joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10057c00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 4
shl eax, 0
cmp dword [eax + 0x10370ad0], 0
jne 0x10057c80
mov dword [ebp - 0x20], 0xedb88320
mov dword [ebp - 0x10], 0
jmp 0x10057c30
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x100
jae 0x10057c80
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0
jmp 0x10057c51
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 8
jae 0x10057c71
mov ecx, dword [ebp - 0x14]
shr ecx, 1
mov edx, dword [ebp - 0x14]
and edx, 1
neg edx
and edx, 0xedb88320
xor ecx, edx
mov dword [ebp - 0x14], ecx
jmp 0x10057c48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax*4 + 0x10370ad0], ecx
jmp 0x10057c27
mov edx, dword [ebp + 0x10]
not edx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jle 0x10057cdd
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x1c], 0
je 0x10057cdb
mov ecx, dword [ebp - 0xc]
shr ecx, 8
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
xor ecx, dword [edx*4 + 0x10370ad0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x10057c9a
jmp 0x10057d4e
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
movzx edx, byte [ebp - 1]
test edx, edx
je 0x10057d4e
movzx eax, byte [ebp - 1]
cmp eax, 0x23
jne 0x10057d2d
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x10057d2d
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x10057d2d
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 8
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
movzx edx, byte [ebp - 1]
xor ecx, edx
xor eax, dword [ecx*4 + 0x10370ad0]
mov dword [ebp - 0xc], eax
jmp 0x10057cdd
mov eax, dword [ebp - 0xc]
not eax
mov esp, ebp
pop ebp
ret

Function at 0x10060520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10370a58]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
xorps xmm0, xmm0
movss dword [ecx + 0x2c2c], xmm0
cmp dword [ebp + 8], 0
jne 0x10060544
jmp 0x1006059a
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
call fcn.100605a0
add esp, 4
mov dword [ebp - 0x10], eax
push 0x1015515c
mov eax, dword [ebp + 8]
push eax
call fcn.10057930
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10060576
jmp 0x1006059a
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x10064a80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014e0b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.1004d510
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.1004d510
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.1004b230
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.1004b230
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.1004b230
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1c], 0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x1c]
call fcn.10023940
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], edx
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x24]
call fcn.10023940
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], edx
mov dword [ebp - 0x14], 0
jmp 0x10064b9c
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 1
jge 0x10064bb2
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [eax + edx*4 + 0x58], 0xffffffff
jmp 0x10064b93
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10077780
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
call fcn.10056c20
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [0x10370fc0]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x38]
cvtsi2ss xmm0, edx
push ecx
movss dword [esp], xmm0
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x3c]
cvtsi2ss xmm0, eax
push ecx
movss dword [esp], xmm0
lea ecx, [ebp - 0x2c]
call fcn.10023940
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [0x10370fc8]
mov edx, dword [ebp - 0x20]
sbb edx, dword [0x10370fcc]
call fcn.10149c50
cvtsd2ss xmm0, xmm0
mov edx, dword [0x10370fd4]
mov ecx, dword [0x10370fd0]
movss dword [ebp - 0x1c], xmm0
call fcn.10149c50
cvtsd2ss xmm0, xmm0
movss xmm1, dword [ebp - 0x1c]
divss xmm1, xmm0
mov edx, dword [ebp - 4]
movss dword [edx + 0x10], xmm1
mov eax, dword [ebp - 0x24]
mov dword [0x10370fc8], eax
mov ecx, dword [ebp - 0x20]
mov dword [0x10370fcc], ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x10077852
mov dword [ebp - 8], 1
jmp 0x10077859
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 8]
mov byte [eax + 0xf4], cl
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x10077881
mov dword [ebp - 0xc], 1
jmp 0x10077888
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 0xc]
mov byte [eax + 0xf5], cl
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x100778b0
mov dword [ebp - 0x10], 1
jmp 0x100778b7
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 0x10]
mov byte [eax + 0xf6], cl
mov edx, dword [ebp - 4]
mov byte [edx + 0xf7], 0
call fcn.100779f0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xb4]
test ecx, ecx
je 0x100778e9
mov dword [ebp - 0x14], 0xffffffff
jmp 0x100778f1
call fcn.10056ca0
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
mov eax, dword [0x103380f8]
cmp eax, dword [ebp - 0x18]
je 0x1007790f
mov ecx, dword [ebp - 0x18]
mov dword [0x103380f8], ecx
call fcn.10077920
mov esp, ebp
pop ebp
ret

Function at 0x1008f580
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
push 1
push 3
lea ecx, [ebp - 0xb0]
call fcn.10022a50
cmp dword [0x1036f9bc], 0
jne 0x1008f5ac
push 0xfffa1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x1036f9b8], 0
jne 0x1008f5c3
push 0
mov eax, dword [0x1036f9bc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
push 0x8000
push 0
mov ecx, dword [0x1036f9b8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x100906d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push str.Variable_or_value_is_null.
push 0x40
push 0x3000
push 0x968940
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push eax
push 0x1036f9b8
call fcn.1008f610
add esp, 0xc
push str.Allocated_memory_pointer_is_null
push 0x186a00
push 0x101609f8
call fcn.10036210
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push eax
push 0
call fcn.1008f5f0
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10092750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014e3bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x37
mov byte [ebp - 0x4c], 0x16
mov byte [ebp - 0x4b], 0x6c
mov byte [ebp - 0x4a], 0xe
mov byte [ebp - 0x49], 0x1d
mov byte [ebp - 0x48], 0x1b
mov byte [ebp - 0x47], 0xe
mov byte [ebp - 0x46], 0x11
mov byte [ebp - 0x45], 0xe
mov byte [ebp - 0x44], 0x11
mov byte [ebp - 0x43], 0xe
mov byte [ebp - 0x42], 0x11
mov byte [ebp - 0x41], 0xe
mov byte [ebp - 0x40], 0x11
mov byte [ebp - 0x3f], 0xe
mov byte [ebp - 0x3e], 0x68
mov byte [ebp - 0x3d], 0x68
mov byte [ebp - 0x3c], 0xe
mov byte [ebp - 0x3b], 0x1f
mov byte [ebp - 0x3a], 0x1e
mov byte [ebp - 0x39], 0xe
mov byte [ebp - 0x38], 0x1e
mov byte [ebp - 0x37], 0x68
mov byte [ebp - 0x36], 0xe
mov byte [ebp - 0x35], 0x6c
mov byte [ebp - 0x34], 0x19
mov byte [ebp - 0x33], 0xe
mov byte [ebp - 0x32], 0x6d
mov byte [ebp - 0x31], 0x1e
mov byte [ebp - 0x30], 0xe
mov byte [ebp - 0x2f], 0x6c
mov byte [ebp - 0x2e], 0x17
mov byte [ebp - 0x2d], 0xe
mov byte [ebp - 0x2c], 0x11
mov byte [ebp - 0x2b], 0xe
mov byte [ebp - 0x2a], 0x11
mov byte [ebp - 0x29], 0xe
mov byte [ebp - 0x28], 0x11
mov byte [ebp - 0x27], 0xe
mov byte [ebp - 0x26], 0x11
mov byte [ebp - 0x25], 0xe
mov byte [ebp - 0x24], 0x1b
mov byte [ebp - 0x23], 0x1e
mov byte [ebp - 0x22], 0xe
mov byte [ebp - 0x21], 0x68
mov byte [ebp - 0x20], 0x68
mov byte [ebp - 0x1f], 0xe
mov byte [ebp - 0x1e], 0x1b
mov byte [ebp - 0x1d], 0x18
mov byte [ebp - 0x1c], 0xe
mov byte [ebp - 0x1b], 0x1e
mov byte [ebp - 0x1a], 0x16
mov byte [ebp - 0x19], 0xe
mov byte [ebp - 0x18], 0x16
mov byte [ebp - 0x17], 0x1b
mov byte [ebp - 0x16], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x10371a48]
cmp eax, dword [edx + 4]
jle 0x100928b9
push 0x10371a48
call fcn.1014a06c
add esp, 4
cmp dword [0x10371a48], 0xffffffff
jne 0x100928b9
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, 0x10371a10
call fcn.10091530
push 0x101509a0
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x10371a48
call fcn.1014a022
add esp, 4
mov eax, 0x10371a10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100928d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014e3dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x27
mov byte [ebp - 0x3c], 0x1b
mov byte [ebp - 0x3b], 0x1b
mov byte [ebp - 0x3a], 0xe
mov byte [ebp - 0x39], 0x16
mov byte [ebp - 0x38], 0x6c
mov byte [ebp - 0x37], 0xe
mov byte [ebp - 0x36], 0x6b
mov byte [ebp - 0x35], 0x6d
mov byte [ebp - 0x34], 0xe
mov byte [ebp - 0x33], 0x16
mov byte [ebp - 0x32], 0x1d
mov byte [ebp - 0x31], 0xe
mov byte [ebp - 0x30], 0x6b
mov byte [ebp - 0x2f], 0x1a
mov byte [ebp - 0x2e], 0xe
mov byte [ebp - 0x2d], 0x68
mov byte [ebp - 0x2c], 0x16
mov byte [ebp - 0x2b], 0xe
mov byte [ebp - 0x2a], 0x16
mov byte [ebp - 0x29], 0x1d
mov byte [ebp - 0x28], 0xe
mov byte [ebp - 0x27], 0x6b
mov byte [ebp - 0x26], 0x6d
mov byte [ebp - 0x25], 0xe
mov byte [ebp - 0x24], 0x1d
mov byte [ebp - 0x23], 0x1e
mov byte [ebp - 0x22], 0xe
mov byte [ebp - 0x21], 0x1b
mov byte [ebp - 0x20], 0x18
mov byte [ebp - 0x1f], 0xe
mov byte [ebp - 0x1e], 0x1b
mov byte [ebp - 0x1d], 0x19
mov byte [ebp - 0x1c], 0xe
mov byte [ebp - 0x1b], 0x16
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0xe
mov byte [ebp - 0x18], 0x1d
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0x16], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x10371848]
cmp eax, dword [edx + 4]
jle 0x100929f9
push 0x10371848
call fcn.1014a06c
add esp, 4
cmp dword [0x10371848], 0xffffffff
jne 0x100929f9
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, 0x10371820
call fcn.10091170
push 0x101509b0
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x10371848
call fcn.1014a022
add esp, 4
mov eax, 0x10371820
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10092b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014e41c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x13
mov byte [ebp - 0x28], 0x4a
mov byte [ebp - 0x27], 0x47
mov byte [ebp - 0x26], 0x5d
mov byte [ebp - 0x25], 0x4d
mov byte [ebp - 0x24], 0x41
mov byte [ebp - 0x23], 0x5c
mov byte [ebp - 0x22], 0x4a
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1f], 0x49
mov byte [ebp - 0x1e], 1
mov byte [ebp - 0x1d], 0x4f
mov byte [ebp - 0x1c], 0x45
mov byte [ebp - 0x1b], 0x60
mov byte [ebp - 0x1a], 0x60
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0x18], 0x5a
mov byte [ebp - 0x17], 0x48
mov byte [ebp - 0x16], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x10371d18]
cmp eax, dword [edx + 4]
jle 0x10092c09
push 0x10371d18
call fcn.1014a06c
add esp, 4
cmp dword [0x10371d18], 0xffffffff
jne 0x10092c09
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, 0x10371d04
call fcn.10014600
push 0x101509d0
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x10371d18
call fcn.1014a022
add esp, 4
mov eax, 0x10371d04
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10092c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014e43c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x35
mov byte [ebp - 0x4c], 0x1b
mov byte [ebp - 0x4b], 0x1b
mov byte [ebp - 0x4a], 0xe
mov byte [ebp - 0x49], 0x16
mov byte [ebp - 0x48], 0x6c
mov byte [ebp - 0x47], 0xe
mov byte [ebp - 0x46], 0x6b
mov byte [ebp - 0x45], 0x6d
mov byte [ebp - 0x44], 0xe
mov byte [ebp - 0x43], 0x16
mov byte [ebp - 0x42], 0x1d
mov byte [ebp - 0x41], 0xe
mov byte [ebp - 0x40], 0x6b
mov byte [ebp - 0x3f], 0x1a
mov byte [ebp - 0x3e], 0xe
mov byte [ebp - 0x3d], 0x68
mov byte [ebp - 0x3c], 0x16
mov byte [ebp - 0x3b], 0xe
mov byte [ebp - 0x3a], 0x1b
mov byte [ebp - 0x39], 0x1f
mov byte [ebp - 0x38], 0xe
mov byte [ebp - 0x37], 0x1b
mov byte [ebp - 0x36], 0x1d
mov byte [ebp - 0x35], 0xe
mov byte [ebp - 0x34], 0x1b
mov byte [ebp - 0x33], 0x18
mov byte [ebp - 0x32], 0xe
mov byte [ebp - 0x31], 0x1b
mov byte [ebp - 0x30], 0x19
mov byte [ebp - 0x2f], 0xe
mov byte [ebp - 0x2e], 0x16
mov byte [ebp - 0x2d], 0x6c
mov byte [ebp - 0x2c], 0xe
mov byte [ebp - 0x2b], 0x68
mov byte [ebp - 0x2a], 0x1f
mov byte [ebp - 0x29], 0xe
mov byte [ebp - 0x28], 0x6b
mov byte [ebp - 0x27], 0x16
mov byte [ebp - 0x26], 0xe
mov byte [ebp - 0x25], 0x11
mov byte [ebp - 0x24], 0xe
mov byte [ebp - 0x23], 0x11
mov byte [ebp - 0x22], 0xe
mov byte [ebp - 0x21], 0x11
mov byte [ebp - 0x20], 0xe
mov byte [ebp - 0x1f], 0x11
mov byte [ebp - 0x1e], 0xe
mov byte [ebp - 0x1d], 0x16
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0xe
mov byte [ebp - 0x1a], 0x19
mov byte [ebp - 0x19], 0x6a
mov byte [ebp - 0x18], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1037105c]
cmp eax, dword [edx + 4]
jle 0x10092d81
push 0x1037105c
call fcn.1014a06c
add esp, 4
cmp dword [0x1037105c], 0xffffffff
jne 0x10092d81
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, 0x10371024
call fcn.10091490
push 0x101509e0
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1037105c
call fcn.1014a022
add esp, 4
mov eax, 0x10371024
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10092ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014e47c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x24
mov byte [ebp - 0x38], 0x16
mov byte [ebp - 0x37], 0x1a
mov byte [ebp - 0x36], 0xe
mov byte [ebp - 0x35], 0x6d
mov byte [ebp - 0x34], 0x1e
mov byte [ebp - 0x33], 0xe
mov byte [ebp - 0x32], 0x19
mov byte [ebp - 0x31], 0x1b
mov byte [ebp - 0x30], 0xe
mov byte [ebp - 0x2f], 0x1e
mov byte [ebp - 0x2e], 0x17
mov byte [ebp - 0x2d], 0xe
mov byte [ebp - 0x2c], 0x1b
mov byte [ebp - 0x2b], 0x68
mov byte [ebp - 0x2a], 0xe
mov byte [ebp - 0x29], 0x1b
mov byte [ebp - 0x28], 0x6b
mov byte [ebp - 0x27], 0xe
mov byte [ebp - 0x26], 0x1b
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0xe
mov byte [ebp - 0x23], 0x16
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0xe
mov byte [ebp - 0x20], 0x6b
mov byte [ebp - 0x1f], 0x1b
mov byte [ebp - 0x1e], 0xe
mov byte [ebp - 0x1d], 0x1b
mov byte [ebp - 0x1c], 0x6a
mov byte [ebp - 0x1b], 0xe
mov byte [ebp - 0x1a], 0x6d
mov byte [ebp - 0x19], 0x1c
mov byte [ebp - 0x18], 0xe
mov byte [ebp - 0x17], 0x1f
mov byte [ebp - 0x16], 0x1a
mov byte [ebp - 0x15], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1037194c]
cmp eax, dword [edx + 4]
jle 0x10092fbd
push 0x1037194c
call fcn.1014a06c
add esp, 4
cmp dword [0x1037194c], 0xffffffff
jne 0x10092fbd
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
push ecx
mov ecx, 0x10371928
call fcn.10091080
push 0x10150a00
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1037194c
call fcn.1014a022
add esp, 4
mov eax, 0x10371928
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100930c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014e4bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x2a
mov byte [ebp - 0x40], 0x1b
mov byte [ebp - 0x3f], 0x1b
mov byte [ebp - 0x3e], 0xe
mov byte [ebp - 0x3d], 0x16
mov byte [ebp - 0x3c], 0x6c
mov byte [ebp - 0x3b], 0xe
mov byte [ebp - 0x3a], 0x6b
mov byte [ebp - 0x39], 0x6d
mov byte [ebp - 0x38], 0xe
mov byte [ebp - 0x37], 0x16
mov byte [ebp - 0x36], 0x1d
mov byte [ebp - 0x35], 0xe
mov byte [ebp - 0x34], 0x6b
mov byte [ebp - 0x33], 0x1a
mov byte [ebp - 0x32], 0xe
mov byte [ebp - 0x31], 0x68
mov byte [ebp - 0x30], 0x16
mov byte [ebp - 0x2f], 0xe
mov byte [ebp - 0x2e], 0x16
mov byte [ebp - 0x2d], 0x1d
mov byte [ebp - 0x2c], 0xe
mov byte [ebp - 0x2b], 0x6b
mov byte [ebp - 0x2a], 0x6d
mov byte [ebp - 0x29], 0xe
mov byte [ebp - 0x28], 0x18
mov byte [ebp - 0x27], 0x1a
mov byte [ebp - 0x26], 0xe
mov byte [ebp - 0x25], 0x1b
mov byte [ebp - 0x24], 0x1d
mov byte [ebp - 0x23], 0xe
mov byte [ebp - 0x22], 0x1b
mov byte [ebp - 0x21], 0x18
mov byte [ebp - 0x20], 0xe
mov byte [ebp - 0x1f], 0x1b
mov byte [ebp - 0x1e], 0x19
mov byte [ebp - 0x1d], 0xe
mov byte [ebp - 0x1c], 0x16
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0xe
mov byte [ebp - 0x19], 0x68
mov byte [ebp - 0x18], 0x1f
mov byte [ebp - 0x17], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1037108c]
cmp eax, dword [edx + 4]
jle 0x100931f5
push 0x1037108c
call fcn.1014a06c
add esp, 4
cmp dword [0x1037108c], 0xffffffff
jne 0x100931f5
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push ecx
mov ecx, 0x10371060
call fcn.10091260
push 0x10150a20
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1037108c
call fcn.1014a022
add esp, 4
mov eax, 0x10371060
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100935e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014e51c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x2c
mov byte [ebp - 0x40], 0x1b
mov byte [ebp - 0x3f], 0x1b
mov byte [ebp - 0x3e], 0xe
mov byte [ebp - 0x3d], 0x16
mov byte [ebp - 0x3c], 0x6c
mov byte [ebp - 0x3b], 0xe
mov byte [ebp - 0x3a], 0x6b
mov byte [ebp - 0x39], 0x6d
mov byte [ebp - 0x38], 0xe
mov byte [ebp - 0x37], 0x1b
mov byte [ebp - 0x36], 0x18
mov byte [ebp - 0x35], 0xe
mov byte [ebp - 0x34], 0x16
mov byte [ebp - 0x33], 0x6c
mov byte [ebp - 0x32], 0xe
mov byte [ebp - 0x31], 0x19
mov byte [ebp - 0x30], 0x1b
mov byte [ebp - 0x2f], 0xe
mov byte [ebp - 0x2e], 0x1e
mov byte [ebp - 0x2d], 0x6d
mov byte [ebp - 0x2c], 0xe
mov byte [ebp - 0x2b], 0x1b
mov byte [ebp - 0x2a], 0x19
mov byte [ebp - 0x29], 0xe
mov byte [ebp - 0x28], 0x16
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0xe
mov byte [ebp - 0x25], 0x68
mov byte [ebp - 0x24], 0x17
mov byte [ebp - 0x23], 0xe
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x17
mov byte [ebp - 0x20], 0xe
mov byte [ebp - 0x1f], 0x11
mov byte [ebp - 0x1e], 0xe
mov byte [ebp - 0x1d], 0x11
mov byte [ebp - 0x1c], 0xe
mov byte [ebp - 0x1b], 0x11
mov byte [ebp - 0x1a], 0xe
mov byte [ebp - 0x19], 0x11
mov byte [ebp - 0x18], 0xe
mov byte [ebp - 0x17], 0x16
mov byte [ebp - 0x16], 0x17
mov byte [ebp - 0x15], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x103713fc]
cmp eax, dword [edx + 4]
jle 0x1009371d
push 0x103713fc
call fcn.1014a06c
add esp, 4
cmp dword [0x103713fc], 0xffffffff
jne 0x1009371d
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push ecx
mov ecx, 0x103713d0
call fcn.10091300
push 0x10150a50
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x103713fc
call fcn.1014a022
add esp, 4
mov eax, 0x103713d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret