joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a2f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101442ee
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x1019646c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
push dword [edi + 8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
push dword [edi + 0xc]
lea eax, [edi + 0xc]
mov dword [ebp - 0x1c], eax
call esi
mov eax, dword [edi + 0x10]
xorps xmm0, xmm0
mov esi, dword [edi]
push 0x20
mov dword [ebp - 0x10], eax
movlpd qword [ebp - 0x28], xmm0
call fcn.100f5bec
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1001a36d
xorps xmm0, xmm0
mov ecx, eax
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
call fcn.100188e0
jmp 0x1001a36f
xor eax, eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
push eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.10018230
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
lea eax, [edi + 8]
push 0x7530
push eax
push dword [esi + 0x3c]
mov dword [ebp - 4], 1
call fcn.10019720
mov edi, dword [ebp - 0x24]
test eax, eax
je 0x1001a4a9
or esi, 0xffffffff
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x1001a3e6
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x1001a3e6
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x1001a3e6
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [ebp - 0x18]
xorps xmm0, xmm0
push 0x20
movlpd qword [ebp - 0x14], xmm0
mov edi, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x18], eax
call fcn.100f5bec
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x1001a424
xorps xmm0, xmm0
mov ecx, eax
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
call fcn.100188e0
jmp 0x1001a426
xor eax, eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
push eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.10018230
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
push 0x7530
push dword [ebp - 0x1c]
mov dword [ebp - 4], 3
push dword [edi + 0x40]
call fcn.10019720
mov edi, dword [ebp - 0x10]
test eax, eax
je 0x1001a4a3
test edi, edi
je 0x1001a48d
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x1001a48d
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x1001a48d
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x1001a4ce
jmp 0x1001a4b0
test edi, edi
je 0x1001a4ce
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x1001a4ce
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x1001a4ce
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10026000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101455bb
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0x101551b8
push 0
push 0
push str.tpi_start_load
call fcn.1001a750
mov ecx, eax
call fcn.1009b2b0
cmp dword [0x1019cd0c], 0
jne 0x10026135
call fcn.1009f3d0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10026110
push 0x5d
push str.d:jenkins.jenkinsworkspacemultiplugin_nativemultipluginencryptplugincloudpopwindow.cpp
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], al
call fcn.10015100
push 3
push 0x10154d04
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.10015100
mov byte [ebp - 4], 1
call fcn.1009f3d0
mov edi, eax
lea ecx, [ebp - 0xdc]
push 0x2dd
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100128c0
mov esi, eax
push str.StartPlugin
push esi
mov byte [ebp - 4], 2
call fcn.100135d0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0xdc]
call fcn.10013680
lea ecx, [ebp - 0x2c]
call fcn.10013270
lea ecx, [ebp - 0x44]
call fcn.10013270
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0
push 0x10023e80
push 0
push 0
call fcn.1011e78f
add esp, 0x18
mov dword [0x1019cd0c], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret

Function at 0x10027760
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101456f0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1019646c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100f5bec
mov edi, eax
add esp, 4
test edi, edi
je 0x10027812
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1007530c
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002aed0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10145a4b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
push 0x84
push 0
push eax
call fcn.101166b0
mov ecx, dword [esi + 0x108]
lea edx, [ebp - 0x94]
add esp, 0xc
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push str.closebtn
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0
call fcn.100aa476
test al, al
je 0x1002af75
mov eax, dword [edi + 0x77c]
test eax, eax
jne 0x1002af5e
push eax
push 0x101551b8
push eax
push eax
push str.download_fail_close
jmp 0x1002afcf
cmp eax, 1
jne 0x1002afdb
push 0
push 0x101551b8
push 0
push 0
push str.install_fail_close
jmp 0x1002afcf
push str.openbtn
lea ecx, [ebp - 0x94]
call fcn.100aa476
test al, al
je 0x1002afe4
push 1
push 0
push 0
push str.http:__www.pcjiami.cn_
push 0x1015609c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [edi + 0x77c]
test eax, eax
jne 0x1002afba
push eax
push 0x101551b8
push eax
push eax
push str.download_fail_click
jmp 0x1002afcf
cmp eax, 1
jne 0x1002afdb
push 0
push 0x101551b8
push 0
push 0
push str.install_fail_click
call fcn.1001a750
mov ecx, eax
call fcn.1009b2b0
push 1
mov ecx, edi
call fcn.100a9abf
lea ecx, [ebp - 0x94]
call fcn.100aa3b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret 4
Function at 0x1002e460
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10145ed8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x38]
mov dword [0x1019cfd4], edi
call fcn.1002d8e0
cmp byte [edi + 8], 0
jne 0x1002e550
push 1
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov eax, dword [edi + 0x10]
test eax, eax
je 0x1002e4d0
push eax
call ebx
mov dword [edi + 0x10], esi
test esi, esi
je 0x1002e586
lea eax, [ebp - 0x14]
mov byte [edi + 8], 1
push eax
push 0
push edi
push 0x1002e5c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [edi + 0xc]
mov esi, eax
lea eax, [edi + 0xc]
test ecx, ecx
je 0x1002e507
push ecx
call ebx
lea eax, [edi + 0xc]
mov dword [eax], esi
test esi, esi
je 0x1002e59d
push 0xf
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x14]
push eax
push 0
push edi
push 0x1002e1c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x1002e53c
push eax
call ebx
mov dword [edi + 0x7c], esi
test esi, esi
jne 0x1002e550
lea ecx, [edi + 0xc]
call fcn.1002da70
push eax
call ebx
jmp 0x1002e59d
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x1002e568
mov edx, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x10184864
push eax
call fcn.1011578f
push 0x10184dfc
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
call fcn.1011578f
int3
Function at 0x100308e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10146273
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1019646c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
lea edi, [esi + 8]
mov dword [esi + 4], 0
lea ecx, [esi + 0x20]
mov dword [edi + 0xc], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ecx], eax
mov dword [esi], vtable.CLockScreenChecker.0
mov dword [esi + 0x24], 0
mov byte [esi + 0x28], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
push dword [ebp - 0x10]
mov byte [ebp - 4], 1
push ecx
push 0x10196160
push section..data
push 0x101a0190
call fcn.100168f0
movzx ebx, ax
add esp, 0x14
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x100309b2
call fcn.10073f8c
mov dword [esi + 0x14], eax
test eax, eax
jne 0x100309b2
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push eax
call fcn.1007408e
test bx, bx
je 0x1003099e
test edi, edi
je 0x10030a42
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x10196004
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1019601c]
mov dword [edi + 8], eax
push 0x10196004
mov dword [0x1019601c], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x10196030]
mov eax, dword [0x10196038]
mov edx, dword [0x1019602c]
sub eax, ecx
push 0
push dword [0x101a0194]
push 0
push 0
push eax
mov eax, dword [0x10196034]
sub eax, edx
push eax
push ecx
push edx
push SysReAllocString
push 0
push ebx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push 0xc0000005
call fcn.10017b00
int3
Function at 0x10033290
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, ecx
mov ebx, dword [ebp + 8]
push edi
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
lea edi, [ecx*8]
mov ecx, dword [edx + 0xc]
add ecx, edi
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x10033306
cmp eax, esi
jne 0x100332fe
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [edi + ecx + 4], eax
jmp 0x1003330e
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x1003330e
cmp eax, esi
jne 0x1003330e
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [eax], edi
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
dec dword [edx + 8]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1003332d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x10
push esi
call fcn.100f5c1c
add esp, 8
mov dword [ebx], edi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10035420
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov ebx, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x18]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and edx, eax
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 4]
mov ecx, dword [eax + edx*8]
add edx, edx
mov edi, dword [eax + edx*4]
lea edx, [eax + edx*4]
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
nop dword [eax]
cmp dword [ebp + 8], esi
jne 0x10035489
mov eax, esi
jmp 0x1003548e
mov eax, dword [edx + 4]
mov eax, dword [eax]
cmp ecx, eax
je 0x100354a8
mov eax, dword [ecx + 8]
cmp eax, dword [edi]
je 0x1003549d
mov ecx, dword [ecx]
jmp 0x10035480
pop edi
pop esi
mov dword [ebx], ecx
mov eax, ebx
pop ebx
pop ebp
ret 8
pop edi
mov dword [ebx], esi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 8

Function at 0x100362b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1019d4f8
mov dword [ebp - 0xa0], 0x4b0048
lea esi, [ebp - 0xa0]
mov dword [ebp - 0x9c], 0x590045
push edi
mov dword [ebp - 0x98], 0x4c005f
mov edx, 0x4e
mov dword [ebp - 0x94], 0x43004f
sub esi, eax
mov dword [ebp - 0x90], 0x4c0041
mov dword [ebp - 0x8c], 0x4d005f
mov dword [ebp - 0x88], 0x430041
mov dword [ebp - 0x84], 0x490048
mov dword [ebp - 0x80], 0x45004e
mov dword [ebp - 0x7c], 0x53005c
mov dword [ebp - 0x78], 0x46004f
mov dword [ebp - 0x74], 0x570054
mov dword [ebp - 0x70], 0x520041
mov dword [ebp - 0x6c], 0x5c0045
mov dword [ebp - 0x68], 0x69004d
mov dword [ebp - 0x64], 0x720063
mov dword [ebp - 0x60], 0x73006f
mov dword [ebp - 0x5c], 0x66006f
mov dword [ebp - 0x58], 0x5c0074
mov dword [ebp - 0x54], 0x690057
mov dword [ebp - 0x50], 0x64006e
mov dword [ebp - 0x4c], 0x77006f
mov dword [ebp - 0x48], 0x5c0073
mov dword [ebp - 0x44], 0x750043
mov dword [ebp - 0x40], 0x720072
mov dword [ebp - 0x3c], 0x6e0065
mov dword [ebp - 0x38], 0x560074
mov dword [ebp - 0x34], 0x720065
mov dword [ebp - 0x30], 0x690073
mov dword [ebp - 0x2c], 0x6e006f
mov dword [ebp - 0x28], 0x55005c
mov dword [ebp - 0x24], 0x69006e
mov dword [ebp - 0x20], 0x73006e
mov dword [ebp - 0x1c], 0x610074
mov dword [ebp - 0x18], 0x6c006c
mov dword [ebp - 0x14], 0x57005c
mov dword [ebp - 0x10], 0x430065
mov dword [ebp - 0xc], 0x610068
mov dword [ebp - 8], 0x74
lea ecx, [edx + 0x7fffffb0]
test ecx, ecx
je 0x1003641f
movzx ecx, word [esi + eax]
test cx, cx
je 0x1003641f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10036401
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret
Function at 0x10036710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xa0], 0x4b0048
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0xa0]
mov eax, 0x1019d5a0
mov dword [ebp - 0x9c], 0x590045
push edi
mov dword [ebp - 0x98], 0x43005f
mov edx, 0x4d
mov dword [ebp - 0x94], 0x520055
sub esi, eax
mov dword [ebp - 0x90], 0x450052
mov dword [ebp - 0x8c], 0x54004e
mov dword [ebp - 0x88], 0x55005f
mov dword [ebp - 0x84], 0x450053
mov dword [ebp - 0x80], 0x5c0052
mov dword [ebp - 0x7c], 0x4f0053
mov dword [ebp - 0x78], 0x540046
mov dword [ebp - 0x74], 0x410057
mov dword [ebp - 0x70], 0x450052
mov dword [ebp - 0x6c], 0x4d005c
mov dword [ebp - 0x68], 0x630069
mov dword [ebp - 0x64], 0x6f0072
mov dword [ebp - 0x60], 0x6f0073
mov dword [ebp - 0x5c], 0x740066
mov dword [ebp - 0x58], 0x57005c
mov dword [ebp - 0x54], 0x6e0069
mov dword [ebp - 0x50], 0x6f0064
mov dword [ebp - 0x4c], 0x730077
mov dword [ebp - 0x48], 0x43005c
mov dword [ebp - 0x44], 0x720075
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x74006e
mov dword [ebp - 0x38], 0x650056
mov dword [ebp - 0x34], 0x730072
mov dword [ebp - 0x30], 0x6f0069
mov dword [ebp - 0x2c], 0x5c006e
mov dword [ebp - 0x28], 0x6e0055
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x740073
mov dword [ebp - 0x1c], 0x6c0061
mov dword [ebp - 0x18], 0x5c006c
mov dword [ebp - 0x14], 0x650057
mov dword [ebp - 0x10], 0x680043
mov dword [ebp - 0xc], 0x740061
lea ecx, [edx + 0x7fffffb1]
test ecx, ecx
je 0x1003687e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1003687e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10036860
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret
Function at 0x100368a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xa0], 0x4b0048
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0xa0]
mov eax, 0x1019d6f0
mov dword [ebp - 0x9c], 0x590045
push edi
mov dword [ebp - 0x98], 0x43005f
mov edx, 0x4d
mov dword [ebp - 0x94], 0x520055
sub esi, eax
mov dword [ebp - 0x90], 0x450052
mov dword [ebp - 0x8c], 0x54004e
mov dword [ebp - 0x88], 0x55005f
mov dword [ebp - 0x84], 0x450053
mov dword [ebp - 0x80], 0x5c0052
mov dword [ebp - 0x7c], 0x4f0053
mov dword [ebp - 0x78], 0x540046
mov dword [ebp - 0x74], 0x410057
mov dword [ebp - 0x70], 0x450052
mov dword [ebp - 0x6c], 0x4d005c
mov dword [ebp - 0x68], 0x630069
mov dword [ebp - 0x64], 0x6f0072
mov dword [ebp - 0x60], 0x6f0073
mov dword [ebp - 0x5c], 0x740066
mov dword [ebp - 0x58], 0x57005c
mov dword [ebp - 0x54], 0x6e0069
mov dword [ebp - 0x50], 0x6f0064
mov dword [ebp - 0x4c], 0x730077
mov dword [ebp - 0x48], 0x43005c
mov dword [ebp - 0x44], 0x720075
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x74006e
mov dword [ebp - 0x38], 0x650056
mov dword [ebp - 0x34], 0x730072
mov dword [ebp - 0x30], 0x6f0069
mov dword [ebp - 0x2c], 0x5c006e
mov dword [ebp - 0x28], 0x6e0055
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x740073
mov dword [ebp - 0x1c], 0x6c0061
mov dword [ebp - 0x18], 0x5c006c
mov dword [ebp - 0x14], 0x650057
mov dword [ebp - 0x10], 0x680043
mov dword [ebp - 0xc], 0x740061
lea ecx, [edx + 0x7fffffb1]
test ecx, ecx
je 0x10036a0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10036a0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100369f0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret
Function at 0x10036a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1019d648
mov dword [ebp - 0xa0], 0x4b0048
lea esi, [ebp - 0xa0]
mov dword [ebp - 0x9c], 0x590045
push edi
mov dword [ebp - 0x98], 0x4c005f
mov edx, 0x4e
mov dword [ebp - 0x94], 0x43004f
sub esi, eax
mov dword [ebp - 0x90], 0x4c0041
mov dword [ebp - 0x8c], 0x4d005f
mov dword [ebp - 0x88], 0x430041
mov dword [ebp - 0x84], 0x490048
mov dword [ebp - 0x80], 0x45004e
mov dword [ebp - 0x7c], 0x53005c
mov dword [ebp - 0x78], 0x46004f
mov dword [ebp - 0x74], 0x570054
mov dword [ebp - 0x70], 0x520041
mov dword [ebp - 0x6c], 0x5c0045
mov dword [ebp - 0x68], 0x69004d
mov dword [ebp - 0x64], 0x720063
mov dword [ebp - 0x60], 0x73006f
mov dword [ebp - 0x5c], 0x66006f
mov dword [ebp - 0x58], 0x5c0074
mov dword [ebp - 0x54], 0x690057
mov dword [ebp - 0x50], 0x64006e
mov dword [ebp - 0x4c], 0x77006f
mov dword [ebp - 0x48], 0x5c0073
mov dword [ebp - 0x44], 0x750043
mov dword [ebp - 0x40], 0x720072
mov dword [ebp - 0x3c], 0x6e0065
mov dword [ebp - 0x38], 0x560074
mov dword [ebp - 0x34], 0x720065
mov dword [ebp - 0x30], 0x690073
mov dword [ebp - 0x2c], 0x6e006f
mov dword [ebp - 0x28], 0x55005c
mov dword [ebp - 0x24], 0x69006e
mov dword [ebp - 0x20], 0x73006e
mov dword [ebp - 0x1c], 0x610074
mov dword [ebp - 0x18], 0x6c006c
mov dword [ebp - 0x14], 0x57005c
mov dword [ebp - 0x10], 0x430065
mov dword [ebp - 0xc], 0x610068
mov dword [ebp - 8], 0x74
lea ecx, [edx + 0x7fffffb0]
test ecx, ecx
je 0x10036b9f
movzx ecx, word [esi + eax]
test cx, cx
je 0x10036b9f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10036b81
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret