joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xc
mov byte [ebp - 0x1c], 0x78
mov byte [ebp - 0x1b], 0xf5
mov byte [ebp - 0x1a], 0x31
mov byte [ebp - 0x19], 0x6a
mov byte [ebp - 0x18], 0x60
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x15], 0x2f
mov byte [ebp - 0x14], 0x4f
mov byte [ebp - 0x13], 0xf1
mov byte [ebp - 0x12], 0x31
mov byte [ebp - 0x11], 0x1d
mov eax, dword [0x1034d2b4]
and eax, 1
jne 0x10001ba8
mov ecx, dword [0x1034d2b4]
or ecx, 1
mov dword [0x1034d2b4], ecx
mov byte [0x1034d2b0], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10001b52
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10001b9b
jb 0x10001b60
cmp dword [ebp - 0x10], 0xc
jae 0x10001b9b
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006c090
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006c090
mov cl, byte [edi + esi]
mov byte [eax + 0x1034d2a4], cl
jmp 0x10001b40
push 0x1007d4e0
call fcn.1006c070
add esp, 4
mov eax, 0x1034d2a4
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10002590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xc
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x32
mov byte [ebp - 0x1a], 0xd0
mov byte [ebp - 0x19], 0x79
mov byte [ebp - 0x18], 0x60
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], 0x2f
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0xd1
mov byte [ebp - 0x11], 0x1b
mov eax, dword [0x1034d31c]
and eax, 1
jne 0x10002668
mov ecx, dword [0x1034d31c]
or ecx, 1
mov dword [0x1034d31c], ecx
mov byte [0x1034d318], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10002612
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x1000265b
jb 0x10002620
cmp dword [ebp - 0x10], 0xc
jae 0x1000265b
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006c090
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006c090
mov cl, byte [edi + esi]
mov byte [eax + 0x1034d30c], cl
jmp 0x10002600
push 0x1007d6c0
call fcn.1006c070
add esp, 4
mov eax, 0x1034d30c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xd
mov byte [ebp - 0x20], 0xcd
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x7c
mov byte [ebp - 0x1d], 0x7f
mov byte [ebp - 0x1c], 0x4d
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0xe0
mov byte [ebp - 0x17], 0x7b
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], 0x5a
mov byte [ebp - 0x14], 1
mov eax, dword [0x1034d0f8]
and eax, 1
jne 0x10002adc
mov ecx, dword [0x1034d0f8]
or ecx, 1
mov dword [0x1034d0f8], ecx
mov byte [0x1034d0f5], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10002a86
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10002acf
jb 0x10002a94
cmp dword [ebp - 0x10], 0xd
jae 0x10002acf
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006c090
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x20]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006c090
mov cl, byte [edi + esi]
mov byte [eax + 0x1034d0e8], cl
jmp 0x10002a74
push 0x1007d7b0
call fcn.1006c070
add esp, 4
mov eax, 0x1034d0e8
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10002cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x13
mov byte [ebp - 0x24], 0x1c
mov byte [ebp - 0x23], 0x50
mov byte [ebp - 0x22], 0x6a
mov byte [ebp - 0x21], 0x6f
mov byte [ebp - 0x20], 0x6e
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x67
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x14
mov byte [ebp - 0x1a], 0x5e
mov byte [ebp - 0x19], 0x53
mov byte [ebp - 0x18], 0x52
mov byte [ebp - 0x17], 0x2e
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x7f
mov byte [ebp - 0x13], 9
mov byte [ebp - 0x12], 9
mov eax, dword [0x1034d348]
and eax, 1
jne 0x10002da4
mov ecx, dword [0x1034d348]
or ecx, 1
mov dword [0x1034d348], ecx
mov byte [0x1034d347], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10002d4e
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10002d97
jb 0x10002d5c
cmp dword [ebp - 0x10], 0x13
jae 0x10002d97
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006c090
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x24]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006c090
mov cl, byte [edi + esi]
mov byte [eax + 0x1034d334], cl
jmp 0x10002d3c
push 0x1007d800
call fcn.1006c070
add esp, 4
mov eax, 0x1034d334
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xa
mov byte [ebp - 0x1c], 0x21
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x77
mov byte [ebp - 0x18], 0x6d
mov byte [ebp - 0x17], 0x2f
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0x14], 0x23
mov byte [ebp - 0x13], 7
mov eax, dword [0x1034d108]
and eax, 1
jne 0x10003080
mov ecx, dword [0x1034d108]
or ecx, 1
mov dword [0x1034d108], ecx
mov byte [0x1034d106], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x1000302a
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10003073
jb 0x10003038
cmp dword [ebp - 0x10], 0xa
jae 0x10003073
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006c090
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006c090
mov cl, byte [edi + esi]
mov byte [eax + 0x1034d0fc], cl
jmp 0x10003018
push 0x1007d8a0
call fcn.1006c070
add esp, 4
mov eax, 0x1034d0fc
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100035a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xc
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x8c
mov byte [ebp - 0x1a], 0x57
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x2f
mov byte [ebp - 0x14], 0x5f
mov byte [ebp - 0x13], 0x89
mov byte [ebp - 0x12], 0x55
mov byte [ebp - 0x11], 0x1b
mov eax, dword [0x1034d1fc]
and eax, 1
jne 0x10003678
mov ecx, dword [0x1034d1fc]
or ecx, 1
mov dword [0x1034d1fc], ecx
mov byte [0x1034d1f8], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10003622
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x1000366b
jb 0x10003630
cmp dword [ebp - 0x10], 0xc
jae 0x1000366b
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006c090
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006c090
mov cl, byte [edi + esi]
mov byte [eax + 0x1034d1ec], cl
jmp 0x10003610
push 0x1007d940
call fcn.1006c070
add esp, 4
mov eax, 0x1034d1ec
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x10
mov byte [ebp - 0x20], 0x13
mov byte [ebp - 0x1f], 0x77
mov byte [ebp - 0x1e], 0x71
mov byte [ebp - 0x1d], 0x5a
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x6d
mov byte [ebp - 0x1a], 0x6e
mov byte [ebp - 0x19], 0x62
mov byte [ebp - 0x18], 0x20
mov byte [ebp - 0x17], 0x77
mov byte [ebp - 0x16], 0x78
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0x13], 0x60
mov byte [ebp - 0x12], 0x71
mov byte [ebp - 0x11], 1
mov eax, dword [0x1034d120]
and eax, 1
jne 0x10003778
mov ecx, dword [0x1034d120]
or ecx, 1
mov dword [0x1034d120], ecx
mov byte [0x1034d11c], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10003722
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x1000376b
jb 0x10003730
cmp dword [ebp - 0x10], 0x10
jae 0x1000376b
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006c090
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x20]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006c090
mov cl, byte [edi + esi]
mov byte [eax + 0x1034d10c], cl
jmp 0x10003710
push 0x1007d990
call fcn.1006c070
add esp, 4
mov eax, 0x1034d10c
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xb
mov byte [ebp - 0x1c], 0x56
mov byte [ebp - 0x1b], 0x78
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x19], 0x49
mov byte [ebp - 0x18], 0x32
mov byte [ebp - 0x17], 0x33
mov byte [ebp - 0x16], 0x2f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x47
mov byte [ebp - 0x12], 0x23
mov eax, dword [0x1034d220]
and eax, 1
jne 0x10003ea4
mov ecx, dword [0x1034d220]
or ecx, 1
mov dword [0x1034d220], ecx
mov byte [0x1034d21f], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10003e4e
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10003e97
jb 0x10003e5c
cmp dword [ebp - 0x10], 0xb
jae 0x10003e97
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006c090
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006c090
mov cl, byte [edi + esi]
mov byte [eax + 0x1034d214], cl
jmp 0x10003e3c
push 0x1007da30
call fcn.1006c070
add esp, 4
mov eax, 0x1034d214
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100040c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xd
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0xd4
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x7a
mov byte [ebp - 0x1c], 0x71
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x32
mov byte [ebp - 0x19], 0x33
mov byte [ebp - 0x18], 9
mov byte [ebp - 0x17], 0xd5
mov byte [ebp - 0x16], 0x2b
mov byte [ebp - 0x15], 0x77
mov byte [ebp - 0x14], 1
mov eax, dword [0x1034d244]
and eax, 1
jne 0x1000419c
mov ecx, dword [0x1034d244]
or ecx, 1
mov dword [0x1034d244], ecx
mov byte [0x1034d241], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10004146
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x1000418f
jb 0x10004154
cmp dword [ebp - 0x10], 0xd
jae 0x1000418f
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006c090
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x20]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006c090
mov cl, byte [edi + esi]
mov byte [eax + 0x1034d234], cl
jmp 0x10004134
push 0x1007dad0
call fcn.1006c070
add esp, 4
mov eax, 0x1034d234
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x12
mov byte [ebp - 0x24], 0xf
mov byte [ebp - 0x23], 0x51
mov byte [ebp - 0x22], 0x29
mov byte [ebp - 0x21], 0x49
mov byte [ebp - 0x20], 0x64
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x68
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x3f
mov byte [ebp - 0x1b], 0x58
mov byte [ebp - 0x1a], 0x37
mov byte [ebp - 0x19], 0x48
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x77
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0x39
mov byte [ebp - 0x13], 0x3d
mov eax, dword [0x1034d168]
and eax, 1
jne 0x10004360
mov ecx, dword [0x1034d168]
or ecx, 1
mov dword [0x1034d168], ecx
mov byte [0x1034d166], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x1000430a
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10004353
jb 0x10004318
cmp dword [ebp - 0x10], 0x12
jae 0x10004353
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006c090
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x24]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006c090
mov cl, byte [edi + esi]
mov byte [eax + 0x1034d154], cl
jmp 0x100042f8
push 0x1007db20
call fcn.1006c070
add esp, 4
mov eax, 0x1034d154
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100044e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x26
mov byte [ebp - 0x38], 0x93
mov byte [ebp - 0x37], 1
mov byte [ebp - 0x36], 0x59
mov byte [ebp - 0x35], 0x6b
mov byte [ebp - 0x34], 0x72
mov byte [ebp - 0x33], 0x3b
mov byte [ebp - 0x32], 0x2e
mov byte [ebp - 0x31], 0x2e
mov byte [ebp - 0x30], 0x88
mov byte [ebp - 0x2f], 0x10
mov byte [ebp - 0x2e], 0x41
mov byte [ebp - 0x2d], 0x7e
mov byte [ebp - 0x2c], 0x77
mov byte [ebp - 0x2b], 0x6a
mov byte [ebp - 0x2a], 0x68
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0xd5
mov byte [ebp - 0x27], 0x14
mov byte [ebp - 0x26], 0x5d
mov byte [ebp - 0x25], 0x6b
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x89
mov byte [ebp - 0x1f], 0x14
mov byte [ebp - 0x1e], 0x4e
mov byte [ebp - 0x1d], 0x78
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x18], 0xd5
mov byte [ebp - 0x17], 0x14
mov byte [ebp - 0x16], 0x5e
mov byte [ebp - 0x15], 0x6b
mov byte [ebp - 0x14], 0x79
mov byte [ebp - 0x13], 1
mov eax, dword [0x1034d194]
and eax, 1
jne 0x10004620
mov ecx, dword [0x1034d194]
or ecx, 1
mov dword [0x1034d194], ecx
mov byte [0x1034d192], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x100045ca
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10004613
jb 0x100045d8
cmp dword [ebp - 0x10], 0x26
jae 0x10004613
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006c090
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x38]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006c090
mov cl, byte [edi + esi]
mov byte [eax + 0x1034d16c], cl
jmp 0x100045b8
push 0x1007dbc0
call fcn.1006c070
add esp, 4
mov eax, 0x1034d16c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100047e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x24
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0xd7
mov byte [ebp - 0x32], 0x49
mov byte [ebp - 0x31], 0x6b
mov byte [ebp - 0x30], 0x72
mov byte [ebp - 0x2f], 0x3b
mov byte [ebp - 0x2e], 0x2e
mov byte [ebp - 0x2d], 0x2e
mov byte [ebp - 0x2c], 0x7a
mov byte [ebp - 0x2b], 0xd6
mov byte [ebp - 0x2a], 0x5c
mov byte [ebp - 0x29], 0x7c
mov byte [ebp - 0x28], 0x6e
mov byte [ebp - 0x27], 0x6d
mov byte [ebp - 0x26], 0x2f
mov byte [ebp - 0x25], 0x62
mov byte [ebp - 0x24], 0x78
mov byte [ebp - 0x23], 0xce
mov byte [ebp - 0x22], 0x12
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x72
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x73
mov byte [ebp - 0x1d], 0x60
mov byte [ebp - 0x1c], 0x74
mov byte [ebp - 0x1b], 0xc0
mov byte [ebp - 0x1a], 0x52
mov byte [ebp - 0x19], 0x6e
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x17], 0x75
mov byte [ebp - 0x16], 0x2f
mov byte [ebp - 0x15], 0x60
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0x13], 0xd3
mov byte [ebp - 0x12], 0x45
mov byte [ebp - 0x11], 0x1b
mov eax, dword [0x1034d1c0]
and eax, 1
jne 0x10004918
mov ecx, dword [0x1034d1c0]
or ecx, 1
mov dword [0x1034d1c0], ecx
mov byte [0x1034d1bc], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x100048c2
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x1000490b
jb 0x100048d0
cmp dword [ebp - 0x10], 0x24
jae 0x1000490b
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006c090
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x34]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006c090
mov cl, byte [edi + esi]
mov byte [eax + 0x1034d198], cl
jmp 0x100048b0
push 0x1007dc60
call fcn.1006c070
add esp, 4
mov eax, 0x1034d198
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000ed10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x1c], 0
xor eax, eax
mov word [ebp - 0xc], ax
cmp dword [ebp + 0xc], 0xffff
ja 0x1000ed34
mov cx, word [ebp + 0xc]
mov word [ebp - 0xc], cx
cmp dword [ebp + 8], 0
je 0x1000ee45
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3c]
add eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x78]
add edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
add edx, dword [ebp + 8]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + 0x18]
cmp edx, dword [ecx + 0x14]
jbe 0x1000ed93
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x18], ecx
jmp 0x1000ed9c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov word [ebp - 4], cx
jmp 0x1000edb0
mov dx, word [ebp - 4]
add dx, 1
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
cmp eax, dword [ebp - 0x18]
jae 0x1000ee45
movzx ecx, word [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp ecx, dword [edx + 0x14]
jae 0x1000edea
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax*4]
add edx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0x28]
mov dx, word [ecx + eax*2]
mov word [ebp - 8], dx
jmp 0x1000edf9
mov dword [ebp - 0x14], 0
mov ax, word [ebp - 4]
mov word [ebp - 8], ax
movzx ecx, word [ebp - 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + ecx*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
movzx ecx, word [ebp - 0xc]
movzx edx, word [ebp - 8]
mov eax, dword [ebp - 0x10]
add edx, dword [eax + 0x10]
cmp ecx, edx
je 0x1000ee38
cmp dword [ebp - 0x14], 0
je 0x1000ee40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
push 0
call fcn.10001260
call eax
test eax, eax
jne 0x1000ee40
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
jmp 0x1000ee45
jmp 0x1000eda4
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x1000ee50
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x1000ee71
xor eax, eax
jmp 0x1000ef8f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx], 0x4550
je 0x1000ee8f
xor eax, eax
jmp 0x1000ef8f
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
cmp ecx, 0x60
jl 0x1000eea4
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x74], 0
jne 0x1000eeab
xor eax, eax
jmp 0x1000ef8f
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x1000eeca
xor eax, eax
jmp 0x1000ef8f
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], 0
jmp 0x1000ef09
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x18]
jae 0x1000ef8d
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
push 0x811c9dc5
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10044f80
cmp eax, dword [ebp + 0xc]
je 0x1000ef3e
jmp 0x1000ef00
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x30]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + 0x10]
add eax, edx
mov word [ebp - 4], ax
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + 0x10]
sub eax, edx
mov word [ebp - 8], ax
mov dword [ebp - 0x20], 0
movzx eax, word [ebp - 8]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
jmp 0x1000ef8f
xor eax, eax
mov esp, ebp
pop ebp
ret 8