joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412355
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x479318]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
sub ebx, ebx
sub esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x41239e
call edi
push eax
pop esi
cmp esi, ebx
je 0x412385
mov dword [0x479318], 1
jmp 0x4123a3
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x412399
mov eax, ebp
mov dword [0x479318], eax
jmp 0x41239e
mov eax, dword [0x479318]
cmp eax, 1
jne 0x412420
cmp esi, ebx
jne 0x4123af
call edi
push eax
pop esi
cmp esi, ebx
je 0x412428
cmp word [esi], bx
push esi
pop eax
je 0x4123c4
add eax, ebp
cmp word [eax], bx
jne 0x4123b6
add eax, ebp
cmp word [eax], bx
jne 0x4123b6
mov edi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sbb eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x412415
push ebp
call fcn.00413592
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x412415
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
or eax, eax
jne 0x412411
push dword [esp + 0x10]
call fcn.0041347a
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
push ebx
pop eax
jmp 0x412470
cmp eax, ebp
je 0x41242c
cmp eax, ebx
je 0x41242c
sub eax, eax
jmp 0x412470
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
push eax
pop esi
cmp esi, ebx
je 0x412428
cmp byte [esi], bl
je 0x412446
inc eax
cmp byte [eax], bl
jne 0x41243c
inc eax
cmp byte [eax], bl
jne 0x41243c
sbb eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.00413592
push eax
pop edi
cmp edi, ebx
pop ecx
jne 0x41245c
sub edi, edi
jmp 0x412467
push ebp
push esi
push edi
call fcn.004135b0
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
push edi
pop eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x412b52
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
sub ebx, ebx
cmp dword [0x479470], ebx
push esi
push edi
jne 0x412bd2
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
je 0x412c0d
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
or eax, eax
mov dword [0x479470], eax
je 0x412c0d
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x479474], eax
call esi
cmp dword [0x4791c4], 2
mov dword [0x479478], eax
jne 0x412bd2
push str.GetUserObjectInformationA
push edi
call esi
or eax, eax
mov dword [0x479480], eax
je 0x412bd2
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x47947c], eax
mov eax, dword [0x47947c]
or eax, eax
je 0x412c17
call eax
or eax, eax
je 0x412bfe
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x479480]
or eax, eax
je 0x412bfe
test byte [ebp - 8], 1
jne 0x412c17
cmp dword [0x4791d0], 4
jb 0x412c11
or byte [ebp + 0x12], 0x20
jmp 0x412c36
sub eax, eax
jmp 0x412c46
or byte [ebp + 0x12], 4
jmp 0x412c36
mov eax, dword [0x479474]
or eax, eax
je 0x412c36
call eax
push eax
pop ebx
or ebx, ebx
je 0x412c36
mov eax, dword [0x479478]
or eax, eax
je 0x412c36
push ebx
call eax
push eax
pop ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x479470]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x415d05
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.004128c0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.kernel32.dll_VirtualQuery]
or eax, eax
je 0x415d9a
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sbb esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x4791c4]
push eax
pop ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x415d9a
cmp eax, 1
je 0x415db2
push edi
pop ebx
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.kernel32.dll_VirtualQuery]
or eax, eax
je 0x415d9a
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x415d6f
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x415d96
sub eax, eax
inc eax
jmp 0x415dce
cmp esi, ebx
jae 0x415d9e
sub eax, eax
jmp 0x415dce
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov eax, dword [0x4791c4]
jmp 0x415db4
push esi
pop ebx
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.kernel32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x16e21eef
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
mov eax, section..reloc
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x29e85e28
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x408000
Capabilities:
Packed with generic packer

Disassembly:
pushal
call 0x408006
or ebp, 0xffffffff
xor ebx, ebx
pop esi
lea edi, [esi - 0x7006]
push edi
add word [edi], 0
add esi, 0x1b3
jmp 0x40802e
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x408039
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x408028
mov eax, 1
add ebx, ebx
jne 0x40804b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
ja 0x408040
jne 0x40805c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408040
xor ecx, ecx
sub eax, 3
jb 0x4080ca
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4080e6
mov ebp, eax
add ebx, ebx
jne 0x40807b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x408088
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4080ac
inc ecx
add ebx, ebx
jne 0x408098
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
ja 0x40808d
jne 0x4080a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40808d
add ecx, 2
cmp eax, 0xfffff300
adc ecx, 1
lea edx, [edi + eax]
cmp eax, 0xfffffffc
jle 0x4080d0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4080bc
jmp 0x40802e
mov eax, ebp
jmp 0x408070
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4080d0
add edi, ecx
jmp 0x40802e
pop esi
sub edi, dword [edi - 4]
push edi
lea edi, [esi]
mov ecx, 0x91
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4080f6
cmp byte [edi], 1
jne 0x4080f6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4080fb
pop edi
mov eax, dword [edi]
or eax, eax
je 0x408166
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6064]
xchg edx, eax
mov al, byte [edi]
inc edi
or al, al
je 0x408123
push edx
mov ecx, edi
jns 0x408153
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push edx
call dword [esi + 0x6068]
pop edx
mov dword [ebx], eax
add ebx, 4
jmp 0x408140
lea ebx, [esi - 4]
add edi, 4
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x408197
cmp al, 0xef
ja 0x40818a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x40816c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x408179
popal
jmp 0x401240
Function at 0x10001340
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10259ea8], 0
jne 0x10001366
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x3285501
call fcn.1001dc00
add esp, 0xc
mov dword [0x10259ea8], eax
mov eax, dword [0x10259ea8]
pop ebp
ret

Function at 0x10001430
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10259e98], 0
jne 0x10001456
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x53b2070f
call fcn.1001dc00
add esp, 0xc
mov dword [0x10259e98], eax
mov eax, dword [0x10259e98]
pop ebp
ret

Function at 0x10001550
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10259ed0], 0
jne 0x10001576
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xafcab3c4
call fcn.1001dc00
add esp, 0xc
mov dword [0x10259ed0], eax
mov eax, dword [0x10259ed0]
pop ebp
ret

Function at 0x100016a0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10259e9c], 0
jne 0x100016c6
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xf8f45725
call fcn.1001dc00
add esp, 0xc
mov dword [0x10259e9c], eax
mov eax, dword [0x10259e9c]
pop ebp
ret

Function at 0x100016d0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10259ed8], 0
jne 0x100016f6
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xfaba0065
call fcn.1001dc00
add esp, 0xc
mov dword [0x10259ed8], eax
mov eax, dword [0x10259ed8]
pop ebp
ret

Function at 0x10002520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100355e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x13
mov byte [ebp - 0x28], 0xbe
mov byte [ebp - 0x27], 0x96
mov byte [ebp - 0x26], 0x9e
mov byte [ebp - 0x25], 0x1b
mov byte [ebp - 0x24], 0x6e
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x67
mov byte [ebp - 0x20], 0x87
mov byte [ebp - 0x1f], 0xd2
mov byte [ebp - 0x1e], 0xaa
mov byte [ebp - 0x1d], 0x27
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x1b], 0x2e
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0xdd
mov byte [ebp - 0x17], 0xcf
mov byte [ebp - 0x16], 0xfd
mov eax, dword [0x104ab100]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x10259e3c]
cmp eax, dword [edx + 4]
jle 0x100025f9
push 0x10259e3c
call fcn.100264c8
add esp, 4
cmp dword [0x10259e3c], 0xffffffff
jne 0x100025f9
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, 0x10259e28
call fcn.10001880
push 0x100358b0
call fcn.10026437
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x10259e3c
call fcn.10026477
add esp, 4
mov eax, 0x10259e28
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10003090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035661
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xb
mov byte [ebp - 0x20], 0x78
mov byte [ebp - 0x1f], 0x38
mov byte [ebp - 0x1e], 0xb2
mov byte [ebp - 0x1d], 0xa
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x2f
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x43
mov byte [ebp - 0x17], 0x3f
mov byte [ebp - 0x16], 0xc1
mov eax, dword [0x104ab100]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x10259db4]
cmp eax, dword [edx + 4]
jle 0x10003149
push 0x10259db4
call fcn.100264c8
add esp, 4
cmp dword [0x10259db4], 0xffffffff
jne 0x10003149
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x10259da8
call fcn.10001a00
push 0x100358f0
call fcn.10026437
