joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417dc0
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x33
mov eax, 0x17961f92
xchg edx, eax
pop ds
xchg esi, eax
pop ss
push ebp
aas
test dword [edx + ecx*8], 0x23e88f1b
push ds
jb 0x417e22
test al, 0xa
mov ch, 0xa1
xchg ebx, eax
cmp ch, byte [esi + 0x305e4bbe]
add ch, al
or esi, 0x9897128a
dec ebx
pop esi
xor byte [eax], al
lds eax, [ecx - 0x68ed7532]
cwde
sbb al, 0x48
pop ecx
jge 0x417de9
mov dl, al
pop ss
movsd dword es:[edi], dword [esi]
and al, 0x7a
fiadd word [eax + edx*2 + 0x546c8a2d]
push es
rol dword [eax], 0xf9
in al, 0xe3
pushfd
push 0x4c
jb 0x417e42
mov bh, byte [esi - 0x44]
jle 0x417dae
jp 0x417df0
add ecx, dword [ecx + 0x6e]
insb byte es:[edi], dx
push 0xffffffffffffffd0
outsd dx, dword [esi]
test al, 4
xor dword [esi + 0x57], 0xb1201c65
mov al, 0x95
cmp al, 0x6b
mov al, 0x4c
mov cs, word [eax + esi*2]
cld
push esi
je 0x417dc6
insb byte es:[edi], dx
cmp byte [bx + si], al
pop es
les edi, [0x13561f3f]
je 0x417dab
inc esi
xchg edi, eax
push 0xffffffffffffffc4
push edx
fcom dword [esp + ebp*2]
inc esi
imul esp, esi, 0x639516ac
sbb ah, dl
adc cl, byte cs:[ebp + eax*2 + 0x5e]
scasb al, byte es:[edi]
cdq
lodsb al, byte [esi]
mov ebx, 0x5e24776d
and al, 0x71
pop ebp
sub dword [edx], edx
outsd dx, dword [esi]
in al, dx
dec ebp
jge 0x417e72
cmp al, 0x36
pop edx
push edx
sbb al, 0x69
sbb byte [eax + 0x36d6441], dl
or al, 0x1b
cli
test eax, 0xa6aa6a69
push es
jae 0x417e76
invalid
mov dword [0xfbb88e10], eax
xor eax, 0x83d77546
pop edx
invalid
or eax, 0x702b3377
or al, 0x56
jo 0x417e84
push esi
sbb al, 0xcd
sub edi, dword [eax - 0x1989e954]
inc edx
lahf
cmp byte [edx], dl
jbe 0x417e64
push edx
jne 0x417ed5
add byte [ecx], ch
invalid
rol dword [edi - 0x1e], 1
and al, 0xf
push esp
movsb byte es:[edi], byte [esi]
loop 0x417ead
mov eax, 0xed62bdf0
xor ah, bh
xlatb
push ds
and al, 0x2c
sub al, 0xf8
clc
lodsd eax, dword [esi]
mov edx, 0x7daf494d
scasd eax, dword es:[edi]
xor dword [0x1ee17ca6], ebx
sbb eax, 0x1ee17ca6
inc ebp
xor al, byte [eax - 0x5f]
jo 0x417f13
push ecx
jge 0x417eae
in al, dx
aam 0x72
fstp qword [eax]
and byte [edx + 0x60], bh
inc esp
xchg ecx, eax
pop esp
daa
xor al, 0x85
sysenter
push ebp
xor al, 0x55
adc dword [ebx], ebp
jle 0x417eb7
inc edx
cmp eax, 0x42baa341
in eax, 0x32
jl 0x417e99
fild dword [esi]
int 0x65
adc ah, dl
xchg bp, ax
int3
fucomp st(4)
jge 0x417f6b
jg 0x417eac
jmp 0x5a8b6528
pop ebp
imul esp, dword [0xe855edb1], 0x65
dec esi
pop esp
pop eax
neg byte [0x16647ff5]
mov ebp, 0xb1bc952d
out dx, al
pop eax
mov byte [edx + 0x1c50342b], dh
insb byte es:[edi], dx
xchg ebp, eax
mov esp, 0x8858eeb1
mov dl, 0x2b
xor al, 0x50
sbb al, 0x6c
jl 0x417f7e
wait
outsb dx, byte [esi]
outsb dx, byte [esi]
cmp esi, ebx
invalid
Function at 0x43315e
Capabilities:
Encode data using xor

Disassembly:
add al, 0
add byte [eax], al
call 0x83bb474
cmp dword [eax], eax
mov eax, 7
or eax, 0x3907f883
add byte [eax + 7], bh
mov ecx, eax
add byte [eax], al
add byte [eax], al
add bl, dl
loop 0x43317d
add ch, ah
shl eax, 0xd
add ax, 0x30
add byte [ecx - 0x48f017bd], cl
outsb dx, byte [esi]
add byte [edi], cl
mov bh, 0xc7
mov ecx, eax
shl ecx, 0
add byte [ecx + ecx*2], cl
add ecx, 0xc6ef
and ecx, 0xffffff00
add byte [eax], al
xor byte [ecx - 0x518ccf07], al
add byte [ebx + 5], dh
mov ecx, 0x7330
add byte [eax], al
xor bh, bh
add byte [eax], al
jbe 0x433163
add byte [eax], dh
inc dword [eax]
add byte [ebx + 0x83c1], cl
movzx edx, di
mov ecx, edx
jle 0x4331c9
div ecx
imul di
add ax, 0
and ax, 0xff00
inc cx
add byte [eax], dh
mov word [ebx - 0x16], ax
add ebx, 0
add byte [edi], cl
test dword [0xf5ffff], ebp
xlatb
invalid

Function at 0x454d80
Capabilities:
Encode data using xor

Disassembly:
or dword [eax], eax
pop ds
inc edi
inc ecx
test dword [edx + 0x67e09dfa], esi
push es
push 0x77
or esp, ebp
sub byte [edx + 0x508529d7], 0x70
test dword [eax + 0x70], edx
push cs
test byte [edi], bh
or byte [ebx], 0x66
aam 0x77
xchg esi, eax
xor eax, dword [edx + 0x3d0546f9]
pop eax
mov esi, dword [ebp + 0x46]
lcall 0x7c2c, 0x1a57893
popal
mov ecx, 0xb3af3535
push ebp
mov byte [edi - 0x27f8b830], 0x6d
jo 0x454d84
rol byte [edi + 7], 1
fsubr dword [ebp + 0x70]
shr byte [ecx + 0x23], cl
pushal
ja 0x454d6f
imul esp, dword [ebx], 0xa4b87760
movsb byte es:[edi], byte [esi]
xchg ebx, eax
jge 0x454dab
cmp al, 0x93
mov edi, 0xc7fbde8e
stc
xchg edx, eax
in eax, dx
mov eax, dword [0x74b29105]
invalid
Function at 0x10021625
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003e2e0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x64
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x2e
xor eax, eax
inc eax
imul eax, eax, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xd
jae 0x10021667
jmp 0x1002166c
call fcn.1002614f
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x6e
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x33
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x32
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x72
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x4b
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x6c
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100245e9
mov esp, ebp
pop ebp
ret

Function at 0x100216ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003e2e0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
inc eax
imul eax, eax, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xd
jae 0x1002170f
jmp 0x10021714
call fcn.1002614f
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x33
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x2e
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x69
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x32
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x61
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x41
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x70
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x76
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x64
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x64
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100245e9
mov esp, ebp
pop ebp
ret
Function at 0x1002186a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1003e2e0]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x28], 0xffffffff
xor eax, eax
inc eax
imul eax, eax, 0x17
mov byte [ebp + eax - 0x20], 0x74
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x20], 0x33
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0x15
mov byte [ebp + eax - 0x20], 0x68
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
imul eax, eax, 0x14
mov byte [ebp + eax - 0x20], 0x73
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x20], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x20], 0x61
xor eax, eax
inc eax
imul eax, eax, 0x16
mov byte [ebp + eax - 0x20], 0x6f
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x20], 0x74
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x20], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x43
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x20], 0x32
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x20], 0x6f
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x20], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x20], 0x68
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x20], 0x70
xor eax, eax
inc eax
imul eax, eax, 0x18
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x19
jae 0x1002196a
jmp 0x1002196f
call fcn.1002614f
mov eax, dword [ebp - 0x2c]
mov byte [ebp + eax - 0x20], 0
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x54
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x20], 0x70
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x20], 0x53
lea eax, [ebp - 0x20]
push eax
call fcn.10021625
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x100219c8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100245e9
mov esp, ebp
pop ebp
ret
Function at 0x100219d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1003e2e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1c], 0
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x61
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x69
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x14], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x72
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x46
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x33
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x68
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x72
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x64
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x54
xor eax, eax
inc eax
imul eax, eax, 0xd
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xe
jae 0x10021a76
jmp 0x10021a7b
call fcn.1002614f
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x73
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x32
lea eax, [ebp - 0x14]
push eax
call fcn.10021625
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10021abe
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100245e9
mov esp, ebp
pop ebp
ret
Function at 0x10021acf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1003e2e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1c], 0
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x32
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x64
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x78
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x4e
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x33
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x68
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x74
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x72
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x54
xor eax, eax
inc eax
imul eax, eax, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xd
jae 0x10021b77
jmp 0x10021b7c
call fcn.1002614f
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x14], 0
lea eax, [ebp - 0x14]
push eax
call fcn.10021625
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10021ba9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100245e9
mov esp, ebp
pop ebp
ret
Function at 0x10021bba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1003e2e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 1
call fcn.100216ee
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10021ce7
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x18], 0x41
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x18], 0x75
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x18], 0x51
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x18], 0x61
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x18], 0x52
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x18], 0x75
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x18], 0x78
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x18], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x18], 0x56
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x18], 0x79
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x18], 0x67
xor eax, eax
inc eax
shl eax, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x11
jae 0x10021c82
jmp 0x10021c87
call fcn.1002614f
mov eax, dword [ebp - 0x28]
mov byte [ebp + eax - 0x18], 0
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x18], 0x45
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x18], 0x72
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x18], 0x65
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10021cde
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100245e9
mov esp, ebp
pop ebp
ret
Function at 0x10021cf8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1003e2e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x63
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x1c], 0x63
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x1c], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x1c], 0x6e
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0x14
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x75
xor eax, eax
inc eax
imul eax, eax, 0x15
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x16
jae 0x10021d80
jmp 0x10021d85
call fcn.1002614f
mov eax, dword [ebp - 0x28]
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x1c], 0x43
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x73
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x6c
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x75
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x73
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x46
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x68
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x1c], 0x68
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x49
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x69
lea eax, [ebp - 0x1c]
push eax
call fcn.10021625
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10021e38
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100245e9
mov esp, ebp
pop ebp
ret
Function at 0x10021e49
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1003e2e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x20], 0
call fcn.100217b7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10021f57
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x14], 0x45
xor eax, eax
inc eax
imul eax, eax, 0xe
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xf
jae 0x10021e8b
jmp 0x10021e90
call fcn.1002614f
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x14], 0x78
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x6f
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x78
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x61
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x4e
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x48
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x6b
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x43
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x74
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10021f4e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100245e9
mov esp, ebp
pop ebp
ret
Function at 0x10021f68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1003e2e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x20], 0
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x18], 0x46
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x18], 0x6c
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x18], 0x75
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x18], 0x47
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x18], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x18], 0x6d
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x18], 0x69
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x18], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x18], 0x61
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 0x12
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x13
jae 0x10021ffa
jmp 0x10021fff
call fcn.1002614f
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x18], 0
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x18], 0x64
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x18], 0x4e
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x18], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x18], 0x41
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x18], 0x4d
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x18], 0x65
lea eax, [ebp - 0x18]
push eax
call fcn.10021625
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10022087
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100245e9
mov esp, ebp
pop ebp
ret
Function at 0x100222aa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1003e2e0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x20], 0x61
xor eax, eax
inc eax
imul eax, eax, 0x19
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1a
jae 0x100222d6
jmp 0x100222db
call fcn.1002614f
mov eax, dword [ebp - 0x28]
mov byte [ebp + eax - 0x20], 0
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0x18
mov byte [ebp + eax - 0x20], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0x17
mov byte [ebp + eax - 0x20], 0x6f
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x20], 0x69
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x20], 0x69
xor eax, eax
inc eax
imul eax, eax, 0x15
mov byte [ebp + eax - 0x20], 0x74
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x20], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x20], 0x69
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x20], 0x53
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x20], 0x7a
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x20], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0x16
mov byte [ebp + eax - 0x20], 0x69
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x20], 0x69
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x20], 0x43
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x61
xor eax, eax
inc eax
imul eax, eax, 0x14
mov byte [ebp + eax - 0x20], 0x63
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x20], 0x63
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x49
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x20], 0x74
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x20], 0x69
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x20], 0x65
lea eax, [ebp - 0x20]
push eax
call fcn.10021625
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10022409
push dword [ebp + 8]
call dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100245e9
mov esp, ebp
pop ebp
ret