joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100483d0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
mov esi, dword [0x101344cc]
push edi
cmp byte [esi], 0
jne 0x100485cf
call fcn.10039520
push 0
lea ecx, [esi + 4]
mov edi, eax
push ecx
push 0x14
push 0x14
push ecx
mov dword [esp], 0x40a00000
push edi
call dword [sym.imp.d3dx9_43.dll_D3DXCreateSphere]
test eax, eax
je 0x10048527
push eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x330044
push eax
lea eax, [ebp - 0x468]
mov dword [ebp - 0x74], 0x580044
xor ecx, ecx
mov dword [ebp - 0x70], 0x720043
push eax
mov dword [ebp - 0x6c], 0x610065
mov dword [ebp - 0x68], 0x650074
mov dword [ebp - 0x64], 0x700053
mov dword [ebp - 0x60], 0x650068
mov dword [ebp - 0x5c], 0x650072
mov dword [ebp - 0x58], 0x700028
mov dword [ebp - 0x54], 0x780044
mov dword [ebp - 0x50], 0x440033
mov dword [ebp - 0x4c], 0x700053
mov dword [ebp - 0x48], 0x650068
mov dword [ebp - 0x44], 0x650072
mov dword [ebp - 0x40], 0x290047
mov dword [ebp - 0x3c], 0x460020
mov dword [ebp - 0x38], 0x690061
mov dword [ebp - 0x34], 0x65006c
mov dword [ebp - 0x30], 0x2e0064
mov dword [ebp - 0x2c], 0xa000d
mov dword [ebp - 0x28], 0x720045
mov dword [ebp - 0x24], 0x6f0072
mov dword [ebp - 0x20], 0x3a0072
mov dword [ebp - 0x1c], 0x250020
mov dword [ebp - 0x18], 0x380030
mov dword [ebp - 0x14], 0x58
mov dword [ebp - 0x10], 0x6c0043
mov dword [ebp - 0xc], 0x650069
mov dword [ebp - 8], 0x74006e
mov word [ebp - 4], cx
call fcn.1003e210
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x50010
push eax
lea eax, [ebp - 0x468]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xffff8000
lea eax, [esi + 8]
push eax
push edi
call fcn.1003e130
push 0xffff0000
lea eax, [esi + 0xc]
push eax
push edi
call fcn.1003e130
push 0xff00ff00
lea eax, [esi + 0x10]
push eax
push edi
call fcn.1003e130
push 0xff0000ff
lea eax, [esi + 0x14]
push eax
push edi
call fcn.1003e130
push 0xffffff00
lea eax, [esi + 0x18]
push eax
push edi
call fcn.1003e130
push 0x96ff0000
lea eax, [esi + 0x1c]
push eax
push edi
call fcn.1003e130
push 0x9600ff00
lea eax, [esi + 0x20]
push eax
push edi
call fcn.1003e130
push 0x960000ff
lea eax, [esi + 0x24]
push eax
push edi
call fcn.1003e130
push 0x96ef00ff
lea eax, [esi + 0x28]
push eax
push edi
call fcn.1003e130
push 0x9600deff
lea eax, [esi + 0x2c]
push eax
push edi
call fcn.1003e130
push 0x96ff9a00
lea eax, [esi + 0x30]
push eax
push edi
call fcn.1003e130
mov byte [esi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10048830
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x101344cc]
cmp byte [ebx], 0
je 0x100489f4
call fcn.10039640
test eax, eax
jne 0x100489f4
push edi
call fcn.10039690
mov edi, eax
call fcn.10039570
test eax, eax
je 0x100489f3
test edi, edi
je 0x100489f3
push esi
call fcn.100397b0
movzx esi, al
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 0
cmp dword [ebx + esi*4 + 0x60], 0
jbe 0x100489f2
xor ecx, ecx
mov dword [ebp - 4], ecx
nop dword [eax]
nop word [eax + eax]
mov esi, dword [ebx + esi*4 + 0x1000]
add esi, ecx
je 0x100489d6
mov eax, dword [edi + 0x1eba70]
sub eax, 0x271
je 0x100489d6
cmp byte [edi + 0x1ebe44], 1
jne 0x100489d6
movss xmm0, dword [esi + 0x70]
xorps xmm2, xmm2
comiss xmm0, xmm2
jb 0x100488f5
movss xmm3, dword [edi + 0x1ebafc]
movss xmm1, dword [esi + 0x64]
comiss xmm3, xmm1
jb 0x100488f5
addss xmm1, xmm0
comiss xmm1, xmm3
jae 0x10048921
comiss xmm2, xmm0
jbe 0x100489d6
movss xmm3, dword [edi + 0x1ebafc]
movss xmm1, dword [esi + 0x64]
comiss xmm1, xmm3
jb 0x100489d6
addss xmm1, xmm0
comiss xmm3, xmm1
jb 0x100489d6
movss xmm0, dword [esi + 0x74]
comiss xmm0, xmm2
jb 0x10048946
movss xmm3, dword [edi + 0x1ebb00]
movss xmm1, dword [esi + 0x68]
comiss xmm3, xmm1
jb 0x10048946
addss xmm1, xmm0
comiss xmm1, xmm3
jae 0x1004896a
comiss xmm2, xmm0
jbe 0x100489d6
movss xmm3, dword [edi + 0x1ebb00]
movss xmm1, dword [esi + 0x68]
comiss xmm1, xmm3
jb 0x100489d6
addss xmm1, xmm0
comiss xmm3, xmm1
jb 0x100489d6
movss xmm0, dword [esi + 0x78]
comiss xmm0, xmm2
jb 0x1004898f
movss xmm3, dword [edi + 0x1ebb04]
movss xmm1, dword [esi + 0x6c]
comiss xmm3, xmm1
jb 0x1004898f
addss xmm1, xmm0
comiss xmm1, xmm3
jae 0x100489af
comiss xmm2, xmm0
jbe 0x100489d6
movss xmm2, dword [edi + 0x1ebb04]
movss xmm1, dword [esi + 0x6c]
comiss xmm1, xmm2
jb 0x100489d6
addss xmm1, xmm0
comiss xmm2, xmm1
jb 0x100489d6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x7c]
add ecx, 0x7d0
cmp eax, ecx
jb 0x100489d3
push esi
mov ecx, ebx
call fcn.10048a00
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x7c], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
sub ecx, 0xffffff80
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], esi
cmp esi, dword [ebx + eax*4 + 0x60]
mov esi, eax
jb 0x100488a0
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10048ae0
Capabilities:
Terminate process

Disassembly:
lea esp, [esp + 4]
movsx eax, cx
mov eax, dword [ebx + 8]
push 0xc3500
jmp loc.10262e65
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x688
push esi
push edi
mov edi, dword [0x10148398]
push 0x100e8a8e
jmp 0x1002b7bb
Function at 0x1004a490
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
mov eax, ebx
cdq
and edx, 3
push esi
push edi
lea esi, [edx + eax]
mov edx, 0x2a
sar esi, 2
lea edi, [ecx + esi*4]
neg esi
je 0x1004a4d3
imul eax, dword [edi + esi*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
rol edx, 0xd
add edx, 0xfaddaf14
lea edx, [edx + edx*4]
add esi, 1
jne 0x1004a4b0
mov eax, ebx
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x1004a4f9
sub eax, 1
je 0x1004a4f0
sub eax, 1
jne 0x1004a50f
movzx ecx, byte [edi + 2]
shl ecx, 0x10
movzx eax, byte [edi + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edi]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, ebx
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
pop ebp
ret

Function at 0x1004a540
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x1cdc
call fcn.100b2020
push esi
mov dword [ebp - 0xc], ecx
push 0x100e8a8e
call fcn.1022aece
mov cl, 0xb9

Function at 0x1004cf70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp loc.10264404

Function at 0x1004d000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp loc.1026028e

Function at 0x1004d090
Capabilities:
Terminate process

Disassembly:
push str.Packet_Overlap
push 0
jmp 0x1002c68c
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
jmp loc.1023db5b
lea esp, [esp + 4]
not eax
nop
sar ch, cl
movsx eax, si
movsx cx, dl
mov eax, dword [ebp - 4]
shl cl, 0x92
mov ecx, dword [eax + 4]
stc
cmp esp, edx
lea ecx, [ecx + 4]
cmp di, 0x7a8f
test dl, bh
clc
cmp ecx, 0x6d60
jbe 0x10098c2b
push 0x10
push str.CNexusMsg_Error
jmp 0x1002a298
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp 0x1004677f
nop
mov esp, ebp
pop ebp
ret 4
mov dword [ecx + 4], eax
jmp 0x100810e5
jmp 0x1004d109
nop
jmp 0x1007035b
mov edx, dword [ebp - 4]
test al, ah
mov eax, dword [edx + 4]
sar dx, 0x2a
mov ecx, dword [ebp - 4]
rol dl, cl
mov edx, dword [ecx]
or cl, ch
rcl ecx, cl
mov ecx, dword [ebp + 8]
clc
mov dword [edx + eax], ecx
dec dh
rol ax, cl
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
shrd ecx, ebx, 0xa4
movsx ecx, bx
add eax, 4
mov ecx, dword [ebp - 4]
jmp 0x1006cd6a

Function at 0x1004d110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ecx
push 0x100e8a8e
jmp loc.1027fe87
Function at 0x1004d420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x100e8a8e
jmp 0x10071143
lea esp, [esp + 4]
nop
stc
mov eax, dword [ebp - 8]
sub cx, cx
mov ecx, dword [eax + 0xc]
sbb edx, ebx
btc dx, 0x9d
lea ecx, [ecx + 1]
bts dx, ax
mov dh, 0x8d
mov edx, dword [ebp - 8]
stc
cmp ecx, dword [edx + 4]
jmp loc.10235ea9

Function at 0x1004d4b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x100e8a8e
jmp 0x100185b0

Function at 0x1004d540
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp loc.1026addc

Function at 0x1004d5d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp loc.10274915

Function at 0x1004d670
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp 0x1008e0fb
lea esp, [esp + 4]
nop
sbb ecx, 0x2d9f2db0
neg cl
mov eax, dword [ebp - 4]
cmovb edx, edx
btr dx, ax
add edx, esi
mov ecx, dword [eax + 0xc]
lea ecx, [ecx + 4]
shl dl, cl
btr dx, 0x1c
mov edx, dword [ebp - 4]
cmp sp, 0x592d
cmp ecx, dword [edx + 4]
jmp loc.102701e8

Function at 0x1004d700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], ecx
push 0x100e8a8e
jmp loc.1024e87b

Function at 0x1004d7c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 8], ecx
push 0x100e8a8e
jmp loc.1022dc6e

Function at 0x1004d8b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
mov ax, si
btr eax, 0x91
add ecx, dword [edx + 0xc]
mov dword [ebp - 8], ecx
sub ax, bx
bsr edx, edx
btr ecx, 0xbd
mov eax, dword [ebp - 4]
sbb edx, ebp
btc edx, 0x31
mov ecx, dword [eax + 0xc]
bsf dx, ax
add ecx, dword [ebp + 0xc]
shr dl, cl
mov edx, dword [ebp - 4]
test bx, si
cmc
test di, 0xe528
cmp ecx, dword [edx + 4]
jmp loc.10230327
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp 0x1007c4d8
lea esp, [esp + 4]
and dx, 0xcbbe
cdq
jmp 0x10042eb7

Function at 0x1004db70
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp loc.10285d65

Function at 0x1004e530
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
rcl eax, 0xa6
mov eax, dword [ebp + 0x10]
cmp esi, 0x503c936
add eax, 5
jmp loc.10250e70
push ebp
mov ebp, esp
sub esp, 0x24
push 0x100e8a8e
jmp 0x1004c864

Function at 0x1004e720
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x100e8a8e
jmp loc.102716ad
Function at 0x1004e7c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x100e8a8e
jmp 0x100855e1
lea esp, [esp + 4]
cmove dx, dx
movzx eax, di
mov eax, dword [0x1012f57c]
xchg dh, dh
mov ecx, dword [eax + 0x3b8]
cdq
mov dword [ebp - 8], ecx
cmovle ax, ax
lea edx, [ebp - 4]
push edx
sets ah
movzx eax, bp
xchg ah, ah
push 0x40
movsx eax, si
push 6
mov eax, dword [ebp + 8]
jmp loc.102ac0e1

Function at 0x1004e9e0
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Create thread
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
mov dword [ebp - 8], ecx
push 0x100e8a8e
jmp loc.1028bf9a

Function at 0x1004ee10
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov dword [ebp - 0x60], ecx
push 0x100e8a8e
jmp loc.1029376c
Function at 0x10052510
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [0x1014839c]
cmp byte [esi + 0x2308], 0
je 0x10052747
cmp byte [esi + 0x2309], 0
jne 0x10052747
cmp byte [esi + 0x230b], 0
movss xmm0, dword [0x101402a0]
mulss xmm0, dword [0x100eced0]
addss xmm0, dword [esi + 0x2310]
movss dword [esi + 0x2310], xmm0
je 0x10052578
cmp byte [esi + 0x230c], 0
je 0x10052578
mov ecx, dword [esi + 0xc]
call fcn.10056800
mov byte [esi + 0x230c], 0
mov eax, dword [esi + 4]
push 0x10
mov eax, dword [eax + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
cmp byte [esi + 0x230a], 0
jne 0x1005261c
cmp dword [0x10148c38], 1
jne 0x10052725
call fcn.10039770
cmp eax, 2
jne 0x10052725
movss xmm0, dword [0x101402a0]
mulss xmm0, dword [0x100ecfb0]
addss xmm0, dword [esi + 0x2314]
movss dword [esi + 0x2314], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x2318]
cmp eax, 0x9c4
jb 0x10052725
mov eax, dword [esi + 0x11c]
neg eax
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esi + 0x2314], xmm0
movss dword [esi + 0x2324], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x2318], eax
mov byte [esi + 0x2320], 1
jmp 0x10052725
movss xmm1, dword [0x101402a0]
xorps xmm0, xmm0
mulss xmm1, dword [0x100ecfd8]
addss xmm1, dword [esi + 0x2304]
comiss xmm1, xmm0
movss dword [esi + 0x2304], xmm1
jbe 0x1005264e
mov dword [esi + 0x2304], 0
cmp byte [esi + 0x230b], 0
je 0x10052725
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x1005266c
mov ecx, dword [esi + 0x14]
call fcn.1005f980
jmp 0x100526b5
cmp eax, 1
jne 0x1005267b
mov ecx, dword [esi + 0x18]
call fcn.10062f40
jmp 0x100526b5
cmp eax, 2
jne 0x1005268a
mov ecx, dword [esi + 0x24]
call fcn.10067040
jmp 0x100526b5
cmp eax, 3
jne 0x10052699
mov ecx, dword [esi + 0x2c]
call fcn.1005e7f0
jmp 0x100526b5
cmp eax, 4
jne 0x100526a8
mov ecx, dword [esi + 0x30]
call fcn.100601c0
jmp 0x100526b5
cmp eax, 5
jne 0x100526b5
mov ecx, dword [esi + 0x34]
call fcn.100601c0
push dword [esi + 0xd8]
mov edx, dword [esi + 0xcc]
lea ecx, [ebp - 0x20]
push dword [esi + 0xd4]
push dword [esi + 0xd0]
call fcn.10039480
mov eax, dword [esi + 4]
add esp, 0xc
movss xmm0, dword [esi + 0x2304]
mov edx, dword [eax + 8]
push 0xffffffffffffffff
mov eax, dword [edx]
mov dword [ebp - 0x10], 0
movss dword [ebp - 0xc], xmm0
mov dword [ebp - 8], 0
mov ecx, dword [eax + 0x24]
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [esi + 0xc8]
push dword [eax]
push edx
call ecx
mov ecx, dword [esi + 8]
call fcn.10054670
mov ecx, dword [esi + 0xc]
call fcn.10055f20
lea ecx, [esi + 0x1190]
call fcn.100571e0
lea ecx, [esi + 0x17c]
call fcn.10057e90
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10055d30
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10055d40
mov eax, dword [ecx]
push ecx
call dword [eax + 0x34]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10055d4d
mov eax, dword [ecx]
push ecx
call dword [eax + 0x44]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x10055d5a
mov eax, dword [ecx]
push ecx
call dword [eax + 0x44]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10055d67
mov eax, dword [ecx]
push ecx
call dword [eax + 0x44]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10055d74