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x10259db4
call fcn.10026477
add esp, 4
mov eax, 0x10259da8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10003300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100356a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x25
mov byte [ebp - 0x3c], 0xef
mov byte [ebp - 0x3b], 0xfd
mov byte [ebp - 0x3a], 0x23
mov byte [ebp - 0x39], 0x19
mov byte [ebp - 0x38], 0x72
mov byte [ebp - 0x37], 0x3b
mov byte [ebp - 0x36], 0x2e
mov byte [ebp - 0x35], 0x2e
mov byte [ebp - 0x34], 0xe2
mov byte [ebp - 0x33], 0xeb
mov byte [ebp - 0x32], 0x36
mov byte [ebp - 0x31], 5
mov byte [ebp - 0x30], 0x75
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x60
mov byte [ebp - 0x2d], 0x69
mov byte [ebp - 0x2c], 0xe6
mov byte [ebp - 0x2b], 0xe5
mov byte [ebp - 0x2a], 0x79
mov byte [ebp - 0x29], 0xa
mov byte [ebp - 0x28], 0x6e
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x2e
mov byte [ebp - 0x25], 0x60
mov byte [ebp - 0x24], 0xe4
mov byte [ebp - 0x23], 0xea
mov byte [ebp - 0x22], 0x38
mov byte [ebp - 0x21], 0x1c
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x75
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x2f
mov byte [ebp - 0x1c], 0xe6
mov byte [ebp - 0x1b], 0xfa
mov byte [ebp - 0x1a], 0x27
mov byte [ebp - 0x19], 0x11
mov byte [ebp - 0x18], 1
mov eax, dword [0x104ab100]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x10259e68]
cmp eax, dword [edx + 4]
jle 0x10003421
push 0x10259e68
call fcn.100264c8
add esp, 4
cmp dword [0x10259e68], 0xffffffff
jne 0x10003421
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, 0x10259e40
call fcn.10001900
push 0x10035910
call fcn.10026437
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x10259e68
call fcn.10026477
add esp, 4
mov eax, 0x10259e40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10003440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100356c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xc
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x1f], 0xbf
mov byte [ebp - 0x1e], 0x77
mov byte [ebp - 0x1d], 0x1e
mov byte [ebp - 0x1c], 0x60
mov byte [ebp - 0x1b], 0x71
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x2f
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x17], 0xbb
mov byte [ebp - 0x16], 0x77
mov byte [ebp - 0x15], 0x69
mov eax, dword [0x104ab100]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x10259ddc]
cmp eax, dword [edx + 4]
jle 0x100034fd
push 0x10259ddc
call fcn.100264c8
add esp, 4
cmp dword [0x10259ddc], 0xffffffff
jne 0x100034fd
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x10259dcc
call fcn.10001a80
push 0x10035920
call fcn.10026437
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x10259ddc
call fcn.10026477
add esp, 4
mov eax, 0x10259dcc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10003510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100356e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x25
mov byte [ebp - 0x3c], 0xcf
mov byte [ebp - 0x3b], 0x79
mov byte [ebp - 0x3a], 0x51
mov byte [ebp - 0x39], 0x19
mov byte [ebp - 0x38], 0x72
mov byte [ebp - 0x37], 0x3b
mov byte [ebp - 0x36], 0x2e
mov byte [ebp - 0x35], 0x2e
mov byte [ebp - 0x34], 0xc2
mov byte [ebp - 0x33], 0x6f
mov byte [ebp - 0x32], 0x44
mov byte [ebp - 0x31], 5
mov byte [ebp - 0x30], 0x75
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x60
mov byte [ebp - 0x2d], 0x69
mov byte [ebp - 0x2c], 0xc6
mov byte [ebp - 0x2b], 0x61
mov byte [ebp - 0x2a], 0xb
mov byte [ebp - 0x29], 0xa
mov byte [ebp - 0x28], 0x6e
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x2e
mov byte [ebp - 0x25], 0x60
mov byte [ebp - 0x24], 0xc4
mov byte [ebp - 0x23], 0x6e
mov byte [ebp - 0x22], 0x4a
mov byte [ebp - 0x21], 0x1c
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x75
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x2f
mov byte [ebp - 0x1c], 0xc6
mov byte [ebp - 0x1b], 0x7e
mov byte [ebp - 0x1a], 0x55
mov byte [ebp - 0x19], 0x11
mov byte [ebp - 0x18], 1
mov eax, dword [0x104ab100]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x10259e94]
cmp eax, dword [edx + 4]
jle 0x10003631
push 0x10259e94
call fcn.100264c8
add esp, 4
cmp dword [0x10259e94], 0xffffffff
jne 0x10003631
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, 0x10259e6c
call fcn.10001900
push 0x10035930
call fcn.10026437
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x10259e94
call fcn.10026477
add esp, 4
mov eax, 0x10259e6c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10003650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035701
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x12
mov byte [ebp - 0x28], 7
mov byte [ebp - 0x27], 0xdd
mov byte [ebp - 0x26], 0x99
mov byte [ebp - 0x25], 0x35
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x66
mov byte [ebp - 0x22], 0x68
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x37
mov byte [ebp - 0x1f], 0xd4
mov byte [ebp - 0x1e], 0x87
mov byte [ebp - 0x1d], 0x34
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x77
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x31
mov byte [ebp - 0x17], 0xb1
mov eax, dword [0x104ab100]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x10259ce8]
cmp eax, dword [edx + 4]
jle 0x10003725
push 0x10259ce8
call fcn.100264c8
add esp, 4
cmp dword [0x10259ce8], 0xffffffff
jne 0x10003725
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, 0x10259cd4
call fcn.10001800
push 0x10035940
call fcn.10026437
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x10259ce8
call fcn.10026477
add esp, 4
mov eax, 0x10259cd4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10003800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035741
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x30
mov byte [ebp - 0x44], 0x6f
mov byte [ebp - 0x43], 0x29
mov byte [ebp - 0x42], 0x85
mov byte [ebp - 0x41], 0x17
mov byte [ebp - 0x40], 0x72
mov byte [ebp - 0x3f], 0x3b
mov byte [ebp - 0x3e], 0x2e
mov byte [ebp - 0x3d], 0x2e
mov byte [ebp - 0x3c], 0x65
mov byte [ebp - 0x3b], 0x31
mov byte [ebp - 0x3a], 0x84
mov byte [ebp - 0x39], 2
mov byte [ebp - 0x38], 0x75
mov byte [ebp - 0x37], 0x73
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x34], 0x70
mov byte [ebp - 0x33], 0x3c
mov byte [ebp - 0x32], 0x85
mov byte [ebp - 0x31], 2
mov byte [ebp - 0x30], 0x73
mov byte [ebp - 0x2f], 0x2f
mov byte [ebp - 0x2e], 0x62
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], 0x6a
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x95
mov byte [ebp - 0x29], 6
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x60
mov byte [ebp - 0x26], 0x2e
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x74
mov byte [ebp - 0x23], 0x38
mov byte [ebp - 0x22], 0x83
mov byte [ebp - 0x21], 6
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x62
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x29
mov byte [ebp - 0x1a], 0xdf
mov byte [ebp - 0x19], 6
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x79
mov byte [ebp - 0x15], 1
mov eax, dword [0x104ab100]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x10259d20]
cmp eax, dword [edx + 4]
jle 0x1000394d
push 0x10259d20
call fcn.100264c8
add esp, 4
cmp dword [0x10259d20], 0xffffffff
jne 0x1000394d
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push ecx
mov ecx, 0x10259cec
call fcn.10001980
push 0x10035960
call fcn.10026437
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x10259d20
call fcn.10026477
add esp, 4
mov eax, 0x10259cec
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10003a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035781
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x30
mov byte [ebp - 0x44], 0x2d
mov byte [ebp - 0x43], 0xc5
mov byte [ebp - 0x42], 0x85
mov byte [ebp - 0x41], 0x17
mov byte [ebp - 0x40], 0x72
mov byte [ebp - 0x3f], 0x3b
mov byte [ebp - 0x3e], 0x2e
mov byte [ebp - 0x3d], 0x2e
mov byte [ebp - 0x3c], 0x27
mov byte [ebp - 0x3b], 0xdd
mov byte [ebp - 0x3a], 0x84
mov byte [ebp - 0x39], 2
mov byte [ebp - 0x38], 0x75
mov byte [ebp - 0x37], 0x73
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x34], 0x32
mov byte [ebp - 0x33], 0xd0
mov byte [ebp - 0x32], 0x85
mov byte [ebp - 0x31], 2
mov byte [ebp - 0x30], 0x73
mov byte [ebp - 0x2f], 0x2f
mov byte [ebp - 0x2e], 0x62
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], 0x28
mov byte [ebp - 0x2b], 0x9e
mov byte [ebp - 0x2a], 0x95
mov byte [ebp - 0x29], 6
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x60
mov byte [ebp - 0x26], 0x2e
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x36
mov byte [ebp - 0x23], 0xd4
mov byte [ebp - 0x22], 0x83
mov byte [ebp - 0x21], 6
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x62
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x2b
mov byte [ebp - 0x1b], 0xc5
mov byte [ebp - 0x1a], 0xdf
mov byte [ebp - 0x19], 6
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x79
mov byte [ebp - 0x15], 1
mov eax, dword [0x104ab100]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x10259d58]
cmp eax, dword [edx + 4]
jle 0x10003b7d
push 0x10259d58
call fcn.100264c8
add esp, 4
cmp dword [0x10259d58], 0xffffffff
jne 0x10003b7d
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push ecx
mov ecx, 0x10259d24
call fcn.10001980
push 0x10035980
call fcn.10026437
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x10259d58
call fcn.10026477
add esp, 4
mov eax, 0x10259d24
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret