joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec1dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ac
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406a78
mov eax, dword [ebp - 8]
call fcn.00406a78
xor eax, eax
push ebp
push 0x4ec2cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40e]
mov edx, dword [ebp - 4]
call fcn.00414468
lea edx, [ebp - 8]
xor eax, eax
call fcn.00407534
lea eax, [ebp - 0x60e]
mov edx, dword [ebp - 8]
call fcn.00414468
lea eax, [ebp - 0x654]
xor ecx, ecx
mov edx, 0x44
call fcn.0040486c
mov dword [ebp - 0x654], 0x44
mov dword [ebp - 0x628], 1
mov word [ebp - 0x624], bx
push 0x4fd418
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x60e]
push eax
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x40e]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4ec293
or ebx, 0xffffffff
jmp 0x4ec2b1
mov eax, dword [0x4f79e0]
mov eax, dword [eax]
call fcn.004b6768
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x4fd418]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec2d3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a88
ret
Function at 0x4ec2dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4ec2e4
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x4ec51d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [0x4f79e0]
mov eax, dword [eax]
call fcn.004b72dc
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00413e74
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4fd3e8]
call fcn.00413e74
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00406ea4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0041423c
lea edx, [ebp - 8]
mov eax, dword [0x4fd3e8]
call fcn.00414148
lea eax, [ebp - 0xc]
mov edx, dword [0x4fd3ec]
call fcn.00406ae4
call fcn.004045c8
mov esi, eax
test esi, esi
jle 0x4ec3f3
mov ebx, 1
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404628
mov edx, dword [ebp - 0x1c]
mov eax, 0x4ec538
call fcn.004074e8
test eax, eax
jg 0x4ec3a0
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00404628
mov edx, dword [ebp - 0x20]
mov eax, 0x4ec548
call fcn.004074e8
test eax, eax
jle 0x4ec3c9
push dword [ebp - 0xc]
push 0x4ec558
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.00404628
push dword [ebp - 0x24]
push 0x4ec56c
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00407048
jmp 0x4ec3eb
push dword [ebp - 0xc]
push 0x4ec538
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.00404628
push dword [ebp - 0x28]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407048
inc ebx
dec esi
jne 0x4ec36a
mov eax, dword [ebp - 4]
call fcn.00414344
push 0
mov ecx, 0x4ec57c
mov edx, 0x4ec590
mov eax, dword [0x4fd408]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x4ec468
mov eax, dword [0x4fd3fc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406b1c
push eax
push 0x4ec5ac
push dword [ebp - 4]
push 0x4ec5dc
push dword [ebp - 8]
push 0x4ec5f0
push dword [ebp - 0xc]
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.00407048
mov eax, dword [ebp - 0x2c]
call fcn.00406b1c
push eax
push 0x4ec5f8
push 0x4ec600
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x4ec4f6
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 8]
call fcn.00414188
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.004126bc
mov eax, dword [ebp - 0x30]
mov edx, 0x4ec610
call fcn.00407168
jne 0x4ec4ca
mov eax, dword [0x4fd3fc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406b1c
push eax
mov eax, dword [ebp - 0xc]
call fcn.00406b1c
push eax
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406f64
mov eax, dword [ebp - 0x38]
call fcn.00406b1c
push eax
push 0x4ec600
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x4ec4f6
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4ec538
push dword [ebp - 0xc]
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00407048
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x4fd3fc]
mov edx, dword [ebp - 4]
call fcn.004ec1dc
mov eax, dword [0x4f79e0]
mov eax, dword [eax]
call fcn.004b6768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec524
lea eax, [ebp - 0x3c]
mov edx, 0xf
call fcn.00406a88
ret
Function at 0x4ecf74
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4ed05c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
mov byte [0x4fd410], al
mov ecx, dword [ebx + 0x39c]
mov dl, 1
mov eax, dword [0x4e7a04]
call fcn.004e7cec
mov esi, eax
mov dword [ebx + 0x3d0], esi
mov byte [esi + 0x10], 1
mov byte [esi + 0x12], 0
mov byte [esi + 0x11], 0
mov byte [esi + 0x13], 0
lea eax, [ebp - 0x10]
mov edx, 2
mov cl, 1
call fcn.004254c0
lea ecx, [ebp - 0x10]
mov edx, 0x4ed070
mov eax, dword [esi + 4]
call fcn.004cea58
mov ecx, dword [ebx + 0x3a0]
mov dl, 1
mov eax, dword [0x4e7a04]
call fcn.004e7cec
mov esi, eax
mov dword [ebx + 0x3d4], esi
mov ebx, esi
mov byte [ebx + 0x10], 1
mov byte [ebx + 0x12], 0
mov byte [ebx + 0x11], 0
mov byte [ebx + 0x13], 0
lea eax, [ebp - 0x20]
mov edx, 2
mov cl, 1
call fcn.004254c0
lea ecx, [ebp - 0x20]
mov eax, dword [ebx + 4]
mov edx, 0x4ed0b4
call fcn.004cea58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed063
lea eax, [ebp - 0x20]
mov edx, dword [0x401288]
mov ecx, 2
call fcn.004078c4
ret
Function at 0xc0f032
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00c10fe8
add esp, 0xc
add ecx, 0
call fcn.00c0f053

Function at 0xc104cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00c10fe8
add esp, 0xc
test dword [esp + 0x10], ebx
jle 0xc10502
pushf
Function at 0xc10881
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00c10fe8
add esp, 0xc
cmp ebx, ecx
je 0xc1089e
test esi, 0x6172
je 0xc108a6
ja 0xc108bc
lea edx, [edx + 0x6ac2]
lea edx, [edx - 0x6ac2]
nop
jp 0xc108b7
jl 0xc108b9
jbe 0xc108bc
mov esp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
jge 0xc108f2
xchg ecx, ebx
xchg ecx, ebx
stc
jbe 0xc108f9
jp 0xc10904
lea esi, [esi]
jg 0xc108ff
jnp 0xc10904
jmp 0x4e4b81f6
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
jmp 0xc1096e
jle 0xc10970
ja 0xc1097e
jb 0xc10974
jmp 0xc10976
mov edi, edi
mov esp, esp
jbe 0xc1097e
mov edx, 0x2730e889
add byte [eax], al
call fcn.00c130b3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xc10993
xor eax, eax
jmp 0xc10a2f
xor edx, dword [esp]
xor edx, dword [esp]
jbe 0xc109a2
ja 0xc1099d
lea ebx, [ebx]
ja 0xc109a2
mov edx, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00c172c8
mov dword [ebp - 4], eax
not esi
not esi
cmp eax, edi
je 0xc109ba
je 0xc109cf
pushf
mov edx, edx
test dword [esp + 4], edx
jp 0xc109c6
popf
jne 0xc109ca
jno 0xc109cc
jne 0xc109cf
mov ebx, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00c10fe8
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0xc109e9
xor eax, eax
jmp 0xc10a2f
jne 0xc109eb
xchg edx, edx
xchg esi, esi
js 0xc10a05
jge 0xc109f3
lea edi, [edi + 0x52c5]
lea edi, [edi - 0x52c5]
jae 0xc10a01
jns 0xc10a05
mov edx, 0xfc4d8b52
mov ecx, dword [ebp - 4]
push ecx
call fcn.00c20cf3
add esp, 4
add ebx, 0
stc
jg 0xc10a2c
pushf
xor edx, edi
xor edx, edi
shl edi, 0
jp 0xc10a22
ror edx, 0
popf
xchg ebx, ebx
jle 0xc10a2c
mov esi, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xc138d3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00c10fe8
add esp, 0xc
cmc
xchg esi, ebx
xchg esi, ebx
add ebx, 0x2a4d
sub ebx, 0x2a4d
jns 0xc13905
je 0xc13901
js 0xc13905
sub eax, 0xe445c63d
dec eax
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6d
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0xe], 0x66
shl ebx, 0
ror edx, 0
jno 0xc1395a
jmp 0xc13953
xchg ebx, ecx
xchg ebx, ecx
jo 0xc1395a
add eax, 0x80e44d8a
jmp 0xe50ec164
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1a]
sub dl, 1
mov byte [ebp - 0x1a], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x19]
sub dl, 1
mov byte [ebp - 0x19], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
shl esi, 0
jp 0xc139ea
jg 0xc139f4
jae 0xc139ee
jnp 0xc139f0
jle 0xc139f4
mov ebp, 0xf6bae8e7
invalid
call fcn.00c130b3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xc13a09
xor eax, eax
jmp 0xc13c83
lea edi, [edi + 0x7904]
lea edi, [edi - 0x7904]
push eax
add eax, 0x66f9
ror eax, 0x17
pop eax
xor esp, 0
call fcn.00c13a27
Function at 0xc14ce7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0xc0aba8], 1
jne 0xc14e4a
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00c10fe8
add esp, 0xc
xchg esp, esp
jo 0xc14d2d
pushf
cmp ebx, 0x4db3
sub ebx, 0
test edx, 0x4e05
popf
jne 0xc14d26
ja 0xc14d28
jns 0xc14d2a
jno 0xc14d2d
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
nop
jnp 0xc14d73
pushf
ror esp, 0
xchg edx, ecx
xchg edx, ecx
or edx, edx
add edx, 0
popf
jne 0xc14d6e
jb 0xc14d70
jp 0xc14d73
mov esp, 0x80e84d8a
jmp 0xe90ed57d
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.00c130b3
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0xc14de0
mov eax, dword [ebp + 8]
jmp 0xc14ec1
dec edi
inc edi
jae 0xc14de4
inc ebx
dec ebx
neg esi
neg esi
jne 0xc14e12
pushf
jae 0xc14df0
xchg ecx, esi
xchg ecx, esi
add ebx, dword [esp]
sub ebx, dword [esp]
ror eax, 0
popf
jle 0xc14e01
jae 0xc14e03
lea ebx, [ebx + 0x3fe2]
lea ebx, [ebx - 0x3fe2]
je 0xc14e12
call 0x53a9a3a3
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00c172c8
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00c10fe8
add esp, 0xc
cmp dword [ebp - 8], 0
je 0xc14e43
mov edx, dword [ebp - 8]
mov dword [0xc0aba8], edx
jmp 0xc14e48
mov eax, dword [ebp + 8]
jmp 0xc14ec1
jmp 0xc14e52
mov eax, dword [0xc0aba8]
mov dword [ebp - 8], eax
mov eax, eax
add esp, 0
jo 0xc14e7d
pushf
shr esp, 0
mov eax, eax
popf
lea ecx, [ecx + 0x7a99]
lea ecx, [ecx - 0x7a99]
lea ebx, [ebx + 0x54d8]
lea ebx, [ebx - 0x54d8]
jno 0xc14e7d
mov edi, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
xor esp, 0
je 0xc14ea1
pushf
test esp, 0x6b3d
test edi, 0x2e3c
popf
js 0xc14e9a
mov eax, eax
jne 0xc14e9e
jne 0xc14ea1
mov esp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00c20cf3
add esp, 4
xor esi, dword [esp]
xor esi, dword [esp]
js 0xc14eba
jp 0xc14eb7
jns 0xc14eba
call 0x50c99449
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xc16ae2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00c10fe8
add esp, 0xc
xor edi, dword [esp + 0xc]
xor edi, dword [esp + 0xc]
nop
ror edx, 9
ror edx, 0x17
jnp 0xc16b0c
jb 0xc16b25
pushf
rol eax, 0xf
ror eax, 0xf
not edi
not edi
popf
mov esp, esp
xchg esi, ecx
xchg esi, ecx
jae 0xc16b25
add eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
lea edi, [edi]
jle 0xc16b60
lea ecx, [ecx]
jns 0xc16b5d
jg 0xc16b60
mov eax, 0x80f04d8a
jmp 0xf10ef36a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
clc
lea esp, [esp]
jae 0xc16bcf
jb 0xc16bc8
jae 0xc16bca
jne 0xc16bcc
jb 0xc16bcf
ljmp 0x89ff:0xffc4dfe8
call fcn.00c130b3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xc16be1
xor eax, eax
jmp 0xc16c2b
or edi, edi
rol esi, 0x1c
rol esi, 4
cmp esp, 0x667c
je 0xc16c08
pushf
rol ecx, 0x11
ror ecx, 0x11
and ecx, ecx
jae 0xc16bfd
ror edx, 0
popf
lea esp, [esp]
jne 0xc16c08
mov edx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00c172c8
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00c10fe8
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xc1adde
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00c10fe8
add esp, 0xc
std
cld
cmp esi, dword [esp + 8]
jp 0xc1adff
test dword [esp], edx
jbe 0xc1ae16
lea ecx, [ecx + 0x6726]
lea ecx, [ecx - 0x6726]
xchg edi, eax
xchg edi, eax
ja 0xc1ae16
sub eax, 0xf445c608
push ebx
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
cmp esp, 0x338d
jo 0xc1ae4e
xor ecx, 0x5cd2
xor ecx, 0x5cd2
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
jg 0xc1ae6f
jle 0xc1ae66
jp 0xc1ae68
mov ebx, ebx
ja 0xc1ae6c
jle 0xc1ae6f
jmp 0x81b5fbfd
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
mov esp, esp
jle 0xc1aee4
pushf
jle 0xc1aed7
jmp 0xc1aed9
jg 0xc1aedb
popf
jbe 0xc1aedf
js 0xc1aee1
jg 0xc1aee4
mov ecx, 0xffe524e8
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 0xa], dh
call 0xc1940d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0xc1aefc
mov eax, 1
jmp 0xc1afa3
xchg edi, eax
xchg edi, eax
jae 0xc1af00
rol esp, 0
je 0xc1af11
nop
mov esi, esi
jne 0xc1af0a
lea esp, [esp]
jne 0xc1af11
mov ebx, 0xf4458d4a
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00c172c8
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.00c10fe8
add esp, 0xc
or edx, edx
lea esp, [esp]
je 0xc1af40
jo 0xc1af3a
jge 0xc1af3c
jne 0xc1af40
mov esi, 0xec7d8336
add byte [ebp + 7], dh
cmp dword [ebp - 0x14], 0
jne 0xc1af4d
mov eax, 1
jmp 0xc1afa3
rol esp, 0
push edi
pop edi
jae 0xc1af6b
xchg ebx, esi
xchg ebx, esi
xchg esi, esi
lea ebx, [ebx + 0x5d8b]
lea ebx, [ebx - 0x5d8b]
lea ecx, [ecx]
jb 0xc1af6b
add eax, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.00c20cf3
add esp, 4
xchg edx, ecx
xchg edx, ecx
lea eax, [eax]
test ebx, 0x4b57
jg 0xc1af9c
pushf
mov esp, esp
xor ebx, 0x24ac
xor ebx, 0x24ac
popf
xchg esp, esp
jle 0xc1af9c
xor eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xc1f455
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00c10fe8
add esp, 0xc
test dword [esp], ecx
xchg esp, esp
inc eax
dec eax
jo 0xc1f487
js 0xc1f480
jp 0xc1f482
jle 0xc1f484
jno 0xc1f487
mov esp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
xor edx, dword [esp]
xor edx, dword [esp]
test esp, 0x3bb
or esi, 0
jb 0xc1f562
pushf
rol esp, 0
push edi
add edi, 0x22e8
ror edi, 2
pop edi
cmp ecx, 0x32fa
popf
jnp 0xc1f55b
jnp 0xc1f55d
xchg esi, esi
jae 0xc1f562
mov esp, 0xff3b4ce8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.00c130b3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xc1f577
xor eax, eax
jmp 0xc1f609
and eax, 0xffffffff
add ecx, 0
jbe 0xc1f59d
pushf
ror esp, 0
xchg esp, esp
std
cld
jno 0xc1f58a
popf
jb 0xc1f58e
lea edx, [edx + 0x3a91]
lea edx, [edx - 0x3a91]
ja 0xc1f59d
mov edi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00c172c8
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00c10fe8
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0xc1f5c7
xor eax, eax
jmp 0xc1f609
lea esp, [esp]
rol esp, 0
je 0xc1f5df
pushf
shl ecx, 0
cmp esi, dword [esp + 8]
popf
ja 0xc1f5dc
jne 0xc1f5df
mov esi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00c20cf3
add esp, 4
test esp, 0x17fc
je 0xc1f5fe
jns 0xc1f5f5
jl 0xc1f5f7
nop
lea edx, [edx]
jne 0xc1f5fe
ljmp 0x8b50:0xc458b4d
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8