joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100046e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10004739
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10004739
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000472a
cmp esi, edx
jae 0x10004739
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10004718
cmp esi, edx
jae 0x10004739
cmp word [esi], 0
je 0x10004739
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10005af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
mov eax, dword [ebp + 0x48]
push esi
movups xmmword [ebp - 0x48], xmm0
mov esi, dword [ebp + 0x8c]
movups xmm0, xmmword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x90]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x4c], esi
mov dword [edi + 0x40], esi
movups xmm0, xmmword [ebp + 0x28]
movups xmmword [ebp - 0x28], xmm0
movups xmm0, xmmword [ebp + 0x38]
movups xmmword [ebp - 0x18], xmm0
movups xmm0, xmmword [ebp + 0x4c]
movups xmmword [ebp - 0x8c], xmm0
movups xmm0, xmmword [ebp + 0x5c]
movups xmmword [ebp - 0x7c], xmm0
movups xmm0, xmmword [ebp + 0x6c]
movups xmmword [ebp - 0x6c], xmm0
movups xmm0, xmmword [ebp + 0x7c]
movups xmmword [ebp - 0x5c], xmm0
test esi, esi
jle 0x10005c74
cmp esi, 0x40
jb 0x10005c5d
lea edx, [esi - 1]
lea ecx, [ebp + esi - 0x49]
add edx, edi
cmp edi, ecx
ja 0x10005b97
lea ecx, [ebp - 0x48]
cmp edx, ecx
jae 0x10005c5d
lea ecx, [ebp + esi - 0x8d]
cmp edi, ecx
ja 0x10005bb0
lea ecx, [ebp - 0x8c]
cmp edx, ecx
jae 0x10005c5d
mov ecx, esi
push ebx
and ecx, 0x8000003f
jns 0x10005bc0
dec ecx
or ecx, 0xffffffc0
inc ecx
mov ebx, esi
lea edx, [edi + 0x20]
sub ebx, ecx
mov dword [ebp - 0x98], edx
mov esi, edi
lea ecx, [ebp - 0x38]
sub esi, ecx
sub ecx, edi
mov dword [ebp - 0x90], ecx
lea ecx, [ebp - 0x7c]
sub ecx, edi
mov edi, dword [ebp - 0x90]
mov dword [ebp - 0x94], ecx
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x48]
lea ecx, [ebp - 0x38]
add edx, eax
movups xmm1, xmmword [ebp + eax - 0x8c]
add ecx, eax
pxor xmm1, xmm0
movups xmm0, xmmword [ecx]
movups xmmword [esi + ecx], xmm1
mov ecx, dword [ebp - 0x94]
movups xmm1, xmmword [ebp + eax - 0x7c]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax - 0x6c]
movups xmmword [edx - 0x10], xmm1
movups xmm1, xmmword [ebp + eax - 0x28]
add eax, 0x40
pxor xmm1, xmm0
movups xmm0, xmmword [edi + edx]
movups xmmword [edx], xmm1
movups xmm1, xmmword [ecx + edx]
pxor xmm1, xmm0
movups xmmword [edx + 0x10], xmm1
mov edx, dword [ebp - 0x98]
cmp eax, ebx
jl 0x10005bf0
mov esi, dword [ebp - 0x9c]
mov edi, dword [ebp - 0xa0]
pop ebx
cmp eax, esi
jge 0x10005c74
mov cl, byte [ebp + eax - 0x8c]
xor cl, byte [ebp + eax - 0x48]
mov byte [edi + eax], cl
inc eax
cmp eax, esi
jl 0x10005c61
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1007d494
mov esp, ebp
pop ebp
ret
Function at 0x10009b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10112e04
mov dword [ebp - 0x24], 0x6f0043
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x70006d
mov dword [ebp - 0x1c], 0x740075
mov edx, 0x11
mov dword [ebp - 0x18], 0x720065
sub esi, eax
mov dword [ebp - 0x14], 0x31005a
mov dword [ebp - 0x10], 0x2e0034
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x10009bee
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009bee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009bd0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112e04
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x10009c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x10112d84
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x520070
mov dword [ebp - 0x14], 0x730065
mov dword [ebp - 0x10], 0x720065
mov dword [ebp - 0xc], 0x650076
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x10009c93
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009c93
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009c75
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112d84
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x10009d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x10112d5c
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x520070
mov dword [ebp - 0x14], 0x730065
mov dword [ebp - 0x10], 0x720065
mov dword [ebp - 0xc], 0x650076
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x10009dc3
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009dc3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009da5
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112d5c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret
Function at 0x10009df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10112db0
mov dword [ebp - 0x28], 0x740055
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x6c0069
mov dword [ebp - 0x20], 0x5c0073
mov edx, 0x13
mov dword [ebp - 0x1c], 0x750067
sub esi, eax
mov dword [ebp - 0x18], 0x720061
mov dword [ebp - 0x14], 0x680064
mov dword [ebp - 0x10], 0x2e0070
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x10009e6e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009e6e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009e50
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112db0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x10009e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10112ddc
mov dword [ebp - 0x28], 0x740055
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x6c0069
mov dword [ebp - 0x20], 0x5c0073
mov edx, 0x13
mov dword [ebp - 0x1c], 0x750067
sub esi, eax
mov dword [ebp - 0x18], 0x720061
mov dword [ebp - 0x14], 0x680064
mov dword [ebp - 0x10], 0x2e0070
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x10009f0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009f0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009ef0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112ddc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret
Function at 0x1000b3e0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000ba00
push 0
push 0
call fcn.100a7907
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x100168a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ce3b0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1010f404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1007d4b8
mov edi, eax
add esp, 4
test edi, edi
je 0x1001694b
push 1
mov dword [ebp - 4], 0
call fcn.10059896
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10018d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10112fc8
mov dword [ebp - 0x1c], 0x720068
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x770073
mov dword [ebp - 0x14], 0x72006f
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0064
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x10018dde
movzx ecx, word [esi + eax]
test cx, cx
je 0x10018dde
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10018dc0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112fc8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x10018e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x34], 0x650054
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x34]
mov eax, 0x10113114
mov dword [ebp - 0x30], 0x6d0061
mov dword [ebp - 0x2c], 0x690056
mov edx, 0x18
mov dword [ebp - 0x28], 0x770065
sub esi, eax
mov dword [ebp - 0x24], 0x720065
mov dword [ebp - 0x20], 0x44005f
mov dword [ebp - 0x1c], 0x730065
mov dword [ebp - 0x18], 0x74006b
mov dword [ebp - 0x14], 0x70006f
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffe6]
test ecx, ecx
je 0x10018e91
movzx ecx, word [esi + eax]
test cx, cx
je 0x10018e91
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10018e73
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10113114
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret
Function at 0x10018ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10112fe4
mov dword [ebp - 0x1c], 0x720070
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x63006f
mov dword [ebp - 0x14], 0x6f006d
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e006e
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x10018f2e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10018f2e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10018f10
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112fe4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x10018f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10112f2c
mov dword [ebp - 0x1c], 0x6d0073
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x6e0073
mov dword [ebp - 0x14], 0x660069
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0066
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x10018fbe
movzx ecx, word [esi + eax]
test cx, cx
je 0x10018fbe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10018fa0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112f2c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x10018fe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x1011301c
mov dword [ebp - 0x20], 0x720070
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x63006f
mov dword [ebp - 0x18], 0x6f006d
mov edx, 0xf
mov dword [ebp - 0x14], 0x36006e
sub esi, eax
mov dword [ebp - 0x10], 0x2e0034
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x1001904f
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001904f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019031
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x1011301c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret
Function at 0x10019070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10112f48
mov dword [ebp - 0x24], 0x69006d
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x69006e
mov dword [ebp - 0x1c], 0x6e0073
mov edx, 0x11
mov dword [ebp - 0x18], 0x660069
sub esi, eax
mov dword [ebp - 0x14], 0x650066
mov dword [ebp - 0x10], 0x2e0072
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x100190ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x100190ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100190d0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112f48
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x100191a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10112f08
mov dword [ebp - 0x24], 0x700073
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x780079
mov dword [ebp - 0x1c], 0x5f0078
mov edx, 0x11
mov dword [ebp - 0x18], 0x6d0061
sub esi, eax
mov dword [ebp - 0x14], 0x360064
mov dword [ebp - 0x10], 0x2e0034
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x1001921e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001921e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019200
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112f08
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x10019240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x1011303c
mov dword [ebp - 0x20], 0x720070
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x63006f
mov dword [ebp - 0x18], 0x780065
mov edx, 0xf
mov dword [ebp - 0x14], 0x360070
sub esi, eax
mov dword [ebp - 0x10], 0x2e0034
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x100192af
movzx ecx, word [esi + eax]
test cx, cx
je 0x100192af
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019291
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x1011303c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret
Function at 0x100192d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x690077
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x10112e70
mov dword [ebp - 0x18], 0x64006e
mov dword [ebp - 0x14], 0x670062
mov edx, 0xc
mov dword [ebp - 0x10], 0x65002e
sub esi, eax
mov dword [ebp - 0xc], 0x650078
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x1001933e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001933e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019320
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112e70
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x10019590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x620064
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x10113094
mov dword [ebp - 0x20], 0x780067
mov dword [ebp - 0x1c], 0x73002e
mov edx, 0x10
mov dword [ebp - 0x18], 0x650068
sub esi, eax
mov dword [ebp - 0x14], 0x6c006c
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
nop word [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x1001960e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001960e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100195f0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10113094
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x100196b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x650064
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x10112ed8
mov dword [ebp - 0x18], 0x650076
mov dword [ebp - 0x14], 0x76006e
mov edx, 0xc
mov dword [ebp - 0x10], 0x65002e
sub esi, eax
mov dword [ebp - 0xc], 0x650078
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x1001971e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001971e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019700
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112ed8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret
Function at 0x10019740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10112f6c
mov dword [ebp - 0x1c], 0x6c006f
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x79006c
mov dword [ebp - 0x14], 0x620064
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0067
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x100197ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x100197ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019790
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112f6c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x100197d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x640069
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x10112fb0
mov dword [ebp - 0x18], 0x710061
mov dword [ebp - 0x14], 0x340036
mov edx, 0xc
mov dword [ebp - 0x10], 0x65002e
sub esi, eax
mov dword [ebp - 0xc], 0x650078
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x1001983e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001983e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019820
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112fb0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x100198f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10112e9c
mov dword [ebp - 0x1c], 0x690066
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x640064
mov dword [ebp - 0x14], 0x65006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0072
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x1001995e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001995e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019940
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112e9c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret
Function at 0x10019980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x750073
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x101130cc
mov dword [ebp - 0x28], 0x6c006e
mov dword [ebp - 0x24], 0x67006f
mov edx, 0x14
mov dword [ebp - 0x20], 0x6e0069
sub esi, eax
mov dword [ebp - 0x1c], 0x6c0063
mov dword [ebp - 0x18], 0x650069
mov dword [ebp - 0x14], 0x74006e
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x10019a03
movzx ecx, word [esi + eax]
test cx, cx
je 0x10019a03
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100199e5
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101130cc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x10019a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10113000
mov dword [ebp - 0x1c], 0x720070
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x63006f
mov dword [ebp - 0x14], 0x780065
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0070
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x10019a9e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10019a9e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019a80
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10113000
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret

Function at 0x10019ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10112eb8
mov dword [ebp - 0x20], 0x690077
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x650072
mov dword [ebp - 0x18], 0x680073
mov edx, 0xf
mov dword [ebp - 0x14], 0x720061
sub esi, eax
mov dword [ebp - 0x10], 0x2e006b
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x10019b2f
movzx ecx, word [esi + eax]
test cx, cx
je 0x10019b2f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019b11
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10112eb8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret