joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e8f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x45de9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e92b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e944
lea eax, [ebp - 0x10]
mov edx, dword [0x47423c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41e957
lea eax, [ebp - 0x10]
mov edx, dword [0x47423c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41e963
adc edx, 0
mov edx, dword [edx*4 + 0x4730d0]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406af4
mov esi, eax
cmp esi, 0xffffffff
je 0x41ea71
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41ea64
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ea64
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d94
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41ea64
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ea64
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ea64
cmp dx, 0x150
ja 0x41ea64
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41ea64
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ea64
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406aac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41ea89
inc ebx
cmp ebx, 0x19
jne 0x41e91d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dea6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x41edc4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
xor ebx, ebx
push 0
push 0
push 0
push edi
call fcn.00406d94
push 0
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call fcn.00406d3c
test eax, eax
je 0x41ee61
cmp word [esi], 0x5a4d
jne 0x41ee61
push 0
push 0
mov eax, dword [esi + 0x3c]
push eax
push edi
call fcn.00406d94
push 0
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00406d3c
test eax, eax
je 0x41ee61
cmp dword [ebp - 0x1c], 0x4550
jne 0x41ee61
lea edx, [ebp - 0x18]
mov ecx, 0x14
mov eax, dword [ebp + 0xc]
call fcn.00406e78
mov ax, word [ebp - 0x18]
cmp ax, 0x14c
jb 0x41ee61
cmp ax, 0x150
ja 0x41ee61
push 0
lea eax, [ebp - 4]
push eax
push 0xe0
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.00406d3c
test eax, eax
je 0x41ee61
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x10001710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x28
mov byte [ebp - 0x38], 0x92
mov byte [ebp - 0x37], 0x2d
mov byte [ebp - 0x36], 0xee
mov byte [ebp - 0x35], 0x2d
mov byte [ebp - 0x34], 0x6a
mov byte [ebp - 0x33], 0x6a
mov byte [ebp - 0x32], 0x76
mov byte [ebp - 0x31], 0x38
mov byte [ebp - 0x30], 0x81
mov byte [ebp - 0x2f], 0x14
mov byte [ebp - 0x2e], 0xd0
mov byte [ebp - 0x2d], 0x25
mov byte [ebp - 0x2c], 0x55
mov byte [ebp - 0x2b], 0x7b
mov byte [ebp - 0x2a], 0x30
mov byte [ebp - 0x29], 0x59
mov byte [ebp - 0x28], 0xe4
mov byte [ebp - 0x27], 0xd
mov byte [ebp - 0x26], 0xf1
mov byte [ebp - 0x25], 0x17
mov byte [ebp - 0x24], 0x45
mov byte [ebp - 0x23], 0x60
mov byte [ebp - 0x22], 0x63
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x9f
mov byte [ebp - 0x1f], 0x12
mov byte [ebp - 0x1e], 0xec
mov byte [ebp - 0x1d], 0x45
mov byte [ebp - 0x1c], 0x32
mov byte [ebp - 0x1b], 0x77
mov byte [ebp - 0x1a], 0x58
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0xa8
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0xf6
mov byte [ebp - 0x15], 0x1f
mov byte [ebp - 0x14], 0x55
mov byte [ebp - 0x13], 0x4d
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 1
mov eax, dword [0x101fb608]
and eax, 1
jne 0x10001858
mov ecx, dword [0x101fb608]
or ecx, 1
mov dword [0x101fb608], ecx
mov byte [0x101fb604], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10001802
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x1000184b
jb 0x10001810
cmp dword [ebp - 0x10], 0x28
jae 0x1000184b
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1007a8a0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x38]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1007a8a0
mov cl, byte [edi + esi]
mov byte [eax + 0x101fb5dc], cl
jmp 0x100017f0
push 0x1008e9f0
call fcn.1007a880
add esp, 4
mov eax, 0x101fb5dc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xc
mov byte [ebp - 0x1c], 0x78
