joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdf8d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xdf8d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xdf8d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xdf8d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xdf8d94
push eax
push esi
call fcn.00dfb20b
add esp, 8
pop esi
ret 0x10

Function at 0xdf8da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xdf8e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xdf8e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xe11320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00dfadff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xdf8dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xdf8e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xdf8ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xdf8eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xe11320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00dfadff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xdf8eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xdf8e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xdf9000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xdf9131
push esi
call fcn.00dfc145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00deb080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xdf9131
push 0
push ebp
call fcn.00deb3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00deb260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xdf908b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00deb2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xdf9121
push 0xe11918
push edi
call fcn.00dfa3f0
push eax
push ebx
push esi
call fcn.00df8f60
push 0xe118f8
push edi
call fcn.00dfa3f0
push eax
push ebx
push esi
call fcn.00df8f60
push 0xe118d8
push edi
call fcn.00dfa3f0
push eax
push ebx
push esi
call fcn.00df8f60
push 0xe118c0
push edi
call fcn.00dfa3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00df8f60
push 0xe118a0
push edi
call fcn.00dfa3f0
push eax
push ebx
push esi
call fcn.00df8f60
push 0xe11888
push edi
call fcn.00dfa3f0
push eax
push ebx
push esi
call fcn.00df8f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xdfa1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00dfa140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00dfa140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00dfa140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00dfa140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xdfabfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xdfac50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xe0c87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xdfac43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xdfac52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b01c]
jne 0x40100a
repz ret
jmp fcn.00401ab1

Function at 0x404c33
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004026b7
and dword [ebp - 0x14], 0
cmp dword [0x42da8c], 0
mov dword [ebp - 0x18], eax
jne 0x404ce6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404d8e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404d8e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42da8c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42da90], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42da94], eax
call edi
push eax
call esi
mov dword [0x42da9c], eax
test eax, eax
je 0x404ce6
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42da98], eax
mov eax, dword [0x42da98]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404d3f
cmp dword [0x42da9c], ecx
je 0x404d3f
push eax
call esi
push dword [0x42da9c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404d3f
test ebx, ebx
je 0x404d3f
call edi
test eax, eax
je 0x404d36
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404d36
test byte [ebp - 8], 1
jne 0x404d3f
or dword [ebp + 0x10], 0x200000
jmp 0x404d72
mov eax, dword [0x42da90]
cmp eax, dword [ebp - 0x18]
je 0x404d72
push eax
call esi
test eax, eax
je 0x404d72
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404d72
mov eax, dword [0x42da94]
cmp eax, dword [ebp - 0x18]
je 0x404d72
push eax
call esi
test eax, eax
je 0x404d72
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42da8c]
call esi
test eax, eax
je 0x404d8e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404d90
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x10008080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100080d9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100080d9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x100080ca
cmp esi, edx
jae 0x100080d9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x100080b8
cmp esi, edx
jae 0x100080d9
cmp word [esi], 0
je 0x100080d9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10009380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1008c180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1008d778
mov dword [ebp - 0x10c], 0x740068
lea esi, [ebp - 0x10c]
mov dword [ebp - 0x108], 0x700074
push edi
mov dword [ebp - 0x104], 0x2f003a
mov edx, 0x84
mov dword [ebp - 0x100], 0x73002f
sub esi, eax
mov dword [ebp - 0xfc], 0x2e0073
mov dword [ebp - 0xf8], 0x610068
mov dword [ebp - 0xf4], 0x6f006c
mov dword [ebp - 0xf0], 0x610070
mov dword [ebp - 0xec], 0x650070
mov dword [ebp - 0xe8], 0x2e0072
mov dword [ebp - 0xe4], 0x6e0063
mov dword [ebp - 0xe0], 0x64002f
mov dword [ebp - 0xdc], 0x74006f
mov dword [ebp - 0xd8], 0x70003f
mov dword [ebp - 0xd4], 0x790074
mov dword [ebp - 0xd0], 0x650070
mov dword [ebp - 0xcc], 0x68003d
mov dword [ebp - 0xc8], 0x6c0061
mov dword [ebp - 0xc4], 0x77006f
mov dword [ebp - 0xc0], 0x260070
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop
lea ecx, [edx + 0x7fffff7a]
test ecx, ecx
je 0x100095fe
movzx ecx, word [esi + eax]
test cx, cx
je 0x100095fe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100095e0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002735f
mov esp, ebp
pop ebp
ret
Function at 0x100097e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x1008c180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1008d528
mov dword [ebp - 0xf8], 0x740068
lea esi, [ebp - 0xf8]
mov dword [ebp - 0xf4], 0x700074
push edi
mov dword [ebp - 0xf0], 0x2f003a
mov edx, 0x7a
mov dword [ebp - 0xec], 0x73002f
sub esi, eax
mov dword [ebp - 0xe8], 0x2e0073
mov dword [ebp - 0xe4], 0x680073
mov dword [ebp - 0xe0], 0x6e0061
mov dword [ebp - 0xdc], 0x750068
mov dword [ebp - 0xd8], 0x650074
mov dword [ebp - 0xd4], 0x680063
mov dword [ebp - 0xd0], 0x63002e
mov dword [ebp - 0xcc], 0x2f006e
mov dword [ebp - 0xc8], 0x690062
mov dword [ebp - 0xc4], 0x68007a
mov dword [ebp - 0xc0], 0x3f0069
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop dword [eax]
lea ecx, [edx + 0x7fffff84]
test ecx, ecx
je 0x10009a2e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009a2e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009a10
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002735f
mov esp, ebp
pop ebp
ret
Function at 0x10009a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x1008c180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1008db28
mov dword [ebp - 0x124], 0x740068
lea esi, [ebp - 0x124]
mov dword [ebp - 0x120], 0x700074
push edi
mov dword [ebp - 0x11c], 0x2f003a
mov edx, 0x90
mov dword [ebp - 0x118], 0x73002f
sub esi, eax
mov dword [ebp - 0x114], 0x2e0073
mov dword [ebp - 0x110], 0x6c0062
mov dword [ebp - 0x10c], 0x650075
mov dword [ebp - 0x108], 0x680077
mov dword [ebp - 0x104], 0x6c0061
mov dword [ebp - 0x100], 0x630065
mov dword [ebp - 0xfc], 0x610068
mov dword [ebp - 0xf8], 0x2e0074
mov dword [ebp - 0xf4], 0x6f0063
mov dword [ebp - 0xf0], 0x2f006d
mov dword [ebp - 0xec], 0x6f0064
mov dword [ebp - 0xe8], 0x3f0074
mov dword [ebp - 0xe4], 0x740070
mov dword [ebp - 0xe0], 0x700079
mov dword [ebp - 0xdc], 0x3d0065
mov dword [ebp - 0xd8], 0x720074
mov dword [ebp - 0xd4], 0x630061
mov dword [ebp - 0xd0], 0x6c0065
mov dword [ebp - 0xcc], 0x730065
mov dword [ebp - 0xc8], 0x630073
mov dword [ebp - 0xc4], 0x610068
mov dword [ebp - 0xc0], 0x260074
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop dword [eax + eax]
lea ecx, [edx + 0x7fffff6e]
test ecx, ecx
je 0x10009d0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009d0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009cf0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002735f
mov esp, ebp
pop ebp
ret
Function at 0x10009ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1008c180]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10c], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x10c]
mov eax, 0x1008dc70
mov dword [ebp - 0x108], 0x700074
push edi
mov dword [ebp - 0x104], 0x2f003a
mov edx, 0x83
mov dword [ebp - 0x100], 0x73002f
sub esi, eax
mov dword [ebp - 0xfc], 0x2e0073
mov dword [ebp - 0xf8], 0x630070
mov dword [ebp - 0xf4], 0x69006a
mov dword [ebp - 0xf0], 0x6d0061
mov dword [ebp - 0xec], 0x2e0069
mov dword [ebp - 0xe8], 0x6e0063
mov dword [ebp - 0xe4], 0x64002f
mov dword [ebp - 0xe0], 0x74006f
mov dword [ebp - 0xdc], 0x70003f
mov dword [ebp - 0xd8], 0x790074
mov dword [ebp - 0xd4], 0x650070
mov dword [ebp - 0xd0], 0x70003d
mov dword [ebp - 0xcc], 0x6a0063
mov dword [ebp - 0xc8], 0x610069
mov dword [ebp - 0xc4], 0x69006d
mov dword [ebp - 0xc0], 0x700026
mov dword [ebp - 0xbc], 0x640069
mov dword [ebp - 0xb8], 0x7b003d
mov dword [ebp - 0xb4], 0x690070
mov dword [ebp - 0xb0], 0x7d0064
mov dword [ebp - 0xac], 0x6d0026
mov dword [ebp - 0xa8], 0x640069
mov dword [ebp - 0xa4], 0x7b003d
mov dword [ebp - 0xa0], 0x69006d
mov dword [ebp - 0x9c], 0x7d0064
mov dword [ebp - 0x98], 0x6d0026
mov dword [ebp - 0x94], 0x640069
mov dword [ebp - 0x90], 0x3d0032
mov dword [ebp - 0x8c], 0x6d007b
mov dword [ebp - 0x88], 0x640069
mov dword [ebp - 0x84], 0x7d0032
mov dword [ebp - 0x80], 0x610026
mov dword [ebp - 0x7c], 0x700070
mov dword [ebp - 0x78], 0x650076
mov dword [ebp - 0x74], 0x3d0072
mov dword [ebp - 0x70], 0x61007b
mov dword [ebp - 0x6c], 0x700070
mov dword [ebp - 0x68], 0x650076
mov dword [ebp - 0x64], 0x7d0072
mov dword [ebp - 0x60], 0x6d0026
mov dword [ebp - 0x5c], 0x64006f
mov dword [ebp - 0x58], 0x650076
mov dword [ebp - 0x54], 0x3d0072
mov dword [ebp - 0x50], 0x6d007b
mov dword [ebp - 0x4c], 0x64006f
mov dword [ebp - 0x48], 0x650076
mov dword [ebp - 0x44], 0x7d0072
mov dword [ebp - 0x40], 0x740026
mov dword [ebp - 0x3c], 0x700079
mov dword [ebp - 0x38], 0x3d0065
mov dword [ebp - 0x34], 0x74007b
mov dword [ebp - 0x30], 0x700079
mov dword [ebp - 0x2c], 0x7d0065
mov dword [ebp - 0x28], 0x610026
mov dword [ebp - 0x24], 0x740063
mov dword [ebp - 0x20], 0x6f0069
mov dword [ebp - 0x1c], 0x3d006e
mov dword [ebp - 0x18], 0x61007b
mov dword [ebp - 0x14], 0x740063
mov dword [ebp - 0x10], 0x6f0069
mov dword [ebp - 0xc], 0x7d006e
nop
lea ecx, [edx + 0x7fffff7b]
test ecx, ecx
je 0x1000a16e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000a16e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000a150
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002735f
mov esp, ebp
pop ebp
ret
Function at 0x1000a190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1008c180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1008d9e0
mov dword [ebp - 0x118], 0x740068
lea esi, [ebp - 0x118]
mov dword [ebp - 0x114], 0x700074
push edi
mov dword [ebp - 0x110], 0x2f003a
mov edx, 0x8a
mov dword [ebp - 0x10c], 0x73002f
sub esi, eax
mov dword [ebp - 0x108], 0x2e0073
mov dword [ebp - 0x104], 0x680077
mov dword [ebp - 0x100], 0x6c0061
mov dword [ebp - 0xfc], 0x700065
mov dword [ebp - 0xf8], 0x6f0072
mov dword [ebp - 0xf4], 0x650074
mov dword [ebp - 0xf0], 0x740063
mov dword [ebp - 0xec], 0x63002e
mov dword [ebp - 0xe8], 0x2f006e
mov dword [ebp - 0xe4], 0x6f0064
mov dword [ebp - 0xe0], 0x3f0074
mov dword [ebp - 0xdc], 0x740070
mov dword [ebp - 0xd8], 0x700079
mov dword [ebp - 0xd4], 0x3d0065
mov dword [ebp - 0xd0], 0x6c0062
mov dword [ebp - 0xcc], 0x650075
mov dword [ebp - 0xc8], 0x680077
mov dword [ebp - 0xc4], 0x6c0061
mov dword [ebp - 0xc0], 0x260065
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop dword [eax]
lea ecx, [edx + 0x7fffff74]
test ecx, ecx
je 0x1000a42e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000a42e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000a410
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002735f
mov esp, ebp
pop ebp
ret