joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100edf68
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x340031
mov dword [ebp - 0x50], 0x330032
mov dword [ebp - 0x4c], 0x450031
mov dword [ebp - 0x48], 0x380043
mov dword [ebp - 0x44], 0x460039
mov dword [ebp - 0x40], 0x420034
mov dword [ebp - 0x3c], 0x460034
mov dword [ebp - 0x38], 0x380037
mov dword [ebp - 0x34], 0x440039
mov dword [ebp - 0x30], 0x410034
mov dword [ebp - 0x2c], 0x450037
mov dword [ebp - 0x28], 0x420033
mov dword [ebp - 0x24], 0x430034
mov dword [ebp - 0x20], 0x360042
mov dword [ebp - 0x1c], 0x450043
mov dword [ebp - 0x18], 0x310039
mov word [ebp - 0x14], ax
call fcn.10013330
mov ecx, eax
test ecx, ecx
je 0x10023c0b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10012890
test al, al
jne 0x10023beb
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10023bd0
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10015450
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10012800
int3
Function at 0x10023c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100edf68
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x450038
mov dword [ebp - 0x50], 0x310032
mov dword [ebp - 0x4c], 0x300035
mov dword [ebp - 0x48], 0x450031
mov dword [ebp - 0x44], 0x390033
mov dword [ebp - 0x40], 0x320046
mov dword [ebp - 0x3c], 0x310034
mov dword [ebp - 0x38], 0x380030
mov dword [ebp - 0x34], 0x340039
mov dword [ebp - 0x30], 0x450038
mov dword [ebp - 0x2c], 0x300044
mov dword [ebp - 0x28], 0x420039
mov dword [ebp - 0x24], 0x380041
mov dword [ebp - 0x20], 0x370031
mov dword [ebp - 0x1c], 0x390046
mov dword [ebp - 0x18], 0x360031
mov word [ebp - 0x14], ax
call fcn.10013330
mov ecx, eax
test ecx, ecx
je 0x10023d3b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10012890
test al, al
jne 0x10023d1b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10023d00
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10015450
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10012800
int3
Function at 0x10026860
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ee4b3
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x1002691b
cmp word [esi], di
je 0x1002691b
test eax, eax
je 0x100268cc
cmp word [eax], di
je 0x100268cc
push edi
push edi
push eax
push esi
push edi
call fcn.100e9f60
push eax
call fcn.10027a10
add esp, 4
call eax
test eax, eax
js 0x1002691b
jmp 0x10026916
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.100c3310
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call fcn.100e9ec0
push eax
call fcn.10027a10
add esp, 4
call eax
test eax, eax
js 0x1002691b
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x10026992
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x1002697d
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x1002694b
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x1002696c
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x100269b2
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x1002697d
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x10026992
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret 0x30
call fcn.1001db2e
int3
Function at 0x10036ff0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ef2e7
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1012b014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [edi + 0x18], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov dword [ebp - 4], 0
mov byte [edi + 0x1c], 0
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100538b0
mov dword [esi], eax
lea esi, [edi + 0x44]
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100538b0
mov dword [esi], eax
mov dword [edi + 0x4c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0xf
mov byte [edi + 0x50], 0
lea ecx, [edi + 0x68]
mov byte [ebp - 4], 4
mov dword [ecx + 0x10], 0
push 0
mov dword [ecx + 0x14], 0xf
push 0x100ffee6
mov byte [ecx], 0
call fcn.1000eee0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10038b50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, dword [eax]
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038b60
sub ecx, edx
xor edi, edi
push ebx
xor ebx, ebx
mov eax, 0x811c9dc5
lea edx, [ecx + esi]
cmp esi, edx
cmova ecx, ebx
pop ebx
test ecx, ecx
je 0x10038b93
movzx edx, byte [esi]
lea esi, [esi + 1]
xor edx, eax
inc edi
imul eax, edx, 0x1000193
cmp edi, ecx
jne 0x10038b80
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.100cbfc7
imul eax, eax, 0xb14
add esp, 8
imul ecx, edx, 0x41a7
pop edi
pop esi
sub ecx, eax
lea eax, [ecx + 0x7fffffff]
js 0x10038bc0
mov eax, ecx
pop ebp
ret 4
Function at 0x1007cce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3e0a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x1012b014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
jne 0x1007cd4d
push 0x38
call fcn.1001f2a8
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x1007cd3a
mov ecx, eax
call fcn.1007f830
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x40], 0
je 0x1007cd61
push 0x38
push 0x1012d5f4
mov ecx, edi
call fcn.1002a630
push 0x38
mov ecx, edi
call fcn.1002a3a0
mov esi, eax
mov dword [ebp + 8], esi
mov dword [esi], vtable.google::protobuf::FieldDescriptorProto.0
mov dword [ebp - 4], 1
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov eax, dword [0x10139d94]
mov byte [ebp - 4], 2
cmp eax, 2
je 0x1007cdc3
mov dword [ebp - 0x18], vtable.google::protobuf::internal::FunctionClosure0.0
mov dword [ebp - 0x14], 0x10087ad0
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
push 0x10139d94
call fcn.1002a650
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.10027ff0
mov dword [esi + 0xc], 0
xorps xmm0, xmm0
mov dword [esi + 0x10], 0x101395b8
mov eax, esi
mov dword [esi + 0x14], 0x101395b8
mov dword [esi + 0x18], 0x101395b8
mov dword [esi + 0x1c], 0x101395b8
mov dword [esi + 0x20], 0x101395b8
movq qword [esi + 0x24], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007dda0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f4165
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x1012b014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
jne 0x1007de0d
push 0x48
call fcn.1001f2a8
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x1007ddfa
mov ecx, eax
call fcn.100807e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x40], 0
je 0x1007de21
push 0x48
push 0x1012e6c0
mov ecx, edi
call fcn.1002a630
push 0x48
mov ecx, edi
call fcn.1002a3a0
mov esi, eax
mov dword [ebp + 8], esi
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
mov dword [ebp - 4], 1
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov eax, dword [0x10139dd4]
mov byte [ebp - 4], 3
cmp eax, 2
je 0x1007de9b
mov dword [ebp - 0x18], vtable.google::protobuf::internal::FunctionClosure0.0
mov dword [ebp - 0x14], 0x10088700
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
push 0x10139dd4
call fcn.1002a650
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.10027ff0
xorps xmm0, xmm0
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x101395b8
mov eax, esi
mov dword [esi + 0x24], 0x101395b8
mov dword [esi + 0x28], 0x101395b8
movups xmmword [esi + 0x30], xmm0
movq qword [esi + 0x40], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1007f750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f42cb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x1012b014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi], vtable.google::protobuf::FieldDescriptorProto.0
mov dword [ebp - 4], 0
mov dword [esi + 4], eax
mov dword [esi + 8], 0
mov eax, dword [0x10139d94]
mov byte [ebp - 4], 1
cmp eax, 2
je 0x1007f7d2
mov dword [ebp - 0x1c], vtable.google::protobuf::internal::FunctionClosure0.0
mov dword [ebp - 0x18], 0x10087ad0
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 0x10139d94
call fcn.1002a650
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.10027ff0
mov dword [esi + 0xc], 0
xorps xmm0, xmm0
mov dword [esi + 0x10], 0x101395b8
mov eax, esi
mov dword [esi + 0x14], 0x101395b8
mov dword [esi + 0x18], 0x101395b8
mov dword [esi + 0x1c], 0x101395b8
mov dword [esi + 0x20], 0x101395b8
movq qword [esi + 0x24], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10084630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov edi, dword [esi + 0x14]
test edi, edi
jle 0x10084672
mov edx, dword [esi + 0x1c]
xor ecx, ecx
nop dword [eax]
mov eax, dword [edx + ecx*4 + 4]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x10084663
mov eax, dword [eax]
inc ecx
mov byte [eax], 0
cmp ecx, edi
jl 0x10084650
mov dword [esi + 0x14], 0
push ebx
mov ebx, dword [esi + 0x24]
test ebx, ebx
jle 0x10084699
mov eax, dword [esi + 0x2c]
xor edi, edi
mov esi, eax
mov ecx, dword [esi + edi*4 + 4]
call fcn.10083e10
inc edi
cmp edi, ebx
jl 0x10084681
mov esi, dword [ebp - 8]
mov dword [esi + 0x24], 0
mov ebx, dword [esi + 0x34]
test ebx, ebx
jle 0x100846c8
mov eax, dword [esi + 0x3c]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop word [eax + eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.10084190
inc edi
cmp edi, ebx
jl 0x100846b0
mov esi, dword [ebp - 8]
mov dword [esi + 0x34], 0
mov ebx, dword [esi + 0x44]
test ebx, ebx
jle 0x100846f8
mov eax, dword [esi + 0x4c]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.10084d00
inc edi
cmp edi, ebx
jl 0x100846e0
mov esi, dword [ebp - 8]
mov dword [esi + 0x44], 0
mov ebx, dword [esi + 0x54]
test ebx, ebx
jle 0x10084728
mov eax, dword [esi + 0x5c]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.100844a0
inc edi
cmp edi, ebx
jl 0x10084710
mov esi, dword [ebp - 8]
mov dword [esi + 0x54], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x6c], 0
mov ebx, dword [esi + 8]
test bl, 0x1f
je 0x100847c8
test bl, 1
je 0x10084763
mov eax, dword [esi + 0x78]
cmp eax, 0x101395b8
je 0x10084763
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x10084760
mov eax, dword [eax]
mov byte [eax], 0
test bl, 2
je 0x10084784
mov eax, dword [esi + 0x7c]
cmp eax, 0x101395b8
je 0x10084784
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x10084781
mov eax, dword [eax]
mov byte [eax], 0
test bl, 4
je 0x100847a8
mov eax, dword [esi + 0x80]
cmp eax, 0x101395b8
je 0x100847a8
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x100847a5
mov eax, dword [eax]
mov byte [eax], 0
test bl, 8
je 0x100847b8
mov ecx, dword [esi + 0x84]
call fcn.10084850
test bl, 0x10
je 0x100847c8
mov ecx, dword [esi + 0x88]
call fcn.10084da0
mov dword [esi + 8], 0
test byte [esi + 4], 1
pop ebx
je 0x100847e6
mov ecx, dword [esi + 4]
and ecx, 0xfffffffe
cmp dword [ecx], 0
je 0x100847e6
call fcn.100306b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100a1580
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ef5e0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.10070170
dec eax
cmp eax, 9
ja case.default.0x100a15bb
jmp dword [eax*4 + 0x100a171c]
push 0x32c
push str.D:_sourcecode460SoftwareGasteprotobuf_cpp_3.5.1protobuf_3.5.1_srcgoogle_protobuf_map_field.h
push 3
lea ecx, [ebp - 0x34]
call fcn.10027f30
push str.Unsupported
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.10028350
push eax
lea ecx, [ebp - 0x59]
call fcn.10028140
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.10028070
push 0x33b
push str.D:_sourcecode460SoftwareGasteprotobuf_cpp_3.5.1protobuf_3.5.1_srcgoogle_protobuf_map_field.h
push 3
lea ecx, [ebp - 0x58]
call fcn.10027f30
push str.Cant_get_here.
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.10028350
push eax
lea ecx, [ebp - 0x5a]
call fcn.10028140
lea ecx, [ebp - 0x58]
call fcn.10028070
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.1006c0a0
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x100a166a
mov esi, dword [esi]
mov edx, esi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x100a1670
sub edx, ecx
xor ebx, ebx
xor edi, edi
mov eax, 0x811c9dc5
lea ecx, [edx + esi]
cmp esi, ecx
cmova edx, ebx
test edx, edx
je 0x100a16a3
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
cmp edi, edx
jne 0x100a1690
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.100cbfc7
imul edx, edx, 0x41a7
add esp, 8
imul ecx, eax, 0xb14
sub edx, ecx
jns 0x100a16cc
add edx, 0x7fffffff
mov eax, edx
jmp 0x100a163b
mov ecx, esi
call fcn.1006bdb0
xor eax, 0xdeadbeef
jmp 0x100a16a3
mov ecx, esi
call fcn.1006bbc0
xor eax, 0xdeadbeef
jmp 0x100a16a3
mov ecx, esi
call fcn.1006c470
xor eax, 0xdeadbeef
jmp 0x100a16a3
mov ecx, esi
call fcn.1006c280
xor eax, 0xdeadbeef
jmp 0x100a16a3
mov ecx, esi
call fcn.1006b9d0
movzx eax, al
xor eax, 0xdeadbeef
jmp 0x100a16a3
Function at 0x100a74b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f64ab
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 0x6f0043
mov dword [ebp - 0x90], 0x66006e
mov dword [ebp - 0x8c], 0x670069
mov dword [ebp - 0x88], 0x650043
mov dword [ebp - 0x84], 0x74006e
mov dword [ebp - 0x80], 0x720065
mov dword [ebp - 0x7c], 0x690053
mov dword [ebp - 0x78], 0x6c006e
mov dword [ebp - 0x74], 0x650067
mov dword [ebp - 0x70], 0x6e0049
mov dword [ebp - 0x6c], 0x740073
mov dword [ebp - 0x68], 0x6e0061
mov dword [ebp - 0x64], 0x650063
mov dword [ebp - 0x60], 0x7b005f
mov dword [ebp - 0x5c], 0x380030
mov dword [ebp - 0x58], 0x370039
mov dword [ebp - 0x54], 0x350035
mov dword [ebp - 0x50], 0x310044
mov dword [ebp - 0x4c], 0x41002d
mov dword [ebp - 0x48], 0x350032
mov dword [ebp - 0x44], 0x2d0042
mov dword [ebp - 0x40], 0x420034
mov dword [ebp - 0x3c], 0x450035
mov dword [ebp - 0x38], 0x41002d
mov dword [ebp - 0x34], 0x350045
mov dword [ebp - 0x30], 0x2d0045
mov dword [ebp - 0x2c], 0x330036
mov dword [ebp - 0x28], 0x340030
mov dword [ebp - 0x24], 0x360031
mov dword [ebp - 0x20], 0x340041
mov dword [ebp - 0x1c], 0x460044
mov dword [ebp - 0x18], 0x340041
mov dword [ebp - 0x14], 0x7d
call fcn.10013330
mov ecx, eax
test ecx, ecx
je 0x100a7652
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10012890
test al, al
jne 0x100a7632
lea ecx, [ebp - 0x94]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a7614
sub ecx, edx
lea eax, [ebp - 0x94]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10015450
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10012800
int3
Function at 0x100a7970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f6528
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], 0x720054
mov dword [ebp - 0x70], 0x630061
mov dword [ebp - 0x6c], 0x6c0065
mov dword [ebp - 0x68], 0x730065
mov dword [ebp - 0x64], 0x630073
mov dword [ebp - 0x60], 0x610068
mov dword [ebp - 0x5c], 0x430074
mov dword [ebp - 0x58], 0x6e006f
mov dword [ebp - 0x54], 0x690066
mov dword [ebp - 0x50], 0x430067
mov dword [ebp - 0x4c], 0x6e0065
mov dword [ebp - 0x48], 0x650074
mov dword [ebp - 0x44], 0x530072
mov dword [ebp - 0x40], 0x750074
mov dword [ebp - 0x3c], 0x500062
mov dword [ebp - 0x38], 0x650072
mov dword [ebp - 0x34], 0x690066
mov dword [ebp - 0x30], 0x570078
mov dword [ebp - 0x2c], 0x64006e
mov dword [ebp - 0x28], 0x6c0043
mov dword [ebp - 0x24], 0x730061
mov dword [ebp - 0x20], 0x4e0073
mov dword [ebp - 0x1c], 0x6d0061
mov dword [ebp - 0x18], 0x5f0065
mov word [ebp - 0x14], ax
call fcn.10013330
mov ecx, eax
test ecx, ecx
je 0x100a7abb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10012890
test al, al
jne 0x100a7a9b
lea ecx, [ebp - 0x74]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a7a80
sub ecx, edx
lea eax, [ebp - 0x74]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10015450
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10012800
int3
Function at 0x100a7c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f6588
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], 0x610048
mov dword [ebp - 0x60], 0x6f006c
mov dword [ebp - 0x5c], 0x700077
mov dword [ebp - 0x58], 0x6f0043
mov dword [ebp - 0x54], 0x66006e
mov dword [ebp - 0x50], 0x670069
mov dword [ebp - 0x4c], 0x650043
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x740053
mov dword [ebp - 0x3c], 0x620075
mov dword [ebp - 0x38], 0x720050
mov dword [ebp - 0x34], 0x660065
mov dword [ebp - 0x30], 0x780069
mov dword [ebp - 0x2c], 0x6e0057
mov dword [ebp - 0x28], 0x430064
mov dword [ebp - 0x24], 0x61006c
mov dword [ebp - 0x20], 0x730073
mov dword [ebp - 0x1c], 0x61004e
mov dword [ebp - 0x18], 0x65006d
mov dword [ebp - 0x14], 0x5f
call fcn.10013330
mov ecx, eax
test ecx, ecx
je 0x100a7d70
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10012890
test al, al
jne 0x100a7d50
lea ecx, [ebp - 0x64]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a7d35
sub ecx, edx
lea eax, [ebp - 0x64]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10015450
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10012800
int3