joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10056f50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x36208e4]
fld dword [esi + 0x1f64]
call fcn.10083ba0
fld dword [esi + 0x1f6c]
mov dword [ebp - 8], eax
call fcn.10083ba0
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 0x103d2178
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x10056fab
mov eax, dword [0x103be1bc]
add eax, 0x44
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.10062754
jmp 0x10057060
push 0x1008c6b0
call fcn.10006485
pop ecx
cmp eax, 1
jne 0x10056fcb
push str.ClickBox1
call fcn.1003882a
pop ecx
jmp 0x10057060
fild dword [ebp + 0xc]
push ecx
push ecx
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp + 4]
fild dword [ebp - 8]
fstp dword [esp]
call fcn.100548ea
fcomp qword [0x1009a8e8]
pop ecx
pop ecx
fnstsw ax
test ah, 5
jp 0x10057041
fild dword [ebp + 0x14]
push ecx
push ecx
fstp dword [esp + 4]
fild dword [ebp - 0xc]
fstp dword [esp]
call fcn.100548ea
fcomp qword [0x1009a8e8]
pop ecx
pop ecx
fnstsw ax
test ah, 5
jp 0x10057041
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103d277c]
cmp eax, 0xbb8
jbe 0x10057041
push dword [ebp + 0x18]
push 1
call fcn.10038ecc
pop ecx
pop ecx
call esi
mov dword [0x103d277c], eax
jmp 0x10057060
fild dword [ebp + 0x14]
sub esp, 0xc
fstp dword [esp + 8]
fild dword [ebp + 0x10]
fstp dword [esp + 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.1003815c
add esp, 0xc
pop esi
leave
ret

Function at 0x10057063
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x36208e4]
fld dword [esi + 0x1f64]
call fcn.10083ba0
fld dword [esi + 0x1f6c]
mov dword [ebp - 8], eax
call fcn.10083ba0
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 0x103d2178
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x100570c0
mov eax, dword [0x103be1bc]
add eax, 0x93
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.10060820
jmp 0x10057175
push 0x1008c6b0
call fcn.10006485
pop ecx
cmp eax, 1
jne 0x100570e0
push str.ClickBox1
call fcn.1003882a
pop ecx
jmp 0x10057175
fild dword [ebp + 0xc]
push ecx
push ecx
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp + 4]
fild dword [ebp - 8]
fstp dword [esp]
call fcn.100548ea
fcomp qword [0x1009a8e8]
pop ecx
pop ecx
fnstsw ax
test ah, 5
jp 0x10057156
fild dword [ebp + 0x14]
push ecx
push ecx
fstp dword [esp + 4]
fild dword [ebp - 0xc]
fstp dword [esp]
call fcn.100548ea
fcomp qword [0x1009a8e8]
pop ecx
pop ecx
fnstsw ax
test ah, 5
jp 0x10057156
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103d2780]
cmp eax, 0xbb8
jbe 0x10057156
push dword [ebp + 0x18]
push 1
call fcn.10038ecc
pop ecx
pop ecx
call esi
mov dword [0x103d2780], eax
jmp 0x10057175
fild dword [ebp + 0x14]
sub esp, 0xc
fstp dword [esp + 8]
fild dword [ebp + 0x10]
fstp dword [esp + 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.1003815c
add esp, 0xc
pop esi
leave
ret
Function at 0x100591ad
Capabilities:
Copy file
Enumerate files on windows
Get common file path

Disassembly:
push 0x604
mov eax, 0x100874a9
call fcn.10083aac
lea eax, [ebp - 0x268]
push eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x268]
push 0x1009a99c
push eax
call sub.MSVCR100.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x604]
call dword [sym.imp.mfc100.dll_Ordinal_310]
and dword [ebp - 4], 0
push str..scs
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x610]
push eax
call fcn.10016d80
add esp, 0xc
lea ecx, [ebp - 0x600]
push ecx
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x610]
mov dword [ebp - 0x60c], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov esi, dword [sym.imp.MSVCR100.dll_strstr]
mov edi, 0x33ccf58
lea eax, [ebp - 0x5d4]
push edi
push eax
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_sprintf]
pop ecx
pop ecx
test eax, eax
je 0x10059335
lea eax, [ebp - 0x5d4]
push eax
call sub.MSVCR100.dll_strlen
add eax, 0xfffffffa
push edi
mov dword [ebp - 0x608], eax
call sub.MSVCR100.dll_strlen
cmp dword [ebp - 0x608], eax
jmp 0x100592fc
mov word [eax + 4], 0x74
lea eax, [ebp - 0x268]
push 0x1009a99c
push eax
call sub.MSVCR100.dll_strcat
lea eax, [ebp - 0x5d4]
push eax
lea eax, [ebp - 0x268]
push eax
call sub.MSVCR100.dll_strcat
add esp, 0x10
push 0
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x4c0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x1005935c
lea eax, [ebp - 0x5d4]
push edi
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x10059335
lea eax, [ebp - 0x5d4]
push eax
call sub.MSVCR100.dll_strlen
add eax, 0xfffffffa
push edi
mov dword [ebp - 0x608], eax
call sub.MSVCR100.dll_strlen
cmp dword [ebp - 0x608], eax
pop ecx
pop ecx
jne 0x10059335
lea eax, [ebp - 0x5d4]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x4c0]
push 0x1008d81c
push eax
call ebx
lea eax, [ebp - 0x268]
push str.lien
push eax
call esi
add esp, 0x18
test eax, eax
jne 0x10059283
lea eax, [ebp - 0x600]
push eax
push dword [ebp - 0x60c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100592cb
push dword [ebp - 0x60c]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x604]
call dword [sym.imp.mfc100.dll_Ordinal_901]
call fcn.10083b2f
ret
Function at 0x1005a2b5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x36208e4]
push 0xaf6500
push dword [eax + 0x1d24]
call fcn.10006298
pop ecx
pop ecx
test eax, eax
je 0x1005a3aa
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [eax + 0x14]
mov eax, dword [0x35f5df8]
mov eax, dword [eax + ecx*4 + 0x53c]
test eax, eax
jne 0x1005a2f7
cmp ecx, 0xffffffff
jne 0x1005a3a9
cmp ecx, 0xffffffff
je 0x1005a30e
add eax, 0x64
push eax
call fcn.100377d3
pop ecx
test eax, eax
jns 0x1005a3a9
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103d2384]
cmp eax, 0xbb8
jb 0x1005a332
push edi
call fcn.10037d89
pop ecx
call esi
mov dword [0x103d2384], eax
cmp byte [edi + 0x102e2858], 0
push ebx
mov ebx, 0x3e8
jbe 0x1005a367
cmp dword [0x103b9a50], 0
jne 0x1005a367
call esi
sub eax, dword [0x103d278c]
cmp eax, ebx
jb 0x1005a367
push 2
push edi
call fcn.10049740
pop ecx
pop ecx
call esi
mov dword [0x103d278c], eax
call esi
mov ecx, dword [0x10342a60]
sub eax, dword [ecx*4 + 0x10302858]
cmp eax, 0x1388
ja 0x1005a38a
call esi
sub eax, dword [edi*4 + 0x10302858]
cmp eax, ebx
jae 0x1005a3a7
call esi
sub eax, dword [0x103d2788]
cmp eax, ebx
jb 0x1005a3a7
push 1
push edi
call fcn.10049740
pop ecx
pop ecx
call esi
mov dword [0x103d2788], eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1005aa43
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x35ed708], 0x64
push esi
mov esi, dword [ebp + 8]
jge 0x1005aa93
push esi
push 0x103d2248
call sub.MSVCR100.dll_strcpy
mov eax, dword [0x103be1bc]
pop ecx
pop ecx
push 0x10043e88
push 0x3e8
add eax, 0x93
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x1005aca8
and dword [0x103429f8], 0
push ebx
push edi
push dword [0x35ed708]
lea eax, [ebp - 0x6c]
push eax
call fcn.10006800
mov edi, dword [sym.imp.MSVCR100.dll_sprintf]
push esi
push 0x10099294
push 0x10342b58
call edi
mov ebx, dword [0x35ed708]
lea eax, [ebx - 0x59da]
add esp, 0x14
cmp eax, 0x3e5
ja 0x1005ab37
push esi
call fcn.100067c2
pop ecx
cmp eax, 0x59d9
jl 0x1005aaf0
push esi
call fcn.100067c2
pop ecx
cmp eax, 0x5dbf
jle 0x1005ab37
push 0x32
lea eax, [ebp - 0x38]
push 0
push eax
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp - 0x38]
push 0x100950e0
push eax
call edi
mov edi, 0x10368780
push edi
push dword [0x1037c3ec]
lea eax, [ebp - 0x38]
push eax
call fcn.10044818
push edi
push dword [0x1037c3ec]
push 0x1009aa48
call fcn.10044818
add esp, 0x30
jmp 0x1005ac58
push esi
call fcn.100067c2
push eax
call fcn.10043ddb
push ebx
mov byte [ebp - 0x6d], al
call fcn.10043ddb
add esp, 0xc
cmp al, byte [ebp - 0x6d]
je 0x1005ab6a
push 1
push esi
call fcn.100067c2
pop ecx
push eax
call fcn.1005808e
pop ecx
pop ecx
jmp 0x1005ac58
cmp dword [0x103ae880], 1
jne 0x1005abcf
push esi
call fcn.100067c2
push eax
call fcn.10043eb6
pop ecx
pop ecx
cmp al, 1
jne 0x1005abcf
mov eax, dword [0x36208e4]
cmp byte [eax + 0x488c], 0
jne 0x1005abcf
push esi
call fcn.100067c2
push esi
mov dword [0x103d228c], eax
call fcn.100067c2
push eax
call fcn.1003a648
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x103d2290], eax
mov eax, dword [0x103be1bc]
push 0x10041e33
push 0x3e8
add eax, 0x44
jmp 0x1005ac69
mov ebx, 0x10342b58
push ebx
call fcn.100060cc
pop ecx
test eax, eax
je 0x1005ac1a
mov eax, dword [0x36208e4]
cmp byte [eax + 0x488c], 0
jne 0x1005ac1a
push esi
call fcn.100067c2
push 1
push ebx
mov dword [0x103d228c], eax
call fcn.10005f7d
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x10041ec0
mov dword [0x103d2290], eax
push 0x3e8
jmp 0x1005ac5f
lea eax, [ebp - 0x6c]
push esi
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x1005ac43
push esi
push 0x1009aa34
mov esi, 0x10111d48
push esi
call edi
push esi
call fcn.10006dd0
add esp, 0x10
jmp 0x1005ac58
push 1
push esi
call fcn.100067c2
pop ecx
push eax
call fcn.1005808e
pop ecx
pop ecx
cmp al, 1
jne 0x1005ac78
push 0x10041079
push 0x64
mov eax, dword [0x103be1bc]
add eax, 0x93
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x1005aca6
push esi
push 0x1009aa0c
mov esi, 0x10111d48
push esi
call edi
push esi
call fcn.10006dd0
push 1
push 0x1008c4f4
call fcn.10005f7d
mov ecx, dword [0x1011280c]
add esp, 0x18
call fcn.1006e863
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10083a34
leave
ret
Function at 0x1005c545
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x103b9048], 1
push ebx
push esi
push edi
jne 0x1005c566
cmp byte [0x10342a8e], 1
jne 0x1005c566
push dword [ebp + 8]
call fcn.1005a2b5
pop ecx
call fcn.10037edd
xor edi, edi
cmp dword [ebp + 8], edi
jl 0x1005c590
pushal
mov ecx, dword ds:[0x12b5b20]
mov ecx, dword ds:[ecx + 0x39c]
push 0
push dword [ebp + 8]
mov eax, 0x7629b0
call eax
popal
jmp 0x1005c5ef
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101123e0]
cmp eax, 0x2bc
jae 0x1005c5ad
cmp dword [0x103a8200], edi
je 0x1005c5ef
call esi
cmp dword [0x103a8200], 1
mov dword [0x101123e0], eax
jne 0x1005c5d4
cmp dword [0x101123dc], edi
ja 0x1005c5ef
mov eax, dword [0x36208e4]
mov dword [eax + 0x1d48], 0xff
pushal
mov ecx, dword ds:[0x36208e4]
mov eax, 0x5560f0
call eax
popal
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101123dc], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1007d60f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x100879d0
call fcn.10083a43
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.PK_page3.0
lea ecx, [esi + 0x1428]
mov dword [ebp - 4], 0x24
call fcn.100019b9
lea ecx, [esi + 0x1398]
mov byte [ebp - 4], 0x23
call fcn.10001272
lea ecx, [esi + 0x130c]
mov byte [ebp - 4], 0x22
call fcn.10001272
lea ecx, [esi + 0x1280]
mov byte [ebp - 4], 0x21
call fcn.10001272
lea ecx, [esi + 0x120c]
mov byte [ebp - 4], 0x20
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1198]
mov byte [ebp - 4], 0x1f
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1124]
mov byte [ebp - 4], 0x1e
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x10b0]
mov byte [ebp - 4], 0x1d
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x103c]
mov byte [ebp - 4], 0x1c
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xfc8]
mov byte [ebp - 4], 0x1b
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xf54]
mov byte [ebp - 4], 0x1a
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xee0]
mov byte [ebp - 4], 0x19
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xe6c]
mov byte [ebp - 4], 0x18
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xdf8]
mov byte [ebp - 4], 0x17
call sub.mfc100.dll_Ordinal_915
mov byte [ebp - 4], 0x16
lea ecx, [esi + 0xd84]
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xd10]
mov byte [ebp - 4], 0x15
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xc9c]
mov byte [ebp - 4], 0x14
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xc28]
mov byte [ebp - 4], 0x13
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xbb4]
mov byte [ebp - 4], 0x12
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xaf8]
mov byte [ebp - 4], 0x11
call fcn.100019b9
lea ecx, [esi + 0xa4c]
mov byte [ebp - 4], 0x10
call fcn.100019b9
lea ecx, [esi + 0x9a0]
mov byte [ebp - 4], 0xf
call fcn.100019b9
lea ecx, [esi + 0x8f4]
mov byte [ebp - 4], 0xe
call fcn.100019b9
lea ecx, [esi + 0x868]
mov byte [ebp - 4], 0xd
call fcn.10001272
lea ecx, [esi + 0x7dc]
mov byte [ebp - 4], 0xc
call fcn.10001272
lea ecx, [esi + 0x750]
mov byte [ebp - 4], 0xb
call fcn.10001272
lea ecx, [esi + 0x6c4]
mov byte [ebp - 4], 0xa
call fcn.10001272
lea ecx, [esi + 0x638]
mov byte [ebp - 4], 9
call fcn.10001272
lea ecx, [esi + 0x5ac]
mov byte [ebp - 4], 8
call fcn.10001272
lea ecx, [esi + 0x520]
mov byte [ebp - 4], 7
call fcn.10001272
lea ecx, [esi + 0x494]
mov byte [ebp - 4], 6
call fcn.10001272
lea ecx, [esi + 0x408]
mov byte [ebp - 4], 5
call fcn.10001272
lea ecx, [esi + 0x37c]
mov byte [ebp - 4], 4
call fcn.10001272
lea ecx, [esi + 0x2ac]
mov byte [ebp - 4], 3
call fcn.100019b9
lea ecx, [esi + 0x1d0]
mov byte [ebp - 4], 2
call fcn.100019b9
lea ecx, [esi + 0x140]
mov byte [ebp - 4], 1
call sub.mfc100.dll_Ordinal_1011
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 0
call fcn.100019b9
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call sub.mfc100.dll_Ordinal_946
call fcn.10083b1b
ret
Function at 0x1007f18d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x10087beb
call fcn.10083a43
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.PK_page4.0
lea ecx, [esi + 0x1374]
mov dword [ebp - 4], 0x24
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x12fc]
mov byte [ebp - 4], 0x23
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1288]
mov byte [ebp - 4], 0x22
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1214]
mov byte [ebp - 4], 0x21
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x11a0]
mov byte [ebp - 4], 0x20
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x112c]
mov byte [ebp - 4], 0x1f
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x10b8]
mov byte [ebp - 4], 0x1e
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1044]
mov byte [ebp - 4], 0x1d
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xfd0]
mov byte [ebp - 4], 0x1c
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xf5c]
mov byte [ebp - 4], 0x1b
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xee8]
mov byte [ebp - 4], 0x1a
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xe74]
mov byte [ebp - 4], 0x19
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xe00]
mov byte [ebp - 4], 0x18
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xd8c]
mov byte [ebp - 4], 0x17
call sub.mfc100.dll_Ordinal_915
mov byte [ebp - 4], 0x16
lea ecx, [esi + 0xd18]
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xca4]
mov byte [ebp - 4], 0x15
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xc30]
mov byte [ebp - 4], 0x14
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xbbc]
mov byte [ebp - 4], 0x13
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xb48]
mov byte [ebp - 4], 0x12
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xad4]
mov byte [ebp - 4], 0x11
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xa60]
mov byte [ebp - 4], 0x10
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x9ec]
mov byte [ebp - 4], 0xf
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x978]
mov byte [ebp - 4], 0xe
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x8a8]
mov byte [ebp - 4], 0xd
call fcn.100019b9
lea ecx, [esi + 0x7fc]
mov byte [ebp - 4], 0xc
call fcn.100019b9
lea ecx, [esi + 0x750]
mov byte [ebp - 4], 0xb
call fcn.100019b9
lea ecx, [esi + 0x6c4]
mov byte [ebp - 4], 0xa
call fcn.10001272
lea ecx, [esi + 0x638]
mov byte [ebp - 4], 9
call fcn.10001272
lea ecx, [esi + 0x5ac]
mov byte [ebp - 4], 8
call fcn.10001272
lea ecx, [esi + 0x520]
mov byte [ebp - 4], 7
call fcn.10001272
lea ecx, [esi + 0x494]
mov byte [ebp - 4], 6
call fcn.10001272
lea ecx, [esi + 0x408]
mov byte [ebp - 4], 5
call fcn.10001272
lea ecx, [esi + 0x37c]
mov byte [ebp - 4], 4
call fcn.10001272
lea ecx, [esi + 0x2f0]
mov byte [ebp - 4], 3
call fcn.10001272
lea ecx, [esi + 0x228]
mov byte [ebp - 4], 2
call fcn.100019b9
lea ecx, [esi + 0x17c]
mov byte [ebp - 4], 1
call fcn.100019b9
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 0
call fcn.100019b9
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call sub.mfc100.dll_Ordinal_946
call fcn.10083b1b
ret
Function at 0x10080b46
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x10087df8
call fcn.10083a43
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push 0x1b8c
call sub.mfc100.dll_Ordinal_381
xor eax, eax
lea ecx, [esi + 0xdc]
mov dword [ebp - 4], eax
mov dword [esi], vtable.PK_page5.0
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], eax
mov dword [esi + 0xd8], eax
call fcn.1000158a
lea ecx, [esi + 0x168]
mov byte [ebp - 4], 1
call fcn.1000158a
lea ecx, [esi + 0x1f4]
mov byte [ebp - 4], 2
call fcn.1000158a
lea ecx, [esi + 0x280]
mov byte [ebp - 4], 3
call fcn.1000158a
lea ecx, [esi + 0x30c]
mov byte [ebp - 4], 4
call fcn.1000158a
lea ecx, [esi + 0x398]
mov byte [ebp - 4], 5
call fcn.1000158a
lea ecx, [esi + 0x424]
mov byte [ebp - 4], 6
call fcn.1000158a
lea ecx, [esi + 0x4b0]
mov byte [ebp - 4], 7
call fcn.1000158a
lea ecx, [esi + 0x53c]
mov byte [ebp - 4], 8
call fcn.1000158a
lea ecx, [esi + 0x5c8]
mov byte [ebp - 4], 9
call fcn.1000158a
lea ecx, [esi + 0x654]
mov byte [ebp - 4], 0xa
call fcn.1000158a
lea ecx, [esi + 0x6e0]
mov byte [ebp - 4], 0xb
call fcn.1000158a
lea ecx, [esi + 0x76c]
mov byte [ebp - 4], 0xc
call fcn.1000158a
lea ecx, [esi + 0x7f8]
mov byte [ebp - 4], 0xd
call fcn.1000158a
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x884]
call fcn.1000158a
lea ecx, [esi + 0x910]
mov byte [ebp - 4], 0xf
call fcn.1000158a
lea ecx, [esi + 0x99c]
mov byte [ebp - 4], 0x10
call fcn.1000158a
lea ecx, [esi + 0xa28]
mov byte [ebp - 4], 0x11
call fcn.1000158a
lea ecx, [esi + 0xab4]
mov byte [ebp - 4], 0x12
call fcn.10001ad1
lea ecx, [esi + 0xb60]
mov byte [ebp - 4], 0x13
call fcn.10001ad1
lea ecx, [esi + 0xc0c]
mov byte [ebp - 4], 0x14
call fcn.10001ad1
lea ecx, [esi + 0xcb8]
mov byte [ebp - 4], 0x15
call fcn.10001ad1
lea ecx, [esi + 0xd64]
mov byte [ebp - 4], 0x16
call fcn.10001ad1
lea ecx, [esi + 0xe10]
mov byte [ebp - 4], 0x17
call fcn.10001ad1
lea ecx, [esi + 0xebc]
mov byte [ebp - 4], 0x18
call fcn.10001ad1
lea ecx, [esi + 0xf68]
mov byte [ebp - 4], 0x19
call fcn.10001ad1
lea ecx, [esi + 0x1014]
mov byte [ebp - 4], 0x1a
call fcn.10001ad1
lea ecx, [esi + 0x10c0]
mov byte [ebp - 4], 0x1b
call fcn.10001ad1
lea ecx, [esi + 0x116c]
mov byte [ebp - 4], 0x1c
call fcn.10001ad1
lea ecx, [esi + 0x1218]
mov byte [ebp - 4], 0x1d
call fcn.10001ad1
lea ecx, [esi + 0x12c4]
mov byte [ebp - 4], 0x1e
call fcn.10001ad1
lea ecx, [esi + 0x1370]
mov byte [ebp - 4], 0x1f
call fcn.10001ad1
lea ecx, [esi + 0x141c]
mov byte [ebp - 4], 0x20
call fcn.10001ad1
lea ecx, [esi + 0x14c8]
mov byte [ebp - 4], 0x21
call fcn.10001ad1
mov byte [ebp - 4], 0x22
lea ecx, [esi + 0x1574]
call fcn.10001ad1
lea ecx, [esi + 0x1620]
mov byte [ebp - 4], 0x23
call fcn.10001ad1
mov eax, esi
call fcn.10083b1b
ret 4
Function at 0x10083a34
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a69a0]
jne 0x10083a3e
repz ret
jmp fcn.10084313

Function at 0x103ea018
Capabilities:
Encode data using base64

Disassembly:
rol edx, 3
mov dword [esp], ecx
or byte [esp + 1], ah
xchg cl, al
sbb edx, 0xe114e125
xor edx, 0x901f6083
xor ebx, edx
shr dword [esp], cl
shr dword [esp], 0x4b
adc ebp, edx
movzx ax, byte [edi]
movsx edx, cx
mov cl, byte [edi + edx - 0x239b]
add edx, 0x37af3d2f
lea edi, [edi + edx - 0x37af60ca]
not al
jg 0x105235aa
not cl
sar dl, 0xe6
sets dl
jae 0x1040ee3d

Function at 0x103f3133
Capabilities:
Encode data using base64

Disassembly:
pushfd
pop esi
mov dword [esp], esi
mov edi, 0xccb92684
mov esi, eax
ror edi, 0xa5
mov edi, edx
jae 0x10473639
inc byte [esp + 3]
sub ebp, 2
mov word [ebp], dx
sub esi, 4
movzx ecx, word [esp]
neg dword [esp + ecx*2 - 0x6dce]
mov edx, dword [ecx + esi - 0x36e7]
xor edx, ebx
pop ecx
rol al, 0x23
dec eax
not edx
xor eax, 0xd0bb2783
shl cl, 0xe6
ror cl, 0x84
rol edx, 1
ror ecx, 5
neg edx
not edx
sar cl, 0xa6
shr ecx, cl
xor ebx, edx
add edi, edx
jmp fcn.105013e9
jae 0x1047b674
call fcn.104fe7d0
mov dword [esp + edx - 0xd298f87], edx
mov dword [edx + edi - 0xd298f8f], eax
mov dword [esp + edx*2 - 0x1a531f1e], ebp
ret 0xc

Function at 0x103f4a40
Capabilities:
Encode data using base64

Disassembly:
xor al, bl
lea ecx, [ecx + 0x1795bd39]
mov dword [esp + ecx - 0x1795bdf6], 0x242c0430
not al
push ecx
inc ecx
rol al, 1
lea ecx, [ecx + ecx*4 - 0x6340dd74]
call fcn.103ea05e
or byte [esp + edx*2 - 0x428c3b75], ch
pop ecx
ja 0x1050042b
mov eax, 0x34233403
mov ecx, dword [edi + eax - 0x34233403]
lea edi, [edi + eax*2 - 0x68466802]
shr ax, 0xc7
neg ax
sub eax, eax
xor ecx, ebx
jmp 0x1045f6d0
push eax
xor ecx, 0x98ac8e
jmp 0x1047bda1

Function at 0x1040982b
Capabilities:
Encode data using base64

Disassembly:
sar ax, 0xa2
rol al, 2
lea ecx, [esp + ecx + 4]
adc al, ah
movzx ax, byte [ecx + edx - 0x8804]
mov dword [esp + edx*2 - 0x11008], 0x529e0d0d
jle 0x1049111b