10]
call fcn.1000fc38
lea ecx, [ebp - 0x14]
call fcn.1000fc38
push dword [ebp - 0x1c]
call fcn.1000ea7a
pop ecx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x1005918c]
pop esi
pop ebx
leave
ret 0x1c
Function at 0x1000f556
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xb], 0x5754464f
push eax
push 0x20019
xor ebx, ebx
mov dword [ebp - 7], 0x5c455241
push ebx
push str.RSpeedupTab
lea ecx, [ebp - 0x10]
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 3], bl
call fcn.1000fbc2
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000fc8d
add esp, 0xc
mov ecx, eax
call fcn.1000fc8a
push eax
push 0x80000001
call fcn.1000ea13
add esp, 0x14
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.1000fc38
lea ecx, [ebp - 0x10]
call fcn.1000fc38
test esi, esi
jne 0x1000f6b3
push 0x104
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.10011f30
lea eax, [ebp - 0x20]
mov word [ebp - 5], 0x736c
push eax
lea eax, [ebp - 0x124]
mov word [ebp - 8], 0x7668
push eax
push ebx
push ebx
lea eax, [ebp - 8]
mov byte [ebp - 3], bl
push eax
push dword [ebp - 0x1c]
mov byte [ebp - 6], 0x61
call fcn.1000e86b
add esp, 0x24
test eax, eax
jne 0x1000f6aa
cmp dword [ebp - 0x20], ebx
jbe 0x1000f6aa
lea ecx, [ebp - 0x14]
call fcn.1000fc0d
push dword [ebp + 8]
lea eax, [ebp - 0x18]
mov word [ebp - 0x17], 0x64
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 0x18], 0x25
push eax
call fcn.1000ff68
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.1000fc0d
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x10]
push 0x10029d7c
push eax
call fcn.1000ff68
add esp, 0xc
lea ecx, [ebp - 0x14]
push ebx
call fcn.1000fc8a
push eax
lea ecx, [ebp - 0x10]
call fcn.1000fe98
test eax, eax
js 0x1000f69a
push dword [ebp - 0x1c]
call fcn.1000ea7a
pop ecx
lea ecx, [ebp - 0x10]
call fcn.1000fc38
lea ecx, [ebp - 0x14]
call fcn.1000fc38
xor eax, eax
inc eax
jmp 0x1000f6bc
lea ecx, [ebp - 0x10]
call fcn.1000fc38
lea ecx, [ebp - 0x14]
call fcn.1000fc38
push dword [ebp - 0x1c]
call fcn.1000ea7a
pop ecx
push dword [ebp + 8]
call dword [0x10059118]
pop esi
pop ebx
leave
ret 4
Function at 0x1000f87a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
lea eax, [ebp - 0x1c]
mov word [ebp - 0xc], 0x4f53
push eax
push 0x20019
xor ebx, ebx
mov dword [ebp - 7], 0x5c455241
push ebx
push str.RSpeedupTab
lea ecx, [ebp - 0x10]
mov byte [ebp - 3], bl
mov word [ebp - 9], 0x5754
mov byte [ebp - 0xa], 0x46
call fcn.1000fbc2
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000fc8d
add esp, 0xc
mov ecx, eax
call fcn.1000fc8a
push eax
push 0x80000001
call fcn.1000ea13
add esp, 0x14
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.1000fc38
lea ecx, [ebp - 0x10]
call fcn.1000fc38
test esi, esi
jne 0x1000f9d5
push 0x104
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.10011f30
lea eax, [ebp - 0x20]
mov dword [ebp - 6], 0x736c61
push eax
lea eax, [ebp - 0x124]
mov word [ebp - 8], 0x7668
push eax
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x1c]
call fcn.1000e86b
add esp, 0x24
test eax, eax
jne 0x1000f9cc
cmp dword [ebp - 0x20], ebx
jbe 0x1000f9cc
lea ecx, [ebp - 0x14]
call fcn.1000fc0d
push dword [ebp + 8]
lea eax, [ebp - 0x18]
mov word [ebp - 0x18], 0x6425
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 0x16], bl
push eax
call fcn.1000ff68
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.1000fc0d
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x10]
push 0x10029d7c
push eax
call fcn.1000ff68
add esp, 0xc
lea ecx, [ebp - 0x14]
push ebx
call fcn.1000fc8a
push eax
lea ecx, [ebp - 0x10]
call fcn.1000fe98
test eax, eax
js 0x1000f9bc
push dword [ebp - 0x1c]
call fcn.1000ea7a
pop ecx
lea ecx, [ebp - 0x10]
call fcn.1000fc38
lea ecx, [ebp - 0x14]
call fcn.1000fc38
xor eax, eax
inc eax
jmp 0x1000f9de
lea ecx, [ebp - 0x10]
call fcn.1000fc38
lea ecx, [ebp - 0x14]
call fcn.1000fc38
push dword [ebp - 0x1c]
call fcn.1000ea7a
pop ecx
push dword [ebp + 8]
call dword [0x10059150]
pop esi
pop ebx
leave
ret 4