joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10098879
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d8aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10113004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.100673b0
dec eax
cmp eax, 9
ja case.default.0x100987db
jmp dword [eax*4 + 0x1009893c]
push 0x32c
push str.D:_sourcecode460SoftwareGasteprotobuf_cpp_3.5.1protobuf_3.5.1_srcgoogle_protobuf_map_field.h
push 3
lea ecx, [ebp - 0x34]
call fcn.1001ee70
push str.Unsupported
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.1001f290
push eax
lea ecx, [ebp - 0x59]
call fcn.1001f080
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.1001efb0
push 0x33b
push str.D:_sourcecode460SoftwareGasteprotobuf_cpp_3.5.1protobuf_3.5.1_srcgoogle_protobuf_map_field.h
push 3
lea ecx, [ebp - 0x58]
call fcn.1001ee70
push str.Cant_get_here.
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.1001f290
push eax
lea ecx, [ebp - 0x5a]
call fcn.1001f080
lea ecx, [ebp - 0x58]
call fcn.1001efb0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001abec
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.100632e0
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x1009888a
mov esi, dword [esi]
mov edx, esi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x10098890
sub edx, ecx
xor ebx, ebx
xor edi, edi
mov eax, 0x811c9dc5
lea ecx, [edx + esi]
cmp esi, ecx
cmova edx, ebx
test edx, edx
je 0x100988c3
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
cmp edi, edx
jne 0x100988b0
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.100bd103
imul edx, edx, 0x41a7
add esp, 8
imul ecx, eax, 0xb14
sub edx, ecx
jns 0x100988ec
add edx, 0x7fffffff
mov eax, edx
jmp 0x1009885b
mov ecx, esi
call fcn.10062ff0
xor eax, 0xdeadbeef
jmp 0x100988c3
mov ecx, esi
call fcn.10062e00
xor eax, 0xdeadbeef
jmp 0x100988c3
mov ecx, esi
call fcn.100636b0
xor eax, 0xdeadbeef
jmp 0x100988c3
mov ecx, esi
call fcn.100634c0
xor eax, 0xdeadbeef
jmp 0x100988c3
mov ecx, esi
call fcn.10062c10
movzx eax, al
xor eax, 0xdeadbeef
jmp 0x100988c3
Function at 0x1009e9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100df9d8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x10113004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], 0x610048
mov dword [ebp - 0x60], 0x6f006c
mov dword [ebp - 0x5c], 0x700077
mov dword [ebp - 0x58], 0x6f0043
mov dword [ebp - 0x54], 0x66006e
mov dword [ebp - 0x50], 0x670069
mov dword [ebp - 0x4c], 0x650043
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x740053
mov dword [ebp - 0x3c], 0x620075
mov dword [ebp - 0x38], 0x720050
mov dword [ebp - 0x34], 0x660065
mov dword [ebp - 0x30], 0x780069
mov dword [ebp - 0x2c], 0x6e0057
mov dword [ebp - 0x28], 0x430064
mov dword [ebp - 0x24], 0x61006c
mov dword [ebp - 0x20], 0x730073
mov dword [ebp - 0x1c], 0x61004e
mov dword [ebp - 0x18], 0x65006d
mov dword [ebp - 0x14], 0x5f
call fcn.10010bd0
mov ecx, eax
test ecx, ecx
je 0x1009eb20
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10010020
test al, al
jne 0x1009eb00
lea ecx, [ebp - 0x64]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009eae5
sub ecx, edx
lea eax, [ebp - 0x64]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001abec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.1000ff90
int3
Function at 0x1009eb30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dfa08
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x10113004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], 0x740068
mov dword [ebp - 0x70], 0x700074
mov dword [ebp - 0x6c], 0x2f003a
mov dword [ebp - 0x68], 0x69002f
mov dword [ebp - 0x64], 0x74006e
mov dword [ebp - 0x60], 0x2d0066
mov dword [ebp - 0x5c], 0x630070
mov dword [ebp - 0x58], 0x73002e
mov dword [ebp - 0x54], 0x610068
mov dword [ebp - 0x50], 0x68006e
mov dword [ebp - 0x4c], 0x740075
mov dword [ebp - 0x48], 0x630065
mov dword [ebp - 0x44], 0x2e0068
mov dword [ebp - 0x40], 0x6e0063
mov dword [ebp - 0x3c], 0x63002f
mov dword [ebp - 0x38], 0x670066
mov dword [ebp - 0x34], 0x62002f
mov dword [ebp - 0x30], 0x7a0069
mov dword [ebp - 0x2c], 0x690068
mov dword [ebp - 0x28], 0x64005f
mov dword [ebp - 0x24], 0x740065
mov dword [ebp - 0x20], 0x690061
mov dword [ebp - 0x1c], 0x2e006c
mov dword [ebp - 0x18], 0x680070
mov dword [ebp - 0x14], 0x70
call fcn.10010bd0
mov ecx, eax
test ecx, ecx
je 0x1009ec7c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10010020
test al, al
jne 0x1009ec5c
lea ecx, [ebp - 0x74]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009ec41
sub ecx, edx
lea eax, [ebp - 0x74]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001abec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.1000ff90
int3
Function at 0x1009ef90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dfa7b
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x10113004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb0], 0x740068
mov dword [ebp - 0xac], 0x700074
mov dword [ebp - 0xa8], 0x2f003a
mov dword [ebp - 0xa4], 0x63002f
mov dword [ebp - 0xa0], 0x6e0064
mov dword [ebp - 0x9c], 0x61002d
mov dword [ebp - 0x98], 0x69006c
mov dword [ebp - 0x94], 0x66002d
mov dword [ebp - 0x90], 0x6c0069
mov dword [ebp - 0x8c], 0x2d0065
mov dword [ebp - 0x88], 0x680073
mov dword [ebp - 0x84], 0x2e0063
mov dword [ebp - 0x80], 0x690079
mov dword [ebp - 0x7c], 0x67006e
mov dword [ebp - 0x78], 0x610079
mov dword [ebp - 0x74], 0x6b006e
mov dword [ebp - 0x70], 0x6e0061
mov dword [ebp - 0x6c], 0x750074
mov dword [ebp - 0x68], 0x63002e
mov dword [ebp - 0x64], 0x6d006f
mov dword [ebp - 0x60], 0x63002f
mov dword [ebp - 0x5c], 0x73006d
mov dword [ebp - 0x58], 0x70002f
mov dword [ebp - 0x54], 0x6f0072
mov dword [ebp - 0x50], 0x65006a
mov dword [ebp - 0x4c], 0x740063
mov dword [ebp - 0x48], 0x31005f
mov dword [ebp - 0x44], 0x360030
mov dword [ebp - 0x40], 0x63002f
mov dword [ebp - 0x3c], 0x670066
mov dword [ebp - 0x38], 0x63005f
mov dword [ebp - 0x34], 0x6e0065
mov dword [ebp - 0x30], 0x650074
mov dword [ebp - 0x2c], 0x2f0072
mov dword [ebp - 0x28], 0x6f006d
mov dword [ebp - 0x24], 0x5f0064
mov dword [ebp - 0x20], 0x69006c
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x6a002e
mov dword [ebp - 0x14], 0x73
call fcn.10010bd0
mov ecx, eax
test ecx, ecx
je 0x1009f17e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0xb0]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10010020
test al, al
jne 0x1009f15e
lea ecx, [ebp - 0xb0]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009f140
sub ecx, edx
lea eax, [ebp - 0xb0]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001abec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.1000ff90
int3
Function at 0x1009f260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dfab8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10113004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x690064
mov dword [ebp - 0x24], 0x610064
mov dword [ebp - 0x20], 0x700077
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
mov word [ebp - 0x14], ax
call fcn.10010bd0
mov ecx, eax
test ecx, ecx
je 0x1009f329
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10010020
test al, al
jne 0x1009f30b
lea ecx, [ebp - 0x28]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009f2f0
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001abec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.1000ff90
int3

Function at 0x1009f340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dfae8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x10113004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], 0x610048
mov dword [ebp - 0x4c], 0x6b006f
mov dword [ebp - 0x48], 0x6e0061
mov dword [ebp - 0x44], 0x6f0043
mov dword [ebp - 0x40], 0x66006e
mov dword [ebp - 0x3c], 0x670069
mov dword [ebp - 0x38], 0x650043
mov dword [ebp - 0x34], 0x74006e
mov dword [ebp - 0x30], 0x720065
mov dword [ebp - 0x2c], 0x6e0057
mov dword [ebp - 0x28], 0x430064
mov dword [ebp - 0x24], 0x61006c
mov dword [ebp - 0x20], 0x730073
mov dword [ebp - 0x1c], 0x61004e
mov dword [ebp - 0x18], 0x65006d
mov word [ebp - 0x14], ax
call fcn.10010bd0
mov ecx, eax
test ecx, ecx
je 0x1009f44c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10010020
test al, al
jne 0x1009f42c
lea ecx, [ebp - 0x50]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009f411
sub ecx, edx
lea eax, [ebp - 0x50]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001abec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.1000ff90
int3
Function at 0x1009f460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dfb18
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10113004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x4a0059
mov dword [ebp - 0x48], 0x420048
mov dword [ebp - 0x44], 0x43005a
mov dword [ebp - 0x40], 0x6e006f
mov dword [ebp - 0x3c], 0x690066
mov dword [ebp - 0x38], 0x430067
mov dword [ebp - 0x34], 0x6e0065
mov dword [ebp - 0x30], 0x650074
mov dword [ebp - 0x2c], 0x570072
mov dword [ebp - 0x28], 0x64006e
mov dword [ebp - 0x24], 0x6c0043
mov dword [ebp - 0x20], 0x730061
mov dword [ebp - 0x1c], 0x4e0073
mov dword [ebp - 0x18], 0x6d0061
mov dword [ebp - 0x14], 0x65
call fcn.10010bd0
mov ecx, eax
test ecx, ecx
je 0x1009f56a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10010020
test al, al
jne 0x1009f54b
lea ecx, [ebp - 0x4c]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009f530
sub ecx, edx
lea eax, [ebp - 0x4c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001abec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.1000ff90
int3
Function at 0x1009f580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dfb48
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x10113004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], 0x740068
mov dword [ebp - 0x78], 0x700074
mov dword [ebp - 0x74], 0x2f003a
mov dword [ebp - 0x70], 0x6c002f
mov dword [ebp - 0x6c], 0x70002e
mov dword [ebp - 0x68], 0x620075
mov dword [ebp - 0x64], 0x69006c
mov dword [ebp - 0x60], 0x2e0063
mov dword [ebp - 0x5c], 0x630070
mov dword [ebp - 0x58], 0x650070
mov dword [ebp - 0x54], 0x730074
mov dword [ebp - 0x50], 0x67002e
mov dword [ebp - 0x4c], 0x6f006f
mov dword [ebp - 0x48], 0x730064
mov dword [ebp - 0x44], 0x650065
mov dword [ebp - 0x40], 0x690070
mov dword [ebp - 0x3c], 0x2e0063
mov dword [ebp - 0x38], 0x6f0063
mov dword [ebp - 0x34], 0x2f006d
mov dword [ebp - 0x30], 0x630070
mov dword [ebp - 0x2c], 0x75002f
mov dword [ebp - 0x28], 0x640070
mov dword [ebp - 0x24], 0x740061
mov dword [ebp - 0x20], 0x2f0061
mov dword [ebp - 0x1c], 0x750064
mov dword [ebp - 0x18], 0x70006d
mov word [ebp - 0x14], ax
call fcn.10010bd0
mov ecx, eax
test ecx, ecx
je 0x1009f6db
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10010020
test al, al
jne 0x1009f6bb
lea ecx, [ebp - 0x7c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009f6a0
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001abec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.1000ff90
int3
Function at 0x1009f6f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dfb78
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10113004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x4f0053
mov dword [ebp - 0x34], 0x540046
mov dword [ebp - 0x30], 0x410057
mov dword [ebp - 0x2c], 0x450052
mov dword [ebp - 0x28], 0x42005c
mov dword [ebp - 0x24], 0x75006c
mov dword [ebp - 0x20], 0x770065
mov dword [ebp - 0x1c], 0x610068
mov dword [ebp - 0x18], 0x65006c
mov word [ebp - 0x14], ax
call fcn.10010bd0
mov ecx, eax
test ecx, ecx
je 0x1009f7ce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10010020
test al, al
jne 0x1009f7b0
lea ecx, [ebp - 0x38]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009f795
sub ecx, edx
lea eax, [ebp - 0x38]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001abec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.1000ff90
int3
Function at 0x1009f7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dfba8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x10113004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], 0x740068
mov dword [ebp - 0x6c], 0x700074
mov dword [ebp - 0x68], 0x2f003a
mov dword [ebp - 0x64], 0x6c002f
mov dword [ebp - 0x60], 0x70002e
mov dword [ebp - 0x5c], 0x620075
mov dword [ebp - 0x58], 0x69006c
mov dword [ebp - 0x54], 0x2e0063
mov dword [ebp - 0x50], 0x6f0064
mov dword [ebp - 0x4c], 0x70006c
mov dword [ebp - 0x48], 0x690068
mov dword [ebp - 0x44], 0x70006e
mov dword [ebp - 0x40], 0x700061
mov dword [ebp - 0x3c], 0x720065
mov dword [ebp - 0x38], 0x63002e
mov dword [ebp - 0x34], 0x6d006f
mov dword [ebp - 0x30], 0x70002f
mov dword [ebp - 0x2c], 0x2f0063
mov dword [ebp - 0x28], 0x700075
mov dword [ebp - 0x24], 0x610064
mov dword [ebp - 0x20], 0x610074
mov dword [ebp - 0x1c], 0x64002f
mov dword [ebp - 0x18], 0x6d0075
mov dword [ebp - 0x14], 0x70
call fcn.10010bd0
mov ecx, eax
test ecx, ecx
je 0x1009f92b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10010020
test al, al
jne 0x1009f90b
lea ecx, [ebp - 0x70]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009f8f0
sub ecx, edx
lea eax, [ebp - 0x70]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001abec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.1000ff90
int3
Function at 0x1009f940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dfbd8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x10113004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], 0x740068
mov dword [ebp - 0x68], 0x700074
mov dword [ebp - 0x64], 0x2f003a
mov dword [ebp - 0x60], 0x6c002f
mov dword [ebp - 0x5c], 0x70002e
mov dword [ebp - 0x58], 0x620075
mov dword [ebp - 0x54], 0x69006c
mov dword [ebp - 0x50], 0x2e0063
mov dword [ebp - 0x4c], 0x6f0067
mov dword [ebp - 0x48], 0x64006f
mov dword [ebp - 0x44], 0x650073
mov dword [ebp - 0x40], 0x700065
mov dword [ebp - 0x3c], 0x630069
mov dword [ebp - 0x38], 0x63002e
mov dword [ebp - 0x34], 0x6d006f
mov dword [ebp - 0x30], 0x70002f
mov dword [ebp - 0x2c], 0x2f0063
mov dword [ebp - 0x28], 0x700075
mov dword [ebp - 0x24], 0x610064
mov dword [ebp - 0x20], 0x610074
mov dword [ebp - 0x1c], 0x64002f
mov dword [ebp - 0x18], 0x6d0075
mov dword [ebp - 0x14], 0x70
call fcn.10010bd0
mov ecx, eax
test ecx, ecx
je 0x1009fa7e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10010020
test al, al
jne 0x1009fa5e
lea ecx, [ebp - 0x6c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009fa43
sub ecx, edx
lea eax, [ebp - 0x6c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001abec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.1000ff90
int3
Function at 0x1009fa90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dfc0b
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x10113004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0xf4], 0x740068
mov dword [ebp - 0xf0], 0x700074
mov dword [ebp - 0xec], 0x2f003a
mov dword [ebp - 0xe8], 0x77002f
mov dword [ebp - 0xe4], 0x770077
mov dword [ebp - 0xe0], 0x2e0031
mov dword [ebp - 0xdc], 0x690079
mov dword [ebp - 0xd8], 0x67006e
mov dword [ebp - 0xd4], 0x610079
mov dword [ebp - 0xd0], 0x6b006e
mov dword [ebp - 0xcc], 0x6e0061
mov dword [ebp - 0xc8], 0x750074
mov dword [ebp - 0xc4], 0x63002e
mov dword [ebp - 0xc0], 0x6d006f
mov dword [ebp - 0xbc], 0x61002f
mov dword [ebp - 0xb8], 0x690070
mov dword [ebp - 0xb4], 0x73002f
mov dword [ebp - 0xb0], 0x720065
mov dword [ebp - 0xac], 0x690076
mov dword [ebp - 0xa8], 0x650063
mov dword [ebp - 0xa4], 0x63002f
mov dword [ebp - 0xa0], 0x670066
mov dword [ebp - 0x9c], 0x70002e
mov dword [ebp - 0x98], 0x700068
mov dword [ebp - 0x94], 0x66003f
mov dword [ebp - 0x90], 0x6f0072
mov dword [ebp - 0x8c], 0x3d006d
mov dword [ebp - 0x88], 0x730025
mov dword [ebp - 0x84], 0x610026
mov dword [ebp - 0x80], 0x700070
mov dword [ebp - 0x7c], 0x650076
mov dword [ebp - 0x78], 0x3d0072
mov dword [ebp - 0x74], 0x730025
mov dword [ebp - 0x70], 0x700026
mov dword [ebp - 0x6c], 0x640069
mov dword [ebp - 0x68], 0x25003d
mov dword [ebp - 0x64], 0x260073
mov dword [ebp - 0x60], 0x6f006d
mov dword [ebp - 0x5c], 0x760064
mov dword [ebp - 0x58], 0x720065
mov dword [ebp - 0x54], 0x25003d
mov dword [ebp - 0x50], 0x260073
mov dword [ebp - 0x4c], 0x69006d
mov dword [ebp - 0x48], 0x3d0064
mov dword [ebp - 0x44], 0x730025
mov dword [ebp - 0x40], 0x6d0026
mov dword [ebp - 0x3c], 0x640069
mov dword [ebp - 0x38], 0x3d0032
mov dword [ebp - 0x34], 0x730025
mov dword [ebp - 0x30], 0x680026
mov dword [ebp - 0x2c], 0x730061
mov dword [ebp - 0x28], 0x3d0068
mov dword [ebp - 0x24], 0x730025
mov dword [ebp - 0x20], 0x6f0026
mov dword [ebp - 0x1c], 0x3d0073
mov dword [ebp - 0x18], 0x730025
mov word [ebp - 0x14], ax
call fcn.10010bd0
mov ecx, eax
test ecx, ecx
je 0x1009fd21
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0xf4]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10010020
test al, al
jne 0x1009fd01
lea ecx, [ebp - 0xf4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009fce3
sub ecx, edx
lea eax, [ebp - 0xf4]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001abec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.1000ff90
int3