joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10041ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x100], 0x160007c
mov dword [ebp - 0xfc], 0x3670264
mov dword [ebp - 0xf8], 0x50004a1
mov dword [ebp - 0xf4], 0x78b0600
mov dword [ebp - 0xf0], 0x9420810
mov dword [ebp - 0xec], 0xb040a74
mov dword [ebp - 0xe8], 0xd920c4a
mov dword [ebp - 0xe4], 0xff70eeb
mov dword [ebp - 0xe0], 0x1140108b
mov dword [ebp - 0xdc], 0x13251204
mov dword [ebp - 0xd8], 0x15001400
mov dword [ebp - 0xd4], 0x17ff16ff
mov dword [ebp - 0xd0], 0x19811866
mov dword [ebp - 0xcc], 0x1b4d1a38
mov dword [ebp - 0xc8], 0x1d741c5a
mov dword [ebp - 0xc4], 0x1f2d1e07
mov dword [ebp - 0xc0], 0x21002000
mov dword [ebp - 0xbc], 0x23002201
mov dword [ebp - 0xb8], 0x25f224eb
mov dword [ebp - 0xb4], 0x27e8268b
mov dword [ebp - 0xb0], 0x29402803
mov dword [ebp - 0xac], 0x2b8b2a3c
mov dword [ebp - 0xa8], 0x2d782c40
mov dword [ebp - 0xa4], 0x2fc52e03
mov dword [ebp - 0xa0], 0x31333050
mov dword [ebp - 0x9c], 0x338b32d2
mov dword [ebp - 0x98], 0x35203440
mov dword [ebp - 0x94], 0x37c53603
mov dword [ebp - 0x90], 0x3938388b
mov dword [ebp - 0x8c], 0x3bfd3a03
mov dword [ebp - 0x88], 0x3d473c4f
mov dword [ebp - 0x84], 0x3f083ee8
mov dword [ebp - 0x80], 0x41004000
mov dword [ebp - 0x7c], 0x43574200
mov dword [ebp - 0x78], 0x456e4469
mov dword [ebp - 0x74], 0x47784645
mov dword [ebp - 0x70], 0x49634865
mov dword [ebp - 0x6c], 0x4b5e4a00
mov dword [ebp - 0x68], 0x4d084cb9
mov dword [ebp - 0x64], 0x4f004e00
mov dword [ebp - 0x60], 0x51f35000
mov dword [ebp - 0x5c], 0x537452a6
mov dword [ebp - 0x58], 0x55425409
mov dword [ebp - 0x54], 0x573f5680
mov dword [ebp - 0x50], 0x59745800
mov dword [ebp - 0x4c], 0x5b475ae2
mov dword [ebp - 0x48], 0x5df85ceb
mov dword [ebp - 0x44], 0x5fd15e58
mov dword [ebp - 0x40], 0x618b60e2
mov dword [ebp - 0x3c], 0x63246258
mov dword [ebp - 0x38], 0x65dd6403
mov dword [ebp - 0x34], 0x67da6603
mov dword [ebp - 0x30], 0x698b6866
mov dword [ebp - 0x2c], 0x6bc16a13
mov dword [ebp - 0x28], 0x6d026ce2
mov dword [ebp - 0x24], 0x6f586e8b
mov dword [ebp - 0x20], 0x7103701c
mov dword [ebp - 0x1c], 0x730372dd
mov dword [ebp - 0x18], 0x758b74da
mov dword [ebp - 0x14], 0x7703761b
mov dword [ebp - 0x10], 0x796a78dd
mov dword [ebp - 0xc], 0x7be87a01
mov byte [ebp - 8], 0xe
test eax, eax
je 0x10041cf1
cmp byte [eax + 0x88], 0
je 0x10041cf1
mov eax, dword [eax + 0xc]
jmp 0x10041cf3
xor eax, eax
mov edx, dword [eax + 0x10]
mov ecx, dword [esi + 4]
lea eax, [edx + 0x7b]
cmp eax, ecx
jb 0x10041d11
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x100]
sub ecx, edx
mov dword [ebp - 0x104], eax
mov eax, dword [esi]
push ecx
add eax, edx
lea ecx, [ebp - 0x104]
push eax
call fcn.1001cbe0
xor ecx, ecx
test al, al
pop esi
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
Function at 0x10041ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
mov dword [ebp - 0x30], 0x1550015
push esi
mov esi, dword [ecx + 4]
push edi
lea eax, [ebx + 0x15]
mov dword [ebp - 0x2c], 0x3ec028b
mov dword [ebp - 0x28], 0x5c40483
mov dword [ebp - 0x24], 0x73306e0
mov dword [ebp - 0x20], 0x98908c0
mov dword [ebp - 0x1c], 0xbe00a45
mov dword [ebp - 0x18], 0xd450c89
mov dword [ebp - 0x14], 0xf890ee8
mov dword [ebp - 0x10], 0x11e41045
mov dword [ebp - 0xc], 0x13451289
mov word [ebp - 8], 0x14ec
mov byte [ebp - 6], 0xb8
mov dword [ebp - 0xb4], 0x1500040
mov dword [ebp - 0xb0], 0x3de02e8
mov dword [ebp - 0xac], 0x5ff04ff
mov dword [ebp - 0xa8], 0x75806ff
mov dword [ebp - 0xa4], 0x92008e8
mov dword [ebp - 0xa0], 0xbff0ae0
mov dword [ebp - 0x9c], 0xdc30cff
mov dword [ebp - 0x98], 0xf400e8d
mov dword [ebp - 0x94], 0x11501000
mov dword [ebp - 0x90], 0x13e01289
mov dword [ebp - 0x8c], 0x15d11489
mov dword [ebp - 0x88], 0x17d21631
mov dword [ebp - 0x84], 0x192c18e8
mov dword [ebp - 0x80], 0x1b001a06
mov dword [ebp - 0x7c], 0x1d581c00
mov dword [ebp - 0x78], 0x1f8b1ec3
mov dword [ebp - 0x74], 0x215320c0
mov dword [ebp - 0x70], 0x23832256
mov dword [ebp - 0x6c], 0x25d424c4
mov dword [ebp - 0x68], 0x27f2268b
mov dword [ebp - 0x64], 0x29d8288b
mov dword [ebp - 0x60], 0x2b732a3b
mov dword [ebp - 0x5c], 0x2d742c1c
mov dword [ebp - 0x58], 0x2f8b2e4b
mov dword [ebp - 0x54], 0x31e830c3
mov dword [ebp - 0x50], 0x33ff32af
mov dword [ebp - 0x4c], 0x35ff34ff
mov dword [ebp - 0x48], 0x37c6368b
mov dword [ebp - 0x44], 0x39433889
mov dword [ebp - 0x40], 0x3b853a1c
mov dword [ebp - 0x3c], 0x3d743cf6
mov dword [ebp - 0x38], 0x3f543e3b
mov byte [ebp - 0x34], 0x50
cmp eax, esi
jae 0x100420cf
mov edi, dword [ecx]
lea eax, [ebp - 0x30]
mov dword [ebp - 0xb8], eax
lea ecx, [ebp - 0xb8]
sub esi, ebx
push esi
lea eax, [edi + ebx]
push eax
call fcn.1001cbe0
test al, al
je 0x100420cf
mov al, byte [edi + ebx + 0x15]
xor ecx, ecx
cmp al, 0xe8
jne 0x1004208f
mov ecx, 0x1c78
jmp 0x10042098
cmp al, 0x54
jne 0x10042098
mov ecx, 0x1be4
lea eax, [ebp - 0xb4]
sub edi, ecx
mov dword [ebp - 0xb8], eax
add edi, ebx
lea eax, [esi + ecx]
push eax
push edi
lea ecx, [ebp - 0xb8]
call fcn.1001cbe0
test al, al
je 0x100420cf
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b37df
mov esp, ebp
pop ebp
ret
Function at 0x10045f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0x20]
cmp eax, 5
ja case.default.0x10045f13
push esi
jmp dword [eax*4 + 0x10046044]
xor esi, esi
cmp dword [edx + 0x1c], esi
jne 0x10045f35
mov al, byte [edx + 0x14]
add byte [esi + ecx], al
inc esi
cmp esi, 0x80
jb 0x10045f21
pop esi
mov al, 1
pop ebp
ret
mov eax, dword [edx + 0x14]
add dword [esi + ecx], eax
add esi, 4
cmp esi, 0x80
jb 0x10045f35
pop esi
mov al, 1
pop ebp
ret
xor esi, esi
cmp dword [edx + 0x1c], esi
jne 0x10045f66
mov al, byte [edx + 0x14]
sub byte [esi + ecx], al
inc esi
cmp esi, 0x80
jb 0x10045f52
pop esi
mov al, 1
pop ebp
ret
mov eax, dword [edx + 0x14]
sub dword [esi + ecx], eax
add esi, 4
cmp esi, 0x80
jb 0x10045f66
pop esi
mov al, 1
pop ebp
ret
xor esi, esi
cmp dword [edx + 0x1c], esi
jne 0x10045f97
mov al, byte [edx + 0x14]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x80
jb 0x10045f83
pop esi
mov al, 1
pop ebp
ret
mov eax, dword [edx + 0x14]
xor dword [esi + ecx], eax
add esi, 4
cmp esi, 0x80
jb 0x10045f97
pop esi
mov al, 1
pop ebp
ret
cmp dword [edx + 0x1c], 0
jne 0x10045fc6
xor edx, edx
not byte [edx + ecx]
inc edx
cmp edx, 0x80
jb 0x10045fb5
pop esi
mov al, 1
pop ebp
ret
xor edx, edx
jmp 0x10045fd0
not dword [edx + ecx]
add edx, 4
cmp edx, 0x80
jb 0x10045fd0
pop esi
mov al, 1
pop ebp
ret
xor eax, eax
cmp dword [edx + 0x1c], eax
jne 0x10046000
lea ebx, [ebx]
inc byte [eax + ecx]
inc eax
cmp eax, 0x80
jb 0x10045ff0
pop esi
mov al, 1
pop ebp
ret
inc dword [eax + ecx]
add eax, 4
cmp eax, 0x80
jb 0x10046000
pop esi
mov al, 1
pop ebp
ret
xor eax, eax
cmp dword [edx + 0x1c], eax
jne 0x10046030
lea esp, [esp]
dec byte [eax + ecx]
inc eax
cmp eax, 0x80
jb 0x10046020
pop esi
mov al, 1
pop ebp
ret
dec dword [eax + ecx]
add eax, 4
cmp eax, 0x80
jb 0x10046030
pop esi
mov al, 1
pop ebp
ret
Function at 0x10046580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ecx + 4]
mov dword [ebp - 0xb4], 0x155001f
mov dword [ebp - 0xb0], 0x3ec028b
mov dword [ebp - 0xac], 0x5ff046a
mov dword [ebp - 0xa8], 0xf680a68
mov dword [ebp - 0xa4], 0x11a11064
mov dword [ebp - 0xa0], 0x13001200
mov dword [ebp - 0x9c], 0x15001400
mov dword [ebp - 0x98], 0x17641650
mov dword [ebp - 0x94], 0x19251889
mov dword [ebp - 0x90], 0x1b001a00
mov dword [ebp - 0x8c], 0x1d001c00
mov dword [ebp - 0x88], 0x1fec1e83
mov dword [ebp - 0x84], 0x21532058
mov dword [ebp - 0x80], 0x23572256
mov dword [ebp - 0x7c], 0x26652489
mov word [ebp - 0x78], 0x27ff
mov byte [ebp - 0x76], 0x15
mov dword [ebp - 0x38], 0x1ff0018
mov dword [ebp - 0x34], 0x3240274
mov dword [ebp - 0x30], 0x9e80404
mov dword [ebp - 0x2c], 0xb680a59
mov dword [ebp - 0x28], 0xd000cff
mov dword [ebp - 0x24], 0xf000e00
mov dword [ebp - 0x20], 0x151510ff
mov dword [ebp - 0x1c], 0x178b16c3
mov dword [ebp - 0x18], 0x1924184c
mov dword [ebp - 0x14], 0x1fa11a04
mov dword [ebp - 0x10], 0x250d2089
mov dword [ebp - 0xc], 0x2ba126c3
mov byte [ebp - 8], 0xc3
mov dword [ebp - 0x74], 0x168001c
mov dword [ebp - 0x70], 0x3100200
mov dword [ebp - 0x6c], 0x5000400
mov dword [ebp - 0x68], 0x794060f
mov dword [ebp - 0x64], 0x95008c0
mov dword [ebp - 0x60], 0xf150aff
mov dword [ebp - 0x5c], 0x11c01085
mov dword [ebp - 0x58], 0x165012a3
mov dword [ebp - 0x54], 0x18151774
mov dword [ebp - 0x50], 0x1aa919e8
mov dword [ebp - 0x4c], 0x1c001b00
mov dword [ebp - 0x48], 0x1e851d00
mov dword [ebp - 0x44], 0x20751fc0
mov dword [ebp - 0x40], 0x22ff210f
mov byte [ebp - 0x3c], 0x35
cmp edx, esi
jae 0x1004679c
lea eax, [edx + 0x194]
cmp eax, esi
jae 0x1004679c
push edi
mov edi, dword [ecx]
lea eax, [ebp - 0xb4]
sub esi, edx
mov dword [ebp - 0xb8], eax
add edi, edx
lea ecx, [ebp - 0xb8]
push esi
push edi
call fcn.1001cbe0
test al, al
je 0x1004674f
lea eax, [ebp - 0x38]
mov dword [ebp - 0xb8], eax
lea ecx, [ebp - 0xb8]
lea eax, [esi - 0x129]
push eax
lea eax, [edi + 0x129]
push eax
call fcn.1001cbe0
test al, al
jne 0x10046761
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x74]
mov dword [ebp - 0xb8], eax
lea ecx, [ebp - 0xb8]
lea eax, [esi - 0x178]
push eax
lea eax, [edi + 0x178]
push eax
call fcn.1001cbe0
xor ecx, ecx
test al, al
pop edi
setne cl
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100b37df
mov esp, ebp
pop ebp
ret
Function at 0x100467b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b65a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edx + 0x14]
test ecx, ecx
je 0x100467e9
mov ecx, dword [ecx + 0x84]
jmp 0x100467eb
xor ecx, ecx
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
sar eax, 2
test ax, ax
je 0x100469bb
mov esi, dword [ebp + 8]
lea eax, [esi + 0x39]
cmp eax, dword [edi + 4]
jae 0x100469bb
mov eax, dword [edi]
cmp byte [eax + esi], 0x60
jne 0x100469bb
cmp byte [eax + esi + 1], 0xe8
jne 0x100469bb
cmp byte [eax + esi + 2], 0
jne 0x100469bb
cmp byte [eax + esi + 3], 0
jne 0x100469bb
cmp byte [eax + esi + 4], 0
jne 0x100469bb
cmp byte [eax + esi + 5], 0
jne 0x100469bb
cmp byte [eax + esi + 6], 0x8b
jne 0x100469bb
cmp byte [eax + esi + 7], 0x2c
jne 0x100469bb
cmp byte [eax + esi + 8], 0x24
jne 0x100469bb
cmp byte [eax + esi + 9], 0x83
jne 0x100469bb
cmp byte [eax + esi + 0xa], 0xc4
jne 0x100469bb
cmp byte [eax + esi + 0xb], 4
jne 0x100469bb
cmp byte [eax + esi + 0xc], 0x81
jne 0x100469bb
cmp byte [eax + esi + 0xd], 0xed
jne 0x100469bb
cmp byte [eax + esi + 0xe], 0xb
jne 0x100469bb
cmp byte [eax + esi + 0xf], 0x10
jne 0x100469bb
mov bl, byte [eax + esi + 0x21]
lea ecx, [ebp - 0x1c]
push 0x14
call fcn.100940a0
mov dword [ebp - 4], 0
mov edx, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 4
mov eax, dword [edi]
add eax, edx
movzx eax, byte [eax + esi + 0x24]
xor al, bl
mov byte [ecx + edx - 1], al
mov eax, dword [edi]
add eax, edx
movzx eax, byte [eax + esi + 0x25]
xor al, bl
mov byte [edx + ecx], al
mov eax, dword [edi]
add eax, edx
movzx eax, byte [eax + esi + 0x26]
xor al, bl
mov byte [edx + ecx + 1], al
mov eax, dword [edi]
add eax, edx
movzx eax, byte [eax + esi + 0x27]
xor al, bl
mov byte [edx + ecx + 2], al
mov eax, dword [edi]
add eax, edx
movzx eax, byte [eax + esi + 0x28]
xor al, bl
mov byte [edx + ecx + 3], al
add edx, 5
dec dword [ebp - 0x10]
jne 0x100468e1
cmp byte [ecx], 0xff
jne 0x10046996
cmp byte [ecx + 1], 0x74
jne 0x10046996
cmp byte [ecx + 2], 0x24
jne 0x10046996
cmp byte [ecx + 3], 0x20
jne 0x10046996
cmp byte [ecx + 4], 0xe8
jne 0x10046996
cmp byte [ecx + 5], 0x2d
jne 0x10046996
cmp byte [ecx + 6], 0
jne 0x10046996
cmp byte [ecx + 7], 0
jne 0x10046996
cmp byte [ecx + 8], 0
jne 0x10046996
cmp byte [ecx + 9], 0xb
jne 0x10046996
cmp byte [ecx + 0xa], 0xc0
jne 0x10046996
cmp byte [ecx + 0xb], 0x74
jne 0x10046996
cmp byte [ecx + 0xc], 0x14
jne 0x10046996
cmp byte [ecx + 0xd], 0x89
jne 0x10046996
cmp byte [ecx + 0xe], 0x85
jne 0x10046996
cmp byte [ecx + 0xf], 0x41
jne 0x10046996
mov bl, 1
jmp 0x10046998
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100941a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10048510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ecx + 4]
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x4e80002
mov byte [ebp - 8], 0
mov dword [ebp - 0x50], 0x1560020
mov dword [ebp - 0x4c], 0x3720269
mov dword [ebp - 0x48], 0x5730475
mov dword [ebp - 0x44], 0x7570620
mov dword [ebp - 0x40], 0x9650865
mov dword [ebp - 0x3c], 0xb200a44
mov dword [ebp - 0x38], 0xd310c76
mov dword [ebp - 0x34], 0xf310e2e
mov dword [ebp - 0x30], 0x114d1020
mov dword [ebp - 0x2c], 0x13641261
mov dword [ebp - 0x28], 0x15201465
mov dword [ebp - 0x24], 0x176e1669
mov dword [ebp - 0x20], 0x19421820
mov dword [ebp - 0x1c], 0x1b6c1a65
mov dword [ebp - 0x18], 0x1d721c61
mov dword [ebp - 0x14], 0x1f731e75
mov byte [ebp - 0x10], 0x21
cmp edi, esi
jae 0x10048608
mov ecx, dword [ecx]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x54], eax
mov eax, esi
sub eax, edi
mov dword [ebp - 0x58], ecx
push eax
lea eax, [ecx + edi]
push eax
lea ecx, [ebp - 0x54]
call fcn.1001cbe0
test al, al
je 0x10048608
cmp esi, 0x1c
jbe 0x10048608
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x54]
lea eax, [esi - 0x1c]
push eax
mov eax, dword [ebp - 0x58]
add eax, 0x1c
push eax
call fcn.1001cbe0
test al, al
je 0x10048608
mov dword [ebx], edi
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b37df
mov esp, ebp
pop ebp
ret
Function at 0x10048620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ecx + 4]
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x1600003
mov word [ebp - 8], 0x5e8
mov byte [ebp - 6], 0
mov dword [ebp - 0x4c], 0x156001f
mov dword [ebp - 0x48], 0x3720269
mov dword [ebp - 0x44], 0x5730475
mov dword [ebp - 0x40], 0x7570620
mov dword [ebp - 0x3c], 0x9650865
mov dword [ebp - 0x38], 0xb200a44
mov dword [ebp - 0x34], 0xd2e0c32
mov dword [ebp - 0x30], 0xf200e30
mov dword [ebp - 0x2c], 0x1161104d
mov dword [ebp - 0x28], 0x13651264
mov dword [ebp - 0x24], 0x15691420
mov dword [ebp - 0x20], 0x1720166e
mov dword [ebp - 0x1c], 0x19651842
mov dword [ebp - 0x18], 0x1b611a6c
mov dword [ebp - 0x14], 0x1d751c72
mov word [ebp - 0x10], 0x1e73
mov byte [ebp - 0xe], 0x21
cmp edi, esi
jae 0x1004871d
mov ecx, dword [ecx]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x50], eax
mov eax, esi
sub eax, edi
mov dword [ebp - 0x54], ecx
push eax
lea eax, [ecx + edi]
push eax
lea ecx, [ebp - 0x50]
call fcn.1001cbe0
test al, al
je 0x1004871d
cmp esi, 0x1c
jbe 0x1004871d
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x50]
lea eax, [esi - 0x1c]
push eax
mov eax, dword [ebp - 0x54]
add eax, 0x1c
push eax
call fcn.1001cbe0
test al, al
je 0x1004871d
mov dword [ebx], edi
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b37df
mov esp, ebp
pop ebp
ret
Function at 0x1004af00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, ecx
mov dword [ebp - 0xd0], 0x1e80064
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xcc], 0x3000200
mov dword [ebp - 0xc8], 0x5000400
mov eax, dword [edx + 4]
mov dword [ebp - 0xc4], 0x781065b
mov dword [ebp - 0xc0], 0x90508eb
mov dword [ebp - 0xbc], 0xb400a10
mov dword [ebp - 0xb8], 0xd8b0c00
mov dword [ebp - 0xb4], 0xf0d0e83
mov dword [ebp - 0xb0], 0x11401016
mov dword [ebp - 0xac], 0x13501200
mov dword [ebp - 0xa8], 0x155714b8
mov dword [ebp - 0xa4], 0x1721166a
mov dword [ebp - 0xa0], 0x19ba182b
mov dword [ebp - 0x9c], 0x1b001a02
mov dword [ebp - 0x98], 0x1d001c00
mov dword [ebp - 0x94], 0x1fb41ee8
mov dword [ebp - 0x90], 0x21002001
mov dword [ebp - 0x8c], 0x23832200
mov dword [ebp - 0x88], 0x250024cf
mov dword [ebp - 0x84], 0x2784260f
mov dword [ebp - 0x80], 0x29012896
mov dword [ebp - 0x7c], 0x2b002a00
mov dword [ebp - 0x78], 0x2dbb2c89
mov dword [ebp - 0x74], 0x2f162e11
mov dword [ebp - 0x70], 0x31003040
mov dword [ebp - 0x6c], 0x335732b8
mov dword [ebp - 0x68], 0x3521346a
mov dword [ebp - 0x64], 0x37ba362b
mov dword [ebp - 0x60], 0x39003803
mov dword [ebp - 0x5c], 0x3b003a00
mov dword [ebp - 0x58], 0x3d963ce8
mov dword [ebp - 0x54], 0x3f003e01
mov dword [ebp - 0x50], 0x41834000
mov dword [ebp - 0x4c], 0x430042cf
mov dword [ebp - 0x48], 0x4584440f
mov dword [ebp - 0x44], 0x47014678
mov dword [ebp - 0x40], 0x49004800
mov dword [ebp - 0x3c], 0x4bbb4a89
mov dword [ebp - 0x38], 0x4d164c15
mov dword [ebp - 0x34], 0x4f004e40
mov dword [ebp - 0x30], 0x515750b8
mov dword [ebp - 0x2c], 0x5322526a
mov dword [ebp - 0x28], 0x55ba542b
mov dword [ebp - 0x24], 0x57005601
mov dword [ebp - 0x20], 0x59005800
mov dword [ebp - 0x1c], 0x5b785ae8
mov dword [ebp - 0x18], 0x5d005c01
mov dword [ebp - 0x14], 0x5f835e00
mov dword [ebp - 0x10], 0x610060cf
mov dword [ebp - 0xc], 0x6384620f
mov byte [ebp - 8], 0x5a
cmp ecx, eax
jae 0x1004b0ec
sub eax, ecx
push esi
push eax
mov eax, dword [edx]
lea esi, [ebp - 0xd0]
add eax, ecx
mov dword [ebp - 0xd4], esi
push eax
lea ecx, [ebp - 0xd4]
call fcn.1001cbe0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
Function at 0x100501f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, ecx
mov dword [ebp - 0x50], 0x1550025
mov ecx, dword [ebp + 8]
push esi
push edi
mov esi, dword [edx + 4]
mov dword [ebp - 0x4c], 0x3ec028b
mov dword [ebp - 0x48], 0x5ff046a
mov dword [ebp - 0x44], 0xf680a68
mov dword [ebp - 0x40], 0x11a11064
mov dword [ebp - 0x3c], 0x13001200
mov dword [ebp - 0x38], 0x15001400
mov dword [ebp - 0x34], 0x17641650
mov dword [ebp - 0x30], 0x19251889
mov dword [ebp - 0x2c], 0x1b001a00
mov dword [ebp - 0x28], 0x1d001c00
mov dword [ebp - 0x24], 0x1fec1e83
mov dword [ebp - 0x20], 0x21532068
mov dword [ebp - 0x1c], 0x23572256
mov dword [ebp - 0x18], 0x26652489
mov dword [ebp - 0x14], 0x28db2733
mov dword [ebp - 0x10], 0x2b5d2989
mov dword [ebp - 0xc], 0x2d022c6a
mov word [ebp - 8], 0x2eff
mov byte [ebp - 6], 0x15
mov dword [ebp - 0xac], 0x168002c
mov dword [ebp - 0xa8], 0x3000200
mov dword [ebp - 0xa4], 0x5000403
mov dword [ebp - 0xa0], 0x7000668
mov dword [ebp - 0x9c], 0x9010800
mov dword [ebp - 0x98], 0xbe80a00
mov dword [ebp - 0x94], 0xd000c1b
mov dword [ebp - 0x90], 0xf000e00
mov dword [ebp - 0x8c], 0x11591059
mov dword [ebp - 0x88], 0x133312c3
mov dword [ebp - 0x84], 0x15c314c0
mov dword [ebp - 0x80], 0x17cc16c3
mov dword [ebp - 0x7c], 0x19cc18cc
mov dword [ebp - 0x78], 0x1bcc1acc
mov dword [ebp - 0x74], 0x1dcc1ccc
mov dword [ebp - 0x70], 0x1fcc1ecc
mov dword [ebp - 0x6c], 0x21cc20cc
mov dword [ebp - 0x68], 0x23cc22cc
mov dword [ebp - 0x64], 0x25ff24cc
mov dword [ebp - 0x60], 0x2bff2a25
mov dword [ebp - 0x5c], 0x31483025
mov dword [ebp - 0x58], 0x3300321a
mov byte [ebp - 0x54], 0
cmp ecx, esi
jae 0x100503c0
lea eax, [ecx + 0x16a]
cmp eax, esi
jae 0x100503c0
mov edi, dword [edx]
lea eax, [ebp - 0x50]
sub esi, ecx
mov dword [ebp - 0xb0], eax
add edi, ecx
lea ecx, [ebp - 0xb0]
push esi
push edi
call fcn.1001cbe0
test al, al
je 0x100503c0
lea eax, [ebp - 0xac]
mov dword [ebp - 0xb0], eax
lea ecx, [ebp - 0xb0]
lea eax, [esi - 0x16a]
push eax
lea eax, [edi + 0x16a]
push eax
call fcn.1001cbe0
test al, al
je 0x100503c0
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100b37df
mov esp, ebp
pop ebp
ret
Function at 0x10050c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ecx + 4]
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 0x9f6]
cmp eax, edx
ja 0x10050e4e
mov dword [ebp - 0xec], 0x1830072
mov dword [ebp - 0xe8], 0x35802ec
mov dword [ebp - 0xe4], 0x5570456
mov dword [ebp - 0xe0], 0x7700668
mov dword [ebp - 0xdc], 0x9400817
mov dword [ebp - 0xd8], 0xbe80a00
mov dword [ebp - 0xd4], 0xd030c01
mov dword [ebp - 0xd0], 0xf000e00
mov dword [ebp - 0xcc], 0x1188108d
mov dword [ebp - 0xc8], 0x13011258
mov dword [ebp - 0xc4], 0x15001400
mov dword [ebp - 0xc0], 0x17b8168d
mov dword [ebp - 0xbc], 0x19001880
mov dword [ebp - 0xb8], 0x1b001a00
mov dword [ebp - 0xb4], 0x1d441c89
mov dword [ebp - 0xb0], 0x1f601e24
mov dword [ebp - 0xac], 0x214c2089
mov dword [ebp - 0xa8], 0x232c2224
mov dword [ebp - 0xa4], 0x2509248b
mov dword [ebp - 0xa0], 0x27f0268b
mov dword [ebp - 0x9c], 0x2907288b
mov dword [ebp - 0x98], 0x2bc42a83
mov dword [ebp - 0x94], 0x2d852c04
mov dword [ebp - 0x90], 0x2f892ec9
mov dword [ebp - 0x8c], 0x3124304c
mov dword [ebp - 0x88], 0x33893224
mov dword [ebp - 0x84], 0x3524347c
mov dword [ebp - 0x80], 0x37893620
mov dword [ebp - 0x7c], 0x39243844
mov dword [ebp - 0x78], 0x3b743a1c
mov dword [ebp - 0x74], 0x3d8b3c0a
mov dword [ebp - 0x70], 0x3f243e4c
mov dword [ebp - 0x6c], 0x41894064
mov dword [ebp - 0x68], 0x4324424c
mov dword [ebp - 0x64], 0x45eb4408
mov dword [ebp - 0x60], 0x47684619
mov dword [ebp - 0x5c], 0x49104880
mov dword [ebp - 0x58], 0x4b004a40
mov dword [ebp - 0x54], 0x4dc04ce8
mov dword [ebp - 0x50], 0x4f004e02
mov dword [ebp - 0x4c], 0x518b5000
mov dword [ebp - 0x48], 0x5388528e
mov dword [ebp - 0x44], 0x55005400
mov dword [ebp - 0x40], 0x57835600
mov dword [ebp - 0x3c], 0x590458c4
mov dword [ebp - 0x38], 0x5bc15a2b
mov dword [ebp - 0x34], 0x5d445c89
mov dword [ebp - 0x30], 0x5f085e24
mov dword [ebp - 0x2c], 0x6107608b
mov dword [ebp - 0x28], 0x6354628b
mov dword [ebp - 0x24], 0x65086424
mov dword [ebp - 0x20], 0x678e668b
mov dword [ebp - 0x1c], 0x69016854
mov dword [ebp - 0x18], 0x6b006a00
mov dword [ebp - 0x14], 0x6dc26c03
mov dword [ebp - 0x10], 0x6fc96e85
mov dword [ebp - 0xc], 0x71447089
mov byte [ebp - 8], 0x24
cmp esi, edx
jae 0x10050e4e
lea eax, [ebp - 0xec]
sub edx, esi
mov dword [ebp - 0xf0], eax
mov eax, dword [ecx]
lea ecx, [ebp - 0xf0]
push edx
add eax, esi
push eax
call fcn.1001cbe0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.100b37df
mov esp, ebp
pop ebp
ret