joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10064a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x860
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x860]
push eax
mov ecx, dword [0x10103414]
call fcn.10013920
mov dword [ebp - 0x848], eax
mov ecx, dword [ebp - 0x848]
call fcn.10007e30
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100a7930
add esp, 8
test eax, eax
jne 0x10064ae3
mov dword [ebp - 0x844], 1
jmp 0x10064aed
mov dword [ebp - 0x844], 0
mov dl, byte [ebp - 0x844]
mov byte [ebp - 0x83d], dl
lea ecx, [ebp - 0x860]
call fcn.10002d70
movzx eax, byte [ebp - 0x83d]
test eax, eax
je 0x10064c3b
mov byte [ebp - 0x3c], 0x55
mov byte [ebp - 0x3b], 0x6e
mov byte [ebp - 0x3a], 0x6b
mov byte [ebp - 0x39], 0x6e
mov byte [ebp - 0x38], 0x6f
mov byte [ebp - 0x37], 0x77
mov byte [ebp - 0x36], 0x6e
mov byte [ebp - 0x35], 0x20
mov byte [ebp - 0x34], 0x61
mov byte [ebp - 0x33], 0x63
mov byte [ebp - 0x32], 0x63
mov byte [ebp - 0x31], 0x65
mov byte [ebp - 0x30], 0x73
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x63
mov byte [ebp - 0x28], 0x74
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x74
mov byte [ebp - 0x25], 0x6f
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x67
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x21], 0x6d
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x20
mov byte [ebp - 0x1e], 0x77
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x77
mov byte [ebp - 0x18], 0x21
mov byte [ebp - 0x17], 0x20
mov byte [ebp - 0x16], 0x46
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0x12], 0x3a
mov byte [ebp - 0x11], 0x20
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x20
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 0xc], 0x79
mov byte [ebp - 0xb], 0x70
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x3a
mov byte [ebp - 8], 0x20
mov byte [ebp - 7], 0x25
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x2000
lea ecx, [ebp - 0x83c]
push ecx
call fcn.1009dec0
add esp, 0x14
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100e163a
push 0
lea edx, [ebp - 0x83c]
push edx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10069210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100ea640
push 0x100a5b10
mov eax, dword fs:[0]
push eax
add esp, 0xfffff778
mov eax, dword [0x100ed440]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x848], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 0x38], 0x6b
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x72
mov byte [ebp - 0x35], 0x6e
mov byte [ebp - 0x34], 0x65
mov byte [ebp - 0x33], 0x6c
mov byte [ebp - 0x32], 0x33
mov byte [ebp - 0x31], 0x32
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x6c
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x28], 0x6e
mov byte [ebp - 0x27], 0x74
mov byte [ebp - 0x26], 0x64
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0x6c
mov byte [ebp - 0x23], 0x2e
mov byte [ebp - 0x22], 0x64
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0x6c
mov byte [ebp - 0x1f], 0
push 0
push 0x101035b4
lea eax, [ebp - 0x38]
push eax
push 2
call fcn.1006a5f0
add esp, 0x10
push 0
push 0x101035b4
lea ecx, [ebp - 0x28]
push ecx
push 3
call fcn.1006a5f0
add esp, 0x10
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x83c], 0
jmp 0x10069301
mov edx, dword [ebp - 0x83c]
add edx, 1
mov dword [ebp - 0x83c], edx
mov ecx, 0x101035b4
call fcn.1006a330
cmp dword [ebp - 0x83c], eax
jae 0x100693c8
push 1
mov eax, dword [ebp - 0x83c]
push eax
mov ecx, 0x101035b4
call fcn.1006a3d0
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x83c]
push edx
mov ecx, 0x101035b4
call fcn.1006a3d0
mov eax, dword [eax + 4]
push eax
call fcn.10069ed0
add esp, 0xc
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 1
je 0x100693c3
mov ecx, dword [ebp - 0x840]
push ecx
mov edx, dword [ebp - 0x83c]
push edx
movzx eax, byte [ebp - 0x841]
push eax
push str.Pre_hook_check_failed1__Step:__d_Error:__d
lea ecx, [ebp - 0x898]
call fcn.1006ac50
mov ecx, eax
call fcn.1006aa80
push eax
push 0x2000
lea ecx, [ebp - 0x438]
push ecx
call fcn.1009dec0
add esp, 0x14
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d46ab
push 0
lea edx, [ebp - 0x438]
push edx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
jmp 0x100692f2
push 0x101035b4
call fcn.1006a170
add esp, 4
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 1
je 0x10069447
mov eax, dword [ebp - 0x840]
push eax
movzx ecx, byte [ebp - 0x842]
push ecx
push str.Module_check_failed1__Error:__d
lea ecx, [ebp - 0x86c]
call fcn.1006b160
mov ecx, eax
call fcn.1000d760
push eax
push 0x2000
lea edx, [ebp - 0x838]
push edx
call fcn.1009dec0
add esp, 0x10
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d46b2
push 0
lea eax, [ebp - 0x838]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov dword [ebp - 4], 0xfffffffe
jmp 0x10069460
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10070a30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c7540
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa0], ecx
lea ecx, [ebp - 0x98]
call fcn.100114c0
mov dword [ebp - 4], 0
jl 0x10070a7b
jmp 0x10070a7d
je 0x10070a78
xor eax, eax
test eax, eax
je 0x10070a86
jne 0x10070a85
call 0x930afb0d
rol byte [ebx + eax*4], 0xf0
add eax, 0x840273f8
aaa
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x10070a94
test byte [edi], dh
je 0x10070a99
jne 0x10070a99
aaa
pushf
push 0xa
Function at 0x100710b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c757d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x40]
call fcn.100114c0
mov dword [ebp - 4], 0
mov byte [ebp - 0x38], 0x44
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x62
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x67
mov byte [ebp - 0x33], 0x67
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x44
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x3b
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x43
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x3a
mov byte [ebp - 0x1c], 0x20
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], pe_nt_image_headers32
mov byte [ebp - 0x19], 0x39
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x30
mov byte [ebp - 0x12], 0x36
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 0x60]
mov dword [ebp - 0x44], edx
mov ecx, dword [ebp - 0x44]
call dword [0x100e7c14]
call dword [ebp - 0x44]
nop
cmp dword [ebp - 0x3c], 0
je 0x100711db
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5192
push 1
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.100114e0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x1007124c
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x1007124a
jmp 0x10071245
call fcn.1007124c
jae 0x10071245
add esp, 4
jmp 0x10071251
dec dword [esp]
jno 0x10071256
jns 0x10071241
jp 0x1007125a
add esp, 4
popf
jmp 0x10071261
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1007127a
jne 0x1007127a
call 0x1fc745ce
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
pushf
push 0xa
jae 0x100712ab
jmp 0x100712a6
call 0x100712ad
jae 0x100712a6
add esp, 4
jmp 0x100712b2
dec dword [esp]
jno 0x100712b7
jns 0x100712a2
jp 0x100712bb
add esp, 4
popf
jmp 0x100712c2
clc
jae 0x100712c7
push ebp
push ss
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100712e0
jne 0x100712e0
push ss
jl 0x100712e5
jmp 0x100712e7
je 0x100712e2
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10071301
jne 0x10071300
call 0x930b0388
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1007130f
jne 0x1007130f
call 0x9b627172
in eax, 0x5d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10071345
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x10071343
jmp 0x1007133e
call fcn.10071345
jae 0x1007133e
add esp, 4
jmp 0x1007134a
dec dword [esp]
jno 0x1007134f
jns 0x1007133a
jp 0x10071353
add esp, 4
popf
jmp 0x1007135a
clc
jae 0x1007135f
dec esp
out 0x50, eax
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10071378
jne 0x10071378
out 0x7c, eax
add ebp, ebx
add esp, edi
jl 0x1007137d
jmp 0x1007137f
je 0x1007137a
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10071399
jne 0x10071398
call 0x930b0420
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100713a7
jne 0x100713a7
call 0x35eb5971
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
call dword [0x100e7c14]
call dword [ebp - 0x20]
pushf
push 0xa
jae 0x1007142c
pop es
jmp 0x10071427
call 0x1007142e
jae 0x10071427
add esp, 4
jmp 0x10071433
dec dword [esp]
jno 0x10071438
jns 0x10071423
jp 0x1007143c
add esp, 4
popf
jmp 0x10071443
clc
jae 0x10071448
jb 0x10071424
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10071461
jne 0x10071461
fdivr qword [ebx + eax - 0x15]
add ebx, esp
jl 0x10071466
jmp 0x10071468
je 0x10071463
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10071482
jne 0x10071481
call 0x930b0509
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10071490
jne 0x10071490
call 0x9b6272f3
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x1007151f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x1007151d
jmp 0x10071518
call fcn.1007151f
jae 0x10071518
add esp, 4
jmp 0x10071524
dec dword [esp]
jno 0x10071529
jns 0x10071514
jp 0x1007152d
add esp, 4
popf
jmp 0x10071534
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1007154d
jne 0x1007154d
call 0x1fc748a1
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x38], 0x44
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x62
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x67
mov byte [ebp - 0x33], 0x67
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x44
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x3b
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x43
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x3a
mov byte [ebp - 0x1c], 0x20
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], pe_nt_image_headers32
mov byte [ebp - 0x19], 0x39
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x30
mov byte [ebp - 0x12], 0x34
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x40], 0
push 0
push 4
lea eax, [ebp - 0x40]
push eax
push 7
push 0xffffffffffffffff
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 0x50]
mov dword [ebp - 0x44], edx
mov ecx, dword [ebp - 0x44]
call dword [0x100e7c14]
call dword [ebp - 0x44]
test eax, eax
jl 0x10071658
cmp dword [ebp - 0x40], 0
je 0x10071658
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5122
push 1
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
pushf
push 0xa
jae 0x10071665
jmp 0x10071660
call 0x10071667
jae 0x10071660
add esp, 4
jmp 0x1007166c
dec dword [esp]
jno 0x10071671
jns 0x1007165c
jp 0x10071675
add esp, 4
popf
jmp 0x1007167c
clc
jae 0x10071681
add esp, dword [ebx + 0x50]
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1007169a
jne 0x1007169a
arpl word [ebx + eax - 0x15], di
add esp, dword [ebx + 0x74]
sti
jl 0x1007169f
jmp 0x100716a1
je 0x1007169c
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100716bb
jne 0x100716ba
call 0x930b0742
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100716c9
jne 0x100716c9
call fcn.10035c94
invalid
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.100114e0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10072558
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x10072556
jmp 0x10072551
call fcn.10072558
jae 0x10072551
add esp, 4
jmp 0x1007255d
dec dword [esp]
jno 0x10072562
jns 0x1007254d
jp 0x10072566
add esp, 4
popf
jmp 0x1007256d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10072586
jne 0x10072586
call 0x1fc758da
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
lea ecx, [ebp - 0x17c]
call fcn.10007e30
push eax
lea ecx, [ebp - 0x134]
call fcn.10007e30
push eax
call fcn.100a7930
add esp, 8
test eax, eax
je 0x100725db
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x134]
call fcn.10007e30
push eax
call fcn.100a7930
add esp, 8
test eax, eax
jne 0x100726b8
mov byte [ebp - 0x7c], 0x41
mov byte [ebp - 0x7b], 0x6e
mov byte [ebp - 0x7a], 0x74
mov byte [ebp - 0x79], 0x69
mov byte [ebp - 0x78], 0x63
mov byte [ebp - 0x77], 0x68
mov byte [ebp - 0x76], 0x65
mov byte [ebp - 0x75], 0x61
mov byte [ebp - 0x74], 0x74
mov byte [ebp - 0x73], 0x20
mov byte [ebp - 0x72], 0x49
mov byte [ebp - 0x71], 0x6e
mov byte [ebp - 0x70], 0x69
mov byte [ebp - 0x6f], 0x74
mov byte [ebp - 0x6e], 0x69
mov byte [ebp - 0x6d], 0x6c
mov byte [ebp - 0x6c], 0x69
mov byte [ebp - 0x6b], 0x7a
mov byte [ebp - 0x6a], 0x61
mov byte [ebp - 0x69], 0x74
mov byte [ebp - 0x68], 0x69
mov byte [ebp - 0x67], 0x6f
mov byte [ebp - 0x66], 0x6e
mov byte [ebp - 0x65], 0x20
mov byte [ebp - 0x64], 0x66
mov byte [ebp - 0x63], 0x61
mov byte [ebp - 0x62], 0x69
mov byte [ebp - 0x61], 0x6c
mov byte [ebp - 0x60], 0x65
mov byte [ebp - 0x5f], 0x64
mov byte [ebp - 0x5e], 0x21
mov byte [ebp - 0x5d], 0x20
mov byte [ebp - 0x5c], 0x45
mov byte [ebp - 0x5b], 0x72
mov byte [ebp - 0x5a], 0x72
mov byte [ebp - 0x59], 0x6f
mov byte [ebp - 0x58], 0x72
mov byte [ebp - 0x57], 0x20
mov byte [ebp - 0x56], 0x63
mov byte [ebp - 0x55], 0x6f
mov byte [ebp - 0x54], 0x64
mov byte [ebp - 0x53], 0x65
mov byte [ebp - 0x52], 0x3a
mov byte [ebp - 0x51], 0x20
mov byte [ebp - 0x50], 0x35
mov byte [ebp - 0x4f], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5142
push 1
lea edx, [ebp - 0x7c]
push edx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
Function at 0x10072b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c72bd
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x5c]
call fcn.100114c0
mov dword [ebp - 4], 0
push 0
push 2
lea eax, [ebp - 0x58]
push eax
push 0x23
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 0x58]
mov dword [ebp - 0x60], edx
mov ecx, dword [ebp - 0x60]
call dword [0x100e7c14]
call dword [ebp - 0x60]
test eax, eax
jl 0x10072d05
movzx eax, byte [ebp - 0x58]
test eax, eax
je 0x10072d05
movzx ecx, byte [ebp - 0x57]
test ecx, ecx
jne 0x10072d05
mov byte [ebp - 0x54], 0x4b
mov byte [ebp - 0x53], 0x65
mov byte [ebp - 0x52], 0x72
mov byte [ebp - 0x51], 0x6e
mov byte [ebp - 0x50], 0x65
mov byte [ebp - 0x4f], 0x6c
mov byte [ebp - 0x4e], 0x20
mov byte [ebp - 0x4d], 0x44
mov byte [ebp - 0x4c], 0x65
mov byte [ebp - 0x4b], 0x62
mov byte [ebp - 0x4a], 0x75
mov byte [ebp - 0x49], 0x67
mov byte [ebp - 0x48], 0x67
mov byte [ebp - 0x47], 0x65
mov byte [ebp - 0x46], 0x72
mov byte [ebp - 0x45], 0x20
mov byte [ebp - 0x44], 0x64
mov byte [ebp - 0x43], 0x65
mov byte [ebp - 0x42], 0x74
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x40], 0x63
mov byte [ebp - 0x3f], 0x74
mov byte [ebp - 0x3e], 0x65
mov byte [ebp - 0x3d], 0x64
mov byte [ebp - 0x3c], 0x21
mov byte [ebp - 0x3b], 0x20
mov byte [ebp - 0x3a], 0x50
mov byte [ebp - 0x39], 0x6c
mov byte [ebp - 0x38], 0x65
mov byte [ebp - 0x37], 0x61
mov byte [ebp - 0x36], 0x73
mov byte [ebp - 0x35], 0x65
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x32], 0x69
mov byte [ebp - 0x31], 0x73
mov byte [ebp - 0x30], 0x61
mov byte [ebp - 0x2f], 0x62
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x20
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x62
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x67
mov byte [ebp - 0x26], 0x67
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x61
mov byte [ebp - 0x20], 0x6e
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x76
mov byte [ebp - 0x18], 0x69
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d514d
push 1
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.100114e0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x1007320f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x1007320d
jmp 0x10073208
call fcn.1007320f
jae 0x10073208
add esp, 4
jmp 0x10073214
dec dword [esp]
jno 0x10073219
jns 0x10073204
jp 0x1007321d
add esp, 4
popf
jmp 0x10073224
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1007323d
jne 0x1007323d
call 0x1fc76591
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x38], 0x44
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x62
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x67
mov byte [ebp - 0x33], 0x67
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x44
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x3b
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x43
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x3a
mov byte [ebp - 0x1c], 0x20
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], pe_nt_image_headers32
mov byte [ebp - 0x19], 0x39
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x30
mov byte [ebp - 0x12], 0x35
mov byte [ebp - 0x11], 0
call fcn.10075fb0
movzx eax, al
test eax, eax
je 0x1007331f
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5123
push 1
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
pushf
push 0xa
jae 0x1007332c
jmp 0x10073327
call 0x1007332e
jae 0x10073327
add esp, 4
jmp 0x10073333
dec dword [esp]
jno 0x10073338
jns 0x10073323
jp 0x1007333c
add esp, 4
popf
jmp 0x10073343
clc
jae 0x10073348
xor dword [ebx + 0x50], esp
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10073361
jne 0x10073361
arpl word [ebx + eax - 0x15], di
add esp, dword [ebx + 0x74]
sti
jl 0x10073366
jmp 0x10073368
je 0x10073363
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10073382
jne 0x10073381
call 0x930b2409
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10073390
jne 0x10073390
call fcn.1003795b
invalid
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.100114e0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret