joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10090640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x6d666954
push eax
push 0x101166f0
mov dword [ebp - 0x10], 0x6679466d
mov dword [ebp - 0xc], 0x66757664
mov word [ebp - 8], 0x58
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101166f0
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x100906a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x78706954
push eax
push 0x10115fb8
mov dword [ebp - 0xc], 0x656f6a58
mov word [ebp - 8], 0x7870
mov byte [ebp - 6], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115fb8
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10090740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x73627554
push eax
push 0x10116400
mov dword [ebp - 0x10], 0x73665475
mov dword [ebp - 0xc], 0x66646a77
mov word [ebp - 8], 0x42
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10116400
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x100907a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x73627554
push eax
push 0x10116410
mov dword [ebp - 0x10], 0x73665475
mov dword [ebp - 0xc], 0x66646a77
mov word [ebp - 8], 0x58
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10116410
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x100908a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66737554
push eax
push 0x10116154
mov dword [ebp - 0xc], 0x43696475
mov word [ebp - 8], 0x756d
mov byte [ebp - 6], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10116154
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10090b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x6f567055
push eax
push 0x10115db0
mov dword [ebp - 0xc], 0x6570646a
mov word [ebp - 8], 0x66
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115db0
call fcn.10064e61
mov esp, ebp
pop ebp
ret
Function at 0x10090df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x624e6f56
push eax
push 0x10115070
mov dword [ebp - 0x10], 0x656f4271
mov dword [ebp - 0xc], 0x6562704d
mov byte [ebp - 8], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115070
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10090f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x62657156
push eax
push 0x10115fc4
mov dword [ebp - 0x10], 0x6a586675
mov dword [ebp - 0xc], 0x7870656f
mov byte [ebp - 8], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115fc4
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10090ff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x52736657
push eax
push 0x10115090
mov dword [ebp - 0x10], 0x7a736676
mov dword [ebp - 0xc], 0x766d6257
mov word [ebp - 8], 0x4266
mov byte [ebp - 6], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115090
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10091050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x52736657
push eax
push 0x10115080
mov dword [ebp - 0x10], 0x7a736676
mov dword [ebp - 0xc], 0x766d6257
mov word [ebp - 8], 0x5866
mov byte [ebp - 6], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115080
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x100910b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x10115128
mov dword [ebp - 0x10], 0x426d6276
mov dword [ebp - 0xc], 0x64706d6d
mov byte [ebp - 8], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115128
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10091150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x10115718
mov dword [ebp - 0x10], 0x476d6276
mov dword [ebp - 0xc], 0x46666673
mov word [ebp - 8], 0x79
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115718
call fcn.10064e61
mov esp, ebp
pop ebp
ret
Function at 0x10091200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x10115b24
mov dword [ebp - 0x10], 0x526d6276
mov dword [ebp - 0xc], 0x7a736676
mov byte [ebp - 8], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115b24
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10091250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x10115684
mov dword [ebp - 0x10], 0x526d6276
mov dword [ebp - 0xc], 0x7a736676
mov word [ebp - 8], 0x7946
mov byte [ebp - 6], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115684
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x100913f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x756a7358
push eax
push 0x10115cdc
mov dword [ebp - 0x10], 0x6f704466
mov dword [ebp - 0xc], 0x666d7074
mov word [ebp - 8], 0x42
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115cdc
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10091450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x756a7358
push eax
push 0x10115d00
mov dword [ebp - 0x10], 0x6f704466
mov dword [ebp - 0xc], 0x666d7074
mov word [ebp - 8], 0x58
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115d00
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x100914b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x756a7358
push eax
push 0x10115460
mov dword [ebp - 0xc], 0x6d6a4766
mov word [ebp - 8], 0x66
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10115460
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10091500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100e5990]
lea eax, [ebp - 0x20]
push 0x1b
push eax
push 0x101159b8
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x54666d6a
mov dword [ebp - 0xc], 0x6f6a7375
mov word [ebp - 8], 0x4268
mov byte [ebp - 6], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101159b8
call fcn.10064e61
mov esp, ebp
pop ebp
ret
Function at 0x10091560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100e5990]
lea eax, [ebp - 0x20]
push 0x1b
push eax
push 0x1011599c
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x54666d6a
mov dword [ebp - 0xc], 0x6f6a7375
mov word [ebp - 8], 0x5868
mov byte [ebp - 6], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011599c
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10091750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66796a6e
push eax
push 0x10114fb0
mov dword [ebp - 0xc], 0x706d4473
mov word [ebp - 8], 0x6674
mov byte [ebp - 6], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10114fb0
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10091930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66796a6e
push eax
push 0x10114fa4
mov dword [ebp - 0xc], 0x66715073
mov word [ebp - 8], 0x6f
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10114fa4
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10091a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x666e6a75
push eax
push 0x10114fe4
mov dword [ebp - 0x10], 0x46756654
mov dword [ebp - 0xc], 0x756f6677
mov byte [ebp - 8], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10114fe4
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10091ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66776278
push eax
push 0x10114f98
mov dword [ebp - 0xc], 0x71506f4a
mov word [ebp - 8], 0x6f66
mov byte [ebp - 6], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10114f98
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10091b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x71746f78
push eax
push 0x10114e80
mov dword [ebp - 0xc], 0x756f6a73
mov word [ebp - 8], 0x4267
mov byte [ebp - 6], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10114e80
call fcn.10064e61
mov esp, ebp
pop ebp
ret
Function at 0x10091bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x71746f78
push eax
push 0x10114e8c
mov dword [ebp - 0xc], 0x756f6a73
mov word [ebp - 8], 0x5867
mov byte [ebp - 6], 0
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10114e8c
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10091c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x73717478
push eax
push 0x1011604c
mov dword [ebp - 0xc], 0x67756f6a
mov word [ebp - 8], 0x42
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011604c
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10091c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x73717478
push eax
push 0x10116034
mov dword [ebp - 0xc], 0x67756f6a
mov word [ebp - 8], 0x58
call fcn.10092910
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10116034
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x100b30ad
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100b2f2c

Function at 0x100b6748
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100b664d
Function at 0x100bbb50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d29b8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], 0x720054
mov dword [ebp - 0x58], 0x630061
mov dword [ebp - 0x54], 0x6c0065
mov dword [ebp - 0x50], 0x730065
mov dword [ebp - 0x4c], 0x630073
mov dword [ebp - 0x48], 0x610068
mov dword [ebp - 0x44], 0x430074
mov dword [ebp - 0x40], 0x6e006f
mov dword [ebp - 0x3c], 0x690066
mov dword [ebp - 0x38], 0x430067
mov dword [ebp - 0x34], 0x6e0065
mov dword [ebp - 0x30], 0x650074
mov dword [ebp - 0x2c], 0x570072
mov dword [ebp - 0x28], 0x64006e
mov dword [ebp - 0x24], 0x6c0043
mov dword [ebp - 0x20], 0x730061
mov dword [ebp - 0x1c], 0x4e0073
mov dword [ebp - 0x18], 0x6d0061
mov dword [ebp - 0x14], 0x65
call fcn.100093c0
mov ecx, eax
test ecx, ecx
je 0x100bbc72
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10019a90
test al, al
jne 0x100bbc52
lea ecx, [ebp - 0x5c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100bbc37
sub ecx, edx
lea eax, [ebp - 0x5c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000aeb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10064e61
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10008920
int3
Function at 0x100bbc80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d29eb
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], 0x740068
mov dword [ebp - 0xbc], 0x700074
mov dword [ebp - 0xb8], 0x2f003a
mov dword [ebp - 0xb4], 0x63002f
mov dword [ebp - 0xb0], 0x6e0064
mov dword [ebp - 0xac], 0x61002d
mov dword [ebp - 0xa8], 0x69006c
mov dword [ebp - 0xa4], 0x66002d
mov dword [ebp - 0xa0], 0x6c0069
mov dword [ebp - 0x9c], 0x2d0065
mov dword [ebp - 0x98], 0x680073
mov dword [ebp - 0x94], 0x2e0063
mov dword [ebp - 0x90], 0x6f0064
mov dword [ebp - 0x8c], 0x70006c
mov dword [ebp - 0x88], 0x690068
mov dword [ebp - 0x84], 0x70006e
mov dword [ebp - 0x80], 0x700061
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x63002e
mov dword [ebp - 0x74], 0x6d006f
mov dword [ebp - 0x70], 0x63002f
mov dword [ebp - 0x6c], 0x73006d
mov dword [ebp - 0x68], 0x70002f
mov dword [ebp - 0x64], 0x6f0072
mov dword [ebp - 0x60], 0x65006a
mov dword [ebp - 0x5c], 0x740063
mov dword [ebp - 0x58], 0x31005f
mov dword [ebp - 0x54], 0x380030
mov dword [ebp - 0x50], 0x63002f
mov dword [ebp - 0x4c], 0x670066
mov dword [ebp - 0x48], 0x63005f
mov dword [ebp - 0x44], 0x6e0065
mov dword [ebp - 0x40], 0x650074
mov dword [ebp - 0x3c], 0x2f0072
mov dword [ebp - 0x38], 0x6f0064
mov dword [ebp - 0x34], 0x70006c
mov dword [ebp - 0x30], 0x690068
mov dword [ebp - 0x2c], 0x5f006e
mov dword [ebp - 0x28], 0x6f006d
mov dword [ebp - 0x24], 0x5f0064
mov dword [ebp - 0x20], 0x69006c
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x6a002e
mov dword [ebp - 0x14], 0x73
call fcn.100093c0
mov ecx, eax
test ecx, ecx
je 0x100bbe9e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0xc0]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10019a90
test al, al
jne 0x100bbe7e
lea ecx, [ebp - 0xc0]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100bbe60
sub ecx, edx
lea eax, [ebp - 0xc0]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000aeb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10064e61
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10008920
int3
Function at 0x100bc1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2a6b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0x6f0043
mov dword [ebp - 0x8c], 0x66006e
mov dword [ebp - 0x88], 0x670069
mov dword [ebp - 0x84], 0x650043
mov dword [ebp - 0x80], 0x74006e
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x690053
mov dword [ebp - 0x74], 0x6c006e
mov dword [ebp - 0x70], 0x650067
mov dword [ebp - 0x6c], 0x6e0049
mov dword [ebp - 0x68], 0x740073
mov dword [ebp - 0x64], 0x6e0061
mov dword [ebp - 0x60], 0x650063
mov dword [ebp - 0x5c], 0x32005f
mov dword [ebp - 0x58], 0x430041
mov dword [ebp - 0x54], 0x350045
mov dword [ebp - 0x50], 0x300043
mov dword [ebp - 0x4c], 0x2d0045
mov dword [ebp - 0x48], 0x440037
mov dword [ebp - 0x44], 0x310046
mov dword [ebp - 0x40], 0x34002d
mov dword [ebp - 0x3c], 0x460038
mov dword [ebp - 0x38], 0x2d0031
mov dword [ebp - 0x34], 0x380042
mov dword [ebp - 0x30], 0x420035
mov dword [ebp - 0x2c], 0x44002d
mov dword [ebp - 0x28], 0x370031
mov dword [ebp - 0x24], 0x460031
mov dword [ebp - 0x20], 0x300030
mov dword [ebp - 0x1c], 0x420031
mov dword [ebp - 0x18], 0x460042
mov dword [ebp - 0x14], 0x43
call fcn.100093c0
mov ecx, eax
test ecx, ecx
je 0x100bc35e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10019a90
test al, al
jne 0x100bc33e
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100bc320
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000aeb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10064e61
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10008920
int3
Function at 0x100bc830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0x740068
mov dword [ebp - 0x64], 0x700074
mov dword [ebp - 0x60], 0x2f003a
mov dword [ebp - 0x5c], 0x6c002f
mov dword [ebp - 0x58], 0x70002e
mov dword [ebp - 0x54], 0x620075
mov dword [ebp - 0x50], 0x69006c
mov dword [ebp - 0x4c], 0x2e0063
mov dword [ebp - 0x48], 0x610068
mov dword [ebp - 0x44], 0x6f006c
mov dword [ebp - 0x40], 0x610070
mov dword [ebp - 0x3c], 0x650070
mov dword [ebp - 0x38], 0x2e0072
mov dword [ebp - 0x34], 0x6e0063
mov dword [ebp - 0x30], 0x70002f
mov dword [ebp - 0x2c], 0x2f0063
mov dword [ebp - 0x28], 0x700075
mov dword [ebp - 0x24], 0x610064
mov dword [ebp - 0x20], 0x610074
mov dword [ebp - 0x1c], 0x64002f
mov dword [ebp - 0x18], 0x6d0075
mov dword [ebp - 0x14], 0x70
call fcn.100093c0
mov ecx, eax
test ecx, ecx
je 0x100bc96b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10019a90
test al, al
jne 0x100bc94b
lea ecx, [ebp - 0x68]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100bc930
sub ecx, edx
lea eax, [ebp - 0x68]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000aeb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10064e61
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10008920
int3
Function at 0x100bc980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2a6b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0x6f0043
mov dword [ebp - 0x8c], 0x66006e
mov dword [ebp - 0x88], 0x670069
mov dword [ebp - 0x84], 0x650043
mov dword [ebp - 0x80], 0x74006e
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x690053
mov dword [ebp - 0x74], 0x6c006e
mov dword [ebp - 0x70], 0x650067
mov dword [ebp - 0x6c], 0x6e0049
mov dword [ebp - 0x68], 0x740073
mov dword [ebp - 0x64], 0x6e0061
mov dword [ebp - 0x60], 0x650063
mov dword [ebp - 0x5c], 0x34005f
mov dword [ebp - 0x58], 0x310044
mov dword [ebp - 0x54], 0x390041
mov dword [ebp - 0x50], 0x340035
mov dword [ebp - 0x4c], 0x2d0036
mov dword [ebp - 0x48], 0x420032
mov dword [ebp - 0x44], 0x370036
mov dword [ebp - 0x40], 0x34002d
mov dword [ebp - 0x3c], 0x300045
mov dword [ebp - 0x38], 0x2d0034
mov dword [ebp - 0x34], 0x330039
mov dword [ebp - 0x30], 0x410041
mov dword [ebp - 0x2c], 0x31002d
mov dword [ebp - 0x28], 0x390041
mov dword [ebp - 0x24], 0x350041
mov dword [ebp - 0x20], 0x430035
mov dword [ebp - 0x1c], 0x310036
mov dword [ebp - 0x18], 0x410031
mov dword [ebp - 0x14], 0x39
call fcn.100093c0
mov ecx, eax
test ecx, ecx
je 0x100bcb1e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10019a90
test al, al
jne 0x100bcafe
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100bcae0
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000aeb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10064e61
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10008920
int3