joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100802f
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1008d30
call fcn.01008304
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x100ce6c
push ebx
push esi
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1007dea
cmp eax, esi
jne 0x1007ddd
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1007ded
push 0x3e8
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x1007dc4
xor esi, esi
inc esi
mov eax, dword [0x100ce68]
cmp eax, esi
jne 0x1007e00
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1007e2f
mov eax, dword [0x100ce68]
test eax, eax
jne 0x1007e29
mov dword [0x100ce68], esi
push 0x10012d0
push 0x10012c4
call fcn.01007d26
pop ecx
pop ecx
test eax, eax
je 0x1007e2f
jmp 0x1007f53
mov dword [0x100cb2c], esi
mov eax, dword [0x100ce68]
cmp eax, esi
jne 0x1007e53
push 0x10012c0
push 0x10012b0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100ce68], 2
cmp dword [ebp - 0x20], ebx
jne 0x1007e60
push ebx
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedExchange]
cmp dword [0x100ce78], ebx
je 0x1007e81
push 0x100ce78
call fcn.01008279
pop ecx
test eax, eax
je 0x1007e81
push ebx
push 2
push ebx
call dword [0x100ce78]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1007f53
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1007eeb
cmp cx, bx
je 0x1007ea6
cmp dword [ebp - 0x1c], ebx
jne 0x1007eeb
movzx ecx, word [eax]
cmp cx, bx
je 0x1007ebb
cmp cx, 0x20
ja 0x1007ebb
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1007ea6
test byte [ebp - 0x40], 1
je 0x1007ec7
movzx ecx, word [ebp - 0x3c]
jmp 0x1007eca
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x100cb28], eax
cmp dword [0x100cb1c], ebx
jne 0x1007f30
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1007efc
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x1007e90
cmp dword [0x100cb2c], ebx
jne 0x1007f3e
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100cb28]
jmp 0x1007f5f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01008349
ret
call fcn.01008451
jmp 0x1007d87
Function at 0x402044
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x42f040]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov esi, dword [0x491750]
xor ebx, ebx
push edi
mov dword [esp + 0x10], edx
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
add eax, esi
mov dword [esp + 0x18], eax
mov edi, dword [eax + 0x20]
mov eax, dword [eax + 0x18]
add edi, esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4020b4
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.00402bc8
lea ecx, [esp + 0x1c]
call fcn.00401e74
cmp eax, dword [esp + 0x10]
je 0x4020cb
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.00403484
inc ebx
cmp ebx, dword [esp + 0x14]
jb 0x402084
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040833e
mov esp, ebp
pop ebp
ret
mov edx, str.QwruxAA
call fcn.00403e0f
push eax
call fcn.00404088
mov edx, dword [esp + 0x1c]
pop ecx
mov eax, dword [edx + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.00403484
jmp 0x4020b6
Function at 0x419180
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418e22

Function at 0x41918b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418fb1

Function at 0x419585
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00409270
mov eax, dword [0x42f040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004164e5
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4195c7
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x419723
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004235a0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x491348]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041a755
mov ecx, dword [esi*4 + 0x491348]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41971c
cmp eax, dword [edi + ecx + 0x24]
jne 0x41971c
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41971c
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041a755
add esp, 0x14
test edx, edx
jl 0x41971c
jg 0x419692
test eax, eax
jb 0x41971c
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41971c
jl 0x4196ac
cmp dword [ebp - 0x1008], eax
ja 0x41971c
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4196ca
test ebx, ebx
je 0x419703
cmp ecx, edi
jae 0x419703
mov al, byte [ecx]
cmp al, 0xd
jne 0x4196e4
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4196f0
cmp byte [ecx + 1], 0xa
jne 0x4196f0
inc ecx
jmp 0x4196f0
movzx eax, al
movsx eax, byte [eax + 0x42f300]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4196ca
cmp edx, ebx
jne 0x4196ca
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x419721
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040833e
leave
ret
Function at 0x419bf3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x491348]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x419c33
cmp byte [ebx], 0xa
jne 0x419c33
or byte [eax + edi + 0x28], 4
jmp 0x419c38
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x419d36
mov al, byte [edx]
cmp al, 0x1a
je 0x419d18
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x419c67
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x419c8c
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x419c96
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x419c49
jmp 0x419d36
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419d13
cmp dword [ebp - 0xc], 0
je 0x419d13
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x491348]
test byte [eax + edi + 0x28], 0x48
je 0x419ced
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x419cd8
mov byte [esi], dl
jmp 0x419ce9
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x491348]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x419d36
cmp byte [ebp - 1], 0xa
jne 0x419cfc
cmp esi, ebx
jne 0x419cfc
mov byte [esi], 0xa
jmp 0x419d35
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041a773
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x419d36
mov byte [esi], 0xd
jmp 0x419d35
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x491348]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419d32
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x419d36
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x419d3f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x491348]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x419d82
cmp word [esi], dx
jne 0x419d82
or byte [edi + eax + 0x28], 4
jmp 0x419d87
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x419eda
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x419eba
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x419dc9
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x419dff
cmp eax, edx
jae 0x419e0b
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x419da1
jmp 0x419eda
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419eb6
cmp dword [ebp - 0x14], 0
je 0x419eb6
mov eax, dword [ebx*4 + 0x491348]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x419e8e
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x419e57
mov word [esi], cx
jmp 0x419e8a
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x491348]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x491348]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x491348]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x419eda
pop ebx
cmp word [ebp - 4], bx
jne 0x419e9f
cmp esi, dword [ebp + 0xc]
jne 0x419e9f
mov word [esi], bx
jmp 0x419ed7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041a773
add esp, 0x10
cmp word [ebp - 4], bx
je 0x419eda
push 0xd
jmp 0x419ed3
mov ecx, dword [ebx*4 + 0x491348]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419ed1
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x419eda
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10001340
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x103d29a4], 0
jne 0x10001366
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x3285501
call fcn.10037840
add esp, 0xc
mov dword [0x103d29a4], eax
mov eax, dword [0x103d29a4]
pop ebp
ret

Function at 0x10001430
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x103d2994], 0
jne 0x10001456
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x53b2070f
call fcn.10037840
add esp, 0xc
mov dword [0x103d2994], eax
mov eax, dword [0x103d2994]
pop ebp
ret

Function at 0x10001550
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x103d29cc], 0
jne 0x10001576
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xafcab3c4
call fcn.10037840
add esp, 0xc
mov dword [0x103d29cc], eax
mov eax, dword [0x103d29cc]
pop ebp
ret

Function at 0x100016a0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x103d2998], 0
jne 0x100016c6
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xf8f45725
call fcn.10037840
add esp, 0xc
mov dword [0x103d2998], eax
mov eax, dword [0x103d2998]
pop ebp
ret

Function at 0x100016d0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x103d29d4], 0
jne 0x100016f6
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xfaba0065
call fcn.10037840
add esp, 0xc
mov dword [0x103d29d4], eax
mov eax, dword [0x103d29d4]
pop ebp
ret

Function at 0x10002280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100662a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xc
mov byte [ebp - 0x20], 0xac
mov byte [ebp - 0x1f], 0x30
mov byte [ebp - 0x1e], 0x34
mov byte [ebp - 0x1d], 0x3b
mov byte [ebp - 0x1c], 0x60
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x64
mov byte [ebp - 0x19], 0x2f
mov byte [ebp - 0x18], 0xab
mov byte [ebp - 0x17], 0x33
mov byte [ebp - 0x16], 0x35
mov byte [ebp - 0x15], 0x59
mov eax, dword [0x103d2914]
and eax, 1
jne 0x10002317
mov ecx, dword [0x103d2914]
or ecx, 1
mov dword [0x103d2914], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x103d2904
call fcn.10001a80
push 0x10066730
call fcn.1005a196
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103d2904
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10002330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100662c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xc
mov byte [ebp - 0x20], 0x3a
mov byte [ebp - 0x1f], 0x1d
mov byte [ebp - 0x1e], 0x3e
mov byte [ebp - 0x1d], 0x27
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x32
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x2f
mov byte [ebp - 0x18], 0x1d
mov byte [ebp - 0x17], 3
mov byte [ebp - 0x16], 0x2b
mov byte [ebp - 0x15], 0x57
mov eax, dword [0x103d2928]
and eax, 1
jne 0x100023c7
mov ecx, dword [0x103d2928]
or ecx, 1
mov dword [0x103d2928], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x103d2918
call fcn.10001a80
push 0x10066740
call fcn.1005a196
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103d2918
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100023e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100662e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xc
mov byte [ebp - 0x20], 0x10
mov byte [ebp - 0x1f], 0x5f
mov byte [ebp - 0x1e], 0x8c
mov byte [ebp - 0x1d], 0x35
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x32
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x2f
mov byte [ebp - 0x18], 0x27
mov byte [ebp - 0x17], 0x5b
mov byte [ebp - 0x16], 0x85
mov byte [ebp - 0x15], 0x59
mov eax, dword [0x103d2870]
and eax, 1
jne 0x10002477
mov ecx, dword [0x103d2870]
or ecx, 1
mov dword [0x103d2870], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x103d2860
call fcn.10001a80
push 0x10066750
call fcn.1005a196
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103d2860
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10002490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066303
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x13
mov byte [ebp - 0x28], 0x2c
mov byte [ebp - 0x27], 0xa8
mov byte [ebp - 0x26], 0xaa
mov byte [ebp - 0x25], 0x25
mov byte [ebp - 0x24], 0x6e
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x67
mov byte [ebp - 0x20], 0x15
mov byte [ebp - 0x1f], 0xec
mov byte [ebp - 0x1e], 0x9e
mov byte [ebp - 0x1d], 0x19
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x1b], 0x2e
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x4f
mov byte [ebp - 0x17], 0xf1
mov byte [ebp - 0x16], 0xc9
mov eax, dword [0x103d2940]
and eax, 1
jne 0x10002543
mov ecx, dword [0x103d2940]
or ecx, 1
mov dword [0x103d2940], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push edx
mov ecx, 0x103d292c
call fcn.10001880
push 0x10066760
call fcn.1005a196
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103d292c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10002c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066363
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xd
mov byte [ebp - 0x24], 0x3f
mov byte [ebp - 0x23], 0x82
mov byte [ebp - 0x22], 0x47
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x71
mov byte [ebp - 0x1f], 0x68
mov byte [ebp - 0x1e], 0x32
mov byte [ebp - 0x1d], 0x33
mov byte [ebp - 0x1c], 0x5f
mov byte [ebp - 0x1b], 0x83
mov byte [ebp - 0x1a], 0x5f
mov byte [ebp - 0x19], 0x37
mov byte [ebp - 0x18], 1
mov eax, dword [0x103d28a8]
and eax, 1
jne 0x10002cfb
mov ecx, dword [0x103d28a8]
or ecx, 1
mov dword [0x103d28a8], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x103d2898
call fcn.10001b00
push 0x10066790
call fcn.1005a196
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103d2898
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10002fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100663c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x21
mov byte [ebp - 0x38], 0x2d
mov byte [ebp - 0x37], 0x83
mov byte [ebp - 0x36], 0xfb
mov byte [ebp - 0x35], 0x2f
mov byte [ebp - 0x34], 0x72
mov byte [ebp - 0x33], 0x3b
mov byte [ebp - 0x32], 0x2e
mov byte [ebp - 0x31], 0x2e
mov byte [ebp - 0x30], 0x36
mov byte [ebp - 0x2f], 0x92
mov byte [ebp - 0x2e], 0xe2
mov byte [ebp - 0x2d], 0x2a
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x2b], 0x6e
mov byte [ebp - 0x2a], 0x79
mov byte [ebp - 0x29], 0x2f
mov byte [ebp - 0x28], 0x26
mov byte [ebp - 0x27], 0x98
mov byte [ebp - 0x26], 0xe2
mov byte [ebp - 0x25], 0x70
mov byte [ebp - 0x24], 0x60
mov byte [ebp - 0x23], 0x62
mov byte [ebp - 0x22], 0x62
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x30
mov byte [ebp - 0x1f], 0x99
mov byte [ebp - 0x1e], 0xfb
mov byte [ebp - 0x1d], 0x71
mov byte [ebp - 0x1c], 0x60
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x71
mov byte [ebp - 0x19], 0x79
mov byte [ebp - 0x18], 0x45
mov eax, dword [0x103d2968]
and eax, 1
jne 0x100030ab
mov ecx, dword [0x103d2968]
or ecx, 1
mov dword [0x103d2968], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x38]
push edx
mov ecx, 0x103d2944
call fcn.10001900
push 0x100667c0
call fcn.1005a196
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103d2944
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100030c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100663e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xc
mov byte [ebp - 0x20], 6
mov byte [ebp - 0x1f], 0x2f
mov byte [ebp - 0x1e], 0xdb
mov byte [ebp - 0x1d], 0x20
mov byte [ebp - 0x1c], 0x60
mov byte [ebp - 0x1b], 0x71
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x2f
mov byte [ebp - 0x18], 0x31
mov byte [ebp - 0x17], 0x2b
mov byte [ebp - 0x16], 0xdb
mov byte [ebp - 0x15], 0x57
mov eax, dword [0x103d28e0]
and eax, 1
jne 0x10003157
mov ecx, dword [0x103d28e0]
or ecx, 1
mov dword [0x103d28e0], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x103d28d0
call fcn.10001a80
push 0x100667d0
call fcn.1005a196
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103d28d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10003170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066403
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x21
mov byte [ebp - 0x38], 7
mov byte [ebp - 0x37], 0x7d
mov byte [ebp - 0x36], 0xa9
mov byte [ebp - 0x35], 0x2d
mov byte [ebp - 0x34], 0x72
mov byte [ebp - 0x33], 0x3b
mov byte [ebp - 0x32], 0x2e
mov byte [ebp - 0x31], 0x2e
mov byte [ebp - 0x30], 0x1c
mov byte [ebp - 0x2f], 0x6c
mov byte [ebp - 0x2e], 0xb0
mov byte [ebp - 0x2d], 0x28
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x2b], 0x6e
mov byte [ebp - 0x2a], 0x79
mov byte [ebp - 0x29], 0x2f
mov byte [ebp - 0x28], 0xc
mov byte [ebp - 0x27], 0x66
mov byte [ebp - 0x26], 0xb0
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x60
mov byte [ebp - 0x23], 0x62
mov byte [ebp - 0x22], 0x62
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x1a
mov byte [ebp - 0x1f], 0x67
mov byte [ebp - 0x1e], 0xa9
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x1c], 0x60
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x71
mov byte [ebp - 0x19], 0x79
mov byte [ebp - 0x18], 0x6f
mov eax, dword [0x103d2990]
and eax, 1
jne 0x1000325b
mov ecx, dword [0x103d2990]
or ecx, 1
mov dword [0x103d2990], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x38]
push edx
mov ecx, 0x103d296c
call fcn.10001900
push 0x100667e0
call fcn.1005a196
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103d296c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret