joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x506c6175
push eax
mov dword [ebp - 0x14], 0x74726956
mov dword [ebp - 0xb], 0x6365746f
mov byte [ebp - 0xc], 0x72
mov dword [ebp - 7], 0x784574
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a0af
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov word [ebp - 0x10], 0x6956
push eax
mov dword [ebp - 0xd], 0x6c617574
mov dword [ebp - 7], 0x797265
mov word [ebp - 9], 0x7551
mov byte [ebp - 0xe], 0x72
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a107
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 0x104
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x10], 0
push 0
push eax
call fcn.1000c110
lea eax, [ebp - 0x28]
mov word [ebp - 2], 0x73
push eax
mov dword [ebp - 0xb], 0x5754464f
mov dword [ebp - 7], 0x5c455241
mov byte [ebp - 3], 0x25
mov byte [ebp - 0xc], 0x53
call fcn.1000aa40
add esp, 0x10
mov ecx, eax
call fcn.1000b070
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x12c]
push 0x104
push eax
call fcn.1000b200
add esp, 0x14
lea ecx, [ebp - 0x28]
call fcn.1000aa20
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x12c]
push eax
call fcn.1000a9f0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x1000a270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.100095f0
test eax, eax
je 0x1000a2b3
lea ecx, [ebp - 0x14]
mov word [ebp - 0xb], 0x776f
push ecx
push eax
mov dword [ebp - 0x10], 0x6e695767
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 9], 0x6f546f54
mov word [ebp - 5], 0x70
mov byte [ebp - 0xc], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a2c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.100095f0
test eax, eax
je 0x1000a303
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xb], 0x776f646e
push ecx
push eax
mov word [ebp - 0x10], 0x6553
mov word [ebp - 6], 0x736f
mov word [ebp - 0xd], 0x6957
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 4], 0
mov byte [ebp - 7], 0x50
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1001b6a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.100095f0
test eax, eax
je 0x1001b6e1
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xa], 0x57657669
push ecx
push eax
mov dword [ebp - 0x10], 0x41746553
mov dword [ebp - 5], 0x776f646e
mov word [ebp - 0xc], 0x7463
mov byte [ebp - 6], 0x69
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1001b6f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.100095f0
test eax, eax
je 0x1001b736
lea ecx, [ebp - 0x14]
mov dword [ebp - 6], 0x6f646e69
push ecx
push eax
mov dword [ebp - 0x14], 0x46746553
mov word [ebp - 2], 0x77
mov dword [ebp - 0xc], 0x6e756f72
mov dword [ebp - 0x10], 0x6765726f
mov word [ebp - 8], 0x5764
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1001b740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x114
cmp eax, 1
jne 0x1001b805
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call fcn.10009990
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x70707573
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0xd], 0x746e6174
push eax
mov dword [ebp - 4], 0x74726f
mov byte [ebp - 9], 0x20
mov word [ebp - 0x10], 0x6e69
mov byte [ebp - 0xe], 0x73
call fcn.10009e60
add esp, 0x14
test eax, eax
jne 0x1001b834
push sym.drvhlp.dll_qkdy98
push 0x1004b07c
call fcn.1000a4b0
add esp, 8
test eax, eax
je 0x1001b834
push sym.drvhlp.dll_ck4n0a
push 0x1004b028
call fcn.1000a4b0
add esp, 8
test eax, eax
je 0x1001b834
push sym.drvhlp.dll_v4weoe
push 0x1004b058
call fcn.1000a4b0
add esp, 8
test eax, eax
je 0x1001b834
push sym.drvhlp.dll_nzk5tc
push 0x1004b04c
call fcn.1000a4b0
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1001b834
push 0x1004b07c
call fcn.1001bc90
push 0x1004b028
call fcn.1001bc90
push 0x1004b058
call fcn.1001bc90
push 0x1004b04c
call fcn.1001bc90
add esp, 0x10
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6c5435e0
Capabilities:
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xc8
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
mov dword [ebp - 0xa4], 0xa0
test byte [0x6c546018], 8
jne 0x6c543758
lea eax, [ebp - 0xa0]
mov dword [esp + 0xc], 0x20019
mov edi, dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.DirectShowMediaObjects
mov dword [esp], 0x80000000
call edi
sub esp, 0x14
test eax, eax
jne 0x6c543820
mov edx, ebx
lea eax, [ebp - 0x98]
call fcn.6c541420
lea edx, [ebp - 0x9c]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa0]
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
mov dword [esp], eax
call edi
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, eax
mov eax, dword [ebp - 0xa0]
sub esp, 0x14
mov dword [esp], eax
call edi
sub esp, 4
test ebx, ebx
jne 0x6c543820
lea eax, [ebp - 0xa4]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x9c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebx, eax
mov eax, dword [ebp - 0x9c]
sub esp, 0x18
mov dword [esp], eax
call edi
sub esp, 4
test ebx, ebx
jne 0x6c543738
cmp dword [ebp - 0xa4], 1
jbe 0x6c543738
test byte [0x6c546018], 8
je 0x6c543742
mov eax, esi
call fcn.6c5414a0
mov dword [esp + 0xc], str.name_s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.DMOGetName
mov dword [esp + 4], 0x6c546018
mov dword [esp], 3
call fcn.6c541730
jmp 0x6c543742
xor eax, eax
mov ebx, 1
mov word [esi], ax
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
test ebx, ebx
je 0x6c543818
mov eax, ebx
shr eax, 0x10
je 0x6c543800
movzx eax, byte [ebx + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [ebx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [ebx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [ebx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [ebx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [ebx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call fcn.6c541370
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._s__p_n
mov dword [esp + 8], str.DMOGetName
mov dword [esp + 4], 0x6c546018
mov dword [esp], 3
call fcn.6c541730
jmp 0x6c543613
movzx eax, bx
mov dword [esp], str._guid_0x_04hx_
mov dword [esp + 4], eax
call fcn.6c541370
jmp 0x6c5437cd
mov eax, str._null_
jmp 0x6c5437cd
mov ebx, 0x80004005
jmp 0x6c543742
Function at 0x2e00e8b1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.2e02ff09
mov edi, dword [ebp + 8]
mov dword [ebp - 0x40], esi
add esp, 0xc
mov esi, 0x2e049420
push 0x2e001848
mov ecx, esi
mov dword [ebp - 0x3c], 0x100
mov dword [ebp - 0x34], 0x2e001840
mov dword [ebp - 0x30], edi
call fcn.2e025fc5
push edi
mov ecx, esi
call fcn.2e025fc5
push 0x2e00183e
mov ecx, esi
call fcn.2e025fc5
push 0x2e00137c
mov ecx, esi
call fcn.2e025fc5
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
pop esi
test eax, eax
jne 0x2e00e945
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.2e00e7c9
mov eax, dword [eax]
mov dword [ebp + 8], eax
push 0x2e042058
lea eax, [ebp + 8]
push eax
call fcn.2e02ef14
cmp dword [ebp - 8], 0
je 0x2e00e954
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret 4

Function at 0x2e00f476
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x2e00f4b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp + 8]
call fcn.2e00e7c9
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
push 0x2e042058
lea eax, [ebp + 0xc]
push eax
call fcn.2e02ef14
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x2e00f4e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push edi
jmp 0x2e00f499
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x2e00f508
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x2e00f4d4
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0xc], 0x10
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x2e00f4f5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
leave
ret 0xc
Function at 0x2e00f53e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push 0x8000000
push 3
push edi
push edi
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x2e00f586
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp + 0xc]
call fcn.2e00e7c9
mov eax, dword [eax]
mov dword [ebp + 8], eax
push 0x2e042058
lea eax, [ebp + 8]
push eax
call fcn.2e02ef14
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x2e00f5aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
jmp 0x2e00f56b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret 8

Function at 0x2e00f69b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x2e0498c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x10c]
push 0x104
push eax
call fcn.2e030082
lea eax, [ebp - 0x10c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x2e00f6d1
push edi
sub eax, edx
mov byte [ebp + eax - 0x10b], cl
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x134]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x12c], eax
mov eax, 0x414
mov word [ebp - 0x124], ax
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 0x130], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
pop edi
test eax, eax
je 0x2e00f74e
push 0x3e3
lea ecx, [ebp - 0x114]
call fcn.2e00e7c9
mov eax, dword [eax]
mov dword [ebp - 0x110], eax
push 0x2e042058
lea eax, [ebp - 0x110]
push eax
call fcn.2e02ef14
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.2e02f873
leave
ret 4

Function at 0x2e00f8d3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x50], 0
je 0x2e00f90a
cmp dword [ecx + 0x54], 0x10
jb 0x2e00f8e8
mov ecx, dword [ecx + 0x40]
jmp 0x2e00f8eb
add ecx, 0x40
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x2e00f90a
mov al, byte [ebp - 1]
mov byte [ebp - 1], al
push 0x2e042210
lea eax, [ebp - 1]
push eax
call fcn.2e02ef14
leave
ret
Function at 0x2e019667
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [ebx], ecx
jne 0x2e019694
lea ecx, [ebp + 0x13]
call fcn.2e0195b3
mov al, byte [eax]
mov byte [ebp + 0xf], al
push 0x2e04361c
lea eax, [ebp + 0xf]
push eax
call fcn.2e02ef14
mov eax, dword [ebp + 0x10]
sub eax, ecx
je 0x2e0196e0
dec eax
je 0x2e0196c9
dec eax
je 0x2e0196b5
lea ecx, [ebp + 0x13]
call fcn.2e00f32e
mov al, byte [eax]
mov byte [ebp + 0xf], al
push 0x2e0424e4
jmp 0x2e01968b
mov esi, dword [ebp + 0xc]
push 2
mov eax, esi
pop edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x2e0196c0
jmp 0x2e0196db
mov esi, dword [ebp + 0xc]
xor edi, edi
mov eax, esi
inc edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x2e0196d4
sub eax, ecx
inc eax
jmp 0x2e0196f4
push dword [ebp + 0xc]
call fcn.2e030673
pop ecx
push 4
mov dword [ebp - 4], eax
pop eax
lea esi, [ebp - 4]
mov edi, eax
push eax
push esi
push edi
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
test eax, eax
je 0x2e019726
push eax
lea ecx, [ebp + 0x10]
call fcn.2e00e7c9
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
push 0x2e042058
lea eax, [ebp + 0xc]
jmp 0x2e01968e
leave
ret 0xc
Function at 0x2e01a577
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x2e01a89d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 8], edi
je 0x2e01a8c9
lea ecx, [ebp - 1]
call fcn.2e0195d9
mov al, byte [eax]
mov byte [ebp + 0xb], al
push 0x2e0436ec
lea eax, [ebp + 0xb]
push eax
call fcn.2e02ef14
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
cmp eax, edi
jne 0x2e01a8f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xc]
call fcn.2e00e7c9
mov eax, dword [eax]
mov dword [ebp + 8], eax
push 0x2e042058
lea eax, [ebp + 8]
jmp 0x2e01a8c3
mov al, byte [ebp + 8]
mov byte [esi + 0x10], al
lea eax, [ebp - 8]
push eax
push edi
push esi
push 0x2e01a833
push edi
push edi
mov dword [ebp - 8], edi
call fcn.2e03086c
add esp, 0x18
push 0xffffffffffffffff
push dword [esi + 0xc]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], edi
pop edi
pop esi
leave
ret 4
Function at 0x2e01d76f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x2e01d77d
sub eax, ecx
push 0
sar eax, 1
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x2e01d7c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp + 8]
call fcn.2e00e7c9
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
push 0x2e042058
lea eax, [ebp + 0xc]
push eax
call fcn.2e02ef14
leave
ret 8

Function at 0x2e01fd4b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
clc
call fcn.2e01fb1f
lodsb al, byte [esi]
or al, 0x2a
or al, 0x66
mov eax, dword [edi + 6]
cmp ax, bx
jbe 0x2e01fd79
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x2e01fd73
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x2e01fd64
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], pe_nt_image_headers32
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.2e01fb1f
and edx, dword [esi + 0x458dda12]
test al, 0x50
call fcn.2e01fb2f
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.2e01fae4
add esp, 0x10
lea ecx, [ebp - 0xb0]
invalid
call dword [ecx - 1]
ror byte [ebx - 0x727407bb], 1
push esp
invalid
invalid
push dword [ebx]
sal bh, cl
int1
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x2e01fe0d
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.2e01fb1f
inc ecx
movsb byte es:[edi], byte [esi]
hlt
Function at 0x2e01fe9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
in eax, dx
salc
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.2e01fb2f
push eax
push esi
push dword [ebp + 8]
call fcn.2e01fae4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.2e01fb2f
push eax
push esi
push dword [ebp + 8]
call fcn.2e01fae4
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.2e01fb2f
push eax
push esi
push dword [ebp + 8]
call fcn.2e01fae4
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.2e01fb1f
mov esi, 0x883c1fbd
popfd
jl 0x2e01ffa4
invalid
invalid
Function at 0x2e020615
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.2e01fae4
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.2e01fb1f
xor al, 0x9d
push es
cwde
and byte [ebp - 0x664], 0
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.2e01fb2f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.2e01fae4
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.2e01fb2f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.2e01fae4
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.2e01fb1f
cmpsd dword [esi], dword es:[edi]
jb 0x2e020736
dec eax
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.2e01fb2f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.2e01fae4
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.2e01fb1f
test byte [eax], bl
fcmovnu st(0), st(2)
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x2e020813
cmp dword [ebp - 0x398], 0
je 0x2e0209dd
cmp dword [ebp + 0xc], 1
je 0x2e0209dd
cmp dword [ebp + 0xc], 8
jne 0x2e0209a5
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
invalid
test dword [eax - 7], ebx