joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e54f7
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10121004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [edi + 0x18], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov dword [ebp - 4], 0
mov byte [edi + 0x1c], 0
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1004eb00
mov dword [esi], eax
lea esi, [edi + 0x44]
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1004eb00
mov dword [esi], eax
mov dword [edi + 0x4c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0xf
mov byte [edi + 0x50], 0
lea ecx, [edi + 0x68]
mov byte [ebp - 4], 4
mov dword [ecx + 0x10], 0
push 0
mov dword [ecx + 0x14], 0xf
push 0x100f5d3e
mov byte [ecx], 0
call fcn.1000cf70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10033da0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, dword [eax]
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10033db0
sub ecx, edx
xor edi, edi
push ebx
xor ebx, ebx
mov eax, 0x811c9dc5
lea edx, [ecx + esi]
cmp esi, edx
cmova ecx, ebx
pop ebx
test ecx, ecx
je 0x10033de3
movzx edx, byte [esi]
lea esi, [esi + 1]
xor edx, eax
inc edi
imul eax, edx, 0x1000193
cmp edi, ecx
jne 0x10033dd0
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.100c2114
imul eax, eax, 0xb14
add esp, 8
imul ecx, edx, 0x41a7
pop edi
pop esi
sub ecx, eax
lea eax, [ecx + 0x7fffffff]
js 0x10033e10
mov eax, ecx
pop ebp
ret 4
Function at 0x10077f80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ea04a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10121004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10077fed
push 0x38
call fcn.1001b02e
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x10077fda
mov ecx, eax
call fcn.1007aac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x40], 0
je 0x10078001
push 0x38
push 0x1012345c
mov ecx, edi
call fcn.10025770
push 0x38
mov ecx, edi
call fcn.100254e0
mov esi, eax
mov dword [ebp + 8], esi
mov dword [esi], vtable.google::protobuf::FieldDescriptorProto.0
mov dword [ebp - 4], 1
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov eax, dword [0x1012fa8c]
mov byte [ebp - 4], 2
cmp eax, 2
je 0x10078063
mov dword [ebp - 0x18], vtable.google::protobuf::internal::FunctionClosure0.0
mov dword [ebp - 0x14], 0x10082d80
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
push 0x1012fa8c
call fcn.10025790
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.10022f80
mov dword [esi + 0xc], 0
xorps xmm0, xmm0
mov dword [esi + 0x10], 0x1012f2b0
mov eax, esi
mov dword [esi + 0x14], 0x1012f2b0
mov dword [esi + 0x18], 0x1012f2b0
mov dword [esi + 0x1c], 0x1012f2b0
mov dword [esi + 0x20], 0x1012f2b0
movq qword [esi + 0x24], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10079040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ea3a5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10121004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
jne 0x100790ad
push 0x48
call fcn.1001b02e
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x1007909a
mov ecx, eax
call fcn.1007ba70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x40], 0
je 0x100790c1
push 0x48
push 0x10124528
mov ecx, edi
call fcn.10025770
push 0x48
mov ecx, edi
call fcn.100254e0
mov esi, eax
mov dword [ebp + 8], esi
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
mov dword [ebp - 4], 1
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov eax, dword [0x1012facc]
mov byte [ebp - 4], 3
cmp eax, 2
je 0x1007913b
mov dword [ebp - 0x18], vtable.google::protobuf::internal::FunctionClosure0.0
mov dword [ebp - 0x14], 0x100839a0
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
push 0x1012facc
call fcn.10025790
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.10022f80
xorps xmm0, xmm0
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x1012f2b0
mov eax, esi
mov dword [esi + 0x24], 0x1012f2b0
mov dword [esi + 0x28], 0x1012f2b0
movups xmmword [esi + 0x30], xmm0
movq qword [esi + 0x40], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1007a9e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ea50b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x10121004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi], vtable.google::protobuf::FieldDescriptorProto.0
mov dword [ebp - 4], 0
mov dword [esi + 4], eax
mov dword [esi + 8], 0
mov eax, dword [0x1012fa8c]
mov byte [ebp - 4], 1
cmp eax, 2
je 0x1007aa62
mov dword [ebp - 0x1c], vtable.google::protobuf::internal::FunctionClosure0.0
mov dword [ebp - 0x18], 0x10082d80
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 0x1012fa8c
call fcn.10025790
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.10022f80
mov dword [esi + 0xc], 0
xorps xmm0, xmm0
mov dword [esi + 0x10], 0x1012f2b0
mov eax, esi
mov dword [esi + 0x14], 0x1012f2b0
mov dword [esi + 0x18], 0x1012f2b0
mov dword [esi + 0x1c], 0x1012f2b0
mov dword [esi + 0x20], 0x1012f2b0
movq qword [esi + 0x24], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1007f8c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov edi, dword [esi + 0x14]
test edi, edi
jle 0x1007f902
mov edx, dword [esi + 0x1c]
xor ecx, ecx
nop dword [eax]
mov eax, dword [edx + ecx*4 + 4]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x1007f8f3
mov eax, dword [eax]
inc ecx
mov byte [eax], 0
cmp ecx, edi
jl 0x1007f8e0
mov dword [esi + 0x14], 0
push ebx
mov ebx, dword [esi + 0x24]
test ebx, ebx
jle 0x1007f929
mov eax, dword [esi + 0x2c]
xor edi, edi
mov esi, eax
mov ecx, dword [esi + edi*4 + 4]
call fcn.1007f0a0
inc edi
cmp edi, ebx
jl 0x1007f911
mov esi, dword [ebp - 8]
mov dword [esi + 0x24], 0
mov ebx, dword [esi + 0x34]
test ebx, ebx
jle 0x1007f958
mov eax, dword [esi + 0x3c]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop word [eax + eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.1007f420
inc edi
cmp edi, ebx
jl 0x1007f940
mov esi, dword [ebp - 8]
mov dword [esi + 0x34], 0
mov ebx, dword [esi + 0x44]
test ebx, ebx
jle 0x1007f988
mov eax, dword [esi + 0x4c]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.1007ff90
inc edi
cmp edi, ebx
jl 0x1007f970
mov esi, dword [ebp - 8]
mov dword [esi + 0x44], 0
mov ebx, dword [esi + 0x54]
test ebx, ebx
jle 0x1007f9b8
mov eax, dword [esi + 0x5c]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.1007f730
inc edi
cmp edi, ebx
jl 0x1007f9a0
mov esi, dword [ebp - 8]
mov dword [esi + 0x54], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x6c], 0
mov ebx, dword [esi + 8]
test bl, 0x1f
je 0x1007fa58
test bl, 1
je 0x1007f9f3
mov eax, dword [esi + 0x78]
cmp eax, 0x1012f2b0
je 0x1007f9f3
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x1007f9f0
mov eax, dword [eax]
mov byte [eax], 0
test bl, 2
je 0x1007fa14
mov eax, dword [esi + 0x7c]
cmp eax, 0x1012f2b0
je 0x1007fa14
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x1007fa11
mov eax, dword [eax]
mov byte [eax], 0
test bl, 4
je 0x1007fa38
mov eax, dword [esi + 0x80]
cmp eax, 0x1012f2b0
je 0x1007fa38
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x1007fa35
mov eax, dword [eax]
mov byte [eax], 0
test bl, 8
je 0x1007fa48
mov ecx, dword [esi + 0x84]
call fcn.1007fae0
test bl, 0x10
je 0x1007fa58
mov ecx, dword [esi + 0x88]
call fcn.10080030
mov dword [esi + 8], 0
test byte [esi + 4], 1
pop ebx
je 0x1007fa76
mov ecx, dword [esi + 4]
and ecx, 0xfffffffe
cmp dword [ecx], 0
je 0x1007fa76
call fcn.1002b7f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1009c830
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e57f0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10121004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.1006b410
dec eax
cmp eax, 9
ja case.default.0x1009c86b
jmp dword [eax*4 + 0x1009c9cc]
push 0x32c
push str.D:_sourcecode460SoftwareGasteprotobuf_cpp_3.5.1protobuf_3.5.1_srcgoogle_protobuf_map_field.h
push 3
lea ecx, [ebp - 0x34]
call fcn.10022ec0
push str.Unsupported
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.100232e0
push eax
lea ecx, [ebp - 0x59]
call fcn.100230d0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.10023000
push 0x33b
push str.D:_sourcecode460SoftwareGasteprotobuf_cpp_3.5.1protobuf_3.5.1_srcgoogle_protobuf_map_field.h
push 3
lea ecx, [ebp - 0x58]
call fcn.10022ec0
push str.Cant_get_here.
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.100232e0
push eax
lea ecx, [ebp - 0x5a]
call fcn.100230d0
lea ecx, [ebp - 0x58]
call fcn.10023000
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b06c
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.10067340
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x1009c91a
mov esi, dword [esi]
mov edx, esi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x1009c920
sub edx, ecx
xor ebx, ebx
xor edi, edi
mov eax, 0x811c9dc5
lea ecx, [edx + esi]
cmp esi, ecx
cmova edx, ebx
test edx, edx
je 0x1009c953
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
cmp edi, edx
jne 0x1009c940
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.100c2114
imul edx, edx, 0x41a7
add esp, 8
imul ecx, eax, 0xb14
sub edx, ecx
jns 0x1009c97c
add edx, 0x7fffffff
mov eax, edx
jmp 0x1009c8eb
mov ecx, esi
call fcn.10067050
xor eax, 0xdeadbeef
jmp 0x1009c953
mov ecx, esi
call fcn.10066e60
xor eax, 0xdeadbeef
jmp 0x1009c953
mov ecx, esi
call fcn.10067710
xor eax, 0xdeadbeef
jmp 0x1009c953
mov ecx, esi
call fcn.10067520
xor eax, 0xdeadbeef
jmp 0x1009c953
mov ecx, esi
call fcn.10066c70
movzx eax, al
xor eax, 0xdeadbeef
jmp 0x1009c953
Function at 0x100a2760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec6e8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10121004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0x690059
mov dword [ebp - 0x64], 0x67006e
mov dword [ebp - 0x60], 0x610079
mov dword [ebp - 0x5c], 0x43006e
mov dword [ebp - 0x58], 0x6e006f
mov dword [ebp - 0x54], 0x690066
mov dword [ebp - 0x50], 0x430067
mov dword [ebp - 0x4c], 0x6e0065
mov dword [ebp - 0x48], 0x650074
mov dword [ebp - 0x44], 0x530072
mov dword [ebp - 0x40], 0x750074
mov dword [ebp - 0x3c], 0x500062
mov dword [ebp - 0x38], 0x650072
mov dword [ebp - 0x34], 0x690066
mov dword [ebp - 0x30], 0x570078
mov dword [ebp - 0x2c], 0x64006e
mov dword [ebp - 0x28], 0x6c0043
mov dword [ebp - 0x24], 0x730061
mov dword [ebp - 0x20], 0x4e0073
mov dword [ebp - 0x1c], 0x6d0061
mov dword [ebp - 0x18], 0x5f0065
mov word [ebp - 0x14], ax
call fcn.10011050
mov ecx, eax
test ecx, ecx
je 0x100a289b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100104a0
test al, al
jne 0x100a287b
lea ecx, [ebp - 0x68]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a2860
sub ecx, edx
lea eax, [ebp - 0x68]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10013190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b06c
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10010410
int3
Function at 0x100a28b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec71b
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x10121004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xb8], 0x740068
mov dword [ebp - 0xb4], 0x700074
mov dword [ebp - 0xb0], 0x2f003a
mov dword [ebp - 0xac], 0x63002f
mov dword [ebp - 0xa8], 0x6e0064
mov dword [ebp - 0xa4], 0x68002d
mov dword [ebp - 0xa0], 0x2d0073
mov dword [ebp - 0x9c], 0x690066
mov dword [ebp - 0x98], 0x65006c
mov dword [ebp - 0x94], 0x77002e
mov dword [ebp - 0x90], 0x610068
mov dword [ebp - 0x8c], 0x65006c
mov dword [ebp - 0x88], 0x720070
mov dword [ebp - 0x84], 0x74006f
mov dword [ebp - 0x80], 0x630065
mov dword [ebp - 0x7c], 0x2e0074
mov dword [ebp - 0x78], 0x6e0063
mov dword [ebp - 0x74], 0x63002f
mov dword [ebp - 0x70], 0x73006d
mov dword [ebp - 0x6c], 0x70002f
mov dword [ebp - 0x68], 0x6f0072
mov dword [ebp - 0x64], 0x65006a
mov dword [ebp - 0x60], 0x740063
mov dword [ebp - 0x5c], 0x31005f
mov dword [ebp - 0x58], 0x350031
mov dword [ebp - 0x54], 0x63002f
mov dword [ebp - 0x50], 0x670066
mov dword [ebp - 0x4c], 0x63005f
mov dword [ebp - 0x48], 0x6e0065
mov dword [ebp - 0x44], 0x650074
mov dword [ebp - 0x40], 0x2f0072
mov dword [ebp - 0x3c], 0x6c0062
mov dword [ebp - 0x38], 0x650075
mov dword [ebp - 0x34], 0x680077
mov dword [ebp - 0x30], 0x6c0061
mov dword [ebp - 0x2c], 0x5f0065
mov dword [ebp - 0x28], 0x6f006d
mov dword [ebp - 0x24], 0x5f0064
mov dword [ebp - 0x20], 0x69006c
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x6a002e
mov dword [ebp - 0x14], 0x73
call fcn.10011050
mov ecx, eax
test ecx, ecx
je 0x100a2aae
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100104a0
test al, al
jne 0x100a2a8e
lea ecx, [ebp - 0xb8]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a2a70
sub ecx, edx
lea eax, [ebp - 0xb8]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10013190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b06c
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10010410
int3
Function at 0x100a2ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec758
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x10121004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], 0x740068
mov dword [ebp - 0x68], 0x700074
mov dword [ebp - 0x64], 0x2f003a
mov dword [ebp - 0x60], 0x6c002f
mov dword [ebp - 0x5c], 0x70002e
mov dword [ebp - 0x58], 0x620075
mov dword [ebp - 0x54], 0x69006c
mov dword [ebp - 0x50], 0x2e0063
mov dword [ebp - 0x4c], 0x6f0067
mov dword [ebp - 0x48], 0x64006f
mov dword [ebp - 0x44], 0x650073
mov dword [ebp - 0x40], 0x700065
mov dword [ebp - 0x3c], 0x630069
mov dword [ebp - 0x38], 0x63002e
mov dword [ebp - 0x34], 0x6d006f
mov dword [ebp - 0x30], 0x70002f
mov dword [ebp - 0x2c], 0x2f0063
mov dword [ebp - 0x28], 0x700075
mov dword [ebp - 0x24], 0x610064
mov dword [ebp - 0x20], 0x610074
mov dword [ebp - 0x1c], 0x64002f
mov dword [ebp - 0x18], 0x6d0075
mov dword [ebp - 0x14], 0x70
call fcn.10011050
mov ecx, eax
test ecx, ecx
je 0x100a2bfe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100104a0
test al, al
jne 0x100a2bde
lea ecx, [ebp - 0x6c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a2bc3
sub ecx, edx
lea eax, [ebp - 0x6c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10013190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b06c
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10010410
int3
Function at 0x100a30c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec7c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10121004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x690062
mov dword [ebp - 0x24], 0x640072
mov dword [ebp - 0x20], 0x700077
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
mov word [ebp - 0x14], ax
call fcn.10011050
mov ecx, eax
test ecx, ecx
je 0x100a3189
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100104a0
test al, al
jne 0x100a316b
lea ecx, [ebp - 0x28]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a3150
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10013190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b06c
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10010410
int3

Function at 0x100a31a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec6e8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10121004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0x740068
mov dword [ebp - 0x64], 0x700074
mov dword [ebp - 0x60], 0x2f003a
mov dword [ebp - 0x5c], 0x6c002f
mov dword [ebp - 0x58], 0x70002e
mov dword [ebp - 0x54], 0x620075
mov dword [ebp - 0x50], 0x69006c
mov dword [ebp - 0x4c], 0x2e0063
mov dword [ebp - 0x48], 0x610068
mov dword [ebp - 0x44], 0x6f006c
mov dword [ebp - 0x40], 0x610070
mov dword [ebp - 0x3c], 0x650070
mov dword [ebp - 0x38], 0x2e0072
mov dword [ebp - 0x34], 0x6e0063
mov dword [ebp - 0x30], 0x70002f
mov dword [ebp - 0x2c], 0x2f0063
mov dword [ebp - 0x28], 0x700075
mov dword [ebp - 0x24], 0x610064
mov dword [ebp - 0x20], 0x610074
mov dword [ebp - 0x1c], 0x64002f
mov dword [ebp - 0x18], 0x6d0075
mov dword [ebp - 0x14], 0x70
call fcn.10011050
mov ecx, eax
test ecx, ecx
je 0x100a32db
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100104a0
test al, al
jne 0x100a32bb
lea ecx, [ebp - 0x68]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a32a0
sub ecx, edx
lea eax, [ebp - 0x68]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10013190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b06c
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10010410
int3
Function at 0x100a32f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec7f8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x10121004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], 0x740068
mov dword [ebp - 0x70], 0x700074
mov dword [ebp - 0x6c], 0x2f003a
mov dword [ebp - 0x68], 0x69002f
mov dword [ebp - 0x64], 0x74006e
mov dword [ebp - 0x60], 0x2d0066
mov dword [ebp - 0x5c], 0x630070
mov dword [ebp - 0x58], 0x70002e
mov dword [ebp - 0x54], 0x6a0063
mov dword [ebp - 0x50], 0x610069
mov dword [ebp - 0x4c], 0x69006d
mov dword [ebp - 0x48], 0x63002e
mov dword [ebp - 0x44], 0x2f006e
mov dword [ebp - 0x40], 0x660063
mov dword [ebp - 0x3c], 0x2f0067
mov dword [ebp - 0x38], 0x630070
mov dword [ebp - 0x34], 0x69006a
mov dword [ebp - 0x30], 0x6d0061
mov dword [ebp - 0x2c], 0x5f0069
mov dword [ebp - 0x28], 0x650064
mov dword [ebp - 0x24], 0x610074
mov dword [ebp - 0x20], 0x6c0069
mov dword [ebp - 0x1c], 0x70002e
mov dword [ebp - 0x18], 0x700068
mov word [ebp - 0x14], ax
call fcn.10011050
mov ecx, eax
test ecx, ecx
je 0x100a343b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100104a0
test al, al
jne 0x100a341b
lea ecx, [ebp - 0x74]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a3400
sub ecx, edx
lea eax, [ebp - 0x74]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10013190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b06c
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10010410
int3