joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002b1e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.1001a2fc
add esp, 0xc
call 0x1002b202
lea esp, [esp + 4]
jae 0x1002b208
jb 0x1002b20a
test dword [esp], ecx
jl 0x1002b21a
jbe 0x1002b211
xchg esp, esp
je 0x1002b215
jge 0x1002b217
jge 0x1002b21a
mov ebp, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
cmp ecx, 0x22c3
shl ebx, 0
lea edi, [edi + 0x5556]
lea edi, [edi - 0x5556]
jns 0x1002b261
jb 0x1002b26b
jmp 0x1002b265
jl 0x1002b267
jae 0x1002b26b
mov ecx, 0xec4d8a4d
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.10032c43
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002b2dd
xor eax, eax
jmp 0x1002b34e
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.1001af90
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.1001a2fc
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x1002b34c
jp 0x1002b305
xor ecx, esi
xor ecx, esi
je 0x1002b317
mov edi, edi
xchg ebx, ebx
jae 0x1002b311
lea esp, [esp]
jne 0x1002b317
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.10034613
add esp, 4
mov esp, esp
xchg ebx, ebx
std
cld
jno 0x1002b33b
pushf
or esi, esi
popf
lea esp, [esp]
mov edi, edi
jge 0x1002b338
jo 0x1002b33b
ljmp 0x558b:0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x1002b34e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002b357
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.1001a2fc
add esp, 0xc
push 0x21
push 0x1001461c
lea ecx, [ebp - 0x138]
push ecx
call fcn.1002c294
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x1002b45f
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.1001a2fc
add esp, 0xc
push 0xb
push 0x10014640
lea edx, [ebp - 0x138]
push edx
call fcn.1002c294
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x1002b452
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1002c294
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1002b461
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1002b465
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
mov ax, word [0x1000ada4]
cmp eax, 1
jne 0x1002b486
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1002b616
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.1001a2fc
add esp, 0xc
neg esi
neg esi
ror esp, 0
jl 0x1002b49f
jae 0x1002b4a8
jb 0x1002b4a3
js 0x1002b4a5
jb 0x1002b4a8
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
sub esp, 0
xor ebx, edi
xor ebx, edi
neg ecx
neg ecx
jne 0x1002b504
pushf
jg 0x1002b4ed
push edx
add edx, 0x1c5e
ror edx, 0x1b
pop edx
popf
jno 0x1002b4fc
lea esp, [esp]
js 0x1002b501
je 0x1002b504
mov esi, 0x80e8558a
ljmp 0x458a
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
xor edx, 0
jno 0x1002b581
pushf
and eax, eax
cmp esi, dword [esp + 0xc]
popf
nop
mov edx, edx
jo 0x1002b581
ljmp 0x8900:0x76bde8
call fcn.10032c43
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002b596
xor eax, eax
jmp 0x1002b616
push eax
add eax, 0x5077
ror eax, 0x15
pop eax
std
cld
cmp edx, dword [esp + 4]
jl 0x1002b5a8
js 0x1002b5b3
xchg edx, edx
nop
jp 0x1002b5af
nop
jns 0x1002b5b3
mov ebp, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.1001af90
mov dword [ebp - 4], eax
nop
add ebx, dword [esp]
sub ebx, dword [esp]
jne 0x1002b5d2
js 0x1002b5ce
je 0x1002b5d2
xor eax, 0x6a0d6a4a
add byte [ebp - 0x17ae17b3], cl
sbb eax, 0x83fffeed
les ecx, [ebx + eax*4]
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.1001a2fc
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1002b5ec
or al, 0x83
jge 0x1002b5e1
add byte [ebp + 4], dh
xor eax, eax
jmp 0x1002b616
cld
je 0x1002b5fb
pushf
ror ecx, 0
popf
jno 0x1002b5f8
jne 0x1002b5fb
mov esp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.10034613
add esp, 4
sub ecx, 0
jno 0x1002b613
lea esp, [esp]
jo 0x1002b613
mov ebx, 0xfc55ff11
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002be1a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.1001a2fc
add esp, 0xc
and ebx, 0xffffffff
jl 0x1002be3d
jp 0x1002be3a
jge 0x1002be3d
mov eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
ror ecx, 0
jns 0x1002be8e
pushf
and esp, 0xffffffff
jl 0x1002be81
xchg esi, esi
jge 0x1002be85
popf
xchg esi, esi
jns 0x1002be8b
js 0x1002be8e
mov ecx, 0x80f44d8a
jmp 0x4504698
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
sub esp, 0
jg 0x1002bf04
shr esp, 0
add esp, 0
jne 0x1002bf11
mov ecx, ecx
je 0x1002bf11
xor eax, 0x6d2de8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.10032c43
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002bf24
jmp 0x1002bfd9
jle 0x1002bf26
cmp esp, 0x41bb
and esp, 0xffffffff
je 0x1002bf3d
pushf
rol ebx, 0
popf
ja 0x1002bf3a
jne 0x1002bf3d
jmp 0x62eb14ce
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.1001af90
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.1001a2fc
add esp, 0xc
lea esi, [esi]
cmp esp, 0x7f86
xchg edx, edx
jg 0x1002bf7d
pushf
add ecx, 0
shr esp, 0
add ebx, 0
jb 0x1002bf76
popf
jl 0x1002bf7a
jle 0x1002bf7d
sub eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x1002bf85
jmp 0x1002bfd9
call 0x1002bf8a
add esp, 4
mov ecx, ecx
jl 0x1002bf98
jb 0x1002bf93
jge 0x1002bf98
mov ebp, 0x558baf5e
cld
mov edx, dword [ebp - 4]
push edx
call fcn.10034613
add esp, 4
lea ebx, [ebx + 0x348b]
lea ebx, [ebx - 0x348b]
jg 0x1002bfb2
lea ebx, [ebx + 0x109b]
sub ebx, 0x109b
jnp 0x1002bfd2
pushf
jl 0x1002bfc4
ror eax, 0
test dword [esp + 0x10], ecx
popf
jno 0x1002bfcf
jp 0x1002bfd2
mov edi, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10030618
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.1001a2fc
add esp, 0xc
ror esp, 0
ja 0x10030636
jnp 0x10030638
jns 0x10030641
jg 0x1003063c
jae 0x1003063e
js 0x10030641
mov ebx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
rol esp, 0
jne 0x10030680
nop
jne 0x10030679
jno 0x1003067b
jnp 0x1003067d
je 0x10030680
add eax, 0x80ec4d8a
jmp 0xfc508e8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.10032c43
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100306f5
xor eax, eax
jmp 0x1003078e
xor eax, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
xor ecx, dword [esp]
xor ecx, dword [esp]
inc ebx
dec ebx
ror ebx, 0x1b
rol ebx, 0x1b
js 0x10030718
xchg esp, esp
mov esp, esp
jae 0x10030713
je 0x10030715
jns 0x10030718
mov eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.1001af90
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.1001a2fc
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x10030742
xor eax, eax
jmp 0x1003078e
jnp 0x10030744
jle 0x10030746
call 0x1003074b
add esp, 4
cld
ja 0x10030760
pushf
and ecx, ecx
or ecx, ecx
jnp 0x10030759
popf
js 0x1003075d
jbe 0x10030760
or dword [ebx - 0x17af03bb], 0x3eaa
mov eax, dword [ebp - 4]
push eax
call fcn.10034613
add esp, 4
ror esp, 0
xchg ecx, edx
xchg ecx, edx
push ecx
pop ecx
rol esi, 3
ror esi, 3
jl 0x10030787
ja 0x1003077f
xchg esi, esi
nop
je 0x10030784
jge 0x10030787
mov eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10030e8b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.1001a2fc
add esp, 0xc
mov ebx, ebx
jle 0x10030ea8
nop
jb 0x10030eab
jg 0x10030ebe
pushf
ror ecx, 0
popf
lea esp, [esp]
jo 0x10030eb9
lea esi, [esi]
jle 0x10030ebe
add eax, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
ror esp, 0
xchg ecx, eax
xchg ecx, eax
call 0x10030f10
lea esp, [esp + 4]
and edi, 0xffffffff
je 0x10030f28
pushf
jge 0x10030f1d
popf
xchg esi, edx
xchg esi, edx
jl 0x10030f25
jne 0x10030f28
mov ebx, 0x80e44d8a
jmp 0xf4509732
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.10032c43
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10030fd6
xor eax, eax
jmp 0x10031051
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.1001af90
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.1001a2fc
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x1003104f
xor edi, 0
shr esp, 0
xchg edi, edi
lea edx, [edx + 0x2c30]
lea edx, [edx - 0x2c30]
jo 0x1003101d
jno 0x10031014
js 0x10031016
je 0x10031018
jno 0x1003101d
mov esp, 0x4d8bc6ae
cld
mov ecx, dword [ebp - 4]
push ecx
call fcn.10034613
add esp, 4
neg eax
neg eax
jl 0x10031036
lea esp, [esp]
jge 0x10031036
mov esi, 0x18558b3e
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x10031051
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10035cf5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.1001a2fc
add esp, 0xc
ror edi, 0
shl esp, 0
dec edx
inc edx
test dword [esp], edi
je 0x10035d23
je 0x10035d1d
jo 0x10035d1f
jne 0x10035d23
add eax, 0xf045c6f2
inc esi
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
xor esp, 0
jns 0x10035d58
jp 0x10035d5a
jg 0x10035d5c
jle 0x10035d68
jge 0x10035d60
jge 0x10035d62
jp 0x10035d64
jg 0x10035d68
mov edi, 0xf04d8a06
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
dec ecx
inc ecx
or edi, edi
test dword [esp], eax
jp 0x10035dde
pushf
xchg edx, edx
popf
mov esp, esp
jle 0x10035ddb
jnp 0x10035dde
sub eax, 0xffce60e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.10032c43
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10035df0
xor eax, eax
jmp 0x10035e33
shl edi, 0
push edx
add edx, 0x461a
ror edx, 0x1e
pop edx
je 0x10035e10
pushf
shl esp, 0
je 0x10035e07
popf
jp 0x10035e0b
jmp 0x10035e0d
jne 0x10035e10
mov esi, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001af90
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.1001a2fc
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003bc2a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.1001a2fc
add esp, 0xc
xor edx, dword [esp]
xor edx, dword [esp]
jns 0x1003bc4b
jo 0x1003bc55
mov edx, edx
xchg esp, esp
jno 0x1003bc55
mov edx, 0xec45c660
dec edx
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
test edi, 0x5b08
ror ecx, 0
shr esi, 0
jne 0x1003bcac
lea esp, [esp]
jle 0x1003bca8
je 0x1003bcac
add eax, 0xec4d8a37
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.1001a84b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003bd40
xor eax, eax
jmp 0x1003bdbd
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.1001af90
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.1001a2fc
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x1003bdbb
ror edx, 0
jbe 0x1003bd85
pushf
lea ecx, [ecx + 0x6331]
lea ecx, [ecx - 0x6331]
xchg esi, eax
xchg esi, eax
cmc
and ebx, ebx
popf
jae 0x1003bd82
ja 0x1003bd85
lcall 0x85e8, 0x51e84d8b
mov bh, bh
inc dword [ebx + 0x7004c4]
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.10034613
add esp, 4
jo 0x1003bd93
add ecx, 0x6bc1
sub ecx, 0x6bc1
jmp 0x1003bda1
jb 0x1003bdb2
pushf
cmc
dec edx
inc edx
popf
jno 0x1003bdac
lea esp, [esp]
jae 0x1003bdb2
mov ebp, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x1003bdbd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003e1c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.1001a2fc
add esp, 0xc
add esp, 0
std
cld
jne 0x1003e1e8
jae 0x1003e200
lea ebx, [ebx + 0x399a]
lea ebx, [ebx - 0x399a]
lea esi, [esi]
lea edi, [edi]
jmp 0x1003e1fc
jb 0x1003e200
mov ecx, 0xe845c6fb
push ecx
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
push eax
add eax, 0x36a
ror eax, 0xb
pop eax
ror esp, 0
jg 0x1003e2c7
pushf
stc
add ecx, 0
jbe 0x1003e2c0
popf
xchg esp, esp
jle 0x1003e2c7
mov esp, 0xff4977e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.10032c43
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1003e2dc
xor eax, eax
jmp 0x1003e39b
call 0x1003e2e1
lea esp, [esp + 4]
jg 0x1003e2e7
add eax, 0x60c5
sub eax, 0x60c5
and edx, 0xffffffff
jge 0x1003e318
pushf
call 0x1003e2fd
lea esp, [esp + 4]
cmp ebx, dword [esp + 8]
xor edi, dword [esp + 0x10]
xor edi, dword [esp + 0x10]
popf
ja 0x1003e311
jmp 0x1003e313
jmp 0x1003e315
jl 0x1003e318
mov esi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.1001af90
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.1001a2fc
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1003e342
xor eax, eax
jmp 0x1003e39b
add edx, 0x1271
sub edx, 0x1271
test edi, ecx
jb 0x1003e36a
pushf
ror edi, 0xb
ror edi, 0x15
rol edi, 0xc
ror edi, 0xc
js 0x1003e362
cld
popf
mov esp, esp
jae 0x1003e36a
mov esp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.10034613
add esp, 4
shl esi, 0
xchg ecx, eax
xchg ecx, eax
cld
rol edx, 0x1b
rol edx, 5
jp 0x1003e390
je 0x1003e386
je 0x1003e388
xchg edi, edi
lea edi, [edi]
jnp 0x1003e390
mov esp, 0xc458b6e
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8