joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029390
Capabilities:
Check if file exists
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10128f48
push 0x100c8be0
mov eax, dword fs:[0]
push eax
sub esp, 0x57c
mov eax, dword [0x10135134]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
test esi, esi
je 0x1002950a
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002950a
push 0x118
push 0
lea eax, [ebp - 0x544]
push eax
call fcn.100c7670
add esp, 0xc
mov dword [ebp - 0x548], 0x11c
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x544], 6
jae 0x10029423
mov eax, 1
jmp 0x1002950c
mov dword [ebp - 0x58c], 0x10
mov dword [ebp - 0x588], esi
mov dword [ebp - 0x584], 0
mov dword [ebp - 0x580], 0
mov dword [ebp - 0x42c], 0xaac56b
mov dword [ebp - 0x428], 0x11d0cd44
mov dword [ebp - 0x424], 0xc000c28c
mov dword [ebp - 0x420], 0xee95c24f
xor eax, eax
mov dword [ebp - 0x57c], 0x30
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x574], eax
mov dword [ebp - 0x570], 2
mov dword [ebp - 0x56c], eax
mov dword [ebp - 0x568], 1
mov dword [ebp - 0x560], 1
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x558], eax
or eax, 0x1080
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x550], 0
lea eax, [ebp - 0x58c]
mov dword [ebp - 0x564], eax
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x42c]
push eax
push edi
call sub.WINTRUST.dll_WinVerifyTrust
test eax, eax
je 0x10029528
cmp eax, 0x800b0101
je 0x10029528
cmp eax, 0x800b0109
je 0x10029528
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10027da5
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x55c]
call sub.WINTRUST.dll_WTHelperProvDataFromStateData
test eax, eax
je 0x100295bf
cmp dword [eax + 0x40], 0
jbe 0x100295bf
mov eax, dword [eax + 0x44]
test eax, eax
je 0x100295bf
mov eax, dword [eax + 0x28]
test eax, eax
je 0x100295bf
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x100295bf
cmp dword [eax + 0xc], 0
jbe 0x100295bf
mov eax, dword [ecx]
test eax, eax
je 0x100295bf
cmp dword [eax + 0xc], 0
jbe 0x100295bf
mov eax, dword [eax + 0x10]
test eax, eax
je 0x100295bf
mov eax, dword [eax]
test eax, eax
je 0x100295bf
mov esi, dword [eax + 4]
test esi, esi
je 0x100295bf
push 0x400
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.100c7670
add esp, 0xc
push 0x200
lea eax, [ebp - 0x41c]
push eax
push 0
push 0
push 4
push esi
call dword [sym.imp.CRYPT32.dll_CertGetNameStringW]
dec eax
mov ecx, 1
cmp eax, 0x1fe
cmovbe edi, ecx
mov dword [ebp - 0x54c], edi
mov esi, dword [ebp - 0x55c]
push 0x30
push 0
lea eax, [ebp - 0x57c]
push eax
call fcn.100c7670
add esp, 0xc
mov dword [ebp - 0x57c], 0x30
mov dword [ebp - 0x55c], esi
mov dword [ebp - 0x560], 2
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
call sub.WINTRUST.dll_WinVerifyTrust
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x1002950c
Function at 0x10038cd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3597
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10135134]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [edi + 0x18], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov dword [ebp - 4], 0
mov byte [edi + 0x1c], 0
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10055570
mov dword [esi], eax
lea esi, [edi + 0x44]
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10055570
mov dword [esi], eax
mov dword [edi + 0x4c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0xf
mov byte [edi + 0x50], 0
lea ecx, [edi + 0x68]
mov byte [ebp - 4], 4
mov dword [ecx + 0x10], 0
push 0
mov dword [ecx + 0x14], 0xf
push 0x10108fc2
mov byte [ecx], 0
call fcn.1000d570
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1003a830
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, dword [eax]
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003a840
sub ecx, edx
xor edi, edi
push ebx
xor ebx, ebx
mov eax, 0x811c9dc5
lea edx, [ecx + esi]
cmp esi, edx
cmova ecx, ebx
pop ebx
test ecx, ecx
je 0x1003a873
movzx edx, byte [esi]
lea esi, [esi + 1]
xor edx, eax
inc edi
imul eax, edx, 0x1000193
cmp edi, ecx
jne 0x1003a860
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.100d033a
imul eax, eax, 0xb14
add esp, 8
imul ecx, edx, 0x41a7
pop edi
pop esi
sub ecx, eax
lea eax, [ecx + 0x7fffffff]
js 0x1003a8a0
mov eax, ecx
pop ebp
ret 4
Function at 0x1007e8d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f808a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10135134]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
jne 0x1007e93d
push 0x38
call fcn.10027d67
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x1007e92a
mov ecx, eax
call fcn.10081410
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x40], 0
je 0x1007e951
push 0x38
push 0x101378ec
mov ecx, edi
call fcn.1002c3a0
push 0x38
mov ecx, edi
call fcn.1002c110
mov esi, eax
mov dword [ebp + 8], esi
mov dword [esi], vtable.google::protobuf::FieldDescriptorProto.0
mov dword [ebp - 4], 1
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov eax, dword [0x1013a084]
mov byte [ebp - 4], 2
cmp eax, 2
je 0x1007e9b3
mov dword [ebp - 0x18], vtable.google::protobuf::internal::FunctionClosure0.0
mov dword [ebp - 0x14], 0x100896c0
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
push 0x1013a084
call fcn.1002c3c0
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.10029d60
mov dword [esi + 0xc], 0
xorps xmm0, xmm0
mov dword [esi + 0x10], 0x101398a8
mov eax, esi
mov dword [esi + 0x14], 0x101398a8
mov dword [esi + 0x18], 0x101398a8
mov dword [esi + 0x1c], 0x101398a8
mov dword [esi + 0x20], 0x101398a8
movq qword [esi + 0x24], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007f990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f83e5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10135134]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
jne 0x1007f9fd
push 0x48
call fcn.10027d67
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x1007f9ea
mov ecx, eax
call fcn.100823c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x40], 0
je 0x1007fa11
push 0x48
push 0x101389b8
mov ecx, edi
call fcn.1002c3a0
push 0x48
mov ecx, edi
call fcn.1002c110
mov esi, eax
mov dword [ebp + 8], esi
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
mov dword [ebp - 4], 1
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov eax, dword [0x1013a0c4]
mov byte [ebp - 4], 3
cmp eax, 2
je 0x1007fa8b
mov dword [ebp - 0x18], vtable.google::protobuf::internal::FunctionClosure0.0
mov dword [ebp - 0x14], 0x1008a2e0
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
push 0x1013a0c4
call fcn.1002c3c0
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.10029d60
xorps xmm0, xmm0
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x101398a8
mov eax, esi
mov dword [esi + 0x24], 0x101398a8
mov dword [esi + 0x28], 0x101398a8
movups xmmword [esi + 0x30], xmm0
movq qword [esi + 0x40], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10081330
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f854b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x10135134]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi], vtable.google::protobuf::FieldDescriptorProto.0
mov dword [ebp - 4], 0
mov dword [esi + 4], eax
mov dword [esi + 8], 0
mov eax, dword [0x1013a084]
mov byte [ebp - 4], 1
cmp eax, 2
je 0x100813b2
mov dword [ebp - 0x1c], vtable.google::protobuf::internal::FunctionClosure0.0
mov dword [ebp - 0x18], 0x100896c0
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 0x1013a084
call fcn.1002c3c0
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.10029d60
mov dword [esi + 0xc], 0
xorps xmm0, xmm0
mov dword [esi + 0x10], 0x101398a8
mov eax, esi
mov dword [esi + 0x14], 0x101398a8
mov dword [esi + 0x18], 0x101398a8
mov dword [esi + 0x1c], 0x101398a8
mov dword [esi + 0x20], 0x101398a8
movq qword [esi + 0x24], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10086210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov edi, dword [esi + 0x14]
test edi, edi
jle 0x10086252
mov edx, dword [esi + 0x1c]
xor ecx, ecx
nop dword [eax]
mov eax, dword [edx + ecx*4 + 4]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x10086243
mov eax, dword [eax]
inc ecx
mov byte [eax], 0
cmp ecx, edi
jl 0x10086230
mov dword [esi + 0x14], 0
push ebx
mov ebx, dword [esi + 0x24]
test ebx, ebx
jle 0x10086279
mov eax, dword [esi + 0x2c]
xor edi, edi
mov esi, eax
mov ecx, dword [esi + edi*4 + 4]
call fcn.100859f0
inc edi
cmp edi, ebx
jl 0x10086261
mov esi, dword [ebp - 8]
mov dword [esi + 0x24], 0
mov ebx, dword [esi + 0x34]
test ebx, ebx
jle 0x100862a8
mov eax, dword [esi + 0x3c]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop word [eax + eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.10085d70
inc edi
cmp edi, ebx
jl 0x10086290
mov esi, dword [ebp - 8]
mov dword [esi + 0x34], 0
mov ebx, dword [esi + 0x44]
test ebx, ebx
jle 0x100862d8
mov eax, dword [esi + 0x4c]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.100868e0
inc edi
cmp edi, ebx
jl 0x100862c0
mov esi, dword [ebp - 8]
mov dword [esi + 0x44], 0
mov ebx, dword [esi + 0x54]
test ebx, ebx
jle 0x10086308
mov eax, dword [esi + 0x5c]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.10086080
inc edi
cmp edi, ebx
jl 0x100862f0
mov esi, dword [ebp - 8]
mov dword [esi + 0x54], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x6c], 0
mov ebx, dword [esi + 8]
test bl, 0x1f
je 0x100863a8
test bl, 1
je 0x10086343
mov eax, dword [esi + 0x78]
cmp eax, 0x101398a8
je 0x10086343
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x10086340
mov eax, dword [eax]
mov byte [eax], 0
test bl, 2
je 0x10086364
mov eax, dword [esi + 0x7c]
cmp eax, 0x101398a8
je 0x10086364
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x10086361
mov eax, dword [eax]
mov byte [eax], 0
test bl, 4
je 0x10086388
mov eax, dword [esi + 0x80]
cmp eax, 0x101398a8
je 0x10086388
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x10086385
mov eax, dword [eax]
mov byte [eax], 0
test bl, 8
je 0x10086398
mov ecx, dword [esi + 0x84]
call fcn.10086430
test bl, 0x10
je 0x100863a8
mov ecx, dword [esi + 0x88]
call fcn.10086980
mov dword [esi + 8], 0
test byte [esi + 4], 1
pop ebx
je 0x100863c6
mov ecx, dword [esi + 4]
and ecx, 0xfffffffe
cmp dword [ecx], 0
je 0x100863c6
call fcn.10032420
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100a30f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3860
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10135134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.10071d50
dec eax
cmp eax, 9
ja case.default.0x100a312b
jmp dword [eax*4 + 0x100a328c]
push 0x32c
push str.D:_sourcecode460SoftwareGasteprotobuf_cpp_3.5.1protobuf_3.5.1_srcgoogle_protobuf_map_field.h
push 3
lea ecx, [ebp - 0x34]
call fcn.10029ca0
push str.Unsupported
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.1002a0c0
push eax
lea ecx, [ebp - 0x59]
call fcn.10029eb0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.10029de0
push 0x33b
push str.D:_sourcecode460SoftwareGasteprotobuf_cpp_3.5.1protobuf_3.5.1_srcgoogle_protobuf_map_field.h
push 3
lea ecx, [ebp - 0x58]
call fcn.10029ca0
push str.Cant_get_here.
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.1002a0c0
push eax
lea ecx, [ebp - 0x5a]
call fcn.10029eb0
lea ecx, [ebp - 0x58]
call fcn.10029de0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10027da5
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.1006dd20
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x100a31da
mov esi, dword [esi]
mov edx, esi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x100a31e0
sub edx, ecx
xor ebx, ebx
xor edi, edi
mov eax, 0x811c9dc5
lea ecx, [edx + esi]
cmp esi, ecx
cmova edx, ebx
test edx, edx
je 0x100a3213
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
cmp edi, edx
jne 0x100a3200
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.100d033a
imul edx, edx, 0x41a7
add esp, 8
imul ecx, eax, 0xb14
sub edx, ecx
jns 0x100a323c
add edx, 0x7fffffff
mov eax, edx
jmp 0x100a31ab
mov ecx, esi
call fcn.1006da30
xor eax, 0xdeadbeef
jmp 0x100a3213
mov ecx, esi
call fcn.1006d840
xor eax, 0xdeadbeef
jmp 0x100a3213
mov ecx, esi
call fcn.1006e0f0
xor eax, 0xdeadbeef
jmp 0x100a3213
mov ecx, esi
call fcn.1006df00
xor eax, 0xdeadbeef
jmp 0x100a3213
mov ecx, esi
call fcn.1006d650
movzx eax, al
xor eax, 0xdeadbeef
jmp 0x100a3213
Function at 0x100a93f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fa7c8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x10135134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], 0x720054
mov dword [ebp - 0x58], 0x630061
mov dword [ebp - 0x54], 0x6c0065
mov dword [ebp - 0x50], 0x730065
mov dword [ebp - 0x4c], 0x630073
mov dword [ebp - 0x48], 0x610068
mov dword [ebp - 0x44], 0x430074
mov dword [ebp - 0x40], 0x6e006f
mov dword [ebp - 0x3c], 0x690066
mov dword [ebp - 0x38], 0x430067
mov dword [ebp - 0x34], 0x6e0065
mov dword [ebp - 0x30], 0x650074
mov dword [ebp - 0x2c], 0x570072
mov dword [ebp - 0x28], 0x64006e
mov dword [ebp - 0x24], 0x6c0043
mov dword [ebp - 0x20], 0x730061
mov dword [ebp - 0x1c], 0x4e0073
mov dword [ebp - 0x18], 0x6d0061
mov dword [ebp - 0x14], 0x65
call fcn.100122e0
mov ecx, eax
test ecx, ecx
je 0x100a9512
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1001dfe0
test al, al
jne 0x100a94f2
lea ecx, [ebp - 0x5c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a94d7
sub ecx, edx
lea eax, [ebp - 0x5c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001f280
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10027da5
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.100139f0
int3
Function at 0x100a95f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fa7fb
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x10135134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], 0x740068
mov dword [ebp - 0xbc], 0x700074
mov dword [ebp - 0xb8], 0x2f003a
mov dword [ebp - 0xb4], 0x63002f
mov dword [ebp - 0xb0], 0x6e0064
mov dword [ebp - 0xac], 0x61002d
mov dword [ebp - 0xa8], 0x69006c
mov dword [ebp - 0xa4], 0x66002d
mov dword [ebp - 0xa0], 0x6c0069
mov dword [ebp - 0x9c], 0x2d0065
mov dword [ebp - 0x98], 0x680073
mov dword [ebp - 0x94], 0x2e0063
mov dword [ebp - 0x90], 0x6f0064
mov dword [ebp - 0x8c], 0x70006c
mov dword [ebp - 0x88], 0x690068
mov dword [ebp - 0x84], 0x70006e
mov dword [ebp - 0x80], 0x700061
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x63002e
mov dword [ebp - 0x74], 0x6d006f
mov dword [ebp - 0x70], 0x63002f
mov dword [ebp - 0x6c], 0x73006d
mov dword [ebp - 0x68], 0x70002f
mov dword [ebp - 0x64], 0x6f0072
mov dword [ebp - 0x60], 0x65006a
mov dword [ebp - 0x5c], 0x740063
mov dword [ebp - 0x58], 0x31005f
mov dword [ebp - 0x54], 0x380030
mov dword [ebp - 0x50], 0x63002f
mov dword [ebp - 0x4c], 0x670066
mov dword [ebp - 0x48], 0x63005f
mov dword [ebp - 0x44], 0x6e0065
mov dword [ebp - 0x40], 0x650074
mov dword [ebp - 0x3c], 0x2f0072
mov dword [ebp - 0x38], 0x6f0064
mov dword [ebp - 0x34], 0x70006c
mov dword [ebp - 0x30], 0x690068
mov dword [ebp - 0x2c], 0x5f006e
mov dword [ebp - 0x28], 0x6f006d
mov dword [ebp - 0x24], 0x5f0064
mov dword [ebp - 0x20], 0x69006c
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x6a002e
mov dword [ebp - 0x14], 0x73
call fcn.100122e0
mov ecx, eax
test ecx, ecx
je 0x100a980e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0xc0]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1001dfe0
test al, al
jne 0x100a97ee
lea ecx, [ebp - 0xc0]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a97d0
sub ecx, edx
lea eax, [ebp - 0xc0]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001f280
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10027da5
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.100139f0
int3
Function at 0x100a9bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fa8ab
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x10135134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0x6f0043
mov dword [ebp - 0x8c], 0x66006e
mov dword [ebp - 0x88], 0x670069
mov dword [ebp - 0x84], 0x650043
mov dword [ebp - 0x80], 0x74006e
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x690053
mov dword [ebp - 0x74], 0x6c006e
mov dword [ebp - 0x70], 0x650067
mov dword [ebp - 0x6c], 0x6e0049
mov dword [ebp - 0x68], 0x740073
mov dword [ebp - 0x64], 0x6e0061
mov dword [ebp - 0x60], 0x650063
mov dword [ebp - 0x5c], 0x32005f
mov dword [ebp - 0x58], 0x430041
mov dword [ebp - 0x54], 0x350045
mov dword [ebp - 0x50], 0x300043
mov dword [ebp - 0x4c], 0x2d0045
mov dword [ebp - 0x48], 0x440037
mov dword [ebp - 0x44], 0x310046
mov dword [ebp - 0x40], 0x34002d
mov dword [ebp - 0x3c], 0x460038
mov dword [ebp - 0x38], 0x2d0031
mov dword [ebp - 0x34], 0x380042
mov dword [ebp - 0x30], 0x420035
mov dword [ebp - 0x2c], 0x44002d
mov dword [ebp - 0x28], 0x370031
mov dword [ebp - 0x24], 0x460031
mov dword [ebp - 0x20], 0x300030
mov dword [ebp - 0x1c], 0x420031
mov dword [ebp - 0x18], 0x460042
mov dword [ebp - 0x14], 0x43
call fcn.100122e0
mov ecx, eax
test ecx, ecx
je 0x100a9d8e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1001dfe0
test al, al
jne 0x100a9d6e
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a9d50
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001f280
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10027da5
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.100139f0
int3
Function at 0x100aa3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fa958
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10135134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0x740068
mov dword [ebp - 0x64], 0x700074
mov dword [ebp - 0x60], 0x2f003a
mov dword [ebp - 0x5c], 0x6c002f
mov dword [ebp - 0x58], 0x70002e
mov dword [ebp - 0x54], 0x620075
mov dword [ebp - 0x50], 0x69006c
mov dword [ebp - 0x4c], 0x2e0063
mov dword [ebp - 0x48], 0x610068
mov dword [ebp - 0x44], 0x6f006c
mov dword [ebp - 0x40], 0x610070
mov dword [ebp - 0x3c], 0x650070
mov dword [ebp - 0x38], 0x2e0072
mov dword [ebp - 0x34], 0x6e0063
mov dword [ebp - 0x30], 0x70002f
mov dword [ebp - 0x2c], 0x2f0063
mov dword [ebp - 0x28], 0x700075
mov dword [ebp - 0x24], 0x610064
mov dword [ebp - 0x20], 0x610074
mov dword [ebp - 0x1c], 0x64002f
mov dword [ebp - 0x18], 0x6d0075
mov dword [ebp - 0x14], 0x70
call fcn.100122e0
mov ecx, eax
test ecx, ecx
je 0x100aa52b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1001dfe0
test al, al
jne 0x100aa50b
lea ecx, [ebp - 0x68]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100aa4f0
sub ecx, edx
lea eax, [ebp - 0x68]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001f280
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10027da5
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.100139f0
int3