joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100702e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2200
call fcn.10087c80
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21dc]
push eax
push 0x20019
push 0
push str.BCD00000000Objects
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10070320
xor al, al
jmp 0x1007056d
mov cl, byte [0x100d4c0f]
mov byte [ebp - 0x108], cl
push 0x103
push 0
lea edx, [ebp - 0x107]
push edx
call fcn.100a76a0
add esp, 0xc
mov dword [ebp - 0x21b0], 0x104
mov dword [ebp - 0x21ac], 0
mov dword [ebp - 0x21ec], 0
mov byte [ebp - 0x21e1], 0
mov dword [ebp - 0x21b8], 0xfa0
lea eax, [ebp - 0x21d8]
push eax
lea ecx, [ebp - 0x21bc]
push ecx
lea edx, [ebp - 0x21c0]
push edx
lea eax, [ebp - 0x21c4]
push eax
lea ecx, [ebp - 0x21c8]
push ecx
lea edx, [ebp - 0x21cc]
push edx
lea eax, [ebp - 0x21d0]
push eax
lea ecx, [ebp - 0x21ac]
push ecx
push 0
lea edx, [ebp - 0x21b0]
push edx
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x21dc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x21ec], eax
cmp dword [ebp - 0x21ac], 0
je 0x1007055a
mov dword [ebp - 0x21e8], 0
jmp 0x100703f4
mov edx, dword [ebp - 0x21e8]
add edx, 1
mov dword [ebp - 0x21e8], edx
mov eax, dword [ebp - 0x21e8]
cmp eax, dword [ebp - 0x21ac]
jae 0x1007055a
mov dword [ebp - 0x21b4], 0xff
lea ecx, [ebp - 0x21d8]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x21b4]
push edx
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21e8]
push ecx
mov edx, dword [ebp - 0x21dc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x21ec], eax
cmp dword [ebp - 0x21ec], 0
jne 0x10070555
lea eax, [ebp - 0x208]
push eax
push str.BCD00000000Objects_sElements16000049
push 0x2000
lea ecx, [ebp - 0x1208]
push ecx
call fcn.1009dec0
add esp, 0x10
lea edx, [ebp - 0x21e0]
push edx
push 1
push 0
lea eax, [ebp - 0x1208]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 0x3cc]
mov dword [ebp - 0x21f0], edx
mov ecx, dword [ebp - 0x21f0]
call dword [0x100e7c9c]
call dword [ebp - 0x21f0]
mov dword [ebp - 0x21fc], eax
cmp dword [ebp - 0x21fc], 0
jne 0x10070555
lea eax, [ebp - 0x21b8]
push eax
lea ecx, [ebp - 0x21a8]
push ecx
push 0
push 0
push str.Element
mov edx, dword [ebp - 0x21e0]
push edx
mov eax, dword [0x101034a4]
mov ecx, dword [eax + 0x3d0]
mov dword [ebp - 0x21f4], ecx
mov ecx, dword [ebp - 0x21f4]
call dword [0x100e7c9c]
call dword [ebp - 0x21f4]
mov dword [ebp - 0x2200], eax
cmp dword [ebp - 0x2200], 0
jne 0x10070529
mov edx, 4
imul eax, edx, 0
cmp dword [ebp + eax - 0x21a8], 1
jne 0x10070529
mov byte [ebp - 0x21e1], 1
mov ecx, dword [ebp - 0x21e0]
push ecx
mov edx, dword [0x101034a4]
mov eax, dword [edx + 0x3d4]
mov dword [ebp - 0x21f8], eax
mov ecx, dword [ebp - 0x21f8]
call dword [0x100e7c9c]
call dword [ebp - 0x21f8]
nop
jmp 0x100703e5
mov ecx, dword [ebp - 0x21dc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x21e1]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x100710b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c757d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x40]
call fcn.100114c0
mov dword [ebp - 4], 0
mov byte [ebp - 0x38], 0x44
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x62
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x67
mov byte [ebp - 0x33], 0x67
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x44
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x3b
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x43
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x3a
mov byte [ebp - 0x1c], 0x20
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], pe_nt_image_headers32
mov byte [ebp - 0x19], 0x39
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x30
mov byte [ebp - 0x12], 0x36
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 0x60]
mov dword [ebp - 0x44], edx
mov ecx, dword [ebp - 0x44]
call dword [0x100e7c9c]
call dword [ebp - 0x44]
nop
cmp dword [ebp - 0x3c], 0
je 0x100711db
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5192
push 1
