joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100999e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x666d6654
push eax
push 0x10120650
mov dword [ebp - 0x10], 0x62517564
mov dword [ebp - 0xc], 0x7575666d
mov word [ebp - 8], 0x66
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10120650
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x10099a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x43756654
push eax
push 0x101205f8
mov dword [ebp - 0xc], 0x6d70446c
mov word [ebp - 8], 0x7370
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101205f8
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x10099ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x45756654
push eax
push 0x101205ac
mov dword [ebp - 0xc], 0x756a434a
mov word [ebp - 8], 0x74
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101205ac
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x10099b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x46756654
push eax
push 0x1012021c
mov dword [ebp - 0x10], 0x6750656f
mov dword [ebp - 0xc], 0x666d6a47
mov byte [ebp - 8], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1012021c
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x10099c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x47756654
push eax
push 0x1011fcf8
mov dword [ebp - 0x10], 0x51666d6a
mov dword [ebp - 0xc], 0x756f6a70
mov word [ebp - 8], 0x7366
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011fcf8
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x10099d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x49756654
push eax
push 0x10120040
mov dword [ebp - 0x10], 0x6d656f62
mov dword [ebp - 0xc], 0x76704466
mov word [ebp - 8], 0x756f
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10120040
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret
Function at 0x10099d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4d756654
push eax
push 0x1011fb80
mov dword [ebp - 0x10], 0x46757462
mov dword [ebp - 0xc], 0x73707373
mov byte [ebp - 8], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011fb80
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x10099dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100d2bd0]
lea eax, [ebp - 0x20]
push 0x1a
push eax
push 0x101207fc
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x7075716a
mov dword [ebp - 0xc], 0x64624573
mov word [ebp - 8], 0x6d
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101207fc
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x10099e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100d2bd0]
lea eax, [ebp - 0x20]
push 0x1a
push eax
push 0x10120688
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x7075716a
mov dword [ebp - 0xc], 0x64625473
mov word [ebp - 8], 0x6d
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10120688
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x10099e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x54756654
push eax
push 0x101201d8
mov dword [ebp - 0x10], 0x62496575
mov dword [ebp - 0xc], 0x666d656f
mov byte [ebp - 8], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101201d8
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x10099ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x55756654
push eax
push 0x101205e8
mov dword [ebp - 0x10], 0x44757966
mov dword [ebp - 0xc], 0x73706d70
mov byte [ebp - 8], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101205e8
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x10099f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x6d666954
push eax
push 0x10120c0c
mov dword [ebp - 0x10], 0x6679466d
mov dword [ebp - 0xc], 0x66757664
mov word [ebp - 8], 0x42
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10120c0c
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret
Function at 0x1009a090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x6d666954
push eax
push 0x10120bfc
mov dword [ebp - 0x10], 0x6679466d
mov dword [ebp - 0xc], 0x66757664
mov word [ebp - 8], 0x58
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10120bfc
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009a0f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x78706954
push eax
push 0x101204c4
mov dword [ebp - 0xc], 0x656f6a58
mov word [ebp - 8], 0x7870
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101204c4
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009a190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x73627554
push eax
push 0x1012090c
mov dword [ebp - 0x10], 0x73665475
mov dword [ebp - 0xc], 0x66646a77
mov word [ebp - 8], 0x42
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1012090c
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009a1f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x73627554
push eax
push 0x1012091c
mov dword [ebp - 0x10], 0x73665475
mov dword [ebp - 0xc], 0x66646a77
mov word [ebp - 8], 0x58
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1012091c
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009a2f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66737554
push eax
push 0x10120660
mov dword [ebp - 0xc], 0x43696475
mov word [ebp - 8], 0x756d
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10120660
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009a570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x6f567055
push eax
push 0x101202bc
mov dword [ebp - 0xc], 0x6570646a
mov word [ebp - 8], 0x66
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101202bc
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret
Function at 0x1009a840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x624e6f56
push eax
push 0x1011f57c
mov dword [ebp - 0x10], 0x656f4271
mov dword [ebp - 0xc], 0x6562704d
mov byte [ebp - 8], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011f57c
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009a990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x62657156
push eax
push 0x101204d0
mov dword [ebp - 0x10], 0x6a586675
mov dword [ebp - 0xc], 0x7870656f
mov byte [ebp - 8], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101204d0
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009aa30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x52736657
push eax
push 0x1011f59c
mov dword [ebp - 0x10], 0x7a736676
mov dword [ebp - 0xc], 0x766d6257
mov word [ebp - 8], 0x4266
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011f59c
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009aa90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x52736657
push eax
push 0x1011f58c
mov dword [ebp - 0x10], 0x7a736676
mov dword [ebp - 0xc], 0x766d6257
mov word [ebp - 8], 0x5866
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011f58c
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009aaf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x1011f634
mov dword [ebp - 0x10], 0x426d6276
mov dword [ebp - 0xc], 0x64706d6d
mov byte [ebp - 8], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011f634
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009ab90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x1011fc24
mov dword [ebp - 0x10], 0x476d6276
mov dword [ebp - 0xc], 0x46666673
mov word [ebp - 8], 0x79
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011fc24
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret
Function at 0x1009ac40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x10120030
mov dword [ebp - 0x10], 0x526d6276
mov dword [ebp - 0xc], 0x7a736676
mov byte [ebp - 8], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10120030
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009ac90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x1011fb90
mov dword [ebp - 0x10], 0x526d6276
mov dword [ebp - 0xc], 0x7a736676
mov word [ebp - 8], 0x7946
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011fb90
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009ae30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x756a7358
push eax
push 0x101201e8
mov dword [ebp - 0x10], 0x6f704466
mov dword [ebp - 0xc], 0x666d7074
mov word [ebp - 8], 0x42
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x101201e8
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009ae90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x756a7358
push eax
push 0x1012020c
mov dword [ebp - 0x10], 0x6f704466
mov dword [ebp - 0xc], 0x666d7074
mov word [ebp - 8], 0x58
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1012020c
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009aef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x756a7358
push eax
push 0x1011f96c
mov dword [ebp - 0xc], 0x6d6a4766
mov word [ebp - 8], 0x66
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011f96c
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009af40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100d29e0]
lea eax, [ebp - 0x20]
push 0x1b
push eax
push 0x1011fec4
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x54666d6a
mov dword [ebp - 0xc], 0x6f6a7375
mov word [ebp - 8], 0x4268
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011fec4
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret
Function at 0x1009afa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100d29e0]
lea eax, [ebp - 0x20]
push 0x1b
push eax
push 0x1011fea8
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x54666d6a
mov dword [ebp - 0xc], 0x6f6a7375
mov word [ebp - 8], 0x5868
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011fea8
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009b190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66796a6e
push eax
push 0x1011f4bc
mov dword [ebp - 0xc], 0x706d4473
mov word [ebp - 8], 0x6674
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011f4bc
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009b370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66796a6e
push eax
push 0x1011f4b0
mov dword [ebp - 0xc], 0x66715073
mov word [ebp - 8], 0x6f
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011f4b0
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009b470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x666e6a75
push eax
push 0x1011f4f0
mov dword [ebp - 0x10], 0x46756654
mov dword [ebp - 0xc], 0x756f6677
mov byte [ebp - 8], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011f4f0
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009b510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66776278
push eax
push 0x1011f4a4
mov dword [ebp - 0xc], 0x71506f4a
mov word [ebp - 8], 0x6f66
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011f4a4
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009b5b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x71746f78
push eax
push 0x1011f38c
mov dword [ebp - 0xc], 0x756f6a73
mov word [ebp - 8], 0x4267
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011f38c
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret
Function at 0x1009b600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x71746f78
push eax
push 0x1011f398
mov dword [ebp - 0xc], 0x756f6a73
mov word [ebp - 8], 0x5867
mov byte [ebp - 6], 0
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1011f398
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009b650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x73717478
push eax
push 0x10120558
mov dword [ebp - 0xc], 0x67756f6a
mov word [ebp - 8], 0x42
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10120558
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x1009b6a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e716c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x73717478
push eax
push 0x10120540
mov dword [ebp - 0xc], 0x67756f6a
mov word [ebp - 8], 0x58
call fcn.1009c580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x10120540
call fcn.1007a7c6
mov esp, ebp
pop ebp
ret

Function at 0x100b92ea
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100b8faa

Function at 0x100b97ea
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100b96ef
Function at 0x4024bc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412320]
jne 0x4024c6
repz ret
jmp fcn.00403ae7

Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call fcn.00407326
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call fcn.004031c2
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call fcn.004031c2
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call fcn.00403fef
pop ecx
call sub.KERNEL32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call fcn.00406c32
test eax, eax
jge 0x4032a5
push 8
call fcn.00403fef
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call fcn.00403fef
pop ecx
push 1
call fcn.004040ae
pop ecx
test eax, eax
je 0x4032c9
push eax
call fcn.00403fef
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call fcn.0040425f
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call 0x545000
jmp 0x4031eb
Function at 0x10001ff0
Capabilities:
Get system information on windows

Disassembly:
lea eax, [esp - 0x24]
sub esp, 0x24
test eax, eax
je 0x10002028
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000201e
lea ecx, [esp]
push ecx
call eax
jmp 0x10002028
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [esp]
cmp ax, 9
je 0x1000203d
cmp ax, 6
mov eax, 0x20
jne 0x10002042
mov eax, 0x40
add esp, 0x24
ret

Function at 0x10002050
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10014004]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x208
lea eax, [esp + 8]
push 0
push eax
mov esi, ecx
call fcn.1000a3d0
mov edx, dword [esp + 0x220]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 1
push 0
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x100020b0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.10005252
add esp, 0x20c
ret
push edi
lea edi, [esp + 8]
add edi, 0xfffffffe
jmp 0x100020c0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100020c0
mov eax, dword [0x100122bc]
mov dword [edi], eax
mov eax, esi
mov edx, esi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100020d7
lea edi, [esp + 8]
sub eax, edx
add edi, 0xfffffffe
jmp 0x100020f0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x100020f0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10002125
push eax
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, 0x82
lea esi, [esp + 8]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.10005252
add esp, 0x20c
ret