joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c620
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x868
mov eax, dword [0x50d108]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x47c657
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0048a7e3
mov esp, ebp
pop ebp
ret 0x14
push 0x800
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.004a33a0
add esp, 0xc
lea eax, [ebp - 0x80c]
test edi, edi
je 0x47c68a
push edi
push esi
push 0x4efb00
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x47c69a
push esi
push 0x4efa1c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x40
lea eax, [ebp - 0x860]
push 0
push eax
call fcn.004a33a0
mov ax, word [ebp + 0x18]
add esp, 0xc
mov word [ebp - 0x834], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x864], 0x44
movups xmmword [ebp - 0x81c], xmm0
push eax
lea eax, [ebp - 0x864]
mov dword [ebp - 0x838], 1
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x80c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x47c642
cmp dword [ebp + 0x10], 0
je 0x47c729
push dword [ebp + 0x14]
push dword [ebp - 0x81c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push dword [ebp - 0x81c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x81c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x818]
call esi
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048a7e3
mov esp, ebp
pop ebp
ret 0x14

Function at 0x47c760
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x50d108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x47c82d
mov eax, dword [0x4ef2cc]
xorps xmm0, xmm0
movups xmmword [ebp - 0x22], xmm0
push 0x38
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x5c]
movq qword [ebp - 0x12], xmm0
movq xmm0, qword [str.runas]
push 0
push eax
mov dword [ebp - 0xa], 0
mov word [ebp - 6], 0
movq qword [ebp - 0x24], xmm0
call fcn.004a33a0
add esp, 0xc
mov dword [ebp - 0x60], 0x3c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x4c], ebx
push eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x5c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x47c82d
cmp dword [ebp + 0x10], 0
je 0x47c80c
push dword [ebp + 0x14]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048a7e3
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048a7e3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47d8f0
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x507610
push 0x4a5330
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x50d108]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x47d95d
push 1
push str.ExtensionProtect
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x47d958
mov ebx, 1
push eax
call edi
push esi
call edi
jmp 0x47d963
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
jne 0x47d96c
lea eax, [ebx + 1]
jmp 0x47d9d1
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], ebx
xor esi, esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 4], ebx
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x47d9c3
push 0x10020
push str.ExtensionProtect
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x40], esi
test esi, esi
je 0x47d9c3
lea eax, [ebp - 0x38]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0047d9f9
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0048a7e3
mov esp, ebp
pop ebp
ret
Function at 0x480270
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d76e4
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x50d108]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x511410]
test esi, esi
jne 0x4802d5
push 0x140
call fcn.0048a2e5
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], esi
test eax, eax
je 0x4802c6
mov ecx, eax
call fcn.0047fcd0
mov esi, eax
jmp 0x4802c8
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [0x511410], esi
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x480392
push 1
mov ecx, esi
call fcn.0041c580
push 0xe8
call fcn.0048a2e5
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x480315
mov ecx, eax
call fcn.0040fb40
mov edi, eax
jmp 0x480317
xor edi, edi
push 3
push 0x83
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.0040f810
push 2
mov ecx, edi
call fcn.004106a0
movaps xmm0, xmmword [0x4dae10]
sub esp, 0x10
mov eax, esp
mov ecx, edi
movups xmmword [eax], xmm0
call fcn.004107f0
push edi
mov ecx, esi
call fcn.0041c5a0
push 0
mov ecx, esi
call fcn.0041afb0
movaps xmm0, xmmword [0x4dae20]
push 0
push ecx
mov eax, esp
push 0x40000
push SysReAllocString
push 0x4efa70
push ecx
mov dword [eax], 0
lea ecx, [ebp - 0x20]
mov eax, esp
movups xmmword [ebp - 0x20], xmm0
push 0
mov dword [eax], ecx
mov ecx, esi
call fcn.00419c70
push 1
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0041c660
push eax
call fcn.0045b420
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a7e3
mov esp, ebp
pop ebp
ret
Function at 0x4846b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7cc6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x50d108]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x48475c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x48475c
call fcn.004445b0
mov esi, eax
jmp 0x48484c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x48477f
call fcn.004445b0
jmp 0x48483f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x48479d
call fcn.004445b0
jmp 0x48483f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4847be
mov esi, 0x8007000e
jmp 0x484841
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00483580
jmp 0x4847e8
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x4847ff
mov esi, 0x8007000e
jmp 0x484841
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x48481f
call fcn.004445b0
jmp 0x48483f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00484550
mov esi, eax
test edi, edi
je 0x48484c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x484870
lea ecx, [ebp - 0x418]
call fcn.00483a60
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048a7e3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x485e90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x485ea9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x485eb5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x485eb0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x48d38c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4c0342
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c01c1

Function at 0x4c6b74
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c6834
Function at 0x10016b60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cf634
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], 0xffffffff
mov dword [edx + 0x18], 0xf
mov dword [edx + 0x14], 0
mov byte [edx + 4], 0
mov dword [ebp - 4], 0
mov dword [edx + 0x30], 0xf
mov dword [edx + 0x2c], 0
mov byte [edx + 0x1c], 0
mov byte [ebp - 4], 1
lea ecx, [edx + 0x38]
lea eax, [ecx + 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov byte [eax], 0
mov byte [ebp - 4], 3
mov al, byte [ebp + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 6
mov dword [ecx + 0xc], 0
mov byte [ecx + 0x10], al
mov dword [ecx + 0x14], 0x201
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov byte [ebp - 4], 4
mov dword [edx + 0x60], 0xffffffff
mov dword [edx + 0x64], connect
mov dword [edx + 0x68], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x10019fa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10019fd1
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10019fc0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x10025110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0b52
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.100a5f36
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
jne 0x100251c4
lea eax, [ebp + 8]
mov dword [ebp + 8], str.bad_locale_name
push eax
lea ecx, [ebp - 0x1c]
call fcn.100aa758
mov byte [ebp - 4], 7
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x1c]
push 0x10120c9c
push eax
call fcn.100b03cb
push eax
push esi
call fcn.100a5d30
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100268b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0ce8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
call fcn.100267e0
test al, al
je 0x1002697c
call fcn.100269e0
push eax
lea ecx, [ebp - 0x34]
call fcn.100108a0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1006fd30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34]
call fcn.100109a0
lea ecx, [ebp - 0x4c]
call fcn.1000fb00
mov byte [ebp - 4], 4
call fcn.10042cb0
mov dl, 1
mov ecx, 0x2718
call fcn.100280e0
call fcn.1000f8f0
test al, al
je 0x1002694d
push 0
push 0x100536e0
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
call esi
push 0
push 0x100536e0
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10026956
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.10044000
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4c]
call fcn.100109a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.10026bf0
mov dword [ebp - 4], 0xffffffff
call fcn.1005c970
mov eax, dword [0x100e6424]
test eax, eax
je 0x100269cb
push 0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027370
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0d78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
cmp edx, 1
jne 0x10027466
mov dword [ebp - 4], 0
call fcn.1000f5f0
test al, al
jne 0x100273b9
call fcn.100529d0
test al, al
je 0x100274ff
call fcn.100529d0
test al, al
jne 0x10027466
mov dword [ebp - 4], 0xffffffff
mov dword [0x100e6424], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x100e6420], eax
mov ecx, esi
call fcn.10027150
call fcn.10027520
mov ecx, eax
call fcn.10053bb0
mov ecx, esi
call fcn.100538a0
mov dword [ebp - 4], 2
call fcn.1000f8e0
test al, al
je 0x1002740d
call fcn.10042cb0
call fcn.1000f910
test al, al
je 0x1002741b
call fcn.10042cb0
call fcn.1000f900
test al, al
je 0x1002747c
call fcn.10052300
test al, al
jne 0x100274ff
call fcn.10042cb0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x10026c60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x10027466
call fcn.10053bf0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x10026c60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, eax
lea ecx, [ebp - 0x20]
call fcn.100714f0
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x100274bb
mov eax, dword [eax]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x100274cd
call fcn.10053bf0
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.10012390
jmp 0x10027466
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100383a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d27ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 2
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov byte [ebp - 4], 3
mov dword [ecx + 0x44], 0xf
mov dword [ecx + 0x40], 0
mov byte [ecx + 0x30], 0
mov byte [ebp - 4], 4
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10041240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x5b505b7b
push 0x5b3e
push 0x100e7f1c
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xf
push eax
mov dword [ebp - 0xfc], 0x5b4c5b5d
mov dword [ebp - 0xf8], 0x5b4e5b47
mov dword [ebp - 0xf4], 0x5b735b4a
mov dword [ebp - 0xf0], 0x5b4d5b5b
mov dword [ebp - 0xec], 0x5b5f5b4d
mov dword [ebp - 0xe8], 0x5b5b5b59
mov dword [ebp - 0xe4], 0x5b3e
call fcn.100520e0
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10041520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x4f2e4f0f
push 0x4f4b
push 0x100e7f58
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xf
push eax
mov dword [ebp - 0xfc], 0x4f394f28
mov dword [ebp - 0xf8], 0x4f3b4f32
mov dword [ebp - 0xf4], 0x4f064f3f
mov dword [ebp - 0xf0], 0x4f384f2e
mov dword [ebp - 0xec], 0x4f2a4f38
mov dword [ebp - 0xe8], 0x4f2e4f2c
mov dword [ebp - 0xe4], 0x4f4b
call fcn.100520e0
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10041800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x433d431c
push 0x4358
push 0x100e7f94
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0x16
push eax
mov dword [ebp - 0xfc], 0x433d4334
mov dword [ebp - 0xf8], 0x433d432c
mov dword [ebp - 0xf4], 0x433d430b
mov dword [ebp - 0xf0], 0x432d433b
mov dword [ebp - 0xec], 0x4331432a
mov dword [ebp - 0xe8], 0x4321432c
mov dword [ebp - 0xe4], 0x4337431b
mov dword [ebp - 0xe0], 0x432c4336
mov dword [ebp - 0xdc], 0x4320433d
mov dword [ebp - 0xd8], 0x4358432c
call fcn.100520e0
add esp, 0x10
mov esp, ebp
pop ebp
ret