joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a2c5
Capabilities:
Hide graphical window

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x4c67b0
push eax
push dword [ebp + 8]
call fcn.00402402
test al, al
jne 0x48a2ef
xor eax, eax
jmp 0x48a422
mov ecx, dword [ebp - 0xc]
mov eax, dword [0x4c6810]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 8]
push edi
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov eax, dword [0x4c6824]
mov eax, dword [eax + ecx*4]
mov ecx, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [eax]
mov ebx, dword [edi]
cmp esi, 0xffffffff
je 0x48a38a
movzx eax, byte [edi + 0x90]
dec eax
dec eax
je 0x48a356
dec eax
je 0x48a359
sub eax, 3
je 0x48a351
dec eax
je 0x48a34c
sub eax, 3
je 0x48a344
sub eax, 0xc
jne 0x48a377
jmp 0x48a41f
or esi, 0x4000000
jmp 0x48a377
or esi, 3
jmp 0x48a377
or esi, 0xe
jmp 0x48a377
or esi, 4
push 0
test esi, 0x800
je 0x48a367
push 1
jmp 0x48a36f
or esi, 0x10000
push 0
push 0xcf
push ebx
call ecx
or esi, 0x50000000
push esi
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
cmp esi, 0xffffffff
je 0x48a3c7
push esi
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [0x4c6824]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax]
cmp byte [eax + 0x90], 0x13
jne 0x48a3c7
push esi
push 0
push 0x1036
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], eax
mov al, byte [edi + 0x93]
mov ecx, dword [ebp + 8]
cmp al, 0xff
je 0x48a3ea
movzx eax, al
cmp eax, dword [ecx + 0x190]
je 0x48a3ea
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x48a3f3
push 1
push edi
push ecx
call fcn.0048b57f
mov al, byte [edi + 0x90]
cmp al, 2
je 0x48a406
cmp al, 3
je 0x48a406
cmp esi, 0xffffffff
je 0x48a417
push 0x27
sub eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowPos]
sub eax, eax
cmp dword [ebp - 4], eax
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48b8ef
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x44
push 0
mov ebx, 0x4c7f20
push ebx
call fcn.00423020
push 0x10
push 0
mov esi, 0x4c7f64
push esi
call fcn.00423020
add esp, 0x18
mov dword [0x4c7f20], 0x44
sub eax, eax
inc eax
mov dword [0x4c7f4c], eax
push esi
push ebx
mov word [0x4c7f50], ax
xor eax, eax
push eax
push eax
push 0x20
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
pop ebx
test eax, eax
je 0x48b954
push dword [0x4c7f64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret 4

Function at 0x48b958
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 3
push ecx
pop edi
mov edx, dword [ebx + 4]
mov dword [ebp + 8], edx
pop esi
cmp dword [ebx + 0x190], eax
je 0x48ba0e
cmp dword [edi + 0x84], esi
jl 0x48ba08
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x48b9f9
cmp dword [ecx + 4], edx
jne 0x48b9f9
mov dl, byte [ecx + 0x90]
cmp dl, 0xb
je 0x48b9f6
mov dh, byte [ecx + 0x93]
movzx eax, dh
cmp eax, dword [ebx + 0x190]
je 0x48b9c8
cmp byte [ebx + 0x198], 0
je 0x48b9f6
cmp dh, 0xff
je 0x48b9f6
cmp dl, 0xa
je 0x48b9f6
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x48b9f6
cmp byte [eax + 0x90], 0x1a
jne 0x48b9f6
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [edi + 0x84]
jle 0x48b988
mov eax, dword [ebp + 0xc]
push 3
pop esi
mov dword [ebx + 0x190], eax
cmp dword [edi + 0x84], esi
jl 0x48ba9b
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
or ecx, ecx
je 0x48ba8c
cmp dword [ecx + 4], edx
jne 0x48ba8c
cmp byte [ecx + 0x90], 0xb
je 0x48ba8c
movzx eax, byte [ecx + 0x93]
cmp eax, dword [ebx + 0x190]
jne 0x48ba8c
test byte [ecx + 0x92], 0x20
jne 0x48ba8c
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
push 4
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x48ba8c
cmp byte [eax + 0x90], 0x1a
jne 0x48ba8c
push 1
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [edi + 0x84]
jle 0x48ba1a
mov eax, dword [ebp + 0xc]
push 0
push eax
push 0x130c
push dword [ebx + 0x188]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48bced
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 0xc]
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
cmp word [eax], di
je 0x48be07
push edi
push edi
push 3
push edi
push edi
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x48bd24
sub eax, eax
jmp 0x48be36
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
pop esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
or ebx, ebx
jne 0x48bd47
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48bd1d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push eax
pop esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x48bd1d
lea eax, [ebp - 8]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x492cac
push edi
push edi
push dword [ebp - 8]
mov dword [ebp - 4], edi
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x48bd1d
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push ecx
call dword [eax + 0xc]
lea eax, [ebp - 0x24]
push eax
push 0x18
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
cmp dword [edx], edi
jne 0x48bde3
cmp dword [ecx], edi
jne 0x48bde3
mov eax, dword [ebp - 0x20]
mov dword [edx], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
push 0x2000
push dword [ecx]
push dword [edx]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
jmp 0x48be0c
mov eax, edi
mov dword [ebp + 0xc], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x64], 0
je 0x48be21
push dword [esi + 0x64]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 0xc]
push eax
push edi
mov dword [esi + 0x64], eax
mov esi, dword [esi]
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x48c788
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
push esp
pop ebp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x4c67b0
push edi
mov ecx, esi
call fcn.00402612
mov ecx, dword [0x4c6810]
mov eax, dword [ecx + eax*4]
mov ebx, dword [eax]
cmp dword [ebp + 0xc], edi
jne 0x48c7e2
sub esi, esi
cmp dword [ebx + 0x1a0], esi
je 0x48c846
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push esi
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push esi
push dword [ebx + 0x1a0]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x48c864
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004025db
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x48c846
mov ecx, dword [0x4c6824]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx]
mov cl, byte [eax + 0x90]
cmp cl, 0xe
je 0x48c846
cmp cl, 0xf
je 0x48c846
cmp cl, 0x13
je 0x48c846
cmp cl, 0x10
je 0x48c846
xor esi, esi
cmp dword [eax + 0xc], esi
je 0x48c846
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x4c6824]
mov ecx, dword [ebp + 8]
push esi
push dword [ebx]
push dword [ebp - 4]
mov eax, dword [eax + ecx*4]
push dword [ebp - 8]
push esi
mov eax, dword [eax]
push dword [eax + 0xc]
jmp 0x48c7d7
mov eax, dword [ebp + 0x14]
movzx ecx, ax
mov eax, dword [ebp + 0x10]
shl ecx, 0x10
movzx eax, ax
or ecx, eax
push ecx
push dword [ebp + 0xc]
push 0x7b
push edi
call dword [sym.imp.USER32.dll_DefDlgProcW]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret 0x10
Function at 0x102d59d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.010399d6
add esp, 0xc
call fcn.0102d5bb

Function at 0x102d931
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.010399d6
add esp, 0xc
inc edx
dec edx
jbe 0x102d966
pushf
ja 0x102d952
cmp eax, 0x1e3c
jl 0x102d959
test esp, 0x5c8e
popf
jbe 0x102d963
ja 0x102d966
mov ecx, 0x48e045c6
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
xchg esi, esi
jne 0x102d9bb
jge 0x102d9b8
je 0x102d9bb
mov ebp, 0x80e04d8a
jmp 0xe15061c5
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
xchg ecx, eax
xchg ecx, eax
jo 0x102da66
jge 0x102da5d
js 0x102da5f
mov ecx, ecx
jno 0x102da66
mov ebx, 0x6ce8293a
add eax, dword [eax]
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.0102ddd7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x102da7b
xor eax, eax
jmp 0x102dd47
je 0x102da7d
cld
call fcn.0102da83
Function at 0x102ec80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.010399d6
add esp, 0xc
and eax, 0xffffffff
test dword [esp], edi
jns 0x102eca1
jne 0x102ecab
mov ecx, ecx
jg 0x102eca7
je 0x102ecab
mov esi, 0xec45c620
dec eax
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
jbe 0x102eced
jle 0x102ecfb
xchg esi, eax
xchg esi, eax
xchg ecx, edi
xchg ecx, edi
jmp 0x102ecf7
jg 0x102ecfb
xor eax, 0xec4d8ac0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.0102ddd7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x102ed92
xor eax, eax
jmp 0x102ee57
mov eax, eax
rol eax, 0x1a
rol eax, 6
std
cld
jle 0x102edbf
pushf
lea ecx, [ecx + 0x31e6]
sub ecx, 0x31e6
neg edx
neg edx
js 0x102edb2
popf
jb 0x102edb6
xchg edx, ecx
xchg edx, ecx
jbe 0x102edbc
jg 0x102edbf
mov eax, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0103a999
mov dword [ebp - 0x18], eax
call fcn.0102edd4
Function at 0x102f2df
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.010399d6
add esp, 0xc
and esi, 0xffffffff
jl 0x102f317
pushf
shr esp, 0
test eax, edx
add edi, 0x421f
sub edi, 0x421f
popf
lea ebx, [ebx]
jge 0x102f317
mov ebx, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
rol ebx, 0
mov esp, esp
jp 0x102f359
jl 0x102f350
jne 0x102f352
mov esi, esi
jne 0x102f356
jnp 0x102f359
call 0x81ef40e7
jmp 0xed507b63
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
jnp 0x102f3bb
jp 0x102f3ca
pushf
jno 0x102f3c1
popf
jne 0x102f3c5
jl 0x102f3c7
jnp 0x102f3ca
mov edx, 0xffea08e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.0102ddd7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x102f3df
xor eax, eax
jmp 0x102f482
cmp ebx, 0x440b
cld
jg 0x102f3fa
lea esi, [esi + 0x1a34]
lea esi, [esi - 0x1a34]
mov eax, eax
jle 0x102f3fa
sub eax, 0xec458dbe
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0103a999
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.010399d6
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x102f458
nop
jnp 0x102f436
pushf
jg 0x102f427
and ebx, ebx
popf
xchg ebx, eax
xchg ebx, eax
xchg edx, esi
xchg edx, esi
js 0x102f433
jp 0x102f436
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.01036c45
add esp, 4
sub edx, 0
mov esi, esi
jne 0x102f44f
nop
jne 0x102f44c
je 0x102f44f
mov esi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x102f482
cmp esp, 0x19c5
ja 0x102f460
test dword [esp + 0xc], esi
rol ebx, 0x1e
ror ebx, 0x1e
jnp 0x102f480
pushf
ror ebx, 8
rol ebx, 8
je 0x102f476
nop
jns 0x102f479
popf
xchg ecx, eax
xchg ecx, eax
jp 0x102f480
xor dword [ebx], 0x5b5e5fc0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10382df
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.010399d6
add esp, 0xc
lea ecx, [ecx]
jb 0x1038313
pushf
inc ebx
dec ebx
jg 0x1038309
jne 0x103830b
cmc
popf
jmp 0x1038310
jae 0x1038313
add eax, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
ror edx, 0xc
rol edx, 0xc
jnp 0x10383e4
pushf
xor ecx, 0
neg esi
neg esi
lea edi, [edi + 0x2205]
lea edi, [edi - 0x2205]
popf
xchg edx, eax
xchg edx, eax
xchg esi, esi
jle 0x10383e1
jp 0x10383e4
sub eax, 0xffff59ee
call fcn.0102ddd7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10383f9
xor eax, eax
jmp 0x103847c
xor esi, dword [esp]
xor esi, dword [esp]
ja 0x103840c
xchg ecx, ebx
xchg ecx, ebx
jle 0x1038407
xchg esi, eax
xchg esi, eax
jbe 0x103840c
call 0x53ebd99d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0103a999
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.010399d6
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1038436
xor eax, eax
jmp 0x103847c
xchg esi, edi
xchg esi, edi
xchg edi, edi
dec eax
inc eax
push edx
add edx, 0xc1e
ror edx, 2
pop edx
jnp 0x1038454
xchg ecx, eax
xchg ecx, eax
jae 0x103844f
nop
jp 0x1038454
or dword [edi - 0x75], 0xe852fc55
call 0x85038445
les eax, [esp + edi*2]
add byte [ebx + 0x5c3b00cc], al
and al, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.01036c45
add esp, 4
jl 0x1038462
or esp, 0
cmp ebx, dword [esp + 0xc]
jb 0x1038471
mov ebx, ebx
jae 0x1038471
add esi, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1039839
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
in al, dx
sbb byte [ebx + 0x56], dl
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.010399d6
add byte [ebp - 0x17af13bb], cl
xchg dword [ecx], eax
add byte [eax], al
add esp, 0xc
ja 0x1039854
ror esp, 0
cmp ebx, dword [esp + 0x10]
jo 0x103986e
pushf
push eax
pop eax
jle 0x1039863
inc ebx
dec ebx
popf
jno 0x1039869
ja 0x103986b
jno 0x103986e
add esi, 0xc653ec45
inc ebp
clc
jo 0x103983d
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
and edi, edi
ror edi, 0
jp 0x10398b1
inc ebp
cmc
jno 0x1039841
inc ebp
out dx, eax
je 0x1039845
inc ebp
invalid
xchg esp, esp
jg 0x10398ca
pushf
jno 0x10398b9
cmp esi, dword [esp]
cmp ebx, dword [esp]
popf
jp 0x10398c3
xchg esp, esp
xchg ecx, eax
xchg ecx, eax
jle 0x10398ca
add eax, 0x80ec4d8a
jmp 0xed5120d4
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.0102ddd7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1039954
jmp 0x10399cd
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0103a999
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.010399d6
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x10399cd
je 0x103997c
inc edi
dec edi
rol esp, 0
jp 0x103998e
mov esp, esp
xchg ecx, ebx
xchg ecx, ebx
jbe 0x103998b
jnp 0x103998e
ljmp 0xaee8:0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.01036c45
add esp, 4
xchg esp, esp
cmp ecx, edx
dec ebx
inc ebx
jne 0x10399ba
pushf
call fcn.010399a9