joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10073660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c742d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x3c]
call fcn.100114c0
mov dword [ebp - 4], 0
mov byte [ebp - 0x38], 0x44
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x62
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x67
mov byte [ebp - 0x33], 0x67
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x44
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x3b
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x43
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x3a
mov byte [ebp - 0x1c], 0x20
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], pe_nt_image_headers32
mov byte [ebp - 0x19], 0x39
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x30
mov byte [ebp - 0x11], 0
call fcn.10076ba0
movzx eax, al
test eax, eax
je 0x1007376b
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d515b
push 1
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.100114e0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x100737a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c73ed
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x40]
call fcn.100114c0
mov dword [ebp - 4], 0
mov byte [ebp - 0x3c], 0x44
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x62
mov byte [ebp - 0x39], 0x75
mov byte [ebp - 0x38], 0x67
mov byte [ebp - 0x37], 0x67
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x44
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3b
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x45
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0x30
mov byte [ebp - 0x1e], pe_nt_image_headers32
mov byte [ebp - 0x1d], 0x39
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x31
mov byte [ebp - 0x16], 0x31
mov byte [ebp - 0x15], 0x32
mov byte [ebp - 0x14], 0
call fcn.10076c20
test eax, eax
je 0x100738ac
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5165
push 1
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.100114e0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x100738e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c742d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x3c]
call fcn.100114c0
mov dword [ebp - 4], 0
mov byte [ebp - 0x38], 0x44
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x62
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x67
mov byte [ebp - 0x33], 0x67
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x44
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x3b
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x43
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x3a
mov byte [ebp - 0x1c], 0x20
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], pe_nt_image_headers32
mov byte [ebp - 0x19], 0x39
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0
call fcn.10076cb0
test eax, eax
je 0x100739e8
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5166
push 1
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.100114e0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10073de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x2c], 0x44
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x62
mov byte [ebp - 0x29], 0x75
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x67
mov byte [ebp - 0x26], 0x65
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x44
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x3b
mov byte [ebp - 0x1a], 0x20
mov byte [ebp - 0x19], 0x45
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x43
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x3a
mov byte [ebp - 0x10], 0x20
mov byte [ebp - 0xf], 0x30
mov byte [ebp - 0xe], pe_nt_image_headers32
mov byte [ebp - 0xd], 0x39
mov byte [ebp - 0xc], 0x30
mov byte [ebp - 0xb], 0x30
mov byte [ebp - 0xa], 0x30
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x30
mov byte [ebp - 7], 0x31
mov byte [ebp - 6], 0x36
mov byte [ebp - 5], 0
mov dword [ebp - 0x30], 0
pushf
push 0xa
Function at 0x10074f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x48], ecx
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], pe_nt_image_headers32
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x10103414]
call fcn.100130e0
mov dword [ebp - 0x40], eax
call fcn.10009fa0
movzx ecx, al
test ecx, ecx
je 0x10074fba
mov edx, dword [0x101034a4]
mov eax, dword [edx + 0x274]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call dword [0x100e7c14]
call dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
push ecx
push 0
push 0x1fffff
call fcn.10178ece
Function at 0x10076b50
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x68]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
and eax, 0x70
je 0x10076b84
mov eax, 1
jmp 0x10076b86
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10077e90
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100eab68
push 0x100a5b10
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff0
mov eax, dword [0x100ed440]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1d], 0
mov dword [ebp - 4], 0
push ebx
mov ebx, 0
mov eax, 1
invalid

Function at 0x10077f30
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100eab88
push 0x100a5b10
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff0
mov eax, dword [0x100ed440]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1d], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x1d]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x10077fb3
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10078025
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x10078023
jmp 0x1007801e
call fcn.10078025
jae 0x1007801e
add esp, 4
jmp 0x1007802a
dec dword [esp]
jno 0x1007802f
jns 0x1007801a
jp 0x10078033
add esp, 4
popf
jmp 0x1007803a
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10078053
jne 0x10078053
call 0x1fc7b3a7
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xf], 0x6d
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x68
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x6b
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0
call fcn.10077e90
movzx eax, al
test eax, eax
jne 0x100780c0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [0x101034a4]
mov eax, dword [edx + 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call dword [0x100e7c14]
call dword [ebp - 0x28]
test eax, eax
je 0x10078135
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x50
mov byte [ebp - 0x1c], 0x43
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x21
mov byte [ebp - 0x11], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5623
push 0
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
pushf
push 0xa
jae 0x10078142
jmp 0x1007813d
call 0x10078144
jae 0x1007813d
add esp, 4
jmp 0x10078149
dec dword [esp]
jno 0x1007814e
jns 0x10078139
jp 0x10078152
add esp, 4
popf
jmp 0x10078159
clc
jae 0x1007815e
jl 0x1007818a
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10078177
jne 0x10078177
sub al, 0x7c
add ebp, ebx
add ebp, dword [esp + esi*2]
sti
jl 0x1007817c
jmp 0x1007817e
je 0x10078179
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10078198
jne 0x10078197
call 0x930b721f
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100781a6
jne 0x100781a6
call 0x9b62e009
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10078205
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x10078203
jmp 0x100781fe
call fcn.10078205
jae 0x100781fe
add esp, 4
jmp 0x1007820a
dec dword [esp]
jno 0x1007820f
jns 0x100781fa
jp 0x10078213
add esp, 4
popf
jmp 0x1007821a
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10078233
jne 0x10078233
call 0x1fc7b587
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10077f30
movzx eax, al
test eax, eax
je 0x100782b9
mov byte [ebp - 0x18], 0x56
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x16], 0x77
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x20
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x21
mov byte [ebp - 8], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d562e
push 0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
pushf
push 0xa
jae 0x100782c6
jmp 0x100782c1
call 0x100782c8
jae 0x100782c1
add esp, 4
jmp 0x100782cd
dec dword [esp]
jno 0x100782d2
jns 0x100782bd
jp 0x100782d6
add esp, 4
popf
jmp 0x100782dd
clc
jae 0x100782e2
or eax, 0x815250b0
nop
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0x358
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100782fb
jne 0x100782fb
mov al, 0x7c
add ebp, ebx
add esi, dword [eax + 0x3350fb74]
ror byte [edi], 0x9b
rcl byte [edx + 0x33], 0xd0
jl 0x10078300
jmp 0x10078302
je 0x100782fd
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1007831c
jne 0x1007831b
call 0x930b73a3
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1007832a
jne 0x1007832a
call 0x9b62e18d
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10078362
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x10078360
jmp 0x1007835b
call fcn.10078362
jae 0x1007835b
add esp, 4
jmp 0x10078367
dec dword [esp]
jno 0x1007836c
jns 0x10078357
jp 0x10078370
add esp, 4
popf
jmp 0x10078377
clc
jae 0x1007837c
shl byte [ecx], 1
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10078395
jne 0x10078395
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x1007839a
jmp 0x1007839c
je 0x10078397
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100783b6
jne 0x100783b5
call 0x930b743d
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100783c4
jne 0x100783c4
call 0x63f7c98e
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x44
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x28]
call dword [0x100e7c14]
call dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x1007848e
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], pe_nt_image_headers32
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x21
mov byte [ebp - 0x11], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d562f
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
jl 0x10078493
jmp 0x10078495
je 0x10078490
xor eax, eax
test eax, eax
je 0x1007849e
jne 0x1007849d
call 0x930b7525
rol byte [ebx + eax*4], 0xf0
add eax, 0x1a0273f8
arpl word [ebx + eax + 0x75], si
add dword [ebx + 0x66], esp
pushfd
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x100784ac
sbb ah, byte [ebx + 0x74]
add esi, dword [ebp + 1]
je 0x100784b1
jne 0x100784b1
arpl word [esi - 0x64], sp
pushf
push 0xa
jae 0x100784be
jmp 0x100784b9
call 0x100784c0
jae 0x100784b9
add esp, 4
jmp 0x100784c5
dec dword [esp]
jno 0x100784ca
jns 0x100784b5
jp 0x100784ce
add esp, 4
popf
jmp 0x100784d5
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100784ee
jne 0x100784ee
call 0x1fc7b842
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x10078ce5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jl 0x10078cb8
jmp 0x10078cba
je 0x10078cb5
xor eax, eax
test eax, eax
je 0x10078cc3
jne 0x10078cc2
call 0x930b7d4a
rol byte [ebx + eax*4], 0xf0
add eax, 0x960273f8
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x10078cd1
xchg esi, eax
invalid
je 0x10078cd6
jne 0x10078cd6
invalid
pushf
push 0xa
jae 0x10078ce3
jmp 0x10078cde
call 0x10078ce5
jae 0x10078cde
add esp, 4
jmp 0x10078cea
dec dword [esp]
jno 0x10078cef
jns 0x10078cda
jp 0x10078cf3
add esp, 4
popf
jmp 0x10078cfa
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10078d13
jne 0x10078d13
call 0x1fc7c067
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x79
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x101034a4]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x28]
call dword [0x100e7c14]
call dword [ebp - 0x28]
test eax, eax
je 0x10078ddd
mov byte [ebp - 0x24], 0x57
mov byte [ebp - 0x23], 0x50
mov byte [ebp - 0x22], 0x45
mov byte [ebp - 0x21], 0x20
mov byte [ebp - 0x20], 0x50
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x20
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x63
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0x2e
mov byte [ebp - 0x13], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5641
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
pushf
push 0xa
jae 0x10078dea
jmp 0x10078de5
call 0x10078dec
jae 0x10078de5
add esp, 4
jmp 0x10078df1
dec dword [esp]
jno 0x10078df6
jns 0x10078de1
jp 0x10078dfa
add esp, 4
popf
jmp 0x10078e01
clc
jae 0x10078e06
or edx, dword ss:[eax + 0x52]
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10078e1f
jne 0x10078e1f
or edi, dword [ebx + eax - 0x15]
add ecx, dword [ebx]
jl 0x10078e24
jmp 0x10078e26
je 0x10078e21
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10078e40
jne 0x10078e3f
call 0x930b7ec7
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10078e4e
jne 0x10078e4e
call 0x9b62ecb1
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
Function at 0x1007a2f0
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x30], 0x54
mov byte [ebp - 0x2f], 0x69
mov byte [ebp - 0x2e], 0x6d
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x2b], 0x75
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x20
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x69
mov byte [ebp - 0x24], 0x6e
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6c
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x7a
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], 0x74
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x6e
mov byte [ebp - 0x18], 0x21
mov byte [ebp - 0x17], 0x20
mov byte [ebp - 0x16], 0x50
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x20
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xc], 0x20
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x67
mov byte [ebp - 9], 0x61
mov byte [ebp - 8], 0x69
mov byte [ebp - 7], 0x6e
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
rdtsc
mov dword [ebp - 0x38], eax
rdtsc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x38]
cmp eax, 0xc8
jbe 0x1007a3fa
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d5621
push 0
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret