joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40309c
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x4170d4]
mov edi, eax
sub esi, dword [0x40b004]
add edi, 0x1f4
add esi, dword [esp + 0x1c]
cmp esi, ebp
jle 0x403272
push dword [0x41f0e4]
call fcn.004032af
push ebp
push ebp
push dword [0x40b004]
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f0e0], esi
mov dword [0x4170d0], ebp
mov eax, dword [0x4170d8]
mov ebx, 0x4000
sub eax, dword [0x41f0e4]
cmp eax, ebx
jg 0x40310f
mov ebx, eax
mov esi, 0x413090
push ebx
push esi
call fcn.0040327d
test eax, eax
je 0x40323d
add dword [0x41f0e4], ebx
mov dword [0x40b020], esi
mov dword [0x40b024], ebx
cmp dword [0x423f28], ebp
je 0x4031a0
cmp dword [0x423fc0], ebp
jne 0x4031a0
cmp dword [esp + 0x10], ebp
je 0x40316d
mov eax, dword [0x41f0e0]
push ebp
sub eax, dword [0x4170d4]
sub eax, dword [esp + 0x20]
add eax, dword [0x40b004]
mov dword [0x4170d0], eax
call fcn.00405e0a
jmp 0x4031a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jbe 0x4031a0
mov eax, dword [0x423f24]
neg eax
sbb eax, eax
not eax
and eax, str.unpacking_data:__d__
push eax
push 0x402bca
push ebp
push 0x6f
push dword [0x423f20]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
mov ecx, 0x40b008
mov dword [0x40b028], 0x40b090
mov dword [0x40b02c], 0x8000
call fcn.00405ecb
test eax, eax
jl 0x403246
mov esi, dword [0x40b028]
mov eax, 0x40b090
sub esi, eax
je 0x403207
lea ecx, [esp + 0x14]
push ebp
push ecx
push esi
push eax
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403242
cmp esi, dword [esp + 0x14]
jne 0x403242
add dword [0x40b004], esi
cmp dword [0x40b024], ebp
jne 0x403135
jmp 0x403213
cmp dword [0x40b024], ebp
jne 0x403246
cmp ebx, ebp
je 0x403246
mov eax, dword [0x4170d4]
mov ecx, eax
sub ecx, dword [0x40b004]
add ecx, dword [esp + 0x1c]
test ecx, ecx
jg 0x4030f9
push ebp
push ebp
push eax
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40324b
or eax, 0xffffffff
jmp 0x403274
push 0xfffffffffffffffe
jmp 0x403248
push 0xfffffffffffffffd
pop eax
jmp 0x403274
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x403272
mov eax, dword [0x41f0e0]
push ebp
push ebp
push 0x113
push esi
mov dword [0x4170d0], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x40a066
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x40a066
lcall 0x5de5, 0x8b10c483
jmp loc.00779578
Function at 0x4f04b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x81000]
push edi
jmp 0x4f04ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4f04d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f04c0
mov eax, 1
add ebx, ebx
jne 0x4f04e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4f04f4
jne 0x4f0513
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f0513
dec eax
add ebx, ebx
jne 0x4f0500
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4f04d8
add ebx, ebx
jne 0x4f050f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4f0565
xor ecx, ecx
sub eax, 3
jb 0x4f052b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4f059a
sar eax, 1
mov ebp, eax
jmp 0x4f0536
add ebx, ebx
jne 0x4f0536
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f0504
inc ecx
add ebx, ebx
jne 0x4f0544
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f0504
add ebx, ebx
jne 0x4f0551
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4f0546
jne 0x4f0562
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4f0546
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4f0584
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4f0576
jmp 0x4f04c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4f0584
add edi, ecx
jmp 0x4f04c6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4f05a2
cmp byte [edi], 0x11
jne 0x4f05a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4f05a7
lea edi, [esi + 0xe9000]
mov eax, dword [edi]
or eax, eax
je 0x4f061f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf1540]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf16e4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4f05d4
mov ecx, edi
jns 0x4f0603
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf16ec]
or eax, eax
je 0x4f0619
mov dword [ebx], eax
add ebx, 4
jmp 0x4f05f1
call dword [esi + 0xf16e8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4f0650
cmp al, 0xef
ja 0x4f0643
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4f0625
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4f0632
mov ebp, dword [esi + 0xf16f0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4f0684
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x43f15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x43f168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x43f14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x43f145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x43f145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret
Function at 0x401000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov dword [ebp - 0x24], edx
mov edx, dword [eax + 0x3c]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov edi, dword [eax + edx + 0x78]
mov dword [ebp - 0x10], ecx
add edi, eax
mov edx, edi
mov edi, dword [edi + 0x1c]
mov ebx, dword [edx + 0x20]
mov esi, dword [edx + 0x24]
mov dword [ebp - 0x18], edi
mov edi, dword [edx + 0x18]
add ebx, eax
add esi, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], edi
xor edi, edi
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x10], ecx
je 0x4010cd
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x10]
mov ecx, eax
mov edx, dword [ebp - 0x24]
add ecx, dword [esi + ebx*4]
mov dword [ebp - 0x20], ecx
xor ecx, ecx
cmp byte [edx], 0
je 0x4010c0
mov esi, dword [ebp - 0x20]
mov bl, byte [edx]
test bl, bl
je 0x401072
cmp bl, byte [esi]
jne 0x4010b6
inc esi
inc edx
jmp 0x401064
cmp byte [esi], 0
jne 0x4010b6
mov ebx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
movsx edx, word [ebx + esi*2]
mov esi, dword [ebp - 0x18]
lea edx, [eax + edx*4]
mov ebx, dword [edx + esi]
add ebx, eax
cmp dword [ebp + 8], 1
mov edx, ebx
jne 0x4010a4
cmp byte [ebx], 0xb8
jne 0x4010c0
mov edx, dword [ebx + 1]
mov ebx, dword [ebp - 0x14]
mov dword [ebx + ecx*4], edx
jmp 0x4010c0
mov esi, dword [ebp - 0x14]
cmp dword [ebp + 8], 2
lea esi, [esi + ecx*4]
jne 0x4010b2
mov edx, dword [ebx]
mov dword [esi], edx
jmp 0x4010c0
inc edx
cmp byte [edx - 1], 0
jne 0x4010b6
inc ecx
jmp 0x40105c
cmp edi, ecx
cmovl edi, ecx
inc dword [ebp - 0x10]
jmp 0x40103d
add esp, 0x20
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4027d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
xor ecx, ecx
push ebx
mov ebx, eax
mov eax, edx
or ah, 1
mov edi, eax
shr eax, 1
and edi, 1
movzx edx, word [ebx + eax*2]
neg edi
and edi, 0x7ff
xor edx, edi
shr edx, 4
add ecx, dword [esi + edx*4]
cmp eax, 1
jne 0x4027ea
pop ebx
mov eax, ecx
pop esi
pop edi
pop ebp
ret

Function at 0x402811
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, 0x100
push ebx
push ebx
mov dword [ebp - 0x10], eax
mov eax, edx
mov edx, ecx
or ah, 1
add edx, edx
mov ecx, esi
mov ebx, eax
and ecx, edx
shr ebx, 8
add ecx, esi
add ecx, ebx
mov ebx, dword [ebp - 0x10]
movzx ecx, word [ebx + ecx*2]
mov ebx, eax
add eax, eax
shl ebx, 0x18
sar ebx, 0x1f
and ebx, 0x7ff
xor ecx, ebx
mov ebx, dword [ebp + 8]
shr ecx, 4
add edi, dword [ebx + ecx*4]
mov ecx, edx
xor ecx, eax
not ecx
and esi, ecx
cmp eax, 0xffff
jbe 0x402829
pop edx
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402898
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov dword [ebp - 0x1c], edx
movzx eax, word [eax + 2]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
xor eax, eax
mov ecx, eax
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp + 8]
shr ecx, 2
mov edx, ecx
movzx ecx, word [ebx + ecx*2 + 4]
neg edx
and edx, 0x7ff
xor edx, esi
mov esi, dword [ebp - 0x1c]
shr edx, 4
add esi, dword [edi + edx*4]
mov edx, esi
mov esi, eax
shr esi, 1
mov dword [ebp - 0x10], esi
and esi, 1
neg esi
and esi, 0x7ff
xor ecx, esi
shr ecx, 4
add edx, dword [edi + ecx*4]
mov edi, dword [ebp - 0x10]
movzx ecx, word [ebx + edi*2 + 8]
mov edi, dword [ebp + 8]
shr ecx, 4
mov esi, dword [edi + ecx*4]
mov edi, dword [ebp - 0x14]
xor ecx, 0x7f
add esi, edx
mov dword [edi + eax*4], esi
mov edi, dword [ebp + 8]
add edx, dword [edi + ecx*4]
mov edi, dword [ebp - 0x14]
mov dword [edi + eax*4 + 4], edx
add eax, 2
cmp eax, 8
jne 0x4028b2
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402a57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ecx, eax
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [eax + 0x548]
lea eax, [eax + 0x1c1c]
sub esp, 0x14
mov dword [ebp - 0x14], eax
movzx eax, word [ecx + 0x1c1e]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
shr edx, 1
and eax, 1
and edx, 1
shr edi, 2
mov dword [ebp - 0x18], edx
lea edx, [eax + 2]
mov esi, dword [ebp - 0x18]
neg eax
mov dword [ebp - 0x1c], edi
lea edi, [edx + edx]
mov edx, dword [ebp - 0x14]
and eax, 0x7ff
neg esi
movzx edx, word [edx + edi]
and esi, 0x7ff
xor edx, esi
mov esi, edx
mov edx, dword [ebp - 0x20]
shr esi, 4
xor eax, edx
shr eax, 4
mov edx, dword [ebx + eax*4]
mov eax, dword [ebp - 0x18]
add edx, dword [ebx + esi*4]
add eax, edi
mov edi, dword [ebp - 0x14]
add eax, eax
movzx esi, word [edi + eax]
mov edi, dword [ebp - 0x1c]
neg edi
and edi, 0x7ff
xor esi, edi
mov edi, dword [ebp - 0x1c]
shr esi, 4
add eax, edi
mov edi, dword [ebp - 0x14]
add edx, dword [ebx + esi*4]
movzx eax, word [edi + eax*2]
mov edi, dword [ebp - 0x10]
inc dword [ebp - 0x10]
shr eax, 4
mov esi, dword [ebx + eax*4]
xor eax, 0x7f
add esi, edx
mov dword [ecx + edi*4 + 0xfdc], esi
add edx, dword [ebx + eax*4]
cmp dword [ebp - 0x10], 8
mov dword [ecx + edi*4 + 0xffc], edx
jne 0x402a80
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403153
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
or dword [esp - 0x1000], 0
or dword [esp - 0x1020], 0
sub esp, 0x20
mov edi, eax
movzx eax, word [ecx]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], edx
mov ebx, dword [ebp + 8]
shr eax, 4
mov dword [ebp - 0x10], ecx
mov edx, eax
mov eax, dword [esi + eax*4]
xor edx, 0x7f
mov dword [ebp - 0x24], eax
mov ax, word [ecx + 0x10]
mov ebx, dword [ebx + edx*4]
shr ax, 4
mov word [ebp - 0x14], ax
movzx eax, ax
mov dword [ebp - 0x1c], ebx
add ebx, dword [esi + eax*4]
xor eax, eax
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x28], ebx
lea ebx, [edi + 4]
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x18], ecx
je 0x4031ed
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
mov dword [esp], eax
mov eax, esi
call fcn.00402898
mov edx, dword [ebp + 8]
lea ecx, [ebx + 0x20]
lea eax, [esi + 0x10]
add ebx, 0x440
add esi, 0x20
mov dword [esp], edx
mov edx, dword [ebp - 0x28]
call fcn.00402898
inc dword [ebp - 0x18]
jmp 0x4031b1
mov eax, dword [edi]
cmp eax, 0x10
jbe 0x4032b2
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, 0xf
shr eax, 1
lea ebx, [esi + 0x200]
xor edx, 0x7f
mov esi, dword [ebp + 8]
add eax, 0x7f
mov dword [ebp - 0x18], ebx
movzx edx, dx
lea ebx, [edi + 0x44]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x1c]
add ebx, dword [esi + edx*4]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
mov ebx, eax
mov esi, ebx
mov ecx, dword [ebp - 0x18]
shr ebx, 1
and esi, 1
movzx ecx, word [ecx + ebx*2]
neg esi
and esi, 0x7ff
xor ecx, esi
mov esi, dword [ebp + 8]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add dword [ebp - 0x14], ecx
cmp ebx, 1
jne 0x40322f
mov ecx, dword [ebp - 0x10]
mov edx, esi
mov esi, dword [ebp - 0x14]
movzx ecx, word [ecx + eax*2 + 0x200]
shr ecx, 4
add esi, dword [edx + ecx*4]
xor ecx, 0x7f
mov dword [edi + eax*8 - 0x3bc], esi
mov esi, dword [ebp - 0x14]
add esi, dword [edx + ecx*4]
mov dword [edi + eax*8 - 0x3b8], esi
dec eax
cmp eax, 0x7f
jne 0x403227
mov eax, dword [edi]
lea edx, [eax*4 - 0x40]
lea eax, [edi + 0x484]
mov edi, dword [ebp - 0x20]
cmp ebx, edi
jae 0x4032b2
mov edi, eax
mov esi, dword [ebp - 0x24]
mov ecx, edx
inc ebx
rep movsb byte es:[edi], byte [esi]
add eax, 0x440
jmp 0x40329a
add esp, 0x20
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1000a440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000a499
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000a499
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000a48a
cmp esi, edx
jae 0x1000a499
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1000a478
cmp esi, edx
jae 0x1000a499
cmp word [esi], 0
je 0x1000a499
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1000c3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100c60c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100c88b0
mov dword [ebp - 0x10c], 0x740068
lea esi, [ebp - 0x10c]
mov dword [ebp - 0x108], 0x700074
push edi
mov dword [ebp - 0x104], 0x2f003a
mov edx, 0x84
mov dword [ebp - 0x100], 0x73002f
sub esi, eax
mov dword [ebp - 0xfc], 0x2e0073
mov dword [ebp - 0xf8], 0x610068
mov dword [ebp - 0xf4], 0x6f006c
mov dword [ebp - 0xf0], 0x610070
mov dword [ebp - 0xec], 0x650070
mov dword [ebp - 0xe8], 0x2e0072
mov dword [ebp - 0xe4], 0x6e0063
mov dword [ebp - 0xe0], 0x64002f
mov dword [ebp - 0xdc], 0x74006f
mov dword [ebp - 0xd8], 0x70003f
mov dword [ebp - 0xd4], 0x790074
mov dword [ebp - 0xd0], 0x650070
mov dword [ebp - 0xcc], 0x68003d
mov dword [ebp - 0xc8], 0x6c0061
mov dword [ebp - 0xc4], 0x77006f
mov dword [ebp - 0xc0], 0x260070
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop
lea ecx, [edx + 0x7fffff7a]
test ecx, ecx
je 0x1000c61e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000c61e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000c600
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003ff0d
mov esp, ebp
pop ebp
ret
Function at 0x1000c640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100c60c0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x118], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x118]
mov eax, 0x100c94f8
mov dword [ebp - 0x114], 0x700074
push edi
mov dword [ebp - 0x110], 0x2f003a
mov edx, 0x89
mov dword [ebp - 0x10c], 0x73002f
sub esi, eax
mov dword [ebp - 0x108], 0x2e0073
mov dword [ebp - 0x104], 0x680077
mov dword [ebp - 0x100], 0x6c0061
mov dword [ebp - 0xfc], 0x630065
mov dword [ebp - 0xf8], 0x65006c
mov dword [ebp - 0xf4], 0x6e0061
mov dword [ebp - 0xf0], 0x63002e
mov dword [ebp - 0xec], 0x2f006e
mov dword [ebp - 0xe8], 0x6f0064
mov dword [ebp - 0xe4], 0x3f0074
mov dword [ebp - 0xe0], 0x740070
mov dword [ebp - 0xdc], 0x700079
mov dword [ebp - 0xd8], 0x3d0065
mov dword [ebp - 0xd4], 0x680077
mov dword [ebp - 0xd0], 0x6c0061
mov dword [ebp - 0xcc], 0x630065
mov dword [ebp - 0xc8], 0x65006c
mov dword [ebp - 0xc4], 0x6e0061
mov dword [ebp - 0xc0], 0x700026
mov dword [ebp - 0xbc], 0x640069
mov dword [ebp - 0xb8], 0x7b003d
mov dword [ebp - 0xb4], 0x690070
mov dword [ebp - 0xb0], 0x7d0064
mov dword [ebp - 0xac], 0x6d0026
mov dword [ebp - 0xa8], 0x640069
mov dword [ebp - 0xa4], 0x7b003d
mov dword [ebp - 0xa0], 0x69006d
mov dword [ebp - 0x9c], 0x7d0064
mov dword [ebp - 0x98], 0x6d0026
mov dword [ebp - 0x94], 0x640069
mov dword [ebp - 0x90], 0x3d0032
mov dword [ebp - 0x8c], 0x6d007b
mov dword [ebp - 0x88], 0x640069
mov dword [ebp - 0x84], 0x7d0032
mov dword [ebp - 0x80], 0x610026
mov dword [ebp - 0x7c], 0x700070
mov dword [ebp - 0x78], 0x650076
mov dword [ebp - 0x74], 0x3d0072
mov dword [ebp - 0x70], 0x61007b
mov dword [ebp - 0x6c], 0x700070
mov dword [ebp - 0x68], 0x650076
mov dword [ebp - 0x64], 0x7d0072
mov dword [ebp - 0x60], 0x6d0026
mov dword [ebp - 0x5c], 0x64006f
mov dword [ebp - 0x58], 0x650076
mov dword [ebp - 0x54], 0x3d0072
mov dword [ebp - 0x50], 0x6d007b
mov dword [ebp - 0x4c], 0x64006f
mov dword [ebp - 0x48], 0x650076
mov dword [ebp - 0x44], 0x7d0072
mov dword [ebp - 0x40], 0x740026
mov dword [ebp - 0x3c], 0x700079
mov dword [ebp - 0x38], 0x3d0065
mov dword [ebp - 0x34], 0x74007b
mov dword [ebp - 0x30], 0x700079
mov dword [ebp - 0x2c], 0x7d0065
mov dword [ebp - 0x28], 0x610026
mov dword [ebp - 0x24], 0x740063
mov dword [ebp - 0x20], 0x6f0069
mov dword [ebp - 0x1c], 0x3d006e
mov dword [ebp - 0x18], 0x61007b
mov dword [ebp - 0x14], 0x740063
mov dword [ebp - 0x10], 0x6f0069
mov dword [ebp - 0xc], 0x7d006e
nop dword [eax]
lea ecx, [edx + 0x7fffff75]
test ecx, ecx
je 0x1000c8de
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000c8de
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000c8c0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003ff0d
mov esp, ebp
pop ebp
ret
Function at 0x1000cac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100c60c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100c9148
mov dword [ebp - 0x10c], 0x740068
lea esi, [ebp - 0x10c]
mov dword [ebp - 0x108], 0x700074
push edi
mov dword [ebp - 0x104], 0x2f003a
mov edx, 0x84
mov dword [ebp - 0x100], 0x73002f
sub esi, eax
mov dword [ebp - 0xfc], 0x2e0073
mov dword [ebp - 0xf8], 0x610068
mov dword [ebp - 0xf4], 0x6f006c
mov dword [ebp - 0xf0], 0x650070
mov dword [ebp - 0xec], 0x2e0074
mov dword [ebp - 0xe8], 0x6e0063
mov dword [ebp - 0xe4], 0x64002f
mov dword [ebp - 0xe0], 0x74006f
mov dword [ebp - 0xdc], 0x70003f
mov dword [ebp - 0xd8], 0x790074
mov dword [ebp - 0xd4], 0x650070
mov dword [ebp - 0xd0], 0x68003d
mov dword [ebp - 0xcc], 0x6c0061
mov dword [ebp - 0xc8], 0x70006f
mov dword [ebp - 0xc4], 0x740065
mov dword [ebp - 0xc0], 0x260073
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop
lea ecx, [edx + 0x7fffff7a]
test ecx, ecx
je 0x1000cd3e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000cd3e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000cd20
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003ff0d
mov esp, ebp
pop ebp
ret