joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100315bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.10036e19
add esp, 0xc
or ebx, ebx
cmp eax, dword [esp]
je 0x100315ee
pushf
ror esp, 0
xor esp, 0
popf
lea edx, [edx]
jnp 0x100315eb
jne 0x100315ee
mov edi, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
cmp edx, esi
stc
xchg edx, edx
jge 0x10031651
pushf
jg 0x10031639
lea esp, [esp]
lea ebx, [ebx + 0x7cb6]
lea ebx, [ebx - 0x7cb6]
jle 0x1003164a
popf
jp 0x1003164e
jl 0x10031651
mov eax, 0x80ec4d8a
jmp 0xfc509e5b
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.100174a7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100316e5
xor eax, eax
jmp 0x10031753
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.1001f190
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x10031751
xchg ecx, ecx
add esp, 0
jle 0x1003171c
xchg esp, esp
lea esp, [esp]
jge 0x10031719
jg 0x1003171c
mov edi, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1003a66f
add esp, 4
shr ebx, 0
jnp 0x10031748
pushf
xor edx, dword [esp]
xor edx, dword [esp]
mov eax, eax
call 0x1003173c
add esp, 4
popf
jb 0x10031743
jae 0x10031745
jp 0x10031748
mov edi, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x10031753
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10032288
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.10036e19
add esp, 0xc
or esp, 0
je 0x100322b2
jge 0x100322af
jne 0x100322b2
mov edx, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.1001f15f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003237a
xor eax, eax
jmp 0x100323f1
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001f190
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x100323a4
xor eax, eax
jmp 0x100323f1
add ecx, 0x316c
sub ecx, 0x316c
jg 0x100323c5
lea eax, [eax + 0x4ca7]
lea eax, [eax - 0x4ca7]
jg 0x100323c0
je 0x100323c2
jle 0x100323c5
add eax, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.1003a66f
add esp, 4
or eax, 0
jg 0x100323e6
pushf
nop
jo 0x100323db
lea ebx, [ebx]
test edx, edi
popf
mov ebx, ebx
jle 0x100323e6
jmp 0x610f7175
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10033ebd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.10036e19
add esp, 0xc
ja 0x10033ed8
lea ebx, [ebx]
clc
jp 0x10033eee
pushf
xchg edx, edx
jbe 0x10033ee3
popf
xchg esp, esp
jp 0x10033ee9
jl 0x10033eeb
jnp 0x10033eee
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
cmp eax, ebx
jns 0x10033f3a
xchg edi, eax
xchg edi, eax
jp 0x10033f32
jae 0x10033f34
jns 0x10033f36
js 0x10033f3a
lcall 0xe980, 0xe84d8a63
add dword [eax + 0x558ae84d], ecx
cmc
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.100174a7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10033fc6
xor eax, eax
jmp 0x1003403d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001f190
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x1003403b
cmc
cmp eax, dword [esp]
jno 0x10033ffb
jge 0x10033ff4
mov eax, eax
jno 0x10033ff8
jo 0x10033ffb
mov esp, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.1003a66f
add esp, 4
call 0x1003400c
add esp, 4
mov ecx, ecx
jl 0x1003402e
pushf
cmp eax, ecx
test esi, 0x7f9
popf
lea ecx, [ecx + 0x4d89]
lea ecx, [ecx - 0x4d89]
jge 0x1003402e
lcall 0x558b, 0x510c4d8b
or byte [edx - 1], dl
push ebp
clc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0x1003403d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100349f9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x10013474], 1
jne 0x10034b3b
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.10036e19
add esp, 0xc
ror esp, 0
jns 0x10034a3b
pushf
jo 0x10034a28
ror eax, 0x12
ror eax, 0xe
jge 0x10034a30
popf
je 0x10034a34
jnp 0x10034a36
xchg esi, esi
js 0x10034a3b
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
jo 0x10034a69
jae 0x10034a7f
jno 0x10034a6d
lea edi, [edi + 0x12d7]
lea edi, [edi - 0x12d7]
xchg ecx, ecx
jb 0x10034a7f
ljmp 0xe980:0xe84d8a02
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.1001f15f
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10034aec
mov eax, dword [ebp + 8]
jmp 0x10034bcc
and ecx, 0xffffffff
add esp, 0
cmp ebx, dword [esp]
jnp 0x10034b00
jnp 0x10034af9
jae 0x10034afb
jp 0x10034b00
mov ebp, 0x558d3457
call 0x448d659
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.1001f190
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x10034b31
mov edx, dword [ebp - 8]
mov dword [0x10013474], edx
jmp 0x10034b39
mov eax, dword [ebp + 8]
jmp 0x10034bcc
jmp 0x10034b43
mov eax, dword [0x10013474]
mov dword [ebp - 8], eax
jl 0x10034b45
je 0x10034b5d
jp 0x10034b49
lea esi, [esi + 0xf6d]
lea esi, [esi - 0xf6d]
je 0x10034b57
jl 0x10034b59
jne 0x10034b5d
ljmp 0x4d89:0xf84d8b16
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
xor ecx, 0x46fb
xor ecx, 0x46fb
shl esp, 0
jge 0x10034b74
jle 0x10034b97
pushf
cmp ecx, dword [esp + 0xc]
rol esp, 0
xor ecx, dword [esp]
xor ecx, dword [esp]
test edx, 0xfa1
popf
jb 0x10034b8f
mov esi, esi
lea esp, [esp]
jg 0x10034b97
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.1003a66f
add esp, 4
dec edi
inc edi
ja 0x10034bc5
pushf
je 0x10034bab
lea eax, [eax + 0x3d2a]
sub eax, 0x3d2a
xchg edx, esi
xchg edx, esi
popf
lea ebx, [ebx]
ja 0x10034bc0
mov esi, esi
jbe 0x10034bc5
sub eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100355e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.10036e19
add esp, 0xc
clc
jnp 0x1003560e
pushf
jp 0x10035607
cmc
popf
nop
jp 0x1003560e
mov ebp, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
neg esi
neg esi
ror eax, 0x12
ror eax, 0xe
cld
ja 0x10035667
pushf
test ebx, eax
clc
test esi, 0x7d36
popf
jb 0x10035662
jo 0x10035664
jbe 0x10035667
mov esp, 0x80ec4d8a
jmp 0xfc50de71
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.100174a7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100356ea
xor eax, eax
jmp 0x1003574d
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.1001f190
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x1003574b
sub esp, 0
jp 0x10035720
jle 0x10035717
jae 0x10035719
jle 0x1003571b
jge 0x1003571d
jnp 0x10035720
add eax, 0x52e8558b
mov edx, dword [ebp - 0x18]
push edx
call fcn.1003a66f
add esp, 4
dec esi
inc esi
jae 0x1003573a
jae 0x10035732
jnp 0x10035734
lea ebx, [ebx]
jb 0x1003573a
mov edx, 0x10458bb5
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x1003574d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003628e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.10036e19
add esp, 0xc
or esi, esi
jbe 0x100362bc
pushf
clc
popf
jg 0x100362b9
ja 0x100362bc
add eax, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
or edx, 0
xchg esi, eax
xchg esi, eax
jae 0x100362fc
jge 0x100362f5
jo 0x100362f7
jb 0x100362fc
call 0x5d8d669d
invalid
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
ror esp, 0
and edi, 0xffffffff
mov esp, esp
inc edx
dec edx
jbe 0x10036376
pushf
jne 0x1003636c
test dword [esp], edx
popf
xchg edx, eax
xchg edx, eax
ja 0x10036376
add eax, 0xfe112ce8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.100174a7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10036388
xor eax, eax
jmp 0x100363c4
jne 0x1003638a
test dword [esp + 0xc], edi
jb 0x100363a1
lea edi, [edi + 0x130f]
lea edi, [edi - 0x130f]
jbe 0x1003639e
jae 0x100363a1
mov ebp, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001f190
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.10036e19
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003714d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.10036e19
add esp, 0xc
jb 0x10037168
add esp, 0
xor ecx, edi
xor ecx, edi
jg 0x1003718d
pushf
jns 0x10037175
ror esi, 0
popf
xchg ecx, eax
xchg ecx, eax
lea eax, [eax]
lea ebx, [ebx + 0x6bb4]
lea ebx, [ebx - 0x6bb4]
jle 0x1003718d
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
add esp, 0
push eax
add eax, 0x7dd9
ror eax, 0x17
pop eax
jne 0x100371ed
pushf
jns 0x100371dc
lea ecx, [ecx]
xor edx, dword [esp]
xor edx, dword [esp]
popf
jge 0x100371e8
je 0x100371ea
je 0x100371ed
mov ebp, 0x80e84d8a
jmp 0xf850f9f7
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.100174a7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003727c
xor eax, eax
jmp 0x10037302
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001f190
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x10037300
xor edi, 0x37a1
xor edi, 0x37a1
and ecx, 0xffffffff
stc
xor edi, 0
jns 0x100372c0
lea esp, [esp]
xchg ecx, ecx
js 0x100372c0
mov esi, 0xf8458b85
mov eax, dword [ebp - 8]
push eax
call fcn.1003a66f
add esp, 4
jns 0x100372ce
neg edx
neg edx
shl esp, 0
cmp ebx, dword [esp]
jae 0x100372ef
mov edx, edx
jnp 0x100372de
lea ecx, [ecx + 0x284f]
lea ecx, [ecx - 0x284f]
jb 0x100372ec
jb 0x100372ef
or dword [ebx - 0x74aeefb3], 0x8b520c55
inc ebp
or byte [eax - 1], dl
push ebp
clc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0x10037302
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100385c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.10036e19
add esp, 0xc
xchg edi, esi
xchg edi, esi
shr ebx, 0
jg 0x100385e5
jge 0x100385f2
xchg ebx, eax
xchg ebx, eax
lea edx, [edx]
jge 0x100385ed
jle 0x100385ef
jl 0x100385f2
sub eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
lea ebx, [ebx + 0x39b2]
lea ebx, [ebx - 0x39b2]
xchg ecx, eax
xchg ecx, eax
cmp ecx, 0x2e9a
jae 0x10038638
jle 0x1003864a
pushf
std
cld
stc
jnp 0x10038641
ja 0x10038643
popf
jo 0x10038647
jg 0x1003864a
mov esp, 0x80f04d8a
jmp 0x510e54
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov esp, esp
cld
xchg edi, edx
xchg edi, edx
jge 0x100386cf
pushf
jns 0x100386b7
test dword [esp + 4], esi
std
cld
push edx
add edx, 0x5b3e
ror edx, 2
pop edx
popf
jle 0x100386cc
jl 0x100386cf
sub eax, 0xfffe6a8b
call fcn.1001f15f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100386e1
xor eax, eax
jmp 0x10038712
or esi, esi
and esi, 0xffffffff
je 0x100386ef
jge 0x100386ea
mov ebx, ebx
jne 0x100386ef
mov edx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001f190
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.10036e19
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b749
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x10013470], 1
jne 0x1003b8a7
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.10036e19
add esp, 0xc
test dword [esp + 0x10], ebx
cmc
cld
je 0x1003b77e
jae 0x1003b779
jne 0x1003b77e
mov ebx, 0x45c679f1
call 0xfd497dcd
insd dword es:[edi], dx
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
je 0x1003b7cb
lea esi, [esi + 0x3fe8]
lea esi, [esi - 0x3fe8]
jmp 0x1003b7c6
jl 0x1003b7c8
jne 0x1003b7cb
sub eax, 0x80e84d8a
jmp 0xf8513fd5
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.1001f15f
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1003b840
xor eax, eax
jmp 0x1003b911
rol ecx, 2
ror ecx, 2
jg 0x1003b853
pushf
jmp 0x1003b84c
popf
jns 0x1003b850
jle 0x1003b853
ljmp 0x4d8b:0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1001f190
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.10036e19
add esp, 0xc
jle 0x1003b875
ja 0x1003b877
lea esp, [esp]
jbe 0x1003b891
pushf
xor edi, edx
xor edi, edx
jp 0x1003b884
popf
mov ebx, ebx
xchg ebx, esi
xchg ebx, esi
jbe 0x1003b88e
ja 0x1003b891
mov esp, 0xf87d83
cmp dword [ebp - 8], 0
je 0x1003b8a1
mov eax, dword [ebp - 8]
mov dword [0x10013470], eax
jmp 0x1003b8a5
xor eax, eax
jmp 0x1003b911
jmp 0x1003b8b0
mov ecx, dword [0x10013470]
mov dword [ebp - 8], ecx
je 0x1003b8b2
xor ecx, dword [esp]
xor ecx, dword [esp]
push eax
pop eax
cmp esp, 0x50b2
jnp 0x1003b8ca
lea esp, [esp]
jb 0x1003b8c7
jp 0x1003b8ca
lcall 0xfc55, 0x89f8558b
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
jge 0x1003b8d2
xor esp, 0
and edi, edi
je 0x1003b8fa
pushf
call 0x1003b8e0
lea esp, [esp + 4]
test dword [esp + 4], eax
shr eax, 0
cmp esi, dword [esp + 8]
popf
jns 0x1003b8f3
lea edx, [edx]
jp 0x1003b8f7
jne 0x1003b8fa
jmp 0x60fffe89
mov eax, dword [ebp - 4]
push eax
call fcn.1003a66f
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8