joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f6b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100d2fb8
mov dword [ebp - 0x20], 0x690041
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x680053
mov dword [ebp - 0x18], 0x6e0061
mov edx, 0xe
mov dword [ebp - 0x14], 0x570067
sub esi, eax
mov dword [ebp - 0x10], 0x2e0070
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x1001f71f
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001f71f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001f701
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x1001f820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100d2bc0
mov dword [ebp - 0x30], 0x610048
lea esi, [ebp - 0x30]
mov dword [ebp - 0x2c], 0x6b006f
mov dword [ebp - 0x28], 0x6e0061
mov edx, 0x16
mov dword [ebp - 0x24], 0x490020
sub esi, eax
mov dword [ebp - 0x20], 0x61006d
mov dword [ebp - 0x1c], 0x650067
mov dword [ebp - 0x18], 0x200073
mov dword [ebp - 0x14], 0x650053
mov dword [ebp - 0x10], 0x760072
mov dword [ebp - 0xc], 0x630069
mov dword [ebp - 8], 0x65
nop dword [eax]
lea ecx, [edx + 0x7fffffe8]
test ecx, ecx
je 0x1001f8ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001f8ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001f890
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x1001fb50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x40], 0x650044
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x40]
mov eax, 0x100d33cc
mov dword [ebp - 0x3c], 0x720066
push edi
mov dword [ebp - 0x38], 0x670061
mov edx, 0x1d
mov dword [ebp - 0x34], 0x650067
sub esi, eax
mov dword [ebp - 0x30], 0x200072
mov dword [ebp - 0x2c], 0x720050
mov dword [ebp - 0x28], 0x74006f
mov dword [ebp - 0x24], 0x630065
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x530020
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x690076
mov dword [ebp - 0xc], 0x650063
nop word [eax + eax]
lea ecx, [edx + 0x7fffffe1]
test ecx, ecx
je 0x1001fbfe
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001fbfe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001fbe0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret
Function at 0x1001fc20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100d2d68
mov dword [ebp - 0x48], 0x610048
lea esi, [ebp - 0x48]
mov dword [ebp - 0x44], 0x6f006c
push edi
mov dword [ebp - 0x40], 0x570020
mov edx, 0x22
mov dword [ebp - 0x3c], 0x6c0061
sub esi, eax
mov dword [ebp - 0x38], 0x50006c
mov dword [ebp - 0x34], 0x700061
mov dword [ebp - 0x30], 0x720065
mov dword [ebp - 0x2c], 0x500020
mov dword [ebp - 0x28], 0x6f0072
mov dword [ebp - 0x24], 0x650074
mov dword [ebp - 0x20], 0x740063
mov dword [ebp - 0x1c], 0x6f0069
mov dword [ebp - 0x18], 0x20006e
mov dword [ebp - 0x14], 0x650053
mov dword [ebp - 0x10], 0x760072
mov dword [ebp - 0xc], 0x630069
mov dword [ebp - 8], 0x65
nop dword [eax]
lea ecx, [edx + 0x7fffffdc]
test ecx, ecx
je 0x1001fcde
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001fcde
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001fcc0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x1001fd00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100d2c3c
mov dword [ebp - 0x20], 0x6f0064
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x70006c
mov dword [ebp - 0x18], 0x690068
mov edx, 0xe
mov dword [ebp - 0x14], 0x77006e
sub esi, eax
mov dword [ebp - 0x10], 0x2e0070
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x1001fd6f
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001fd6f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001fd51
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret
Function at 0x1001fe70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x50], 0x690041
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x50]
mov eax, 0x100d3008
mov dword [ebp - 0x4c], 0x680053
push edi
mov dword [ebp - 0x48], 0x6e0061
mov edx, 0x25
mov dword [ebp - 0x44], 0x200067
sub esi, eax
mov dword [ebp - 0x40], 0x610057
mov dword [ebp - 0x3c], 0x6c006c
mov dword [ebp - 0x38], 0x610050
mov dword [ebp - 0x34], 0x650070
mov dword [ebp - 0x30], 0x200072
mov dword [ebp - 0x2c], 0x720050
mov dword [ebp - 0x28], 0x74006f
mov dword [ebp - 0x24], 0x630065
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x530020
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x690076
mov dword [ebp - 0xc], 0x650063
lea ecx, [edx + 0x7fffffd9]
test ecx, ecx
je 0x1001ff34
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001ff34
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001ff16
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x1001ff60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100d31b4
mov dword [ebp - 0x1c], 0x430050
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x61004d
mov dword [ebp - 0x14], 0x61006e
mov edx, 0xc
mov dword [ebp - 0x10], 0x650067
sub esi, eax
mov dword [ebp - 0xc], 0x760053
mov dword [ebp - 8], 0x63
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x1001ffce
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001ffce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001ffb0
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret
Function at 0x1001fff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100d3138
mov dword [ebp - 0x50], 0x610048
lea esi, [ebp - 0x50]
mov dword [ebp - 0x4c], 0x6f006c
push edi
mov dword [ebp - 0x48], 0x9762684c
mov edx, 0x26
mov dword [ebp - 0x44], 0x72695ba0
sub esi, eax
mov dword [ebp - 0x40], 0x62a44fdd
mov dword [ebp - 0x3c], 0x52a1670d
mov dword [ebp - 0x38], 0x505c3002
mov dword [ebp - 0x34], 0x62166b62
mov dword [ebp - 0x30], 0x75287981
mov dword [ebp - 0x2c], 0x670d6b64
mov dword [ebp - 0x28], 0x4f1a52a1
mov dword [ebp - 0x24], 0x81f45bfc
mov dword [ebp - 0x20], 0x610048
mov dword [ebp - 0x1c], 0x6f006c
mov dword [ebp - 0x18], 0x9762684c
mov dword [ebp - 0x14], 0x72695ba0
mov dword [ebp - 0x10], 0x80fd529f
mov dword [ebp - 0xc], 0x5e385f02
mov dword [ebp - 8], 0x3002
nop word [eax + eax]
lea ecx, [edx + 0x7fffffd8]
test ecx, ecx
je 0x100200be
movzx ecx, word [esi + eax]
test cx, cx
je 0x100200be
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100200a0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x100200e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100d2e08
mov dword [ebp - 0x1c], 0x430043
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x6f004d
mov dword [ebp - 0x14], 0x730075
mov edx, 0xc
mov dword [ebp - 0x10], 0x2e0065
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x1002014e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1002014e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10020130
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret
Function at 0x100205a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x40], 0x610057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x40]
mov eax, 0x100d29bc
mov dword [ebp - 0x3c], 0x6c006c
push edi
mov dword [ebp - 0x38], 0x610050
mov edx, 0x1d
mov dword [ebp - 0x34], 0x650070
sub esi, eax
mov dword [ebp - 0x30], 0x200072
mov dword [ebp - 0x2c], 0x720050
mov dword [ebp - 0x28], 0x74006f
mov dword [ebp - 0x24], 0x630065
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x530020
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x690076
mov dword [ebp - 0xc], 0x650063
nop word [eax + eax]
lea ecx, [edx + 0x7fffffe1]
test ecx, ecx
je 0x1002064e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1002064e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10020630
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x10020670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x690041
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x100d3280
mov dword [ebp - 0x20], 0x680053
mov dword [ebp - 0x1c], 0x6e0061
mov edx, 0xf
mov dword [ebp - 0x18], 0x500067
sub esi, eax
mov dword [ebp - 0x14], 0x740065
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
nop word [eax + eax]
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x100206ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x100206ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100206d0
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x10020710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x40], 0x6c0042
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x40]
mov eax, 0x100d2f20
mov dword [ebp - 0x3c], 0x650075
push edi
mov dword [ebp - 0x38], 0x680077
mov edx, 0x1d
mov dword [ebp - 0x34], 0x6c0061
sub esi, eax
mov dword [ebp - 0x30], 0x200065
mov dword [ebp - 0x2c], 0x720050
mov dword [ebp - 0x28], 0x74006f
mov dword [ebp - 0x24], 0x630065
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x530020
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x690076
mov dword [ebp - 0xc], 0x650063
nop word [eax + eax]
lea ecx, [edx + 0x7fffffe1]
test ecx, ecx
je 0x100207be
movzx ecx, word [esi + eax]
test cx, cx
je 0x100207be
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100207a0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret
Function at 0x100207e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100d32a8
mov dword [ebp - 0x20], 0x690061
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x680073
mov dword [ebp - 0x18], 0x6e0061
mov edx, 0xe
mov dword [ebp - 0x14], 0x700067
sub esi, eax
mov dword [ebp - 0x10], 0x740065
mov dword [ebp - 0xc], 0x760053
mov dword [ebp - 8], 0x63
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x1002084f
movzx ecx, word [esi + eax]
test cx, cx
je 0x1002084f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10020831
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x10020870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100d32d0
mov dword [ebp - 0x54], 0x690041
lea esi, [ebp - 0x54]
mov dword [ebp - 0x50], 0x680053
push edi
mov dword [ebp - 0x4c], 0x6e0061
mov edx, 0x28
mov dword [ebp - 0x48], 0x500067
sub esi, eax
mov dword [ebp - 0x44], 0x740065
mov dword [ebp - 0x40], 0x570020
mov dword [ebp - 0x3c], 0x6c0061
mov dword [ebp - 0x38], 0x50006c
mov dword [ebp - 0x34], 0x700061
mov dword [ebp - 0x30], 0x720065
mov dword [ebp - 0x2c], 0x500020
mov dword [ebp - 0x28], 0x6f0072
mov dword [ebp - 0x24], 0x650074
mov dword [ebp - 0x20], 0x740063
mov dword [ebp - 0x1c], 0x6f0069
mov dword [ebp - 0x18], 0x20006e
mov dword [ebp - 0x14], 0x650053
mov dword [ebp - 0x10], 0x760072
mov dword [ebp - 0xc], 0x630069
mov dword [ebp - 8], 0x65
nop
lea ecx, [edx + 0x7fffffd6]
test ecx, ecx
je 0x1002093e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1002093e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10020920
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret
Function at 0x10020960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x50], 0x6f0044
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x50]
mov eax, 0x100d2c88
mov dword [ebp - 0x4c], 0x70006c
push edi
mov dword [ebp - 0x48], 0x690068
mov edx, 0x25
mov dword [ebp - 0x44], 0x20006e
sub esi, eax
mov dword [ebp - 0x40], 0x610057
mov dword [ebp - 0x3c], 0x6c006c
mov dword [ebp - 0x38], 0x610050
mov dword [ebp - 0x34], 0x650070
mov dword [ebp - 0x30], 0x200072
mov dword [ebp - 0x2c], 0x720050
mov dword [ebp - 0x28], 0x74006f
mov dword [ebp - 0x24], 0x630065
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x530020
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x690076
mov dword [ebp - 0xc], 0x650063
lea ecx, [edx + 0x7fffffd9]
test ecx, ecx
je 0x10020a24
movzx ecx, word [esi + eax]
test cx, cx
je 0x10020a24
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10020a06
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x10020a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100d30f0
mov dword [ebp - 0x3c], 0x610048
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x38], 0x6f006c
push edi
mov dword [ebp - 0x34], 0x650050
mov edx, 0x1c
mov dword [ebp - 0x30], 0x730074
sub esi, eax
mov dword [ebp - 0x2c], 0x500020
mov dword [ebp - 0x28], 0x6f0072
mov dword [ebp - 0x24], 0x650074
mov dword [ebp - 0x20], 0x740063
mov dword [ebp - 0x1c], 0x6f0069
mov dword [ebp - 0x18], 0x20006e
mov dword [ebp - 0x14], 0x650053
mov dword [ebp - 0x10], 0x760072
mov dword [ebp - 0xc], 0x630069
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7fffffe2]
test ecx, ecx
je 0x10020af2
movzx ecx, word [esi + eax]
test cx, cx
je 0x10020af2
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10020ad4
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x10020b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100d30cc
mov dword [ebp - 0x1c], 0x610068
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x6f006c
mov dword [ebp - 0x14], 0x650070
mov edx, 0xc
mov dword [ebp - 0x10], 0x730074
sub esi, eax
mov dword [ebp - 0xc], 0x760053
mov dword [ebp - 8], 0x63
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x10020b7e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10020b7e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10020b60
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret
Function at 0x10020ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100d2ed4
mov dword [ebp - 0x20], 0x6c0042
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x650075
mov dword [ebp - 0x18], 0x680077
mov edx, 0xe
mov dword [ebp - 0x14], 0x6c0061
sub esi, eax
mov dword [ebp - 0x10], 0x2e0065
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x10020c0f
movzx ecx, word [esi + eax]
test cx, cx
je 0x10020c0f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10020bf1
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x10020c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100d31d8
mov dword [ebp - 0x50], 0x430050
lea esi, [ebp - 0x50]
mov dword [ebp - 0x4c], 0x61004d
push edi
mov dword [ebp - 0x48], 0x61006e
mov edx, 0x26
mov dword [ebp - 0x44], 0x650067
sub esi, eax
mov dword [ebp - 0x40], 0x570020
mov dword [ebp - 0x3c], 0x6c0061
mov dword [ebp - 0x38], 0x50006c
mov dword [ebp - 0x34], 0x700061
mov dword [ebp - 0x30], 0x720065
mov dword [ebp - 0x2c], 0x500020
mov dword [ebp - 0x28], 0x6f0072
mov dword [ebp - 0x24], 0x650074
mov dword [ebp - 0x20], 0x740063
mov dword [ebp - 0x1c], 0x6f0069
mov dword [ebp - 0x18], 0x20006e
mov dword [ebp - 0x14], 0x650053
mov dword [ebp - 0x10], 0x760072
mov dword [ebp - 0xc], 0x630069
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7fffffd8]
test ecx, ecx
je 0x10020cfe
movzx ecx, word [esi + eax]
test cx, cx
je 0x10020cfe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10020ce0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x10020ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100d3380
mov dword [ebp - 0x20], 0x650044
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x720066
mov dword [ebp - 0x18], 0x670061
mov edx, 0xe
mov dword [ebp - 0x14], 0x650067
sub esi, eax
mov dword [ebp - 0x10], 0x2e0072
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x10020f2f
movzx ecx, word [esi + eax]
test cx, cx
je 0x10020f2f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10020f11
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret
Function at 0x10020f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x44], 0x640044
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x44]
mov eax, 0x100d2a80
mov dword [ebp - 0x40], 0x610057
push edi
mov dword [ebp - 0x3c], 0x6c006c
mov edx, 0x1f
mov dword [ebp - 0x38], 0x610050
sub esi, eax
mov dword [ebp - 0x34], 0x650070
mov dword [ebp - 0x30], 0x200072
mov dword [ebp - 0x2c], 0x720050
mov dword [ebp - 0x28], 0x74006f
mov dword [ebp - 0x24], 0x630065
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x530020
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x690076
mov dword [ebp - 0xc], 0x650063
lea ecx, [edx + 0x7fffffdf]
test ecx, ecx
je 0x10020fff
movzx ecx, word [esi + eax]
test cx, cx
je 0x10020fff
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10020fe1
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret

Function at 0x10021020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3c], 0x430043
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x3c]
mov eax, 0x100d2e4c
mov dword [ebp - 0x38], 0x6f004d
push edi
mov dword [ebp - 0x34], 0x730075
mov edx, 0x1b
mov dword [ebp - 0x30], 0x200065
sub esi, eax
mov dword [ebp - 0x2c], 0x720050
mov dword [ebp - 0x28], 0x74006f
mov dword [ebp - 0x24], 0x630065
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x530020
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x690076
mov dword [ebp - 0xc], 0x650063
lea ecx, [edx + 0x7fffffe3]
test ecx, ecx
je 0x100210c1
movzx ecx, word [esi + eax]
test cx, cx
je 0x100210c1
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100210a3
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret
Function at 0x100210e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x34], 0x690059
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x34]
mov eax, 0x100d2b28
mov dword [ebp - 0x30], 0x67006e
push edi
mov dword [ebp - 0x2c], 0x610079
mov edx, 0x17
mov dword [ebp - 0x28], 0x20006e
sub esi, eax
mov dword [ebp - 0x24], 0x6d0049
mov dword [ebp - 0x20], 0x670061
mov dword [ebp - 0x1c], 0x730065
mov dword [ebp - 0x18], 0x530020
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x690076
mov dword [ebp - 0xc], 0x650063
lea ecx, [edx + 0x7fffffe7]
test ecx, ecx
je 0x10021172
movzx ecx, word [esi + eax]
test cx, cx
je 0x10021172
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10021154
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret