joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
xor bl, bl
push esi
mov dword [ebp - 0x44], 0x53005c
mov dword [ebp - 0x40], 0x730079
mov dword [ebp - 0x3c], 0x650074
mov dword [ebp - 0x38], 0x52006d
mov dword [ebp - 0x34], 0x6f006f
mov dword [ebp - 0x30], 0x5c0074
mov dword [ebp - 0x2c], 0x790073
cmp byte [ebp + 0x10], bl
jne 0x156a9
mov dword [ebp - 0x28], 0x740073
mov dword [ebp - 0x24], 0x6d0065
mov dword [ebp - 0x20], 0x320033
xor esi, esi
jmp 0x156c3
mov dword [ebp - 0x28], 0x570073
mov dword [ebp - 0x24], 0x57004f
mov dword [ebp - 0x20], 0x340036
mov esi, 1
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x1c], 0x75005c
mov dword [ebp - 0x18], 0x650073
mov dword [ebp - 0x14], 0x330072
mov dword [ebp - 0x10], 0x2e0032
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
call fcn.0004d700
test eax, eax
jne 0x1572f
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp - 4]
push edx
push eax
push ecx
push esi
call fcn.00014940
cmp al, 1
jne 0x1571d
mov bl, al
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x15990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00015650
cmp al, 1
jne 0x15a34
xor edx, edx
push esi
mov esi, dword [ebp - 8]
test bl, bl
push edi
mov edi, dword [ebp - 4]
setne dl
lea eax, [ebp - 0x20]
push eax
push edi
mov eax, esi
mov dword [ebp - 0x20], 0x72657355
mov dword [ebp - 0x1c], 0x65696c43
mov dword [ebp - 0x18], 0x6c44746e
mov dword [ebp - 0x14], 0x696e496c
mov dword [ebp - 0x10], 0x6c616974
mov dword [ebp - 0xc], 0x657a69
call fcn.00015090
test eax, eax
je 0x15a20
push edi
push esi
call fcn.00015740
mov edx, eax
test edx, edx
je 0x15a20
push edx
test bl, bl
jne 0x15a0e
push 0x312
jmp 0x15a13
push 0x313
call fcn.00049620
push ebx
push edi
push esi
call fcn.000158c0
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x15a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9c6c0
push 0x9b56a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 0x20], esi
push 0x877
call fcn.00049640
push eax
push 0x1000
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
mov dword [ebp - 0x28], ebx
cmp ebx, esi
je 0x15b9d
mov dword [ebp - 0x40], 0x730075
mov dword [ebp - 0x3c], 0x720065
mov dword [ebp - 0x38], 0x320033
mov dword [ebp - 0x34], 0x64002e
mov dword [ebp - 0x30], 0x6c006c
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp - 0x1c]
cmp edi, dword [ebp + 8]
je 0x15b59
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x1000
ja 0x15b59
xor eax, eax
sub edi, eax
mov edx, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [edx]
cmp edi, eax
jae 0x15b59
lea ecx, [edi + 0x48]
cmp ecx, eax
jae 0x15b59
cmp dword [edi + 0x18], esi
je 0x15b62
movzx esi, word [edi + 0x24]
cmp esi, 0x1fe
jbe 0x15b0d
mov esi, 0x1fe
jmp 0x15b12
cmp esi, 2
jbe 0x15b62
mov ecx, dword [edi + 0x28]
cmp ecx, eax
jae 0x15b62
test ecx, ecx
je 0x15b62
lea edx, [ecx + esi]
cmp edx, eax
jae 0x15b62
push esi
push ecx
push ebx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
shr esi, 1
xor eax, eax
mov word [ebx + esi*2], ax
mov edx, ebx
call fcn.0008f0a0
mov ecx, eax
test ecx, ecx
je 0x15b62
add ecx, 2
lea eax, [ebp - 0x40]
call fcn.0008f040
test eax, eax
jne 0x15b62
mov ecx, dword [edi + 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x15b8b
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
xor esi, esi
jmp 0x15ac4
push 0x877
call fcn.00049640
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x160f0
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9c9f8
push 0x9b56a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x314
call fcn.00049640
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x16146
mov eax, dword [ebp + 0xc]
add eax, 0x14
mov edx, esi
mov ecx, dword [eax]
test ecx, ecx
je 0x16140
cmp ecx, dword [eax + 4]
je 0x16140
mov byte [eax + 8], 1
add eax, 0x30
dec edx
jne 0x16131
mov edx, dword [ebp + 8]
call fcn.0008a7b0
mov byte [ebp - 0x19], al
xor ebx, ebx
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jae 0x162ca
lea esi, [ebx + ebx*2]
shl esi, 4
add esi, dword [ebp + 0xc]
cmp dword [esi + 0x14], 0
je 0x162c1
mov ecx, 0xc
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
push 0x19
call fcn.00088910
mov byte [ebp - 0x1d], al
push 0xe
call fcn.00088910
mov byte [ebp - 0x28], al
lea edx, [ebp - 0x5c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov ecx, dword [ebp - 0x28]
push ecx
push 0xe
call fcn.00088aa0
mov edx, dword [ebp - 0x1d]
push edx
push 0x19
call fcn.00088aa0
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [eax]
mov esi, dword [ebp - 0x78]
cmp esi, eax
jae 0x1624d
lea ecx, [esi + 0xf]
cmp ecx, eax
jae 0x1624d
mov dword [ebp - 4], 0
push esi
mov edi, 0x10
lea ecx, [ebp - 0x6e]
call fcn.0008f350
test eax, eax
je 0x16231
mov byte [ebp - 0x6f], 1
cmp byte [ebp - 0x70], 0
jne 0x16231
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov edx, dword [esi]
mov dword [ebp - 0x44], edx
mov eax, dword [esi + 4]
mov dword [ebp - 0x40], eax
mov ecx, dword [esi + 8]
mov dword [ebp - 0x3c], ecx
mov edx, dword [esi + 0xc]
mov dword [ebp - 0x38], edx
lea eax, [ebp - 0x2c]
push eax
push edi
lea ecx, [ebp - 0x44]
push ecx
mov eax, esi
call fcn.00016aa0
cmp al, 1
jne 0x16231
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x74], edx
mov dword [ebp - 4], 0xffffffff
jmp 0x1624d
push 0x19
call fcn.00088910
mov byte [ebp - 0x1d], al
push 0xf
call fcn.00088910
mov byte [ebp - 0x30], al
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 0x30]
push ecx
push 0xf
call fcn.00088aa0
mov edx, dword [ebp - 0x1d]
push edx
push 0x19
call fcn.00088aa0
mov dword [ebp - 4], 1
lea edi, [ebx + ebx*2]
shl edi, 4
add edi, dword [ebp + 0xc]
mov ecx, 0xc
lea esi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], 0xffffffff
inc ebx
mov esi, dword [ebp - 0x34]
jmp 0x16153
inc ebx
mov esi, dword [ebp - 0x34]
jmp 0x16153
cmp byte [ebp - 0x19], 1
jne 0x162d8
mov ecx, dword [ebp + 8]
call fcn.0008a870
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x164a0
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9c9e8
push 0x9b56a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x165bc
mov ecx, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov ecx, dword [ecx]
cmp eax, ecx
jae 0x165bc
add eax, 4
cmp eax, ecx
jae 0x165bc
push 0x314
call fcn.00049640
cmp dword [esi + 0xc], eax
jae 0x165bc
mov edx, dword [esi]
call fcn.0008a7b0
mov byte [ebp - 0x1a], al
push 0x19
call fcn.00088910
mov byte [ebp - 0x1e], al
push 0xe
call fcn.00088910
mov byte [ebp - 0x22], al
lea edx, [ebp - 0x3c]
push edx
mov eax, dword [esi]
push eax
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov ecx, dword [ebp - 0x22]
push ecx
push 0xe
call fcn.00088aa0
mov edx, dword [ebp - 0x1e]
push edx
push 0x19
call fcn.00088aa0
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x14]
push eax
mov ecx, dword [esi + 8]
push ecx
call fcn.000938b0
mov bl, 1
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xffffffff
jmp 0x1657b
push 0x19
call fcn.00088910
mov byte [ebp - 0x1e], al
push 0xf
call fcn.00088910
mov byte [ebp + 8], al
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, dword [ebp + 8]
push eax
push 0xf
call fcn.00088aa0
mov ecx, dword [ebp - 0x1e]
push ecx
push 0x19
call fcn.00088aa0
cmp byte [ebp - 0x1a], 1
jne 0x165bc
mov ecx, dword [esi]
call fcn.0008a870
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x165e0
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9c9d8
push 0x9b56a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x16718
mov ecx, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov ecx, dword [ecx]
cmp eax, ecx
jae 0x16718
add eax, 0xf
cmp eax, ecx
jae 0x16718
push 0x314
call fcn.00049640
cmp dword [esi + 0xc], eax
jae 0x16718
mov edx, dword [esi]
call fcn.0008a7b0
mov byte [ebp - 0x1a], al
push 0x19
call fcn.00088910
mov byte [ebp - 0x1e], al
push 0xe
call fcn.00088910
mov byte [ebp - 0x22], al
lea edx, [ebp - 0x4c]
push edx
mov eax, dword [esi]
push eax
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov ecx, dword [ebp - 0x22]
push ecx
push 0xe
call fcn.00088aa0
mov edx, dword [ebp - 0x1e]
push edx
push 0x19
call fcn.00088aa0
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x1e]
mov dword [ebp - 0x34], eax
mov ecx, dword [esi + 0x22]
mov dword [ebp - 0x30], ecx
mov edx, dword [esi + 0x26]
mov dword [ebp - 0x2c], edx
mov eax, dword [esi + 0x2a]
mov dword [ebp - 0x28], eax
push 1
push 0x10
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [esi + 0x14]
push edx
call fcn.000938f0
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xffffffff
jmp 0x166d7
push 0x19
call fcn.00088910
mov byte [ebp - 0x1e], al
push 0xf
call fcn.00088910
mov byte [ebp + 8], al
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp + 8]
push ecx
push 0xf
call fcn.00088aa0
mov edx, dword [ebp - 0x1e]
push edx
push 0x19
call fcn.00088aa0
cmp byte [ebp - 0x1a], 1
jne 0x16718
mov ecx, dword [esi]
call fcn.0008a870
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x180e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
push esi
push edi
xor ebx, ebx
push 0x4904
mov esi, eax
mov dword [esp + 0x14], ebx
call fcn.00049640
push 0x493d
mov ecx, eax
call fcn.00049640
push 0x490a
mov edi, eax
call fcn.00049640
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x18223
test edi, edi
je 0x18223
test eax, eax
je 0x18223
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x2c], 0x44005c
mov dword [esp + 0x30], 0x760065
mov dword [esp + 0x34], 0x630069
mov dword [esp + 0x38], 0x5c0065
mov dword [esp + 0x3c], 0x610048
mov dword [esp + 0x40], 0x640072
mov dword [esp + 0x44], 0x690064
mov dword [esp + 0x48], 0x6b0073
mov dword [esp + 0x4c], 0x5c0030
mov dword [esp + 0x50], 0x520044
mov dword [esp + 0x54], 0x30
call ecx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x80
lea edx, [esp + 0x28]
push edx
call edi
test eax, eax
jne 0x18223
mov edx, dword [esp + 0x14]
xor edi, edi
lea ebx, [esp + 0xc]
call fcn.0004bdb0
mov ebx, 1
cmp al, bl
jne 0x1820e
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov dword [esp + 0xc], eax
test eax, eax
je 0x1820e
lea ebx, [ebx]
cmp dword [ebp + 8], edi
jbe 0x1820e
push ecx
push eax
push esi
mov eax, ebx
call fcn.00017b40
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x10]
sub dword [ebp + 8], ebx
add dword [esp + 0x10], ebx
add esi, 0x82c
mov dword [esp + 0xc], eax
test eax, eax
jne 0x181e0
mov ecx, dword [esp + 0x14]
call dword [esp + 0x18]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x18230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
xor bl, bl
push 0x4904
mov byte [ebp - 1], bl
call fcn.00049640
push 0x493d
mov ecx, eax
call fcn.00049640
push 0x490a
mov edi, eax
call fcn.00049640
mov esi, eax
test ecx, ecx
je 0x1833b
test edi, edi
je 0x1833b
test esi, esi
je 0x1833b
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x40], 0x44005c
mov dword [ebp - 0x3c], 0x760065
mov dword [ebp - 0x38], 0x630069
mov dword [ebp - 0x34], 0x5c0065
mov dword [ebp - 0x30], 0x610048
mov dword [ebp - 0x2c], 0x640072
mov dword [ebp - 0x28], 0x690064
mov dword [ebp - 0x24], 0x6b0073
mov dword [ebp - 0x20], 0x5c0030
mov dword [ebp - 0x1c], 0x520044
mov dword [ebp - 0x18], 0x30
call ecx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0x80
lea edx, [ebp - 0x14]
push edx
call edi
test eax, eax
jne 0x1833b
mov edx, dword [ebp - 0xc]
xor edi, edi
lea ebx, [ebp - 8]
call fcn.0004bdb0
cmp al, 1
jne 0x1832a
mov eax, dword [ebp - 8]
test eax, eax
je 0x1832a
mov ecx, dword [ebp + 8]
cmp dword [eax + 0x10], ecx
je 0x18323
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
test eax, eax
jne 0x18300
mov ecx, dword [ebp - 0xc]
call esi
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [eax + 0x10], edi
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 0xc]
call esi
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x18350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
xor ebx, ebx
push 0x4904
mov esi, eax
mov dword [esp + 0x18], ebx
call fcn.00049640
push 0x493d
mov ecx, eax
call fcn.00049640
push 0x490a
mov edi, eax
call fcn.00049640
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x18498
test edi, edi
je 0x18498
test eax, eax
je 0x18498
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x30], 0x44005c
mov dword [esp + 0x34], 0x760065
mov dword [esp + 0x38], 0x630069
mov dword [esp + 0x3c], 0x5c0065
mov dword [esp + 0x40], 0x610048
mov dword [esp + 0x44], 0x640072
mov dword [esp + 0x48], 0x690064
mov dword [esp + 0x4c], 0x6b0073
mov dword [esp + 0x50], 0x6f0056
mov dword [esp + 0x54], 0x75006c
mov dword [esp + 0x58], 0x65006d
mov dword [esp + 0x5c], 0x31
call ecx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x80
lea edx, [esp + 0x2c]
push edx
call edi
test eax, eax
jne 0x18498
mov edx, dword [esp + 0x18]
xor edi, edi
lea ebx, [esp + 0x10]
call fcn.0004bdb0
mov ebx, 1
cmp al, bl
jne 0x18483
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x10], eax
test eax, eax
je 0x18483
cmp dword [ebp + 8], edi
jbe 0x18483
push ecx
push eax
push esi
mov eax, 3
call fcn.00017b40
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x10]
sub dword [ebp + 8], ebx
add dword [esp + 0x14], ebx
add esi, 0x82c
mov dword [esp + 0x10], eax
test eax, eax
jne 0x18452
mov ecx, dword [esp + 0x18]
call dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x184b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
xor bl, bl
push 0x4904
mov byte [ebp - 1], bl
call fcn.00049640
push 0x493d
mov ecx, eax
call fcn.00049640
push 0x490a
mov edi, eax
call fcn.00049640
mov esi, eax
test ecx, ecx
je 0x185c2
test edi, edi
je 0x185c2
test esi, esi
je 0x185c2
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x44], 0x44005c
mov dword [ebp - 0x40], 0x760065
mov dword [ebp - 0x3c], 0x630069
mov dword [ebp - 0x38], 0x5c0065
mov dword [ebp - 0x34], 0x610048
mov dword [ebp - 0x30], 0x640072
mov dword [ebp - 0x2c], 0x690064
mov dword [ebp - 0x28], 0x6b0073
mov dword [ebp - 0x24], 0x6f0056
mov dword [ebp - 0x20], 0x75006c
mov dword [ebp - 0x1c], 0x65006d
mov dword [ebp - 0x18], 0x31
call ecx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0x80
lea edx, [ebp - 0x14]
push edx
call edi
test eax, eax
jne 0x185c2
mov edx, dword [ebp - 0xc]
xor edi, edi
lea ebx, [ebp - 8]
call fcn.0004bdb0
cmp al, 1
jne 0x185b1
mov eax, dword [ebp - 8]
test eax, eax
je 0x185b1
mov ecx, dword [ebp + 8]
cmp dword [eax + 0x10], ecx
je 0x185aa
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
test eax, eax
jne 0x18587
mov ecx, dword [ebp - 0xc]
call esi
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [eax + 0x10], edi
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 0xc]
call esi
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x18790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push eax
mov eax, dword [ebp + 8]
push 8
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], 0x44005c
mov dword [ebp - 0x20], 0x690072
mov dword [ebp - 0x1c], 0x650076
mov dword [ebp - 0x18], 0x5c0072
mov dword [ebp - 0x14], 0x62004b
mov dword [ebp - 0x10], 0x430064
mov dword [ebp - 0xc], 0x61006c
mov dword [ebp - 8], 0x730073
mov dword [ebp - 4], 0
call fcn.000185d0
mov esp, ebp
pop ebp
ret 4

Function at 0x187f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push eax
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], 0x44005c
mov dword [ebp - 0x20], 0x690072
mov dword [ebp - 0x1c], 0x650076
mov dword [ebp - 0x18], 0x5c0072
mov dword [ebp - 0x14], 0x62004b
mov dword [ebp - 0x10], 0x430064
mov dword [ebp - 0xc], 0x61006c
mov dword [ebp - 8], 0x730073
mov dword [ebp - 4], 0
call fcn.000186d0
mov esp, ebp
pop ebp
ret

Function at 0x18850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push eax
mov eax, dword [ebp + 8]
push 5
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], 0x44005c
mov dword [ebp - 0x18], 0x690072
mov dword [ebp - 0x14], 0x650076
mov dword [ebp - 0x10], 0x5c0072
mov dword [ebp - 0xc], 0x630054
mov dword [ebp - 8], 0x690070
mov dword [ebp - 4], 0x70
call fcn.000185d0
mov esp, ebp
pop ebp
ret 4
Function at 0x188a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], 0x44005c
mov dword [ebp - 0x18], 0x690072
mov dword [ebp - 0x14], 0x650076
mov dword [ebp - 0x10], 0x5c0072
mov dword [ebp - 0xc], 0x630054
mov dword [ebp - 8], 0x690070
mov dword [ebp - 4], 0x70
call fcn.000186d0
mov esp, ebp
pop ebp
ret

Function at 0x188f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push eax
mov eax, dword [ebp + 8]
push 6
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], 0x44005c
mov dword [ebp - 0x20], 0x690072
mov dword [ebp - 0x1c], 0x650076
mov dword [ebp - 0x18], 0x5c0072
mov dword [ebp - 0x14], 0x73006e
mov dword [ebp - 0x10], 0x700069
mov dword [ebp - 0xc], 0x6f0072
mov dword [ebp - 8], 0x790078
mov dword [ebp - 4], 0
call fcn.000185d0
mov esp, ebp
pop ebp
ret 4

Function at 0x18950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push eax
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], 0x44005c
mov dword [ebp - 0x20], 0x690072
mov dword [ebp - 0x1c], 0x650076
mov dword [ebp - 0x18], 0x5c0072
mov dword [ebp - 0x14], 0x73006e
mov dword [ebp - 0x10], 0x700069
mov dword [ebp - 0xc], 0x6f0072
mov dword [ebp - 8], 0x790078
mov dword [ebp - 4], 0
call fcn.000186d0
mov esp, ebp
pop ebp
ret

Function at 0x189b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push eax
mov eax, dword [ebp + 8]
push 7
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], 0x44005c
mov dword [ebp - 0x14], 0x690072
mov dword [ebp - 0x10], 0x650076
mov dword [ebp - 0xc], 0x5c0072
mov dword [ebp - 8], 0x640074
mov dword [ebp - 4], 0x78
call fcn.000185d0
mov esp, ebp
pop ebp
ret 4

Function at 0x18a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push eax
mov eax, dword [ebp + 8]
push 9
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], 0x44005c
mov dword [ebp - 0x20], 0x690072
mov dword [ebp - 0x1c], 0x650076
mov dword [ebp - 0x18], 0x5c0072
mov dword [ebp - 0x14], 0x6f004d
mov dword [ebp - 0x10], 0x630075
mov dword [ebp - 0xc], 0x61006c
mov dword [ebp - 8], 0x730073
mov dword [ebp - 4], 0
call fcn.000185d0
mov esp, ebp
pop ebp
ret 4

Function at 0x18a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push eax
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], 0x44005c
mov dword [ebp - 0x20], 0x690072
mov dword [ebp - 0x1c], 0x650076
mov dword [ebp - 0x18], 0x5c0072
mov dword [ebp - 0x14], 0x6f004d
mov dword [ebp - 0x10], 0x630075
mov dword [ebp - 0xc], 0x61006c
mov dword [ebp - 8], 0x730073
mov dword [ebp - 4], 0
call fcn.000186d0
mov esp, ebp
pop ebp
ret