joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x26407121
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x4122f74
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x401010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xa
mov dword [ebp - 4], edx
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10007b20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10007b79
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10007b79
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10007b6a
cmp esi, edx
jae 0x10007b79
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10007b58
cmp esi, edx
jae 0x10007b79
cmp word [esi], 0
je 0x10007b79
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10008e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1008d180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1008e778
mov dword [ebp - 0x10c], 0x740068
lea esi, [ebp - 0x10c]
mov dword [ebp - 0x108], 0x700074
push edi
mov dword [ebp - 0x104], 0x2f003a
mov edx, 0x84
mov dword [ebp - 0x100], 0x73002f
sub esi, eax
mov dword [ebp - 0xfc], 0x2e0073
mov dword [ebp - 0xf8], 0x610068
mov dword [ebp - 0xf4], 0x6f006c
mov dword [ebp - 0xf0], 0x610070
mov dword [ebp - 0xec], 0x650070
mov dword [ebp - 0xe8], 0x2e0072
mov dword [ebp - 0xe4], 0x6e0063
mov dword [ebp - 0xe0], 0x64002f
mov dword [ebp - 0xdc], 0x74006f
mov dword [ebp - 0xd8], 0x70003f
mov dword [ebp - 0xd4], 0x790074
mov dword [ebp - 0xd0], 0x650070
mov dword [ebp - 0xcc], 0x68003d
mov dword [ebp - 0xc8], 0x6c0061
mov dword [ebp - 0xc4], 0x77006f
mov dword [ebp - 0xc0], 0x260070
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop
lea ecx, [edx + 0x7fffff7a]
test ecx, ecx
je 0x1000909e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000909e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009080
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100284dd
mov esp, ebp
pop ebp
ret
Function at 0x10009280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x1008d180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1008e528
mov dword [ebp - 0xf8], 0x740068
lea esi, [ebp - 0xf8]
mov dword [ebp - 0xf4], 0x700074
push edi
mov dword [ebp - 0xf0], 0x2f003a
mov edx, 0x7a
mov dword [ebp - 0xec], 0x73002f
sub esi, eax
mov dword [ebp - 0xe8], 0x2e0073
mov dword [ebp - 0xe4], 0x680073
mov dword [ebp - 0xe0], 0x6e0061
mov dword [ebp - 0xdc], 0x750068
mov dword [ebp - 0xd8], 0x650074
mov dword [ebp - 0xd4], 0x680063
mov dword [ebp - 0xd0], 0x63002e
mov dword [ebp - 0xcc], 0x2f006e
mov dword [ebp - 0xc8], 0x690062
mov dword [ebp - 0xc4], 0x68007a
mov dword [ebp - 0xc0], 0x3f0069
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop dword [eax]
lea ecx, [edx + 0x7fffff84]
test ecx, ecx
je 0x100094ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x100094ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100094b0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100284dd
mov esp, ebp
pop ebp
ret
Function at 0x100094f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x1008d180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1008eb28
mov dword [ebp - 0x124], 0x740068
lea esi, [ebp - 0x124]
mov dword [ebp - 0x120], 0x700074
push edi
mov dword [ebp - 0x11c], 0x2f003a
mov edx, 0x90
mov dword [ebp - 0x118], 0x73002f
sub esi, eax
mov dword [ebp - 0x114], 0x2e0073
mov dword [ebp - 0x110], 0x6c0062
mov dword [ebp - 0x10c], 0x650075
mov dword [ebp - 0x108], 0x680077
mov dword [ebp - 0x104], 0x6c0061
mov dword [ebp - 0x100], 0x630065
mov dword [ebp - 0xfc], 0x610068
mov dword [ebp - 0xf8], 0x2e0074
mov dword [ebp - 0xf4], 0x6f0063
mov dword [ebp - 0xf0], 0x2f006d
mov dword [ebp - 0xec], 0x6f0064
mov dword [ebp - 0xe8], 0x3f0074
mov dword [ebp - 0xe4], 0x740070
mov dword [ebp - 0xe0], 0x700079
mov dword [ebp - 0xdc], 0x3d0065
mov dword [ebp - 0xd8], 0x720074
mov dword [ebp - 0xd4], 0x630061
mov dword [ebp - 0xd0], 0x6c0065
mov dword [ebp - 0xcc], 0x730065
mov dword [ebp - 0xc8], 0x630073
mov dword [ebp - 0xc4], 0x610068
mov dword [ebp - 0xc0], 0x260074
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop dword [eax + eax]
lea ecx, [edx + 0x7fffff6e]
test ecx, ecx
je 0x100097ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x100097ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009790
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100284dd
mov esp, ebp
pop ebp
ret
Function at 0x10009990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1008d180]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10c], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x10c]
mov eax, 0x1008ec70
mov dword [ebp - 0x108], 0x700074
push edi
mov dword [ebp - 0x104], 0x2f003a
mov edx, 0x83
mov dword [ebp - 0x100], 0x73002f
sub esi, eax
mov dword [ebp - 0xfc], 0x2e0073
mov dword [ebp - 0xf8], 0x630070
mov dword [ebp - 0xf4], 0x69006a
mov dword [ebp - 0xf0], 0x6d0061
mov dword [ebp - 0xec], 0x2e0069
mov dword [ebp - 0xe8], 0x6e0063
mov dword [ebp - 0xe4], 0x64002f
mov dword [ebp - 0xe0], 0x74006f
mov dword [ebp - 0xdc], 0x70003f
mov dword [ebp - 0xd8], 0x790074
mov dword [ebp - 0xd4], 0x650070
mov dword [ebp - 0xd0], 0x70003d
mov dword [ebp - 0xcc], 0x6a0063
mov dword [ebp - 0xc8], 0x610069
mov dword [ebp - 0xc4], 0x69006d
mov dword [ebp - 0xc0], 0x700026
mov dword [ebp - 0xbc], 0x640069
mov dword [ebp - 0xb8], 0x7b003d
mov dword [ebp - 0xb4], 0x690070
mov dword [ebp - 0xb0], 0x7d0064
mov dword [ebp - 0xac], 0x6d0026
mov dword [ebp - 0xa8], 0x640069
mov dword [ebp - 0xa4], 0x7b003d
mov dword [ebp - 0xa0], 0x69006d
mov dword [ebp - 0x9c], 0x7d0064
mov dword [ebp - 0x98], 0x6d0026
mov dword [ebp - 0x94], 0x640069
mov dword [ebp - 0x90], 0x3d0032
mov dword [ebp - 0x8c], 0x6d007b
mov dword [ebp - 0x88], 0x640069
mov dword [ebp - 0x84], 0x7d0032
mov dword [ebp - 0x80], 0x610026
mov dword [ebp - 0x7c], 0x700070
mov dword [ebp - 0x78], 0x650076
mov dword [ebp - 0x74], 0x3d0072
mov dword [ebp - 0x70], 0x61007b
mov dword [ebp - 0x6c], 0x700070
mov dword [ebp - 0x68], 0x650076
mov dword [ebp - 0x64], 0x7d0072
mov dword [ebp - 0x60], 0x6d0026
mov dword [ebp - 0x5c], 0x64006f
mov dword [ebp - 0x58], 0x650076
mov dword [ebp - 0x54], 0x3d0072
mov dword [ebp - 0x50], 0x6d007b
mov dword [ebp - 0x4c], 0x64006f
mov dword [ebp - 0x48], 0x650076
mov dword [ebp - 0x44], 0x7d0072
mov dword [ebp - 0x40], 0x740026
mov dword [ebp - 0x3c], 0x700079
mov dword [ebp - 0x38], 0x3d0065
mov dword [ebp - 0x34], 0x74007b
mov dword [ebp - 0x30], 0x700079
mov dword [ebp - 0x2c], 0x7d0065
mov dword [ebp - 0x28], 0x610026
mov dword [ebp - 0x24], 0x740063
mov dword [ebp - 0x20], 0x6f0069
mov dword [ebp - 0x1c], 0x3d006e
mov dword [ebp - 0x18], 0x61007b
mov dword [ebp - 0x14], 0x740063
mov dword [ebp - 0x10], 0x6f0069
mov dword [ebp - 0xc], 0x7d006e
nop
lea ecx, [edx + 0x7fffff7b]
test ecx, ecx
je 0x10009c0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009c0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009bf0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100284dd
mov esp, ebp
pop ebp
ret
Function at 0x10009c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1008d180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1008e9e0
mov dword [ebp - 0x118], 0x740068
lea esi, [ebp - 0x118]
mov dword [ebp - 0x114], 0x700074
push edi
mov dword [ebp - 0x110], 0x2f003a
mov edx, 0x8a
mov dword [ebp - 0x10c], 0x73002f
sub esi, eax
mov dword [ebp - 0x108], 0x2e0073
mov dword [ebp - 0x104], 0x680077
mov dword [ebp - 0x100], 0x6c0061
mov dword [ebp - 0xfc], 0x700065
mov dword [ebp - 0xf8], 0x6f0072
mov dword [ebp - 0xf4], 0x650074
mov dword [ebp - 0xf0], 0x740063
mov dword [ebp - 0xec], 0x63002e
mov dword [ebp - 0xe8], 0x2f006e
mov dword [ebp - 0xe4], 0x6f0064
mov dword [ebp - 0xe0], 0x3f0074
mov dword [ebp - 0xdc], 0x740070
mov dword [ebp - 0xd8], 0x700079
mov dword [ebp - 0xd4], 0x3d0065
mov dword [ebp - 0xd0], 0x6c0062
mov dword [ebp - 0xcc], 0x650075
mov dword [ebp - 0xc8], 0x680077
mov dword [ebp - 0xc4], 0x6c0061
mov dword [ebp - 0xc0], 0x260065
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop dword [eax]
lea ecx, [edx + 0x7fffff74]
test ecx, ecx
je 0x10009ece
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009ece
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009eb0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100284dd
mov esp, ebp
pop ebp
ret
Function at 0x10009ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1008d180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1008e8a8
mov dword [ebp - 0x10c], 0x740068
lea esi, [ebp - 0x10c]
mov dword [ebp - 0x108], 0x700074
push edi
mov dword [ebp - 0x104], 0x2f003a
mov edx, 0x84
mov dword [ebp - 0x100], 0x73002f
sub esi, eax
mov dword [ebp - 0xfc], 0x2e0073
mov dword [ebp - 0xf8], 0x630063
mov dword [ebp - 0xf4], 0x6f006d
mov dword [ebp - 0xf0], 0x730075
mov dword [ebp - 0xec], 0x2e0065
mov dword [ebp - 0xe8], 0x6f0063
mov dword [ebp - 0xe4], 0x2f006d
mov dword [ebp - 0xe0], 0x6f0064
mov dword [ebp - 0xdc], 0x3f0074
mov dword [ebp - 0xd8], 0x740070
mov dword [ebp - 0xd4], 0x700079
mov dword [ebp - 0xd0], 0x3d0065
mov dword [ebp - 0xcc], 0x630063
mov dword [ebp - 0xc8], 0x6f006d
mov dword [ebp - 0xc4], 0x730075
mov dword [ebp - 0xc0], 0x260065
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop
lea ecx, [edx + 0x7fffff7a]
test ecx, ecx
je 0x1000a16e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000a16e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000a150
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100284dd
mov esp, ebp
pop ebp
ret
Function at 0x1000a270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1008d180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1008e640
mov dword [ebp - 0x114], 0x740068
lea esi, [ebp - 0x114]
mov dword [ebp - 0x110], 0x700074
push edi
mov dword [ebp - 0x10c], 0x2f003a
mov edx, 0x88
mov dword [ebp - 0x108], 0x73002f
sub esi, eax
mov dword [ebp - 0x104], 0x2e0073
mov dword [ebp - 0x100], 0x690064
mov dword [ebp - 0xfc], 0x610064
mov dword [ebp - 0xf8], 0x610070
mov dword [ebp - 0xf4], 0x650070
mov dword [ebp - 0xf0], 0x2e0072
mov dword [ebp - 0xec], 0x6f0063
mov dword [ebp - 0xe8], 0x2f006d
mov dword [ebp - 0xe4], 0x6f0064
mov dword [ebp - 0xe0], 0x3f0074
mov dword [ebp - 0xdc], 0x740070
mov dword [ebp - 0xd8], 0x700079
mov dword [ebp - 0xd4], 0x3d0065
mov dword [ebp - 0xd0], 0x690064
mov dword [ebp - 0xcc], 0x610064
mov dword [ebp - 0xc8], 0x610070
mov dword [ebp - 0xc4], 0x650070
mov dword [ebp - 0xc0], 0x260072
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
lea ecx, [edx + 0x7fffff76]
test ecx, ecx
je 0x1000a501
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000a501
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000a4e3
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100284dd
mov esp, ebp
pop ebp
ret