mov eax, dword [ecx]
push ecx
call dword [eax + 0x44]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x10055d81
mov eax, dword [ecx]
push ecx
call dword [eax + 0x44]
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x10055d8e
mov eax, dword [ecx]
push ecx
call dword [eax + 0x44]
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x10055d9b
mov eax, dword [ecx]
push ecx
call dword [eax + 0x44]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10055da8
mov eax, dword [ecx]
push ecx
call dword [eax + 0x44]
mov ecx, esi
pop esi
jmp fcn.10054f80
Function at 0x10056c70
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push esi
mov esi, ecx
push edi
cmp byte [esi + 8], 0
je 0x10056d77
mov edx, dword [esi]
lea edi, [esi + 0x17c]
push 0
push edi
push 0
mov eax, dword [edx]
push 0x15
push 1
push 1
push 0x200
push 0x200
push edx
call dword [eax + 0x5c]
test eax, eax
je 0x10056d47
movaps xmm0, xmmword [0x100ed4f0]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], 0x4552480a
push eax
movups xmmword [ebp - 0x30], xmm0
lea eax, [ebp - 0x248]
mov dword [ebp - 0xc], 0x544c5553
movaps xmm0, xmmword [str._render_target._rSFF__s__d.sff___s_r_nErrorID:___d._r_nRequested_ScrItemListInfo_Could_not_load__SFF_scr__d.sffHeadersCanvas1.DonationCanvas1DonationCanvas2CPortalUI_Tier::CItemsPreviews::_font._r_nHRESULT:]
push eax
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x3025203a
mov word [ebp - 4], 0x5838
mov byte [ebp - 2], 0
call fcn.10003fa0
movaps xmm0, xmmword [0x100ed6a0]
lea eax, [ebp - 0x54]
add esp, 0xc
mov dword [ebp - 0x34], 0x656369
movups xmmword [ebp - 0x54], xmm0
movaps xmm0, xmmword [0x100ed750]
push 0x50010
push eax
lea eax, [ebp - 0x248]
push eax
push 0
movups xmmword [ebp - 0x44], xmm0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esi + 0x18c], 0
mov eax, dword [edi]
mov dword [esi + 0x180], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x184], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x188], eax
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x18c], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10057a00
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x248
push ebx
push esi
mov esi, ecx
push edi
push 0x9e
push 0x12e
mov dword [esi], eax
lea ecx, [esi + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [0x1014839c]
push 0x306
push 0xb
mov edx, dword [eax + 4]
add edx, 0xfc
call fcn.10039120
mov ecx, dword [esi]
lea ebx, [esi + 0x38]
add esp, 0x10
mov eax, dword [ecx]
push 0
push ebx
push 0
push 0x15
push 1
push 1
push 0x200
push 0x200
push ecx
call dword [eax + 0x5c]
test eax, eax
je 0x10057b03
movaps xmm0, xmmword [0x100ed4f0]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], 0x4552480a
push eax
movups xmmword [ebp - 0x30], xmm0
lea eax, [ebp - 0x248]
mov dword [ebp - 0xc], 0x544c5553
movaps xmm0, xmmword [str._render_target._rSFF__s__d.sff___s_r_nErrorID:___d._r_nRequested_ScrItemListInfo_Could_not_load__SFF_scr__d.sffHeadersCanvas1.DonationCanvas1DonationCanvas2CPortalUI_Tier::CItemsPreviews::_font._r_nHRESULT:]
push eax
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x3025203a
mov word [ebp - 4], 0x5838
mov byte [ebp - 2], 0
call fcn.10003fa0
movaps xmm0, xmmword [0x100ed490]
lea eax, [ebp - 0x54]
add esp, 0xc
mov word [ebp - 0x34], 0x657a
movups xmmword [ebp - 0x54], xmm0
mov byte [ebp - 0x32], 0
movaps xmm0, xmmword [0x100ed560]
push 0x50010
push eax
lea eax, [ebp - 0x248]
push eax
push 0
movups xmmword [ebp - 0x44], xmm0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esi + 0x48], 0
mov eax, dword [ebx]
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x14]
pop edi
mov eax, dword [eax + 0xc]
mov dword [esi + 0x48], eax
mov al, 1
mov dword [esi + 0x1008], 0
mov byte [esi + 0x1010], 0
mov dword [esi + 0xc], 0x188
mov dword [esi + 0x10], 0x13e
mov dword [esi + 0xff4], 0
mov dword [esi + 0xff8], 0
mov dword [esi + 0xffc], 0
mov dword [esi + 0x1000], 0
mov dword [esi + 0x1004], 0
mov byte [esi + 8], 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10057bb0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push esi
mov esi, ecx
push edi
cmp byte [esi + 8], 0
je 0x10057cab
mov edx, dword [esi]
lea edi, [esi + 0x38]
push 0
push edi
push 0
mov eax, dword [edx]
push 0x15
push 1
push 1
push 0x200
push 0x200
push edx
call dword [eax + 0x5c]
test eax, eax
je 0x10057c8a
movaps xmm0, xmmword [0x100ed4f0]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], 0x4552480a
push eax
movups xmmword [ebp - 0x30], xmm0
lea eax, [ebp - 0x24c]
mov dword [ebp - 0xc], 0x544c5553
movaps xmm0, xmmword [str._render_target._rSFF__s__d.sff___s_r_nErrorID:___d._r_nRequested_ScrItemListInfo_Could_not_load__SFF_scr__d.sffHeadersCanvas1.DonationCanvas1DonationCanvas2CPortalUI_Tier::CItemsPreviews::_font._r_nHRESULT:]
push eax
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x3025203a
mov word [ebp - 4], 0x5838
mov byte [ebp - 2], 0
call fcn.10003fa0
movaps xmm0, xmmword [0x100ed490]
lea eax, [ebp - 0x58]
add esp, 0xc
mov dword [ebp - 0x38], 0x63697665
movups xmmword [ebp - 0x58], xmm0
mov word [ebp - 0x34], 0x65
movaps xmm0, xmmword [0x100ed2c0]
push 0x50010
push eax
lea eax, [ebp - 0x24c]
push eax
push 0
movups xmmword [ebp - 0x48], xmm0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esi + 0x48], 0
mov eax, dword [edi]
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x48], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100583c0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push esi
mov esi, ecx
push edi
cmp byte [esi + 8], 0
je 0x100584ce
mov edx, dword [esi]
lea edi, [esi + 0xa8]
push 0
push edi
push 0
mov eax, dword [edx]
push 0x15
push 1
push 1
push 0x200
push 0x200
push edx
call dword [eax + 0x5c]
test eax, eax
je 0x1005849e
movaps xmm0, xmmword [0x100ed4f0]
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x30], 0x4552480a
push eax
movups xmmword [ebp - 0x50], xmm0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x2c], 0x544c5553
movaps xmm0, xmmword [str._render_target._rSFF__s__d.sff___s_r_nErrorID:___d._r_nRequested_ScrItemListInfo_Could_not_load__SFF_scr__d.sffHeadersCanvas1.DonationCanvas1DonationCanvas2CPortalUI_Tier::CItemsPreviews::_font._r_nHRESULT:]
push eax
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x28], 0x3025203a
mov word [ebp - 0x24], 0x5838
mov byte [ebp - 0x22], 0
call fcn.10003fa0
movaps xmm0, xmmword [0x100ed270]
lea eax, [ebp - 0x20]
add esp, 0xc
mov dword [ebp - 0x10], 0x6f4c6e4f
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0xc], 0x65447473
mov dword [ebp - 8], 0x65636976
push 0x50010
push eax
lea eax, [ebp - 0x244]
mov byte [ebp - 4], 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esi + 0xb8], 0
mov eax, dword [edi]
mov dword [esi + 0xac], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0xb0], eax
mov eax, dword [esi + 0x28]
mov dword [esi + 0xb4], eax
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0xc]
mov dword [esi + 0xb8], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10067020
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
add ecx, 0x6ef884
jmp fcn.1005da50