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x41
mov byte [ebp - 0x19], 8
mov byte [ebp - 0x18], 0x60
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x15], 0x2f
mov byte [ebp - 0x14], 0x4f
mov byte [ebp - 0x13], 0x77
mov byte [ebp - 0x12], 0x41
mov byte [ebp - 0x11], 0x7f
mov eax, dword [0x101fb780]
and eax, 1
jne 0x10001e88
mov ecx, dword [0x101fb780]
or ecx, 1
mov dword [0x101fb780], ecx
mov byte [0x101fb77c], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10001e32
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10001e7b
jb 0x10001e40
cmp dword [ebp - 0x10], 0xc
jae 0x10001e7b
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1007a8a0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1007a8a0
mov cl, byte [edi + esi]
mov byte [eax + 0x101fb770], cl
jmp 0x10001e20
push 0x1008eb80
call fcn.1007a880
add esp, 4
mov eax, 0x101fb770
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100026e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xc
mov byte [ebp - 0x1c], 0x62
mov byte [ebp - 0x1b], 0x7f
mov byte [ebp - 0x1a], 0x24
mov byte [ebp - 0x19], 0x13
mov byte [ebp - 0x18], 0x6d
mov byte [ebp - 0x17], 0x32
mov byte [ebp - 0x16], 0x33
mov byte [ebp - 0x15], 0x2f
mov byte [ebp - 0x14], 0x55
mov byte [ebp - 0x13], 0x7b
mov byte [ebp - 0x12], 0x2d
mov byte [ebp - 0x11], 0x7f
mov eax, dword [0x101fb68c]
and eax, 1
jne 0x100027b8
mov ecx, dword [0x101fb68c]
or ecx, 1
mov dword [0x101fb68c], ecx
mov byte [0x101fb688], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10002762
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x100027ab
jb 0x10002770
cmp dword [ebp - 0x10], 0xc
jae 0x100027ab
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1007a8a0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1007a8a0
mov cl, byte [edi + esi]
mov byte [eax + 0x101fb67c], cl
jmp 0x10002750
push 0x1008ed60
call fcn.1007a880
add esp, 4
mov eax, 0x101fb67c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x13
mov byte [ebp - 0x24], 0xa8
mov byte [ebp - 0x23], 0xca
mov byte [ebp - 0x22], 0x52
mov byte [ebp - 0x21], 0xd
mov byte [ebp - 0x20], 0x6e
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x67
mov byte [ebp - 0x1c], 0x91
mov byte [ebp - 0x1b], 0x8e
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x19], 0x31
mov byte [ebp - 0x18], 0x52
mov byte [ebp - 0x17], 0x2e
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0xcb
mov byte [ebp - 0x13], 0x93
mov byte [ebp - 0x12], 0x31
mov eax, dword [0x101fb800]
and eax, 1
jne 0x10002df4
mov ecx, dword [0x101fb800]
or ecx, 1
mov dword [0x101fb800], ecx
mov byte [0x101fb7ff], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10002d9e
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10002de7
jb 0x10002dac
cmp dword [ebp - 0x10], 0x13
jae 0x10002de7
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1007a8a0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x24]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1007a8a0
mov cl, byte [edi + esi]
mov byte [eax + 0x101fb7ec], cl
jmp 0x10002d8c
push 0x1008ee50
call fcn.1007a880
add esp, 4
mov eax, 0x101fb7ec
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100036e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xc
mov byte [ebp - 0x1c], 0xc
mov byte [ebp - 0x1b], 0x78
mov byte [ebp - 0x1a], 0xb9
mov byte [ebp - 0x19], 0x14
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x2f
mov byte [ebp - 0x14], 0x3f
mov byte [ebp - 0x13], 0x7d
mov byte [ebp - 0x12], 0xbb
mov byte [ebp - 0x11], 0x7d
mov eax, dword [0x101fb6b4]
and eax, 1
jne 0x100037b8
mov ecx, dword [0x101fb6b4]
or ecx, 1
mov dword [0x101fb6b4], ecx
mov byte [0x101fb6b0], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10003762
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x100037ab
jb 0x10003770
cmp dword [ebp - 0x10], 0xc
jae 0x100037ab
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1007a8a0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1007a8a0
mov cl, byte [edi + esi]
mov byte [eax + 0x101fb6a4], cl
jmp 0x10003750
push 0x1008ef90
call fcn.1007a880
add esp, 4
mov eax, 0x101fb6a4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100037d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x10
mov byte [ebp - 0x20], 0x87
mov byte [ebp - 0x1f], 0x23
mov byte [ebp - 0x1e], 0xcd
mov byte [ebp - 0x1d], 0x3c
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x6d
mov byte [ebp - 0x1a], 0x6e
mov byte [ebp - 0x19], 0x62
mov byte [ebp - 0x18], 0xb4
mov byte [ebp - 0x17], 0x23
mov byte [ebp - 0x16], 0xc4
mov byte [ebp - 0x15], 0x35
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0x13], 0x60
mov byte [ebp - 0x12], 0x71
mov byte [ebp - 0x11], 1
mov eax, dword [0x101fb5d8]
and eax, 1
jne 0x100038b8
mov ecx, dword [0x101fb5d8]
or ecx, 1
mov dword [0x101fb5d8], ecx
mov byte [0x101fb5d4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10003862
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x100038ab
jb 0x10003870
cmp dword [ebp - 0x10], 0x10
jae 0x100038ab
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1007a8a0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x20]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1007a8a0
mov cl, byte [edi + esi]
mov byte [eax + 0x101fb5c4], cl
jmp 0x10003850
push 0x1008efe0
call fcn.1007a880
add esp, 4
mov eax, 0x101fb5c4
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xb
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0x19], 0x2d
mov byte [ebp - 0x18], 0x32
mov byte [ebp - 0x17], 0x33
mov byte [ebp - 0x16], 0x2f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x17
mov byte [ebp - 0x13], 0x51
mov byte [ebp - 0x12], 0x27
mov eax, dword [0x101fb6e8]
and eax, 1
jne 0x10004434
mov ecx, dword [0x101fb6e8]
or ecx, 1
mov dword [0x101fb6e8], ecx
mov byte [0x101fb6e7], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x100043de
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10004427
jb 0x100043ec
cmp dword [ebp - 0x10], 0xb
jae 0x10004427
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1007a8a0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1007a8a0
mov cl, byte [edi + esi]
mov byte [eax + 0x101fb6dc], cl
jmp 0x100043cc
push 0x1008f0d0
call fcn.1007a880
add esp, 4
mov eax, 0x101fb6dc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100045e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x12
mov byte [ebp - 0x24], 0x63
mov byte [ebp - 0x23], 0x23
mov byte [ebp - 0x22], 0xa5
mov byte [ebp - 0x21], 0x2f
mov byte [ebp - 0x20], 0x64
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x68
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x2a
mov byte [ebp - 0x1a], 0xbb
mov byte [ebp - 0x19], 0x2e
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x77
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0x55
mov byte [ebp - 0x13], 0x4f
mov eax, dword [0x101fb620]
and eax, 1
jne 0x100046d0
mov ecx, dword [0x101fb620]
or ecx, 1
mov dword [0x101fb620], ecx
mov byte [0x101fb61e], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x1000467a
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x100046c3
jb 0x10004688
cmp dword [ebp - 0x10], 0x12
jae 0x100046c3
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1007a8a0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x24]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1007a8a0
mov cl, byte [edi + esi]
mov byte [eax + 0x101fb60c], cl
jmp 0x10004668
push 0x1008f170
call fcn.1007a880
add esp, 4
mov eax, 0x101fb60c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x26
mov byte [ebp - 0x38], 0x83
mov byte [ebp - 0x37], 0x9b
mov byte [ebp - 0x36], 0xb7
mov byte [ebp - 0x35], 0xd
mov byte [ebp - 0x34], 0x72
mov byte [ebp - 0x33], 0x3b
mov byte [ebp - 0x32], 0x2e
mov byte [ebp - 0x31], 0x2e
mov byte [ebp - 0x30], 0x98
mov byte [ebp - 0x2f], 0x8a
mov byte [ebp - 0x2e], 0xaf
mov byte [ebp - 0x2d], 0x18
mov byte [ebp - 0x2c], 0x77
mov byte [ebp - 0x2b], 0x6a
mov byte [ebp - 0x2a], 0x68
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0xc5
mov byte [ebp - 0x27], 0x8e
mov byte [ebp - 0x26], 0xb3
mov byte [ebp - 0x25], 0xd
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x99
mov byte [ebp - 0x1f], 0x8e
mov byte [ebp - 0x1e], 0xa0
mov byte [ebp - 0x1d], 0x1e
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x18], 0xc5
mov byte [ebp - 0x17], 0x8e
mov byte [ebp - 0x16], 0xb0
mov byte [ebp - 0x15], 0xd
mov byte [ebp - 0x14], 0x79
mov byte [ebp - 0x13], 1
mov eax, dword [0x101fb64c]
and eax, 1
jne 0x10004990
mov ecx, dword [0x101fb64c]
or ecx, 1
mov dword [0x101fb64c], ecx
mov byte [0x101fb64a], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x1000493a
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10004983
jb 0x10004948
cmp dword [ebp - 0x10], 0x26
jae 0x10004983
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1007a8a0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x38]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1007a8a0
mov cl, byte [edi + esi]
mov byte [eax + 0x101fb624], cl
jmp 0x10004928
push 0x1008f210
call fcn.1007a880
add esp, 4
mov eax, 0x101fb624
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x26
mov byte [ebp - 0x38], 0x17
mov byte [ebp - 0x37], 0xb
mov byte [ebp - 0x36], 0xc7
mov byte [ebp - 0x35], 0xd
mov byte [ebp - 0x34], 0x72
mov byte [ebp - 0x33], 0x3b
mov byte [ebp - 0x32], 0x2e
mov byte [ebp - 0x31], 0x2e
mov byte [ebp - 0x30], 0x1e
mov byte [ebp - 0x2f], 0xf
mov byte [ebp - 0x2e], 0xd2
mov byte [ebp - 0x2d], 0x11
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x77
mov byte [ebp - 0x2a], 0x60
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x51
mov byte [ebp - 0x27], 0x1c
mov byte [ebp - 0x26], 0xdc
mov byte [ebp - 0x25], 0x10
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0xd
mov byte [ebp - 0x1f], 0x1e
mov byte [ebp - 0x1e], 0xd0
mov byte [ebp - 0x1d], 0x1e
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x17], 0x1e
mov byte [ebp - 0x16], 0xc0
mov byte [ebp - 0x15], 0xd
mov byte [ebp - 0x14], 0x79
mov byte [ebp - 0x13], 1
mov eax, dword [0x101fb678]
and eax, 1
jne 0x10004c60
mov ecx, dword [0x101fb678]
or ecx, 1
mov dword [0x101fb678], ecx
mov byte [0x101fb676], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10004c0a
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10004c53
jb 0x10004c18
cmp dword [ebp - 0x10], 0x26
jae 0x10004c53
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1007a8a0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x38]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1007a8a0
mov cl, byte [edi + esi]
mov byte [eax + 0x101fb650], cl
jmp 0x10004bf8
push 0x1008f2b0
call fcn.1007a880
add esp, 4
mov eax, 0x101fb650
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x1c], 0
xor eax, eax
mov word [ebp - 0xc], ax
cmp dword [ebp + 0xc], 0xffff
ja 0x10006e74
mov cx, word [ebp + 0xc]
mov word [ebp - 0xc], cx
cmp dword [ebp + 8], 0
je 0x10006f85
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3c]
add eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x78]
add edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
add edx, dword [ebp + 8]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + 0x18]
cmp edx, dword [ecx + 0x14]
jbe 0x10006ed3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x18], ecx
jmp 0x10006edc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov word [ebp - 4], cx
jmp 0x10006ef0
mov dx, word [ebp - 4]
add dx, 1
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
cmp eax, dword [ebp - 0x18]
jae 0x10006f85
movzx ecx, word [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp ecx, dword [edx + 0x14]
jae 0x10006f2a
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax*4]
add edx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0x28]
mov dx, word [ecx + eax*2]
mov word [ebp - 8], dx
jmp 0x10006f39
mov dword [ebp - 0x14], 0
mov ax, word [ebp - 4]
mov word [ebp - 8], ax
movzx ecx, word [ebp - 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + ecx*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
movzx ecx, word [ebp - 0xc]
movzx edx, word [ebp - 8]
mov eax, dword [ebp - 0x10]
add edx, dword [eax + 0x10]
cmp ecx, edx
je 0x10006f78
cmp dword [ebp - 0x14], 0
je 0x10006f80
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
push 0
call fcn.10001290
call eax
test eax, eax
jne 0x10006f80
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
jmp 0x10006f85
jmp 0x10006ee4
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8