joyce8/EMBER2024-capa huggingface dataset:
Function at 0x24fec1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
push edi
push dword [esp + 0x54]
mov eax, edx
mov ebp, ecx
push dword [esp + 0x54]
mov dword [esp + 0x28], eax
push dword [esp + 0x54]
push dword [esp + 0x54]
push eax
push ebp
call fcn.0024db25
mov dword [esp + 0x4c], 0x589440
xor esi, esi
mov dword [esp + 0x50], 0xbb2de1
add esp, 0x18
mov dword [esp + 0x3c], 0xb037ec
xor edx, edx
mov dword [esp + 0x40], esi
mov dword [esp + 0x10], 0x8e191
shr dword [esp + 0x10], 5
or dword [esp + 0x10], 0x3f21c3b
add dword [esp + 0x10], 0xffff81cc
xor dword [esp + 0x10], 0x3f1e10b
mov dword [esp + 0x1c], 0xb412e8
or dword [esp + 0x1c], 0x407f059a
shr dword [esp + 0x1c], 3
xor dword [esp + 0x1c], 0x81d10d3
mov dword [esp + 0x18], 0x3f578f
or dword [esp + 0x18], 0x21f23266
mov eax, dword [esp + 0x18]
push 0x75
pop ecx
div ecx
mov dword [esp + 0x18], eax
add dword [esp + 0x18], 0x9780
xor dword [esp + 0x18], 0x4cc5cc
mov dword [esp + 0x14], 0x6e6a50
xor dword [esp + 0x14], 0x7513b86e
add dword [esp + 0x14], 0x3db9
imul eax, dword [esp + 0x14], 0x5a
mov dword [esp + 0x14], eax
xor dword [esp + 0x14], 0x4e5b290f
mov eax, dword [ebp + 0x3c]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov ebx, dword [eax + ebp + 0x78]
add ebx, ebp
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x20]
add eax, ebp
mov dword [esp + 0x2c], eax
add ecx, ebp
mov eax, dword [ebx + 0x24]
add eax, ebp
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
jmp 0x24fff8
push dword [esp + 0x14]
mov edx, dword [ecx + edi*4]
push dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
add edx, ebp
call fcn.00260a5e
xor eax, 0x3e95e426
pop ecx
pop ecx
cmp eax, dword [esp + 0x20]
je 0x24ffff
mov ecx, dword [esp + 0x24]
inc edi
cmp edi, dword [ebx + 0x18]
jb 0x24ffd0
jmp 0x25002b
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
movzx eax, word [eax + edi*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, ebx
jb 0x25002b
mov eax, dword [esp + 0x30]
mov eax, dword [eax + ebp + 0x7c]
add eax, ebx
cmp esi, eax
jae 0x25002b
mov ecx, esi
call fcn.0024d450
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x25ca0b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 8]
push edx
push ecx
call fcn.0024db25
and dword [ebp - 8], 0
add esp, 0x10
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x217f91
mov dword [ebp - 0xc], 0x11d4a0
mov dword [ebp + 0xc], 0x3daa8d
imul eax, dword [ebp + 0xc], 0x77
mov dword [ebp + 0xc], eax
xor dword [ebp + 0xc], 0x1caa4680
cmp dword [esi + 4], 0x40
jae 0x25ca58
xor eax, eax
jmp 0x25ca7f
mov ecx, dword [esi]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x25ca54
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x25ca54
movzx edx, word [eax + 0x18]
xor esi, esi
mov ecx, dword [ebp + 0xc]
cmp edx, ecx
cmovne eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x260a5e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push dword [ebp + 0xc]
mov ebx, edx
push dword [ebp + 8]
push ebx
push ecx
call fcn.0024db25
and dword [ebp - 0x10], 0
add esp, 0x10
and dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0xb7011a
mov dword [ebp - 4], 0x2f2ffc
or dword [ebp - 4], 0xb7f89416
add dword [ebp - 4], 0x3b62
xor dword [ebp - 4], 0xb7fffb60
mov dword [ebp - 8], 0x5ab39
imul eax, dword [ebp - 8], 0x78
mov dword [ebp - 8], eax
xor dword [ebp - 8], 0x2a842be
mov dword [ebp - 8], 0x7d9abf
shr dword [ebp - 8], 0x10
shl dword [ebp - 8], 9
xor dword [ebp - 8], 0xfa10
cmp byte [ebx], 0
je 0x260b29
push esi
push edi
mov edi, dword [ebp - 4]
mov dword [ebp - 8], 0x5ab39
imul eax, dword [ebp - 8], 0x78
mov dword [ebp - 8], eax
xor dword [ebp - 8], 0x2a842be
mov cl, byte [ebp - 8]
mov esi, dword [ebp - 4]
mov dword [ebp - 8], 0x7d9abf
shr dword [ebp - 8], 0x10
shl dword [ebp - 8], 9
xor dword [ebp - 8], 0xfa10
shl esi, cl
mov cl, byte [ebp - 8]
mov edx, dword [ebp - 4]
movsx eax, byte [ebx]
mov dword [ebp - 4], eax
add dword [ebp - 4], esi
shl edx, cl
add dword [ebp - 4], edx
sub dword [ebp - 4], edi
inc ebx
cmp byte [ebx], 0
jne 0x260ad4
pop edi
pop esi
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407f08
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push 0
push 0
push 0
cld
call dword es:[sym.imp.KERNEL32.dll_GetShortPathNameW]
sub eax, 2
mov edx, dword [ecx]
imul eax, edx
cmp al, 0x7c
jne 0x407f5a
lea eax, [esp + 4]
push eax
push esp
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
cmp eax, dword [edx + ebp]
je 0x407f9e
mov eax, 0x407f55
lea eax, [edx + eax]
push ebp
push eax
push 0
call sub.KERNEL32.dll_EnumResourceTypesW
test eax, eax
jne 0x407f73
jmp 0x407f9e
cmc
nop
mov eax, esp
lea eax, [eax + 8]
mov ecx, eax
or eax, dword [ecx]
and eax, dword [ecx]
cld
or eax, 7
xchg dword [esp + 0xc], edx
lea eax, es:[eax + 0x789691]
xchg ecx, eax
xchg esi, eax
js 0x407f77
sub eax, 0x783648
xacquire lock add dword es:[edx - 0x1b4], eax
mov ecx, dword [esp]
sub esp, 0xffffffec
mov eax, 0
mov dx, cs
push dx
push ecx
retf
add byte [eax], al
add byte [eax], al
inc ebp
mov cl, bh
or cl, byte [edi - 0x76073c21]
mov ch, 0xf8
cdq
lea esi, [ebp + edi*8 - 0x469934e]
jg 0x407f3e
and dword [esi - 0x2709ff3c], ebp
pop edi
lodsd eax, dword [esi]
repne lodsb al, byte [esi]
dec esp
xor edx, dword [edx - 0x31fff918]
pop esp
push ebp
push ecx
mov eax, 0xb398a1a8
jp 0x407feb
invalid
push ecx
mov byte [ebx - 0x44ff7be3], dh
aas
pop edx
jmp 0xaccf2a35
Function at 0x10002ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x10]
call fcn.10013ab0
mov dword [ebp - 4], 0
mov byte [ebp - 0x3c], 0x44
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x62
mov byte [ebp - 0x39], 0x75
mov byte [ebp - 0x38], 0x67
mov byte [ebp - 0x37], 0x67
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x44
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3b
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x45
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0x30
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x39
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x36
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x1008335c]
mov edx, dword [ecx + 0x2cc]
call edx
cmp dword [ebp - 0x14], 0
je 0x10002fd1
mov ecx, dword [0x10083360]
call fcn.10001440
push eax
push 0
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [0x10083364]
call fcn.10013b20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10013b00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10002ff0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
pushal
mov eax, dword fs:[0xc0]
mov dword [ebp - 8], eax
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
mov byte [ebp - 2], al
popal
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1000302e
mov eax, 1
jmp 0x1000305b
cmp dword [ebp - 8], 0
je 0x10003059
pushal
mov eax, dword fs:[0x18]
sub eax, 0x2000
mov eax, dword [eax + 0x60]
mov al, byte [eax + 2]
mov byte [ebp - 1], al
popal
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x10003059
mov eax, 2
jmp 0x1000305b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100033b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
mov esp, ebp
pop ebp
ret

Function at 0x100033d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x25
mov byte [ebp - 5], 0x73
mov byte [ebp - 4], 0x25
mov byte [ebp - 3], 0x73
mov byte [ebp - 2], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x1008335c]
mov edx, dword [ecx + 0x2d0]
call edx
mov esp, ebp
pop ebp
ret

Function at 0x10003450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044d78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x14]
call fcn.10013ab0
mov dword [ebp - 4], 0
mov byte [ebp - 0x3c], 0x44
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x62
mov byte [ebp - 0x39], 0x75
mov byte [ebp - 0x38], 0x67
mov byte [ebp - 0x37], 0x67
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x44
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3b
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x45
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0x30
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x39
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x34
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x10], 0
push 0
push 4
lea eax, [ebp - 0x10]
push eax
push 7
push 0xffffffffffffffff
mov ecx, dword [0x1008335c]
mov edx, dword [ecx + 0xd8]
call edx
test eax, eax
jl 0x1000356b
cmp dword [ebp - 0x10], 0
je 0x1000356b
mov ecx, dword [0x10083360]
call fcn.10001440
push eax
push 0
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [0x10083364]
call fcn.10013b20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10013b00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10003610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x10]
call fcn.10013ab0
mov dword [ebp - 4], 0
mov byte [ebp - 0x38], 0x44
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x62
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x67
mov byte [ebp - 0x33], 0x67
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x44
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x45
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x20
mov byte [ebp - 0x22], 0x43
mov byte [ebp - 0x21], 0x6f
mov byte [ebp - 0x20], 0x64
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x3a
mov byte [ebp - 0x1d], 0x20
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x78
mov byte [ebp - 0x1a], 0x39
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x12], 0
call fcn.10003590
movzx eax, al
test eax, eax
je 0x10003708
mov ecx, dword [0x10083360]
call fcn.10001440
push eax
push 0
lea ecx, [ebp - 0x38]
push ecx
push 1
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [0x10083364]
call fcn.10013b20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10013b00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100037e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x50], ecx
mov byte [ebp - 0xc], 0x2f
mov byte [ebp - 0xb], 0x2f
mov byte [ebp - 0xa], 0x2f
mov byte [ebp - 9], 0x2f
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x2f
mov byte [ebp - 6], 0x2f
mov byte [ebp - 5], 0x53
mov byte [ebp - 4], 0x49
mov byte [ebp - 3], 0x43
mov byte [ebp - 2], 0x45
mov byte [ebp - 1], 0
mov byte [ebp - 0x34], 0x2f
mov byte [ebp - 0x33], 0x2f
mov byte [ebp - 0x32], 0x2f
mov byte [ebp - 0x31], 0x2f
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2f], 0x2f
mov byte [ebp - 0x2e], 0x2f
mov byte [ebp - 0x2d], 0x53
mov byte [ebp - 0x2c], 0x49
mov byte [ebp - 0x2b], 0x57
mov byte [ebp - 0x2a], 0x56
mov byte [ebp - 0x29], 0x49
mov byte [ebp - 0x28], 0x44
mov byte [ebp - 0x27], 0x53
mov byte [ebp - 0x26], 0x54
mov byte [ebp - 0x25], 0x41
mov byte [ebp - 0x24], 0x52
mov byte [ebp - 0x23], 0x54
mov byte [ebp - 0x22], 0
mov byte [ebp - 0x20], 0x2f
mov byte [ebp - 0x1f], 0x2f
mov byte [ebp - 0x1e], 0x2f
mov byte [ebp - 0x1d], 0x2f
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x2f
mov byte [ebp - 0x1a], 0x2f
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x18], 0x54
mov byte [ebp - 0x17], 0x49
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0x14], 0
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [0x1008335c]
mov edx, dword [ecx + 0x238]
call edx
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov byte [ebp - 0xe], cl
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x34]
push edx
mov eax, dword [0x1008335c]
mov ecx, dword [eax + 0x238]
call ecx
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov byte [ebp - 0x35], dl
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [0x1008335c]
mov edx, dword [ecx + 0x238]
call edx
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov byte [ebp - 0xd], cl
movzx edx, byte [ebp - 0xe]
test edx, edx
jne 0x1000393d
movzx eax, byte [ebp - 0x35]
test eax, eax
jne 0x1000393d
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
je 0x100039b0
mov byte [ebp - 0x4c], 0x44
mov byte [ebp - 0x4b], 0x65
mov byte [ebp - 0x4a], 0x62
mov byte [ebp - 0x49], 0x75
mov byte [ebp - 0x48], 0x67
mov byte [ebp - 0x47], 0x67
mov byte [ebp - 0x46], 0x65
mov byte [ebp - 0x45], 0x72
mov byte [ebp - 0x44], 0x20
mov byte [ebp - 0x43], 0x44
mov byte [ebp - 0x42], 0x65
mov byte [ebp - 0x41], 0x74
mov byte [ebp - 0x40], 0x65
mov byte [ebp - 0x3f], 0x63
mov byte [ebp - 0x3e], 0x74
mov byte [ebp - 0x3d], 0x65
mov byte [ebp - 0x3c], 0x64
mov byte [ebp - 0x3b], 0x38
mov byte [ebp - 0x3a], 0x21
mov byte [ebp - 0x39], 0
mov ecx, dword [0x10083360]
call fcn.10001440
push eax
push 0
lea edx, [ebp - 0x4c]
push edx
push 1
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [0x10083364]
call fcn.10013b20
mov esp, ebp
pop ebp
ret
Function at 0x100039c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 0x54], ecx
mov byte [ebp - 0x10], 0x5c
mov byte [ebp - 0xf], 0x5c
mov byte [ebp - 0xe], 0x2e
mov byte [ebp - 0xd], 0x5c
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x79
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0
mov byte [ebp - 0x24], 0x5c
mov byte [ebp - 0x23], 0x5c
mov byte [ebp - 0x22], 0x2e
mov byte [ebp - 0x21], 0x5c
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x79
mov byte [ebp - 0x1e], 0x73
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x42
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x38], 0x5c
mov byte [ebp - 0x37], 0x5c
mov byte [ebp - 0x36], 0x2e
mov byte [ebp - 0x35], 0x5c
mov byte [ebp - 0x34], 0x53
mov byte [ebp - 0x33], 0x79
mov byte [ebp - 0x32], 0x73
mov byte [ebp - 0x31], 0x65
mov byte [ebp - 0x30], 0x72
mov byte [ebp - 0x2f], 0x44
mov byte [ebp - 0x2e], 0x62
mov byte [ebp - 0x2d], 0x67
mov byte [ebp - 0x2c], 0x4d
mov byte [ebp - 0x2b], 0x73
mov byte [ebp - 0x2a], 0x67
mov byte [ebp - 0x29], 0
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x1008335c]
mov edx, dword [ecx + 0x238]
call edx
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov byte [ebp - 0x11], cl
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x24]
push edx
mov eax, dword [0x1008335c]
mov ecx, dword [eax + 0x238]
call ecx
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov byte [ebp - 0x25], dl
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [0x1008335c]
mov edx, dword [ecx + 0x238]
call edx
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 0x11]
test edx, edx
jne 0x10003b0d
movzx eax, byte [ebp - 0x25]
test eax, eax
jne 0x10003b0d
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x10003b88
mov byte [ebp - 0x50], 0x44
mov byte [ebp - 0x4f], 0x65
mov byte [ebp - 0x4e], 0x62
mov byte [ebp - 0x4d], 0x75
mov byte [ebp - 0x4c], 0x67
mov byte [ebp - 0x4b], 0x67
mov byte [ebp - 0x4a], 0x65
mov byte [ebp - 0x49], 0x72
mov byte [ebp - 0x48], 0x20
mov byte [ebp - 0x47], 0x44
mov byte [ebp - 0x46], 0x65
mov byte [ebp - 0x45], 0x74
mov byte [ebp - 0x44], 0x65
mov byte [ebp - 0x43], 0x63
mov byte [ebp - 0x42], 0x74
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x40], 0x64
mov byte [ebp - 0x3f], 0x38
mov byte [ebp - 0x3e], 0x2d
mov byte [ebp - 0x3d], 0x32
mov byte [ebp - 0x3c], 0x21
mov byte [ebp - 0x3b], 0
mov ecx, dword [0x10083360]
call fcn.10001440
push eax
push 0
lea edx, [ebp - 0x50]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [0x10083364]
call fcn.10013b20
mov esp, ebp
pop ebp
ret
Function at 0x10003b90
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x68]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0x70
je 0x10003bb8
mov eax, 1
jmp 0x10003bba
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10003eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x10]
call fcn.10013ab0
mov dword [ebp - 4], 0
mov byte [ebp - 0x38], 0x44
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x62
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x67
mov byte [ebp - 0x33], 0x67
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x44
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x3b
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x43
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x3a
mov byte [ebp - 0x1c], 0x20
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], 0x78
mov byte [ebp - 0x19], 0x39
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x30
mov byte [ebp - 0x11], 0
call fcn.10003e40
movzx eax, al
test eax, eax
je 0x10003fac
mov ecx, dword [0x10083360]
call fcn.10001440
push eax
push 0
lea ecx, [ebp - 0x38]
push ecx
push 1
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [0x10083364]
call fcn.10013b20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10013b00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100040c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x10]
call fcn.10013ab0
mov dword [ebp - 4], 0
mov byte [ebp - 0x3c], 0x44
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x62
mov byte [ebp - 0x39], 0x75
mov byte [ebp - 0x38], 0x67
mov byte [ebp - 0x37], 0x67
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x44
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3b
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x45
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0x30
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x39
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x31
mov byte [ebp - 0x16], 0x31
mov byte [ebp - 0x15], 0x32
mov byte [ebp - 0x14], 0
call fcn.10003fd0
test eax, eax
je 0x100041bd
mov ecx, dword [0x10083360]
call fcn.10001440
push eax
push 0
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [0x10083364]
call fcn.10013b20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10013b00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret