joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f739
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.10036e19
add esp, 0xc
rol ecx, 0
je 0x1001f757
jne 0x1001f759
js 0x1001f76c
pushf
cld
rol esp, 0
popf
jmp 0x1001f765
xchg edi, eax
xchg edi, eax
jns 0x1001f769
jns 0x1001f76c
call 0x54ee3d36
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
xor ebx, eax
xor ebx, eax
xor edi, 0x6660
xor edi, 0x6660
add esp, 0
jb 0x1001f7c8
pushf
stc
test esp, 0xa68
inc edx
dec edx
jns 0x1001f7be
popf
jp 0x1001f7c2
lea esp, [esp]
jae 0x1001f7c8
mov eax, 0x80ec4d8a
jmp 0xfc4f7fd2
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.1001f15f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001f83d
xor eax, eax
jmp 0x1001f8c6
stc
jp 0x1001f855
pushf
xor eax, esi
xor eax, esi
xchg ecx, ebx
xchg ecx, ebx
xchg ebx, ebx
popf
jg 0x1001f850
je 0x1001f852
jnp 0x1001f855
mov ebx, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.1001f190
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1001f87f
xor eax, eax
jmp 0x1001f8c6
xor edi, dword [esp + 4]
xor edi, dword [esp + 4]
rol esp, 0
ror ebx, 0
shr esp, 0
js 0x1001f897
mov edi, edi
jns 0x1001f897
ljmp 0xcfe8:0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.1003a66f
add esp, 4
rol edi, 0x16
rol edi, 0xa
shr eax, 0
and edi, edi
rol edx, 0
jg 0x1001f8bf
jno 0x1001f8b5
jb 0x1001f8b7
jmp 0x1001f8b9
jbe 0x1001f8bb
jle 0x1001f8bf
mov esi, 0x84d8b93
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10021127
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.10036e19
add esp, 0xc
push 0x21
push 0x10014558
lea ecx, [ebp - 0x138]
push ecx
call fcn.1001d37e
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x1002122f
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.10036e19
add esp, 0xc
push 0xb
push 0x1001457c
lea edx, [ebp - 0x138]
push edx
call fcn.1001d37e
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x10021222
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1001d37e
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x10021231
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100256cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.10036e19
add esp, 0xc
ror ebx, 0x14
ror ebx, 0xc
lea edi, [edi + 0x2d75]
lea edi, [edi - 0x2d75]
jns 0x1002570b
jo 0x10025701
jp 0x10025703
je 0x10025705
jmp 0x10025707
js 0x1002570b
mov ecx, 0xec45c684
inc edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x42
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], 0x58
mov byte [ebp - 0xb], 0x78
jg 0x1002573d
jle 0x10025762
pushf
jb 0x10025743
clc
add esp, 0
rol ebx, 0x10
ror ebx, 0x10
popf
jg 0x10025751
jbe 0x10025753
lea ebx, [ebx + 0x2ebd]
lea ebx, [ebx - 0x2ebd]
jg 0x10025762
xor eax, 0x80ec4d8a
jmp 0xfc4fdf6c
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.100174a7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100257d7
xor eax, eax
jmp 0x100259f3
add edi, dword [esp]
sub edi, dword [esp]
jae 0x100257df
jg 0x100257f1
pushf
shr edx, 0
popf
jb 0x100257ea
jbe 0x100257ec
jge 0x100257ee
jle 0x100257f1
mov edx, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001f190
mov dword [ebp - 0x18], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.10036e19
add esp, 0xc
sub esi, 0
jb 0x10025821
pushf
jl 0x1002581a
popf
xchg esi, eax
xchg esi, eax
jae 0x10025821
jmp 0x10ead5a8
cmp dword [ebp - 0x18], 0
jne 0x1002582e
xor eax, eax
jmp 0x100259f3
lea esp, [esp]
call fcn.10025836
Function at 0x1002777e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
mov ax, word [0x1000ada4]
cmp eax, 1
jne 0x1002779f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1002793f
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.10036e19
add esp, 0xc
nop
ja 0x100277ca
pushf
rol ecx, 0xa
rol ecx, 0x16
add esi, 0
test edx, esi
popf
xchg esp, esp
je 0x100277c5
xchg ecx, eax
xchg ecx, eax
jbe 0x100277ca
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
add esp, 0
jg 0x10027823
pushf
xchg esi, esi
xchg ebx, ebx
lea esp, [esp]
jb 0x1002780e
popf
jp 0x10027812
lea ebx, [ebx + 0x4281]
lea ebx, [ebx - 0x4281]
mov edx, edx
jle 0x10027823
mov esp, 0x80e8558a
ljmp 0x458a
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
dec edx
inc edx
rol esp, 0
sub ebx, 0
js 0x100278a2
xchg ecx, edi
xchg ecx, edi
lea eax, [eax]
jno 0x1002789d
jp 0x1002789f
jns 0x100278a2
ljmp 0x89ff:0xff78b8e8
call fcn.1001f15f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100278b7
xor eax, eax
jmp 0x1002793f
add ebx, 0
xor esp, 0
mov esp, esp
test edi, 0x3bf4
jnp 0x100278d2
mov esp, esp
jo 0x100278cb
jl 0x100278cd
jp 0x100278d2
mov esi, 0x558dc928
call 0x848042b
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.1001f190
mov dword [ebp - 4], eax
shl ebx, 0
xchg esi, ebx
xchg esi, ebx
clc
jb 0x100278f7
xchg esi, eax
xchg esi, eax
jns 0x100278f0
je 0x100278f2
xchg edi, edi
jae 0x100278f7
call 0x106c8665
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x10027911
xor eax, eax
jmp 0x1002793f
jmp 0x10027913
jp 0x10027915
inc edi
dec edi
jne 0x10027923
jnp 0x1002791b
xchg ecx, ecx
ja 0x1002791f
je 0x10027923
mov edx, 0xfc558bca
mov edx, dword [ebp - 4]
push edx
call fcn.1003a66f
add esp, 4
mov edi, edi
jl 0x1002793c
jb 0x10027935
js 0x10027937
jge 0x1002793c
sbb dword [ebx - 0x3aa00ba], 0x8b5b5e5f
in eax, 0x5d
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100292fd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.10036e19
add esp, 0xc
push ecx
pop ecx
js 0x10029332
pushf
lea edi, [edi]
clc
popf
lea esi, [esi + 0xad5]
lea esi, [esi - 0xad5]
mov edx, edx
jns 0x10029332
xor eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
xor eax, 0x56e1
xor eax, 0x56e1
shl edx, 0
jl 0x10029371
jbe 0x10029386
pushf
test esi, 0x2b8a
xchg esi, esi
jle 0x1002937f
popf
mov ebx, ebx
ja 0x10029386
xor eax, 0x80f44d8a
jmp 0x4501b90
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
or edx, edx
ror esi, 0xc
ror esi, 0x14
jnp 0x100293f0
ror edi, 0
jp 0x100293fd
je 0x100293f7
jp 0x100293f9
jnp 0x100293fd
mov edx, 0xc1bae81f
add byte [eax], al
call fcn.100355bc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10029415
mov eax, 1
jmp 0x100294b0
cmp ebx, esi
je 0x10029424
xchg esi, ebx
xchg esi, ebx
jge 0x1002941f
jle 0x10029421
jne 0x10029424
mov edi, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1001f190
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.10036e19
add esp, 0xc
and edx, edx
jb 0x10029454
xchg edi, edi
xchg edx, edx
jns 0x1002944e
lea ecx, [ecx]
jae 0x10029454
jmp 0xfc801848
cmp dword [ebp - 0x14], 0
jne 0x10029461
mov eax, 1
jmp 0x100294b0
xor ecx, esi
xor ecx, esi
rol esp, 0
ror edx, 0
jne 0x10029489
pushf
xchg esi, edi
xchg esi, edi
popf
lea eax, [eax + 0x762b]
lea eax, [eax - 0x762b]
nop
xchg esi, edi
xchg esi, edi
je 0x10029489
mov edx, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.1003a66f
add esp, 4
js 0x10029497
lea esi, [esi]
jle 0x1002949b
xchg ebx, ebx
jl 0x100294a9
js 0x100294a1
je 0x100294a3
ja 0x100294a5
jge 0x100294a9
xor eax, 0x84d8b17
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002fa50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.10036e19
add esp, 0xc
jno 0x1002fa6b
jl 0x1002fa76
jle 0x1002fa6f
xchg esi, ecx
xchg esi, ecx
jge 0x1002fa76
mov esi, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
mov ebx, ebx
jnp 0x1002fac7
jae 0x1002fab4
jp 0x1002fab6
lea edi, [edi + 0x6ec5]
lea edi, [edi - 0x6ec5]
xchg edi, edi
jp 0x1002fac7
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.100174a7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002fb4a
xor eax, eax
jmp 0x1002fbb2
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.1001f190
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x1002fbb0
jle 0x1002fb72
xor eax, 0
jg 0x1002fb7e
je 0x1002fb79
mov edi, edi
jle 0x1002fb7e
mov ebp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.1003a66f
add esp, 4
ja 0x1002fb8c
push ecx
pop ecx
ja 0x1002fb9b
pushf
jno 0x1002fb94
popf
lea eax, [eax]
jbe 0x1002fb9b
mov ecx, 0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x1002fbb2
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002fd37
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.10036e19
add esp, 0xc
lea esp, [esp]
cmp edx, 0x2b61
jge 0x1002fd6c
pushf
shl esp, 0
jne 0x1002fd62
shl esp, 0
popf
jge 0x1002fd69
jl 0x1002fd6c
call 0x60ef4336
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
xchg esi, esi
lea ebx, [ebx + 0x689c]
sub ebx, 0x689c
je 0x1002fdac
js 0x1002fdb3
mov ecx, ecx
jns 0x1002fdb3
ljmp 0x1e9:0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.1001f15f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002fe25
xor eax, eax
jmp 0x1002fea3
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.1001f190
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x1002fea1
test ebx, 0x285c
or esp, 0
ror esp, 0
jno 0x1002fe6d
pushf
ror ecx, 5
ror ecx, 0x1b
stc
popf
mov ebx, ebx
js 0x1002fe68
js 0x1002fe6a
jo 0x1002fe6d
mov ebx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.1003a66f
add esp, 4
mov ebx, ebx
xor ecx, 0xdb9
xor ecx, 0xdb9
stc
jg 0x1002fe90
jnp 0x1002fe8c
jle 0x1002fe90
sbb ebp, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x1002fea3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10031294
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.10036e19
add esp, 0xc
cmp esp, 0x1011
je 0x100312bc
jns 0x100312b7
mov ebx, ebx
jne 0x100312bc
xor eax, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
add ebx, dword [esp]
sub ebx, dword [esp]
add edi, 0
jb 0x10031310
pushf
jnp 0x10031307
jl 0x10031309
popf
mov ecx, ecx
jae 0x10031310
mov ecx, 0x80ec4d8a
jmp 0xfc509b1a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.1001f15f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003139a
jmp 0x10031418
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001f190
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x10031418
dec ecx
inc ecx
jg 0x100313d6
pushf
or ebx, ebx
cmc
neg ebx
neg ebx
popf
lea eax, [eax]
jl 0x100313d3
jle 0x100313d6
mov eax, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.1003a66f
add esp, 4
xchg esp, esp
je 0x10031405
pushf
cmp esp, 0x2742
lea edx, [edx + 0x603b]
sub edx, 0x603b
lea ebx, [ebx]
popf
jge 0x10031400
mov edi, edi
jne 0x10031405
mov esp, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10031421
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.10036e19
add esp, 0xc
test dword [esp + 0x10], edx
xor ebx, 0
and esp, 0xffffffff
cmp esi, dword [esp]
jnp 0x10031464
pushf
inc ebx
dec ebx
add edi, 0x5fbf
sub edi, 0x5fbf
rol edx, 1
ror edx, 1
popf
jae 0x10031461
jp 0x10031464
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x55
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0
shl ebx, 0
add edi, dword [esp]
sub edi, dword [esp]
test esp, 0x489a
cmc
jae 0x100314c1
pushf
jno 0x100314ae
test esp, 0x3a63
mov esp, esp
jae 0x100314b8
popf
je 0x100314bc
xchg edx, edx
jb 0x100314c1
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
call fcn.1001f15f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10031539
jmp 0x100315b4
cmp esi, ecx
sub esp, 0
jl 0x1003154c
jp 0x10031542
jl 0x10031544
xchg ecx, edx
xchg ecx, edx
jge 0x1003154c
add eax, 0xe84d8df7
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.1001f190
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x100315b4
xor eax, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
xchg ecx, ebx
xchg ecx, ebx
jl 0x10031585
jb 0x10031582
jge 0x10031585
mov ebp, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.1003a66f
add esp, 4
push edi
add edi, 0x3f6b
ror edi, 0x15
pop edi
jle 0x1003159e
jns 0x100315ad
jbe 0x100315a2
mov ebx, ebx
jl 0x100315a6
ja 0x100315a8
js 0x100315ad
ljmp 0x5208:0x558b994e
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4