joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ad36b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100db688]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x5c]
mov dword [edi], 0xb18c5a78
mov dword [edi + 4], 0x34f1cc93
mov dword [edi + 8], 0x26a862d
mov dword [edi + 0xc], 0xb47b5e45
mov dword [edi + 0x10], 0x8a1fb40b
mov dword [edi + 0x14], 0x96d88b7f
mov dword [edi + 0x18], 0x4f9fa12d
mov dword [edi + 0x1c], 0x89f60427
mov dword [edi + 0x20], 0x88328cf0
mov dword [edi + 0x24], 0xc8445ffd
mov dword [edi + 0x28], 0x43e99d4c
mov dword [edi + 0x2c], 0x7777fbd8
mov dword [edi + 0x30], 0xace3eeae
mov dword [edi + 0x34], 0xfbb86346
mov dword [edi + 0x38], 0x2eecb99
mov dword [edi + 0x3c], 0x4632ce24
mov dword [edi + 0x40], 0xd675abc6
mov dword [edi + 0x44], 0x5993d793
mov dword [edi + 0x48], 0xefae7b7d
mov dword [edi + 0x4c], 0x53821f02
mov dword [edi + 0x50], 0x13d3578e
mov word [edi + 0x54], 0x5633
mov byte [edi + 0x56], 0x35
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [edi + 0x58], 0
mov ecx, esi
mov eax, dword [esi]
push esi
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x736d6864
mov dword [ebp - 0x18], 0xc
mov dword [esi + 4], eax
call fcn.10032420
mov eax, dword [esi]
movq xmm0, qword [ebp - 0x1c]
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10032c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x100db688]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100df238
mov dword [ebp - 0xf4], 0x2d002d
lea esi, [ebp - 0xf4]
mov dword [ebp - 0xf0], 0x6c0064
push edi
mov dword [ebp - 0xec], 0x3d006c
mov edx, 0x78
mov dword [ebp - 0xe8], 0x730025
sub esi, eax
mov dword [ebp - 0xe4], 0x2d0020
mov dword [ebp - 0xe0], 0x65002d
mov dword [ebp - 0xdc], 0x74006e
mov dword [ebp - 0xd8], 0x790072
mov dword [ebp - 0xd4], 0x52003d
mov dword [ebp - 0xd0], 0x6e0075
mov dword [ebp - 0xcc], 0x420054
mov dword [ebp - 0xc8], 0x2d0020
mov dword [ebp - 0xc4], 0x68002d
mov dword [ebp - 0xc0], 0x6e0077
mov dword [ebp - 0xbc], 0x3d0064
mov dword [ebp - 0xb8], 0x700025
mov dword [ebp - 0xb4], 0x2d0020
mov dword [ebp - 0xb0], 0x66002d
mov dword [ebp - 0xac], 0x6c0069
mov dword [ebp - 0xa8], 0x6d0065
mov dword [ebp - 0xa4], 0x700061
mov dword [ebp - 0xa0], 0x22003d
mov dword [ebp - 0x9c], 0x730025
mov dword [ebp - 0x98], 0x200022
mov dword [ebp - 0x94], 0x2d002d
mov dword [ebp - 0x90], 0x65006c
mov dword [ebp - 0x8c], 0x67006e
mov dword [ebp - 0x88], 0x680074
mov dword [ebp - 0x84], 0x25003d
mov dword [ebp - 0x80], 0x200075
mov dword [ebp - 0x7c], 0x2d002d
mov dword [ebp - 0x78], 0x630069
mov dword [ebp - 0x74], 0x6e006f
mov dword [ebp - 0x70], 0x70005f
mov dword [ebp - 0x6c], 0x740061
mov dword [ebp - 0x68], 0x3d0068
mov dword [ebp - 0x64], 0x250022
mov dword [ebp - 0x60], 0x220073
mov dword [ebp - 0x5c], 0x2d0020
mov dword [ebp - 0x58], 0x74002d
mov dword [ebp - 0x54], 0x750068
mov dword [ebp - 0x50], 0x62006d
mov dword [ebp - 0x4c], 0x61006e
mov dword [ebp - 0x48], 0x6c0069
mov dword [ebp - 0x44], 0x70005f
mov dword [ebp - 0x40], 0x740061
mov dword [ebp - 0x3c], 0x3d0068
mov dword [ebp - 0x38], 0x250022
mov dword [ebp - 0x34], 0x220073
mov dword [ebp - 0x30], 0x2d0020
mov dword [ebp - 0x2c], 0x70002d
mov dword [ebp - 0x28], 0x650072
mov dword [ebp - 0x24], 0x690076
mov dword [ebp - 0x20], 0x770065
mov dword [ebp - 0x1c], 0x70005f
mov dword [ebp - 0x18], 0x740061
mov dword [ebp - 0x14], 0x3d0068
mov dword [ebp - 0x10], 0x250022
mov dword [ebp - 0xc], 0x220073
mov dword [ebp - 8], 0x20
lea ecx, [edx + 0x7fffff86]
test ecx, ecx
je 0x10032e51
movzx ecx, word [esi + eax]
test cx, cx
je 0x10032e51
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10032e33
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061c7c
mov esp, ebp
pop ebp
ret
Function at 0x10033300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [0x100db688]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.100906cc
cdq
mov edi, 0x64
idiv edi
cmp edx, dword [ebp + 0x10]
jl 0x100333cb
call fcn.1002b310
test eax, eax
je 0x100333cb
xor eax, eax
mov dword [ebp - 0x2c], 0x64004c
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x100df028
mov dword [ebp - 0x28], 0x4c0073
mov dword [ebp - 0x24], 0x6e0069
mov edx, 0x104
mov dword [ebp - 0x20], 0x50006b
sub esi, eax
mov dword [ebp - 0x1c], 0x70006f
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x430064
mov dword [ebp - 0x10], 0x61006c
mov dword [ebp - 0xc], 0x730073
nop
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x100333ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x100333ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10033390
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061c7c
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, esi
cmp esi, ebx
cmovbe eax, ebx
cmovbe ebx, esi
mov dword [ebp - 0x1b0], eax
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.100906ed
mov ecx, 0x1f
lea edi, [ebp - 0xac]
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
add esp, 4
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea esi, [ebp - 0xac]
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10033410
push 0x100
lea eax, [ebp - 0x1ac]
sub esi, ecx
push 0
push eax
sar esi, 1
call fcn.10081e40
add esp, 0xc
call fcn.100906cc
mov ecx, dword [ebp - 0x1b0]
xor edx, edx
sub ecx, ebx
div ecx
mov eax, 0x7f
mov ebx, edx
add ebx, dword [ebp + 0xc]
cmp ebx, eax
cmovg ebx, eax
xor edi, edi
test ebx, ebx
jle 0x1003347e
nop dword [eax + eax]
call fcn.100906cc
xor edx, edx
div esi
mov ax, word [ebp + edx*2 - 0xac]
mov word [ebp + edi*2 - 0x1ac], ax
inc edi
cmp edi, ebx
jl 0x10033460
lea eax, [ebp - 0x1ac]
push eax
push 0x103
push 0x100df028
call fcn.1009045d
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.10061c7c
mov esp, ebp
pop ebp
ret
Function at 0x1003d770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x100db688]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.100906cc
cdq
mov ecx, 0x64
idiv ecx
cmp edx, dword [ebp + 0x10]
jl 0x1003d8c1
lea eax, [ebp - 0x1c4]
mov dword [ebp - 0x1c4], 0
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x360033
push eax
mov dword [ebp - 0x1c], 0x740030
mov dword [ebp - 0x18], 0x610072
mov dword [ebp - 0x14], 0x2e0079
mov dword [ebp - 0x10], 0x780065
mov dword [ebp - 0xc], 0x65
call fcn.1002d520
mov esi, eax
mov dword [ebp - 0x1c4], 0
lea eax, [ebp - 0x1c4]
mov dword [ebp - 0x40], 0x360033
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], 0x730030
push eax
mov dword [ebp - 0x38], 0x2e0064
mov dword [ebp - 0x34], 0x780065
mov dword [ebp - 0x30], 0x65
call fcn.1002d520
add esp, 0x10
test esi, esi
jne 0x1003d831
test eax, eax
je 0x1003d8c1
xor eax, eax
mov dword [ebp - 0x2c], 0x64004c
mov ecx, 0x100df358
mov dword [ebp - 0x28], 0x4c0073
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x50006b
mov edx, 0x104
mov dword [ebp - 0x1c], 0x70006f
sub esi, ecx
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x430064
mov dword [ebp - 0x10], 0x61006c
mov dword [ebp - 0xc], 0x730073
mov word [ebp - 8], ax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1003d8a3
movzx eax, word [esi + ecx]
test ax, ax
je 0x1003d8a3
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1003d885
test edx, edx
lea eax, [ecx - 2]
pop edi
cmovne eax, ecx
xor ecx, ecx
pop esi
pop ebx
mov word [eax], cx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061c7c
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
mov eax, edi
cmp edi, ebx
cmovbe eax, ebx
cmovbe ebx, edi
mov dword [ebp - 0x1c4], eax
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.100906ed
mov ecx, 0x1f
lea edi, [ebp - 0xc0]
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
add esp, 4
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea esi, [ebp - 0xc0]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1003d903
push 0x100
lea eax, [ebp - 0x1c0]
sub esi, ecx
push 0
push eax
sar esi, 1
call fcn.10081e40
add esp, 0xc
call fcn.100906cc
mov ecx, dword [ebp - 0x1c4]
xor edx, edx
sub ecx, ebx
div ecx
mov eax, 0x7f
mov ebx, edx
add ebx, dword [ebp + 0xc]
cmp ebx, eax
cmovg ebx, eax
xor edi, edi
test ebx, ebx
jle 0x1003d96e
nop
call fcn.100906cc
xor edx, edx
div esi
mov ax, word [ebp + edx*2 - 0xc0]
mov word [ebp + edi*2 - 0x1c0], ax
inc edi
cmp edi, ebx
jl 0x1003d950
lea eax, [ebp - 0x1c0]
push eax
push 0x103
push 0x100df358
call fcn.1009045d
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10061c7c
mov esp, ebp
pop ebp
ret
Function at 0x1003eb00
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
push str.RunDll.exe
push esi
call fcn.10090557
add esp, 8
test eax, eax
je 0x1003eb4a
push str.32.exe
push esi
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x1003eb43
push str.taskpop.exe
push esi
call fcn.10090557
add esp, 8
test eax, eax
jne 0x1003eb4a
pop esi
pop ebp
jmp fcn.10020ac0
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100438f0
Capabilities:
Encode data using base64 via winapi
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, ecx
push esi
push edi
mov dword [ebp - 8], eax
mov ebx, dword [eax + 0x60]
mov edi, dword [eax + 0x5c]
sub ebx, edi
mov dword [ebp - 0x14], ebx
je 0x10043a12
push ebx
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
call fcn.10088bb3
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
test esi, esi
je 0x10043a12
push ebx
push edi
push esi
call fcn.10081340
add esp, 0xc
xor edi, edi
test ebx, ebx
je 0x100439b2
mov eax, 0xd41d41d5
mov esi, edi
mul edi
mov eax, edi
mov ecx, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x23
sub esi, eax
mov eax, 0x2f684bdb
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1b
sub ecx, eax
mov eax, dword [ebp - 8]
mov bl, byte [esi + eax + 0x34]
mov esi, eax
mov eax, 0xf0f0f0f1
mul edi
xor bl, byte [ecx + esi + 0x19]
mov eax, edi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
xor bl, byte [eax + esi + 8]
mov eax, edi
and eax, 7
xor bl, byte [eax + esi]
mov esi, dword [ebp - 0xc]
xor byte [edi + esi], bl
inc edi
mov ebx, dword [ebp - 0x14]
cmp edi, ebx
jb 0x10043944
lea eax, [ebp - 4]
push eax
push 0
push 0x40000001
push ebx
push esi
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call esi
push dword [ebp - 4]
call fcn.1006190b
mov edi, dword [ebp - 0xc]
lea ecx, [ebp - 4]
add esp, 4
mov dword [ebp - 8], eax
push ecx
push eax
push 0x40000001
push ebx
push edi
call esi
mov esi, dword [ebp - 8]
test eax, eax
je 0x100439f9
push esi
call fcn.10093c7c
add esp, 4
mov dword [ebp - 0x10], eax
push edi
call fcn.10088bae
push esi
call fcn.10061914
mov eax, dword [ebp - 0x10]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10043cd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100aeaf0
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x100db688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 8], 0
je 0x10043e1b
cmp dword [ebx + 4], 0
je 0x10043e1b
push 0
push 0
push 0x12
push dword [ebx]
mov dword [ebx + 0xc], 1
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp dword [ebx + 8], 0
mov dword [ebp - 0x44], eax
je 0x10043e1b
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, dword [ebp - 0x44]
cmp eax, 0x1f4
jae 0x10043d5a
push 0xa
call edi
cmp dword [ebx + 8], 0
jne 0x10043d44
cmp dword [ebx + 8], 0
je 0x10043e1b
call fcn.100609e0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10043e1b
push 0x57
push str.d:jenkins.jenkinsworkspacepop_popex_poppop_popexpoppopworkthreadworkthread.cpp
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
call fcn.1000bdb0
push 3
push 0x100b3af0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000bdb0
call fcn.100609e0
mov edi, eax
lea ecx, [ebp - 0xdc]
push 0x82
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100090e0
mov esi, eax
push str.CWorkThread::Stop__wait_thread_stop_timeout_
push esi
call fcn.10009d60
add esp, 8
mov ecx, esi
push 0x1f4
call fcn.10010b30
mov edx, dword [edi]
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0xdc]
call fcn.10009fa0
lea ecx, [ebp - 0x28]
call fcn.10006b60
lea ecx, [ebp - 0x40]
call fcn.10006b60
mov ecx, dword [ebx + 0x34]
add ebx, 0x10
test ecx, ecx
je 0x10043e3a
mov edx, dword [ecx]
cmp ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebx + 0x24], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061c7c
mov esp, ebp
pop ebp
ret
Function at 0x10044390
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100abfcb
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x100db688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 4], 0
je 0x100444e2
push 0
push 0
push 0x12
push dword [esi]
mov dword [esi + 0xc], 1
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [esi + 8], 0
mov dword [ebp - 0x44], eax
je 0x100444e6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
call edi
sub eax, dword [ebp - 0x44]
cmp eax, dword [ebp + 8]
jae 0x10044414
push 0xa
call ebx
cmp dword [esi + 8], 0
jne 0x10044400
cmp dword [esi + 8], 0
je 0x100444e6
call fcn.100609e0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x100444e2
push 0x57
push str.d:jenkins.jenkinsworkspacepop_popex_poppop_popexpoppopworkthreadworkthread.cpp
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
call fcn.1000bdb0
push 3
push 0x100b3af0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000bdb0
mov byte [ebp - 4], 1
call fcn.100609e0
mov edi, eax
lea ecx, [ebp - 0xdc]
push 0x82
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100090e0
mov esi, eax
push str.CWorkThread::Stop__wait_thread_stop_timeout_
push esi
mov byte [ebp - 4], 2
call fcn.10009d60
add esp, 8
mov ecx, esi
push dword [ebp + 8]
call fcn.10010b30
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xdc]
call fcn.10009fa0
lea ecx, [ebp - 0x28]
call fcn.10006b60
lea ecx, [ebp - 0x40]
call fcn.10006b60
xor eax, eax
jmp 0x100444eb
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061c7c
mov esp, ebp
pop ebp
ret 4
Function at 0x100485f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x100db688]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x60], 0x690051
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x60]
mov eax, 0x100df9f0
mov dword [ebp - 0x5c], 0x6f0068
push edi
mov dword [ebp - 0x58], 0x20006f
mov edx, 0x2d
mov dword [ebp - 0x54], 0x360033
sub esi, eax
mov dword [ebp - 0x50], 0x200030
mov dword [ebp - 0x4c], 0x6f0053
mov dword [ebp - 0x48], 0x740066
mov dword [ebp - 0x44], 0x610077
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x280020
mov dword [ebp - 0x38], 0x650042
mov dword [ebp - 0x34], 0x6a0069
mov dword [ebp - 0x30], 0x6e0069
mov dword [ebp - 0x2c], 0x290067
mov dword [ebp - 0x28], 0x430020
mov dword [ebp - 0x24], 0x6d006f
mov dword [ebp - 0x20], 0x610070
mov dword [ebp - 0x1c], 0x79006e
mov dword [ebp - 0x18], 0x4c0020
mov dword [ebp - 0x14], 0x6d0069
mov dword [ebp - 0x10], 0x740069
mov dword [ebp - 0xc], 0x640065
lea ecx, [edx + 0x7fffffd1]
test ecx, ecx
je 0x100486d0
movzx ecx, word [esi + eax]
test cx, cx
je 0x100486d0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100486b2
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061c7c
mov esp, ebp
pop ebp
ret
Function at 0x1004c9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af078
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100db688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], 0x720054
mov dword [ebp - 0x58], 0x630061
mov dword [ebp - 0x54], 0x6c0065
mov dword [ebp - 0x50], 0x730065
mov dword [ebp - 0x4c], 0x630073
mov dword [ebp - 0x48], 0x610068
mov dword [ebp - 0x44], 0x430074
mov dword [ebp - 0x40], 0x6e006f
mov dword [ebp - 0x3c], 0x690066
mov dword [ebp - 0x38], 0x430067
mov dword [ebp - 0x34], 0x6e0065
mov dword [ebp - 0x30], 0x650074
mov dword [ebp - 0x2c], 0x570072
mov dword [ebp - 0x28], 0x64006e
mov dword [ebp - 0x24], 0x6c0043
mov dword [ebp - 0x20], 0x730061
mov dword [ebp - 0x1c], 0x4e0073
mov dword [ebp - 0x18], 0x6d0061
mov dword [ebp - 0x14], 0x65
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x1004cac2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100075c0
test al, al
jne 0x1004caa2
lea ecx, [ebp - 0x5c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004ca87
sub ecx, edx
lea eax, [ebp - 0x5c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10007260
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061c7c
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10006cd0
int3
Function at 0x1004cba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af0ab
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x100db688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], 0x740068
mov dword [ebp - 0xbc], 0x700074
mov dword [ebp - 0xb8], 0x2f003a
mov dword [ebp - 0xb4], 0x63002f
mov dword [ebp - 0xb0], 0x6e0064
mov dword [ebp - 0xac], 0x61002d
mov dword [ebp - 0xa8], 0x69006c
mov dword [ebp - 0xa4], 0x66002d
mov dword [ebp - 0xa0], 0x6c0069
mov dword [ebp - 0x9c], 0x2d0065
mov dword [ebp - 0x98], 0x680073
mov dword [ebp - 0x94], 0x2e0063
mov dword [ebp - 0x90], 0x6f0064
mov dword [ebp - 0x8c], 0x70006c
mov dword [ebp - 0x88], 0x690068
mov dword [ebp - 0x84], 0x70006e
mov dword [ebp - 0x80], 0x700061
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x63002e
mov dword [ebp - 0x74], 0x6d006f
mov dword [ebp - 0x70], 0x63002f
mov dword [ebp - 0x6c], 0x73006d
mov dword [ebp - 0x68], 0x70002f
mov dword [ebp - 0x64], 0x6f0072
mov dword [ebp - 0x60], 0x65006a
mov dword [ebp - 0x5c], 0x740063
mov dword [ebp - 0x58], 0x31005f
mov dword [ebp - 0x54], 0x380030
mov dword [ebp - 0x50], 0x63002f
mov dword [ebp - 0x4c], 0x670066
mov dword [ebp - 0x48], 0x63005f
mov dword [ebp - 0x44], 0x6e0065
mov dword [ebp - 0x40], 0x650074
mov dword [ebp - 0x3c], 0x2f0072
mov dword [ebp - 0x38], 0x6f0064
mov dword [ebp - 0x34], 0x70006c
mov dword [ebp - 0x30], 0x690068
mov dword [ebp - 0x2c], 0x5f006e
mov dword [ebp - 0x28], 0x6f006d
mov dword [ebp - 0x24], 0x5f0064
mov dword [ebp - 0x20], 0x69006c
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x6a002e
mov dword [ebp - 0x14], 0x73
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x1004cdbe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0xc0]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100075c0
test al, al
jne 0x1004cd9e
lea ecx, [ebp - 0xc0]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004cd80
sub ecx, edx
lea eax, [ebp - 0xc0]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10007260
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061c7c
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10006cd0
int3
Function at 0x1004d1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af15b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x100db688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0x6f0043
mov dword [ebp - 0x8c], 0x66006e
mov dword [ebp - 0x88], 0x670069
mov dword [ebp - 0x84], 0x650043
mov dword [ebp - 0x80], 0x74006e
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x690053
mov dword [ebp - 0x74], 0x6c006e
mov dword [ebp - 0x70], 0x650067
mov dword [ebp - 0x6c], 0x6e0049
mov dword [ebp - 0x68], 0x740073
mov dword [ebp - 0x64], 0x6e0061
mov dword [ebp - 0x60], 0x650063
mov dword [ebp - 0x5c], 0x32005f
mov dword [ebp - 0x58], 0x430041
mov dword [ebp - 0x54], 0x350045
mov dword [ebp - 0x50], 0x300043
mov dword [ebp - 0x4c], 0x2d0045
mov dword [ebp - 0x48], 0x440037
mov dword [ebp - 0x44], 0x310046
mov dword [ebp - 0x40], 0x34002d
mov dword [ebp - 0x3c], 0x460038
mov dword [ebp - 0x38], 0x2d0031
mov dword [ebp - 0x34], 0x380042
mov dword [ebp - 0x30], 0x420035
mov dword [ebp - 0x2c], 0x44002d
mov dword [ebp - 0x28], 0x370031
mov dword [ebp - 0x24], 0x460031
mov dword [ebp - 0x20], 0x300030
mov dword [ebp - 0x1c], 0x420031
mov dword [ebp - 0x18], 0x460042
mov dword [ebp - 0x14], 0x43
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x1004d33e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100075c0
test al, al
jne 0x1004d31e
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004d300
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10007260
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061c7c
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10006cd0
int3