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.100114e0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10071345
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x10071343
jmp 0x1007133e
call fcn.10071345
jae 0x1007133e
add esp, 4
jmp 0x1007134a
dec dword [esp]
jno 0x1007134f
jns 0x1007133a
jp 0x10071353
add esp, 4
popf
jmp 0x1007135a
clc
jae 0x1007135f
dec esp
out 0x50, eax
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10071378
jne 0x10071378
out 0x7c, eax
add ebp, ebx
add esp, edi
jl 0x1007137d
jmp 0x1007137f
je 0x1007137a
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10071399
jne 0x10071398
call 0x930b0420
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100713a7
jne 0x100713a7
call 0x35eb5971
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
call dword [0x100e7c9c]
call dword [ebp - 0x20]
pushf
push 0xa
jae 0x1007142c
pop es
jmp 0x10071427
call 0x1007142e
jae 0x10071427
add esp, 4
jmp 0x10071433
dec dword [esp]
jno 0x10071438
jns 0x10071423
jp 0x1007143c
add esp, 4
popf
jmp 0x10071443
clc
jae 0x10071448
jb 0x10071424
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10071461
jne 0x10071461
fdivr qword [ebx + eax - 0x15]
add ebx, esp
jl 0x10071466
jmp 0x10071468
je 0x10071463
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10071482
jne 0x10071481
call 0x930b0509
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10071490
jne 0x10071490
call 0x9b6272f3
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x1007151f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x1007151d
jmp 0x10071518
call fcn.1007151f
jae 0x10071518
add esp, 4
jmp 0x10071524
dec dword [esp]
jno 0x10071529
jns 0x10071514
jp 0x1007152d
add esp, 4
popf
jmp 0x10071534
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1007154d
jne 0x1007154d
call 0x1fc748a1
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x38], 0x44
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x62
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x67
mov byte [ebp - 0x33], 0x67
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x44
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x3b
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x43
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x3a
mov byte [ebp - 0x1c], 0x20
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], pe_nt_image_headers32
mov byte [ebp - 0x19], 0x39
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x30
mov byte [ebp - 0x12], 0x34
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x40], 0
push 0
push 4
lea eax, [ebp - 0x40]
push eax
push 7
push 0xffffffffffffffff
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 0x50]
mov dword [ebp - 0x44], edx
mov ecx, dword [ebp - 0x44]
call dword [0x100e7c9c]
call dword [ebp - 0x44]
test eax, eax
jl 0x10071658
cmp dword [ebp - 0x40], 0
je 0x10071658
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5122
push 1
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
pushf
push 0xa
jae 0x10071665
jmp 0x10071660
call 0x10071667
jae 0x10071660
add esp, 4
jmp 0x1007166c
dec dword [esp]
jno 0x10071671
jns 0x1007165c
jp 0x10071675
add esp, 4
popf
jmp 0x1007167c
clc
jae 0x10071681
add esp, dword [ebx + 0x50]
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1007169a
jne 0x1007169a
arpl word [ebx + eax - 0x15], di
add esp, dword [ebx + 0x74]
sti
jl 0x1007169f
jmp 0x100716a1
je 0x1007169c
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100716bb
jne 0x100716ba
call 0x930b0742
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100716c9
jne 0x100716c9
call fcn.10035c94
invalid
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.100114e0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10072b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c72bd
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x5c]
call fcn.100114c0
mov dword [ebp - 4], 0
push 0
push 2
lea eax, [ebp - 0x58]
push eax
push 0x23
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 0x58]
mov dword [ebp - 0x60], edx
mov ecx, dword [ebp - 0x60]
call dword [0x100e7c9c]
call dword [ebp - 0x60]
test eax, eax
jl 0x10072d05
movzx eax, byte [ebp - 0x58]
test eax, eax
je 0x10072d05
movzx ecx, byte [ebp - 0x57]
test ecx, ecx
jne 0x10072d05
mov byte [ebp - 0x54], 0x4b
mov byte [ebp - 0x53], 0x65
mov byte [ebp - 0x52], 0x72
mov byte [ebp - 0x51], 0x6e
mov byte [ebp - 0x50], 0x65
mov byte [ebp - 0x4f], 0x6c
mov byte [ebp - 0x4e], 0x20
mov byte [ebp - 0x4d], 0x44
mov byte [ebp - 0x4c], 0x65
mov byte [ebp - 0x4b], 0x62
mov byte [ebp - 0x4a], 0x75
mov byte [ebp - 0x49], 0x67
mov byte [ebp - 0x48], 0x67
mov byte [ebp - 0x47], 0x65
mov byte [ebp - 0x46], 0x72
mov byte [ebp - 0x45], 0x20
mov byte [ebp - 0x44], 0x64
mov byte [ebp - 0x43], 0x65
mov byte [ebp - 0x42], 0x74
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x40], 0x63
mov byte [ebp - 0x3f], 0x74
mov byte [ebp - 0x3e], 0x65
mov byte [ebp - 0x3d], 0x64
mov byte [ebp - 0x3c], 0x21
mov byte [ebp - 0x3b], 0x20
mov byte [ebp - 0x3a], 0x50
mov byte [ebp - 0x39], 0x6c
mov byte [ebp - 0x38], 0x65
mov byte [ebp - 0x37], 0x61
mov byte [ebp - 0x36], 0x73
mov byte [ebp - 0x35], 0x65
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x32], 0x69
mov byte [ebp - 0x31], 0x73
mov byte [ebp - 0x30], 0x61
mov byte [ebp - 0x2f], 0x62
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x20
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x62
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x67
mov byte [ebp - 0x26], 0x67
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x61
mov byte [ebp - 0x20], 0x6e
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x76
mov byte [ebp - 0x18], 0x69
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d514d
push 1
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.100114e0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10077e90
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100eabf8
push 0x100a5b10
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff0
mov eax, dword [0x100ed440]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1d], 0
mov dword [ebp - 4], 0
push ebx
mov ebx, 0
mov eax, 1
invalid

Function at 0x10077f30
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100eac18
push 0x100a5b10
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff0
mov eax, dword [0x100ed440]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1d], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x1d]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x10077fb3
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10078025
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x10078023
jmp 0x1007801e
call fcn.10078025
jae 0x1007801e
add esp, 4
jmp 0x1007802a
dec dword [esp]
jno 0x1007802f
jns 0x1007801a
jp 0x10078033
add esp, 4
popf
jmp 0x1007803a
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10078053
jne 0x10078053
call 0x1fc7b3a7
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xf], 0x6d
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x68
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x6b
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0
call fcn.10077e90
movzx eax, al
test eax, eax
jne 0x100780c0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [0x101034a4]
mov eax, dword [edx + 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call dword [0x100e7c9c]
call dword [ebp - 0x28]
test eax, eax
je 0x10078135
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x50
mov byte [ebp - 0x1c], 0x43
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x21
mov byte [ebp - 0x11], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5623
push 0
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
pushf
push 0xa
jae 0x10078142
jmp 0x1007813d
call 0x10078144
jae 0x1007813d
add esp, 4
jmp 0x10078149
dec dword [esp]
jno 0x1007814e
jns 0x10078139
jp 0x10078152
add esp, 4
popf
jmp 0x10078159
clc
jae 0x1007815e
jl 0x1007818a
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10078177
jne 0x10078177
sub al, 0x7c
add ebp, ebx
add ebp, dword [esp + esi*2]
sti
jl 0x1007817c
jmp 0x1007817e
je 0x10078179
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10078198
jne 0x10078197
call 0x930b721f
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100781a6
jne 0x100781a6
call 0x9b62e009
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10078362
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x10078360
jmp 0x1007835b
call fcn.10078362
jae 0x1007835b
add esp, 4
jmp 0x10078367
dec dword [esp]
jno 0x1007836c
jns 0x10078357
jp 0x10078370
add esp, 4
popf
jmp 0x10078377
clc
jae 0x1007837c
shl byte [ecx], 1
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10078395
jne 0x10078395
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x1007839a
jmp 0x1007839c
je 0x10078397
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100783b6
jne 0x100783b5
call 0x930b743d
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100783c4
jne 0x100783c4
call 0x63f7c98e
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x44
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x28]
call dword [0x100e7c9c]
call dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x1007848e
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], pe_nt_image_headers32
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x21
mov byte [ebp - 0x11], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d562f
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
jl 0x10078493
jmp 0x10078495
je 0x10078490
xor eax, eax
test eax, eax
je 0x1007849e
jne 0x1007849d
call 0x930b7525
rol byte [ebx + eax*4], 0xf0
add eax, 0x1a0273f8
arpl word [ebx + eax + 0x75], si
add dword [ebx + 0x66], esp
pushfd
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x100784ac
sbb ah, byte [ebx + 0x74]
add esi, dword [ebp + 1]
je 0x100784b1
jne 0x100784b1
arpl word [esi - 0x64], sp
pushf
push 0xa
jae 0x100784be
jmp 0x100784b9
call 0x100784c0
jae 0x100784b9
add esp, 4
jmp 0x100784c5
dec dword [esp]
jno 0x100784ca
jns 0x100784b5
jp 0x100784ce
add esp, 4
popf
jmp 0x100784d5
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100784ee
jne 0x100784ee
call 0x1fc7b842
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10078ce5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jl 0x10078cb8
jmp 0x10078cba
je 0x10078cb5
xor eax, eax
test eax, eax
je 0x10078cc3
jne 0x10078cc2
call 0x930b7d4a
rol byte [ebx + eax*4], 0xf0
add eax, 0x960273f8
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x10078cd1
xchg esi, eax
invalid
je 0x10078cd6
jne 0x10078cd6
invalid
pushf
push 0xa
jae 0x10078ce3
jmp 0x10078cde
call 0x10078ce5
jae 0x10078cde
add esp, 4
jmp 0x10078cea
dec dword [esp]
jno 0x10078cef
jns 0x10078cda
jp 0x10078cf3
add esp, 4
popf
jmp 0x10078cfa
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10078d13
jne 0x10078d13
call 0x1fc7c067
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x79
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x28]
call dword [0x100e7c9c]
call dword [ebp - 0x28]
test eax, eax
je 0x10078ddd
mov byte [ebp - 0x24], 0x57
mov byte [ebp - 0x23], 0x50
mov byte [ebp - 0x22], 0x45
mov byte [ebp - 0x21], 0x20
mov byte [ebp - 0x20], 0x50
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x20
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x63
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0x2e
mov byte [ebp - 0x13], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5641
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
pushf
push 0xa
jae 0x10078dea
jmp 0x10078de5
call 0x10078dec
jae 0x10078de5
add esp, 4
jmp 0x10078df1
dec dword [esp]
jno 0x10078df6
jns 0x10078de1
jp 0x10078dfa
add esp, 4
popf
jmp 0x10078e01
clc
jae 0x10078e06
or edx, dword ss:[eax + 0x52]
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10078e1f
jne 0x10078e1f
or edi, dword [ebx + eax - 0x15]
add ecx, dword [ebx]
jl 0x10078e24
jmp 0x10078e26
je 0x10078e21
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10078e40
jne 0x10078e3f
call 0x930b7ec7
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10078e4e
jne 0x10078e4e
call 0x9b62ecb1
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret