joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ad90
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1004
call fcn.0048ed30
mov eax, dword [0x4c97a0]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [esp + 0x1010]
push 0x1000
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0048dc10
push 0x800
lea ecx, [esp + 0x18]
push 0x4ad638
push ecx
call fcn.0048c41b
push 0x800
lea edx, [esp + 0x24]
push esi
push edx
call fcn.0048d4e5
push 0x800
lea eax, [esp + 0x30]
push 0x4ad60c
push eax
call fcn.0048d4e5
push 0x800
lea ecx, [esp + 0x3c]
push esi
push ecx
call fcn.0048d4e5
push 0x800
lea edx, [esp + 0x48]
push str.vL
push edx
call fcn.0048d4e5
add esp, 0x48
push 0x800
lea eax, [esp + 0xc]
push edi
push eax
call fcn.0048d4e5
push 0x800
lea ecx, [esp + 0x18]
push 0x4ad5cc
push ecx
call fcn.0048d4e5
add esp, 0x18
push 0x14
push esi
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
cmp esi, 6
jne 0x48aea2
call fcn.0048ab90
test eax, eax
je 0x48ae8a
call fcn.0048ac80
test eax, eax
je 0x48ae8a
push 5
push 0
push 0
push str.http:__down.360safe.com_setupbeta.exe
jmp 0x48ae95
push 5
push 0
push 0
push str.http:__down.360safe.com_setup.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [esp + 0x1018], 0
je 0x48aeb3
push 0
call fcn.0048effb
mov ecx, dword [esp + 0x1008]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0048b133
add esp, 0x1004
ret

Function at 0x48aed0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x140
mov eax, dword [0x4c97a0]
xor eax, esp
mov dword [esp + 0x13c], eax
mov eax, dword [esp + 0x144]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x48af22
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.0048b133
add esp, 0x140
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 0x40
lea ecx, [esp + 0x114]
push ecx
push esi
call edi
test eax, eax
je 0x48afab
cmp dword [esp + 0xc], 0x40
jne 0x48afab
mov edx, 0x5a4d
cmp word [esp + 0x108], dx
jne 0x48afab
mov eax, dword [esp + 0x144]
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [esp + 0x144]
jne 0x48afab
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xf8
lea edx, [esp + 0x1c]
push edx
push esi
call edi
test eax, eax
je 0x48afab
cmp dword [esp + 0xc], 0xf8
jne 0x48afab
cmp dword [esp + 0x10], 0x4550
jne 0x48afab
cmp word [esp + 0x16], bx
je 0x48afab
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x148]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0048b133
add esp, 0x140
ret

Function at 0x48b133
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c97a0]
jne 0x48b13d
repz ret
jmp fcn.0048f116
Function at 0x49cfba
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0049002d
and dword [ebp - 4], 0
cmp dword [0x4cf284], 0
mov ebx, eax
jne 0x49d06b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x49d11c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x49d11c
push eax
call fcn.0048ffbb
mov dword [esp], 0x4af85c
push edi
mov dword [0x4cf284], eax
call esi
push eax
call fcn.0048ffbb
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4cf288], eax
call esi
push eax
call fcn.0048ffbb
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4cf28c], eax
call esi
push eax
call fcn.0048ffbb
pop ecx
mov dword [0x4cf294], eax
test eax, eax
je 0x49d06b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0048ffbb
pop ecx
mov dword [0x4cf290], eax
mov eax, dword [0x4cf290]
cmp eax, ebx
je 0x49d0c3
cmp dword [0x4cf294], ebx
je 0x49d0c3
push eax
call fcn.00490036
push dword [0x4cf294]
mov esi, eax
call fcn.00490036
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x49d0c3
test edi, edi
je 0x49d0c3
call esi
test eax, eax
je 0x49d0ba
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x49d0ba
test byte [ebp - 0xc], 1
jne 0x49d0c3
or dword [ebp + 0x10], 0x200000
jmp 0x49d0fc
mov eax, dword [0x4cf288]
cmp eax, ebx
je 0x49d0fc
push eax
call fcn.00490036
pop ecx
test eax, eax
je 0x49d0fc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x49d0fc
mov eax, dword [0x4cf28c]
cmp eax, ebx
je 0x49d0fc
push eax
call fcn.00490036
pop ecx
test eax, eax
je 0x49d0fc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4cf284]
call fcn.00490036
pop ecx
test eax, eax
je 0x49d11c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x49d11e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a2250
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4a22c1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x4a22c1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x4a22aa
jmp 0x4a22c1
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x10017024
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x100143a4], 1
jne 0x100171a3
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.1001a2fc
add esp, 0xc
lea edx, [edx]
jno 0x1001705e
pushf
jnp 0x10017052
cmp ecx, ebx
popf
jle 0x10017058
mov esp, esp
nop
jo 0x1001705e
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
test esp, 0x5765
xchg edx, edx
jle 0x10017098
cmp ecx, dword [esp + 0x10]
jne 0x100170b0
pushf
xchg edx, ebx
xchg edx, ebx
rol ebx, 5
rol ebx, 0x1b
popf
nop
je 0x100170b0
jmp 0x90e9be3e
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.10032c43
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10017125
xor eax, eax
jmp 0x1001721b
cmp eax, dword [esp]
stc
jp 0x1001714b
pushf
ror esp, 0
lea esi, [esi + 0x5262]
lea esi, [esi - 0x5262]
jl 0x1001713e
jo 0x10017140
popf
xchg edi, edi
jl 0x10017146
jno 0x10017148
jnp 0x1001714b
sub eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1001af90
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.1001a2fc
add esp, 0xc
jge 0x1001716d
call fcn.10017172
mov ecx, dword [0x100143a4]
mov dword [ebp - 8], ecx
Function at 0x10018066
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.1001a2fc
add esp, 0xc
and esi, 0xffffffff
ror esp, 0
jns 0x10018090
jae 0x10018089
jge 0x1001808b
xchg edx, edx
js 0x10018090
add esi, 0xc648e045
inc ebp
in eax, 0x65
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
test esi, edx
add edx, 0
lea esp, [esp]
jne 0x10018101
pushf
test esp, 0x9af
jl 0x100180f0
mov eax, eax
test esp, 0x7c7b
popf
mov esp, esp
je 0x100180fe
je 0x10018101
mov edx, 0x80e04d8a
jmp 0xf04f090b
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
test esi, 0x4077
dec edx
inc edx
xor edx, 0xa4
xor edx, 0xa4
jno 0x100181b3
jg 0x100181c9
pushf
xchg ecx, ecx
ror eax, 0
rol edx, 0x16
rol edx, 0xa
popf
lea esi, [esi]
jle 0x100181c9
call 0x11abf7b5
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.10032c43
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100181de
xor eax, eax
jmp 0x10018478
or esp, 0
shr eax, 0
test dword [esp], edi
je 0x100181e9
jae 0x100181f4
xchg ecx, edx
xchg ecx, edx
jb 0x100181f4
ljmp 0x51e0:0x4d8d6a60
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.1001af90
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.1001a2fc
add esp, 0xc
xor edx, 0x5d57
xor edx, 0x5d57
and edx, edx
call fcn.10018227
Function at 0x10018f72
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
add ebx, 0
jl 0x10018f95
jne 0x10018f82
jl 0x10018f84
jno 0x10018f86
lea edx, [edx + 0x7b49]
lea edx, [edx - 0x7b49]
jge 0x10018f95
mov ebx, 0x439c3d83
add dword [eax], edx
add dword [edi], ecx
test dword [eax], ebp
add dword [eax], eax
add byte [edx + 0xc], ch
cmp dword [0x1001439c], 1
jne 0x100190ca
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.1001a2fc
add esp, 0xc
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 6], 0x42
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x47
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0xd], 0x62
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 7], 0x66
clc
call fcn.10018fe8
mov ecx, dword [0x1001439c]
mov dword [ebp - 4], ecx
Function at 0x1001b08a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
add byte [ebp - 0x17af13bb], cl
pop esp
invalid
push eax
call fcn.1001a2fc
add esp, 0xc
or edi, 0
ror esi, 0x12
ror esi, 0xe
stc
je 0x1001b0c3
pushf
xchg esp, esp
mov edi, edi
shr esi, 0
popf
jle 0x1001b0bc
mov ebx, ebx
jl 0x1001b0c0
jne 0x1001b0c3
lcall 0x45c6, 0x53ec45c6
clc
jo 0x1001b092
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
neg ebx
neg ebx
jno 0x1001b10f
inc ebp
cmc
jno 0x1001b096
inc ebp
out dx, eax
je 0x1001b09a
inc ebp
invalid
lea ebx, [ebx]
mov ebx, ebx
jae 0x1001b10b
jo 0x1001b10f
mov edi, 0xec4d8aa6
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.10032c43
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001b199
jmp 0x1001b20c
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001af90
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.1001a2fc
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x1001b20c
rol esp, 0
je 0x1001b1db
pushf
cmp edx, dword [esp + 0xc]
clc
jae 0x1001b1cd
or esp, 0
popf
jb 0x1001b1d4
mov ebx, ebx
jbe 0x1001b1d8
jne 0x1001b1db
mov ebp, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.10034613
add esp, 4
rol edi, 0xb
ror edi, 0xb
neg eax
neg eax
jbe 0x1001b1f9
jle 0x1001b1f5
ja 0x1001b1f9
mov esp, 0x144d8b98
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001c931
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.1001a2fc
add esp, 0xc
rol esi, 0
call fcn.1001c959

Function at 0x1001e6f1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.1001a2fc
add esp, 0xc
rol ecx, 0x12
ror ecx, 0x12
call fcn.1001e715
Function at 0x1001f4d7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.1001a2fc
add esp, 0xc
call fcn.1001f4f5
Function at 0x1001fdd4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.1001a2fc
add esp, 0xc
jno 0x1001fdef
ror edi, 0
not ecx
not ecx
nop
jp 0x1001fe01
mov esp, esp
jb 0x1001fdfd
jnp 0x1001fe01
mov esp, 0xf045c69b
dec eax
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
xor edx, dword [esp + 0x10]
xor edx, dword [esp + 0x10]
rol ebx, 0x17
ror ebx, 0x17
add esi, 0x54b9
sub esi, 0x54b9
cmc
jp 0x1001fe57
pushf
or esi, esi
cmp ecx, ebx
cmc
popf
js 0x1001fe51
nop
jo 0x1001fe54
jnp 0x1001fe57
mov eax, 0x80f04d8a
jmp 0x4f8661
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.1001a84b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001feb7
xor eax, eax
jmp 0x1001ff36
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.1001af90
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.1001a2fc
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x1001ff34
xchg edi, esi
xchg edi, esi
je 0x1001ff00
pushf
rol esi, 0x1c
rol esi, 4
jg 0x1001feed
jp 0x1001feef
test dword [esp + 4], edi
popf
jle 0x1001fef7
xchg edi, edx
xchg edi, edx
xchg ebx, ebx
jne 0x1001ff00
call 0x61ee4c8f
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10034613
add esp, 4
xor esp, 0
jb 0x1001ff27
pushf
cmc
popf
je 0x1001ff18
lea edi, [edi + 0x7107]
lea edi, [edi - 0x7107]
jae 0x1001ff27
add eax, 0x520c558b
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x1001ff36
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10022b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x10022b94
jmp 0x10022d2b
clc
jae 0x10022b97
stc
test esp, 0x6362
je 0x10022ba8
xchg edi, edi
jle 0x10022ba4
jne 0x10022ba8
mov eax, 0x8458b24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x10013d3c], edx
jle 0x10022bbb
js 0x10022bc9
lea esp, [esp]
xchg esi, eax
xchg esi, eax
xchg ecx, ecx
nop
jns 0x10022bc9
mov edi, 0xec458b17
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x10013bec], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x10013be8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x10013d10], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x10013d14], ecx
jp 0x10022bfa
and edi, 0xffffffff
cmp ecx, dword [esp]
je 0x10022c0c
jns 0x10022c04
jl 0x10022c06
js 0x10022c08
jne 0x10022c0c
mov esp, 0xf045c6d9
dec ebp
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
ror ebx, 0x14
rol ebx, 0x14
shl esp, 0
call 0x10022c4e
add esp, 4
inc eax
dec eax
jge 0x10022c61
jge 0x10022c57
je 0x10022c59
jne 0x10022c5b
jns 0x10022c5d
jl 0x10022c61
xor eax, 0xf0558aab
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
neg eax
neg eax
je 0x10022ce3
pushf
rol esp, 0
call 0x10022cd9
add esp, 4
popf
lea edx, [edx]
jne 0x10022ce3
mov ebx, 0x3be83d83
add dword [eax], edx
add byte [esp + edx - 0x73], dh
push ebp
invalid
cmp dword [0x10013be8], 0
je 0x10022d00
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x10013be8]
push eax
call fcn.1001af90
mov dword [0x10013d38], eax
jno 0x10022d02
cmp edx, dword [esp]
jnp 0x10022d1b
pushf
jns 0x10022d0b
xchg ecx, ecx
sub esp, 0
lea edx, [edx]
popf
jo 0x10022d16
mov esp, esp
jp 0x10022d1b
mov ebp, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.1001a2fc
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100234c5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.1001a2fc
add esp, 0xc
xor eax, 0
clc
js 0x100234e4
lea eax, [eax + 0x7e31]
sub eax, 0x7e31
je 0x10023506
jbe 0x100234f3
lea ebx, [ebx + 0x797e]
lea ebx, [ebx - 0x797e]
lea esp, [esp]
jne 0x10023506
mov esi, 0xe845c638
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
lea edi, [edi + 0x5aea]
lea edi, [edi - 0x5aea]
jae 0x10023569
jb 0x1002355e
mov esp, esp
mov esp, esp
jb 0x10023564
jb 0x10023569
call 0x5d8c68a9
call 0x98041ef0
dec ebp
call 0x90ef8b00
ljmp 0x458a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.10032c43
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10023612
xor eax, eax
jmp 0x10023697
lea esi, [esi]
ror eax, 3
ror eax, 0x1d
jne 0x10023621
jno 0x1002361e
je 0x10023621
lcall 0x4d8b, 0x50e8458d
cld
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001af90
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.1001a2fc
add esp, 0xc
std
cld
jl 0x1002364c
xchg edi, eax
xchg edi, eax
jge 0x1002364c
mov ebx, 0x7d836902
in al, 0
cmp dword [ebp - 0x1c], 0
jne 0x10023656
xor eax, eax
jmp 0x10023697
test dword [esp], eax
xor esp, 0
test dword [esp + 0x10], edx
jb 0x10023676
pushf
xor edi, ecx
xor edi, ecx
nop
jp 0x1002366b
popf
lea ebx, [ebx]
jp 0x10023671
xchg esp, esp
jae 0x10023676
mov ecx, 0x50e4458b
mov eax, dword [ebp - 0x1c]
push eax
call fcn.10034613
add esp, 4
add esp, 0
jne 0x10023694
pushf
lea edi, [edi]
jmp 0x1002368d
popf
xchg esp, esp
je 0x10023694
add eax, 0x5fe455ff
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret