joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006dbd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014b583
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xa4]
push 0x84
push 0
push eax
call fcn.101166b0
mov ecx, dword [esi + 0x108]
lea edx, [ebp - 0xa4]
add esp, 0xc
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push str.closebtn
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 0
call fcn.100aa476
test al, al
je 0x1006dc7f
mov eax, dword [edi + 0x77c]
test eax, eax
jne 0x1006dc61
push eax
push str.ProtectPlugin
push eax
push eax
push str.download_fail_close
jmp 0x1006dd3f
cmp eax, 1
jne 0x1006dd4b
push 0
push str.ProtectPlugin
push 0
push 0
push str.install_fail_close
jmp 0x1006dd3f
push str.openbtn
lea ecx, [ebp - 0xa4]
call fcn.100aa476
test al, al
je 0x1006dd54
xorps xmm0, xmm0
mov byte [ebp - 0xa5], 0
movlpd qword [ebp - 0x18], xmm0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
call fcn.100749f5
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xa5]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push 0x10053440
push 0x1019e374
call fcn.10075792
add esp, 0x10
test eax, eax
je 0x1006dd7c
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
call fcn.10074a2f
mov eax, dword [0x1019e370]
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [eax]
push 1
push 0
push 0
push dword [eax + 0x7c]
push 0x1015609c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [edi + 0x77c]
test eax, eax
jne 0x1006dd2a
push eax
push str.ProtectPlugin
push eax
push eax
push str.download_fail_click
jmp 0x1006dd3f
cmp eax, 1
jne 0x1006dd4b
push 0
push str.ProtectPlugin
push 0
push 0
push str.install_fail_click
call fcn.1001a750
mov ecx, eax
call fcn.1009b2b0
push 1
mov ecx, edi
call fcn.100a9abf
lea ecx, [ebp - 0xa4]
call fcn.100aa3b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
call fcn.10074a50
add esp, 4
mov byte [ebp - 4], 2
test al, al
jne 0x1006dd99
call fcn.100757aa
sub esp, 8
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.10012e00
call fcn.10015d10
int3
Function at 0x10070920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push edi
push eax
mov ecx, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x4b0048
mov dword [ebp - 0x48], 0x590045
mov dword [ebp - 0x44], 0x4c005f
mov dword [ebp - 0x40], 0x43004f
mov dword [ebp - 0x3c], 0x4c0041
mov dword [ebp - 0x38], 0x4d005f
mov dword [ebp - 0x34], 0x430041
mov dword [ebp - 0x30], 0x490048
mov dword [ebp - 0x2c], 0x45004e
mov dword [ebp - 0x28], 0x53005c
mov dword [ebp - 0x24], 0x46004f
mov dword [ebp - 0x20], 0x570054
mov dword [ebp - 0x1c], 0x520041
mov dword [ebp - 0x18], 0x5c0045
mov dword [ebp - 0x14], 0x75004c
mov dword [ebp - 0x10], 0x610064
mov dword [ebp - 0xc], 0x680073
mov dword [ebp - 8], 0x69
call fcn.1001ded0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret 4

Function at 0x100709e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x60], 0x4d005c
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x60]
mov eax, 0x101a00f0
mov dword [ebp - 0x5c], 0x6c0075
push edi
mov dword [ebp - 0x58], 0x690074
mov edx, 0x2d
mov dword [ebp - 0x54], 0x43002d
sub esi, eax
mov dword [ebp - 0x50], 0x300032
mov dword [ebp - 0x4c], 0x390045
mov dword [ebp - 0x48], 0x440034
mov dword [ebp - 0x44], 0x2d0031
mov dword [ebp - 0x40], 0x370032
mov dword [ebp - 0x3c], 0x310043
mov dword [ebp - 0x38], 0x34002d
mov dword [ebp - 0x34], 0x340044
mov dword [ebp - 0x30], 0x2d0044
mov dword [ebp - 0x2c], 0x340039
mov dword [ebp - 0x28], 0x340031
mov dword [ebp - 0x24], 0x31002d
mov dword [ebp - 0x20], 0x420032
mov dword [ebp - 0x1c], 0x440030
mov dword [ebp - 0x18], 0x350038
mov dword [ebp - 0x14], 0x340037
mov dword [ebp - 0x10], 0x350045
mov dword [ebp - 0xc], 0x5c0042
lea ecx, [edx + 0x7fffffd1]
test ecx, ecx
je 0x10070ac0
movzx ecx, word [esi + eax]
test cx, cx
je 0x10070ac0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10070aa2
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret
Function at 0x10070cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x58]
push edi
push eax
mov ecx, esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], 0x4b0048
mov dword [ebp - 0x54], 0x590045
mov dword [ebp - 0x50], 0x4c005f
mov dword [ebp - 0x4c], 0x43004f
mov dword [ebp - 0x48], 0x4c0041
mov dword [ebp - 0x44], 0x4d005f
mov dword [ebp - 0x40], 0x430041
mov dword [ebp - 0x3c], 0x490048
mov dword [ebp - 0x38], 0x45004e
mov dword [ebp - 0x34], 0x53005c
mov dword [ebp - 0x30], 0x46004f
mov dword [ebp - 0x2c], 0x570054
mov dword [ebp - 0x28], 0x520041
mov dword [ebp - 0x24], 0x5c0045
mov dword [ebp - 0x20], 0x44004c
mov dword [ebp - 0x1c], 0x470053
mov dword [ebp - 0x18], 0x6d0061
mov dword [ebp - 0x14], 0x4d0065
mov dword [ebp - 0x10], 0x730061
mov dword [ebp - 0xc], 0x650074
mov dword [ebp - 8], 0x72
call fcn.1001ded0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret 4
Function at 0x10070e50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014b95b
mov eax, dword fs:[0]
push eax
mov eax, 0x2018
call fcn.100f6830
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x2020], eax
mov eax, dword [ebp + 0x10]
push 0x2000
mov dword [ebp - 0x2024], eax
lea eax, [ebp - 0x2010]
push 0
push eax
call fcn.101166b0
add esp, 0xc
lea eax, [ebp - 0x2014]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x10070fd3
cmp eax, 0x1fff
ja 0x10070fd3
lea ecx, [ebp - 0x2010]
push ecx
push eax
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10070fd3
lea eax, [ebp - 0x2018]
push eax
lea eax, [ebp - 0x201c]
push eax
push 0x10156e8c
lea eax, [ebp - 0x2010]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10070fd3
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp - 0x201c]
je 0x10070f23
mov ebx, dword [eax + 8]
mov edi, dword [eax + 0xc]
jmp 0x10070f29
mov ebx, dword [eax + 0x10]
mov edi, dword [eax + 0x14]
mov eax, dword [ebp - 0x2020]
test eax, eax
je 0x10070f35
mov dword [eax], ebx
mov eax, dword [ebp - 0x2024]
test eax, eax
je 0x10070f41
mov dword [eax], edi
test esi, esi
je 0x10070fcc
lea ecx, [ebp - 0x2020]
mov dword [ebp - 0x2020], 0
call fcn.1001d9b0
movzx eax, di
push eax
shr edi, 0x10
push edi
movzx eax, bx
push eax
shr ebx, 0x10
lea eax, [ebp - 0x2020]
push ebx
push str._d._d._d._d
push eax
mov dword [ebp - 4], 0
call fcn.1001a680
mov edx, dword [ebp - 0x2020]
add esp, 0x18
mov ecx, 0x104
sub edx, esi
lea eax, [ecx + 0x7ffffefa]
test eax, eax
je 0x10070fb4
movzx eax, word [edx + esi]
test ax, ax
je 0x10070fb4
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x10070f96
test ecx, ecx
lea eax, [esi - 2]
cmovne eax, esi
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x2020]
call fcn.100131c0
mov eax, 1
jmp 0x10070fd5
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret
Function at 0x10071c40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bbbb
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
call fcn.100a92d4
push 0x84
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.101166b0
lea eax, [ebp - 0x94]
push eax
call fcn.100a44b6
add esp, 0x14
mov dword [ebp - 4], 0
call fcn.100a4669
dec eax
cmp eax, 3
ja case.default.0x10071cac
jmp dword [eax*4 + 0x10071e04]
push str.skin_
lea ecx, [ebp - 0x94]
call fcn.100aa513
lea ecx, [ebp - 0x94]
call fcn.1002da70
push eax
call fcn.100a928b
add esp, 4
push 0
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.10037ca0
mov ecx, eax
call fcn.100c3447
jmp case.default.0x10071cac
push str.skin_
lea ecx, [ebp - 0x94]
call fcn.100aa513
lea ecx, [ebp - 0x94]
call fcn.1002da70
push eax
call fcn.100a928b
add esp, 4
push 0x10156ec4
push ecx
mov eax, esp
mov dword [eax], str.IDR_RES
call fcn.10037ca0
mov ecx, eax
call fcn.100c3447
jmp case.default.0x10071cac
push str.skin_
lea ecx, [ebp - 0x94]
call fcn.100aa513
lea ecx, [ebp - 0x94]
call fcn.1002da70
push eax
call fcn.100a928b
push 0
push 1
push str.skin.zip
call fcn.100a93aa
add esp, 0x10
jmp 0x10071cd7
push 0x10156ef0
push 0x65
call fcn.100a4654
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je case.default.0x10071cac
push esi
call fcn.100a4654
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10071dd4
push esi
call fcn.100a4654
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x10071dd4
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.100a92e1
add esp, 0xc
push 0
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.10037ca0
mov ecx, eax
call fcn.100c3447
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x94]
call fcn.100aa3b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret
Function at 0x10071d6d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bbbb
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
call fcn.100a92d4
push 0x84
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.101166b0
lea eax, [ebp - 0x94]
push eax
call fcn.100a44b6
add esp, 0x14
mov dword [ebp - 4], 0
call fcn.100a4669
dec eax
cmp eax, 3
ja case.default.0x10071cac
jmp dword [eax*4 + 0x10071e04]
push str.skin_
lea ecx, [ebp - 0x94]
call fcn.100aa513
lea ecx, [ebp - 0x94]
call fcn.1002da70
push eax
call fcn.100a928b
add esp, 4
push 0
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.10037ca0
mov ecx, eax
call fcn.100c3447
jmp case.default.0x10071cac
push str.skin_
lea ecx, [ebp - 0x94]
call fcn.100aa513
lea ecx, [ebp - 0x94]
call fcn.1002da70
push eax
call fcn.100a928b
add esp, 4
push 0x10156ec4
push ecx
mov eax, esp
mov dword [eax], str.IDR_RES
call fcn.10037ca0
mov ecx, eax
call fcn.100c3447
jmp case.default.0x10071cac
push str.skin_
lea ecx, [ebp - 0x94]
call fcn.100aa513
lea ecx, [ebp - 0x94]
call fcn.1002da70
push eax
call fcn.100a928b
push 0
push 1
push str.skin.zip
call fcn.100a93aa
add esp, 0x10
jmp 0x10071cd7
push 0x10156ef0
push 0x65
call fcn.100a4654
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je case.default.0x10071cac
push esi
call fcn.100a4654
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10071dd4
push esi
call fcn.100a4654
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x10071dd4
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.100a92e1
add esp, 0xc
push 0
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.10037ca0
mov ecx, eax
call fcn.100c3447
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x94]
call fcn.100aa3b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret
Function at 0x1008ac90
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], ebx
test edi, edi
je 0x1008ae58
test eax, eax
je 0x1008ae58
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x20
jl 0x1008ae58
push ecx
push ebx
push eax
call fcn.101166b0
add esp, 0xc
push ebx
push 1
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x1008ae58
cmp edi, 0xffffffff
je 0x1008ae51
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.1009a9c0
add esp, 8
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1008ae51
mov eax, dword [ebp - 0x78]
or eax, dword [ebp - 0x74]
je 0x1008ade7
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, eax
mov dword [ebp - 0x70], edx
test edx, edx
je 0x1008ae51
mov ecx, dword [ebp - 0x74]
xorps xmm0, xmm0
movq qword [ebp - 0x8c], xmm0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jg 0x1008ade7
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x8c]
jl 0x1008ad80
cmp edi, esi
jae 0x1008ade7
nop
sub esi, edi
sbb ecx, eax
js 0x1008ad95
jg 0x1008ad90
cmp esi, 0x400000
jb 0x1008ad95
mov esi, 0x400000
push esi
push edi
push eax
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x1008ade7
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.1009aa10
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
mov ecx, dword [ebp - 0x74]
add edi, 0x400000
adc eax, ebx
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jge 0x1008addb
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
jmp 0x1008ad80
jg 0x1008ade7
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
cmp edi, esi
jb 0x1008ad80
lea eax, [ebp - 0x6c]
push eax
call fcn.1009a8b0
mov edi, dword [ebp - 0x80]
add esp, 4
xor esi, esi
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push 0x1015e370
push 3
push edi
call fcn.1002a190
inc esi
add esp, 0x10
add edi, 2
cmp esi, 0x10
jl 0x1008ae00
push dword [ebp + 0x10]
push dword [ebp - 0x80]
call fcn.1012c7a2
add esp, 8
mov esi, 1
test ebx, ebx
je 0x1008ae3d
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x1008ae4b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret
Function at 0x1008c400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014d1c8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], 0x690044
mov dword [ebp - 0x5c], 0x610064
mov dword [ebp - 0x58], 0x6f0043
mov dword [ebp - 0x54], 0x66006e
mov dword [ebp - 0x50], 0x670069
mov dword [ebp - 0x4c], 0x650043
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x740053
mov dword [ebp - 0x3c], 0x620075
mov dword [ebp - 0x38], 0x720050
mov dword [ebp - 0x34], 0x660065
mov dword [ebp - 0x30], 0x780069
mov dword [ebp - 0x2c], 0x6e0057
mov dword [ebp - 0x28], 0x430064
mov dword [ebp - 0x24], 0x61006c
mov dword [ebp - 0x20], 0x730073
mov dword [ebp - 0x1c], 0x61004e
mov dword [ebp - 0x18], 0x65006d
mov dword [ebp - 0x14], 0x5f
call fcn.10017640
mov ecx, eax
test ecx, ecx
je 0x1008c52b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10019430
test al, al
jne 0x1008c50b
lea ecx, [ebp - 0x60]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008c4f0
sub ecx, edx
lea eax, [ebp - 0x60]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001c180
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10013b40
int3
Function at 0x1008c610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014d22b
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xac], 0x740068
mov dword [ebp - 0xa8], 0x700074
mov dword [ebp - 0xa4], 0x2f003a
mov dword [ebp - 0xa0], 0x63002f
mov dword [ebp - 0x9c], 0x6e0064
mov dword [ebp - 0x98], 0x68002d
mov dword [ebp - 0x94], 0x2d0073
mov dword [ebp - 0x90], 0x690066
mov dword [ebp - 0x8c], 0x65006c
mov dword [ebp - 0x88], 0x70002e
mov dword [ebp - 0x84], 0x6a0063
mov dword [ebp - 0x80], 0x610069
mov dword [ebp - 0x7c], 0x69006d
mov dword [ebp - 0x78], 0x63002e
mov dword [ebp - 0x74], 0x2f006e
mov dword [ebp - 0x70], 0x6d0063
mov dword [ebp - 0x6c], 0x2f0073
mov dword [ebp - 0x68], 0x720070
mov dword [ebp - 0x64], 0x6a006f
mov dword [ebp - 0x60], 0x630065
mov dword [ebp - 0x5c], 0x5f0074
mov dword [ebp - 0x58], 0x310031
mov dword [ebp - 0x54], 0x2f0039
mov dword [ebp - 0x50], 0x660063
mov dword [ebp - 0x4c], 0x5f0067
mov dword [ebp - 0x48], 0x650063
mov dword [ebp - 0x44], 0x74006e
mov dword [ebp - 0x40], 0x720065
mov dword [ebp - 0x3c], 0x70002f
mov dword [ebp - 0x38], 0x6a0063
mov dword [ebp - 0x34], 0x610069
mov dword [ebp - 0x30], 0x69006d
mov dword [ebp - 0x2c], 0x6d005f
mov dword [ebp - 0x28], 0x64006f
mov dword [ebp - 0x24], 0x6c005f
mov dword [ebp - 0x20], 0x730069
mov dword [ebp - 0x1c], 0x2e0074
mov dword [ebp - 0x18], 0x73006a
mov word [ebp - 0x14], ax
call fcn.10017640
mov ecx, eax
test ecx, ecx
je 0x1008c7ee
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0xac]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10019430
test al, al
jne 0x1008c7ce
lea ecx, [ebp - 0xac]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008c7b0
sub ecx, edx
lea eax, [ebp - 0xac]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001c180
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10013b40
int3
Function at 0x1008c800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014d268
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x430050
mov dword [ebp - 0x24], 0x69006a
mov dword [ebp - 0x20], 0x6d0061
mov dword [ebp - 0x1c], 0x2e0069
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.10017640
mov ecx, eax
test ecx, ecx
je 0x1008c8c9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10019430
test al, al
jne 0x1008c8ab
lea ecx, [ebp - 0x28]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008c890
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001c180
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10013b40
int3

Function at 0x1008c8e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014d298
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 0x4f0053
mov dword [ebp - 0x2c], 0x540046
mov dword [ebp - 0x28], 0x410057
mov dword [ebp - 0x24], 0x450052
mov dword [ebp - 0x20], 0x48005c
mov dword [ebp - 0x1c], 0x6f0061
mov dword [ebp - 0x18], 0x61006b
mov dword [ebp - 0x14], 0x6e
call fcn.10017640
mov ecx, eax
test ecx, ecx
je 0x1008c9b9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10019430
test al, al
jne 0x1008c99b
lea ecx, [ebp - 0x30]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008c980
sub ecx, edx
lea eax, [ebp - 0x30]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001c180
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10013b40
int3
Function at 0x1008ca90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014d2fb
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0x6f0043
mov dword [ebp - 0x8c], 0x66006e
mov dword [ebp - 0x88], 0x670069
mov dword [ebp - 0x84], 0x650043
mov dword [ebp - 0x80], 0x74006e
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x690053
mov dword [ebp - 0x74], 0x6c006e
mov dword [ebp - 0x70], 0x650067
mov dword [ebp - 0x6c], 0x6e0049
mov dword [ebp - 0x68], 0x740073
mov dword [ebp - 0x64], 0x6e0061
mov dword [ebp - 0x60], 0x650063
mov dword [ebp - 0x5c], 0x42005f
mov dword [ebp - 0x58], 0x310037
mov dword [ebp - 0x54], 0x440036
mov dword [ebp - 0x50], 0x320045
mov dword [ebp - 0x4c], 0x2d0033
mov dword [ebp - 0x48], 0x450035
mov dword [ebp - 0x44], 0x320034
mov dword [ebp - 0x40], 0x34002d
mov dword [ebp - 0x3c], 0x460046
mov dword [ebp - 0x38], 0x2d0036
mov dword [ebp - 0x34], 0x320042
mov dword [ebp - 0x30], 0x320036
mov dword [ebp - 0x2c], 0x34002d
mov dword [ebp - 0x28], 0x310032
mov dword [ebp - 0x24], 0x460038
mov dword [ebp - 0x20], 0x450043
mov dword [ebp - 0x1c], 0x370030
mov dword [ebp - 0x18], 0x460046
mov dword [ebp - 0x14], 0x38
call fcn.10017640
mov ecx, eax
test ecx, ecx
je 0x1008cc2e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10019430
test al, al
jne 0x1008cc0e
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008cbf0
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001c180
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10013b40
int3