joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10114fe4
mov dword [ebp - 0x1c], 0x720070
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x63006f
mov dword [ebp - 0x14], 0x6f006d
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e006e
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x10018f2e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10018f2e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10018f10
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114fe4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10018f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10114f2c
mov dword [ebp - 0x1c], 0x6d0073
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x6e0073
mov dword [ebp - 0x14], 0x660069
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0066
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x10018fbe
movzx ecx, word [esi + eax]
test cx, cx
je 0x10018fbe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10018fa0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114f2c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10018fe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x1011501c
mov dword [ebp - 0x20], 0x720070
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x63006f
mov dword [ebp - 0x18], 0x6f006d
mov edx, 0xf
mov dword [ebp - 0x14], 0x36006e
sub esi, eax
mov dword [ebp - 0x10], 0x2e0034
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x1001904f
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001904f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019031
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x1011501c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x10019070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10114f48
mov dword [ebp - 0x24], 0x69006d
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x69006e
mov dword [ebp - 0x1c], 0x6e0073
mov edx, 0x11
mov dword [ebp - 0x18], 0x660069
sub esi, eax
mov dword [ebp - 0x14], 0x650066
mov dword [ebp - 0x10], 0x2e0072
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x100190ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x100190ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100190d0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114f48
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x100191a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10114f08
mov dword [ebp - 0x24], 0x700073
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x780079
mov dword [ebp - 0x1c], 0x5f0078
mov edx, 0x11
mov dword [ebp - 0x18], 0x6d0061
sub esi, eax
mov dword [ebp - 0x14], 0x360064
mov dword [ebp - 0x10], 0x2e0034
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x1001921e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001921e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019200
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114f08
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10019240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x1011503c
mov dword [ebp - 0x20], 0x720070
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x63006f
mov dword [ebp - 0x18], 0x780065
mov edx, 0xf
mov dword [ebp - 0x14], 0x360070
sub esi, eax
mov dword [ebp - 0x10], 0x2e0034
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x100192af
movzx ecx, word [esi + eax]
test cx, cx
je 0x100192af
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019291
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x1011503c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x100192d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x690077
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x10114e70
mov dword [ebp - 0x18], 0x64006e
mov dword [ebp - 0x14], 0x670062
mov edx, 0xc
mov dword [ebp - 0x10], 0x65002e
sub esi, eax
mov dword [ebp - 0xc], 0x650078
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x1001933e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001933e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019320
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114e70
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10019590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x620064
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x10115094
mov dword [ebp - 0x20], 0x780067
mov dword [ebp - 0x1c], 0x73002e
mov edx, 0x10
mov dword [ebp - 0x18], 0x650068
sub esi, eax
mov dword [ebp - 0x14], 0x6c006c
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
nop word [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x1001960e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001960e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100195f0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10115094
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x100196b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x650064
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x10114ed8
mov dword [ebp - 0x18], 0x650076
mov dword [ebp - 0x14], 0x76006e
mov edx, 0xc
mov dword [ebp - 0x10], 0x65002e
sub esi, eax
mov dword [ebp - 0xc], 0x650078
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x1001971e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001971e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019700
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114ed8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x10019740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10114f6c
mov dword [ebp - 0x1c], 0x6c006f
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x79006c
mov dword [ebp - 0x14], 0x620064
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0067
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x100197ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x100197ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019790
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114f6c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x100197d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x640069
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x10114fb0
mov dword [ebp - 0x18], 0x710061
mov dword [ebp - 0x14], 0x340036
mov edx, 0xc
mov dword [ebp - 0x10], 0x65002e
sub esi, eax
mov dword [ebp - 0xc], 0x650078
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x1001983e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001983e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019820
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114fb0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x100198f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10114e9c
mov dword [ebp - 0x1c], 0x690066
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x640064
mov dword [ebp - 0x14], 0x65006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0072
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x1001995e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001995e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019940
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114e9c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x10019980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x750073
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x101150cc
mov dword [ebp - 0x28], 0x6c006e
mov dword [ebp - 0x24], 0x67006f
mov edx, 0x14
mov dword [ebp - 0x20], 0x6e0069
sub esi, eax
mov dword [ebp - 0x1c], 0x6c0063
mov dword [ebp - 0x18], 0x650069
mov dword [ebp - 0x14], 0x74006e
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x10019a03
movzx ecx, word [esi + eax]
test cx, cx
je 0x10019a03
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100199e5
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101150cc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10019a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10115000
mov dword [ebp - 0x1c], 0x720070
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x63006f
mov dword [ebp - 0x14], 0x780065
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0070
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x10019a9e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10019a9e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019a80
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10115000
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10019ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10114eb8
mov dword [ebp - 0x20], 0x690077
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x650072
mov dword [ebp - 0x18], 0x680073
mov edx, 0xf
mov dword [ebp - 0x14], 0x720061
sub esi, eax
mov dword [ebp - 0x10], 0x2e006b
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x10019b2f
movzx ecx, word [esi + eax]
test cx, cx
je 0x10019b2f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019b11
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114eb8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x10019b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x1011505c
mov dword [ebp - 0x24], 0x750073
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x650070
mov dword [ebp - 0x1c], 0x6b0072
mov edx, 0x11
mov dword [ebp - 0x18], 0x6c0069
sub esi, eax
mov dword [ebp - 0x14], 0x65006c
mov dword [ebp - 0x10], 0x2e0072
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x10019bce
movzx ecx, word [esi + eax]
test cx, cx
je 0x10019bce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10019bb0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x1011505c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x1001f700
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d1012
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ecx, edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x41c], 0
push 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
push 0x100dfde0
mov dword [ebp - 4], 0
mov byte [edi], 0
call fcn.100057a0
push 0
push 0
push 0
push 1
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x41c], 1
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x1001f857
cmp dword [esi + 0x14], 8
jb 0x1001f7a1
mov esi, dword [esi]
push 0
push 0x84000000
push 0
push 0
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
test esi, esi
je 0x1001f84b
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x418], 0
nop
push 0x401
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.100a5d20
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x400
lea eax, [ebp - 0x414]
push eax
push esi
call ebx
test eax, eax
mov eax, dword [ebp - 0x418]
je 0x1001f840
test eax, eax
je 0x1001f844
cmp eax, 0x401
jae 0x1001f877
mov byte [ebp + eax - 0x414], 0
lea eax, [ebp - 0x414]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001f822
sub eax, edx
mov ecx, edi
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.100047b0
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x1001f7d0
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x420]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret 8
call fcn.1007f56e
int3
Function at 0x10022910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10115298
mov dword [ebp - 0x6c], 0x4f0053
lea esi, [ebp - 0x6c]
mov dword [ebp - 0x68], 0x540046
push edi
mov dword [ebp - 0x64], 0x410057
mov edx, 0x35
mov dword [ebp - 0x60], 0x450052
sub esi, eax
mov dword [ebp - 0x5c], 0x4d005c
mov dword [ebp - 0x58], 0x630069
mov dword [ebp - 0x54], 0x6f0072
mov dword [ebp - 0x50], 0x6f0073
mov dword [ebp - 0x4c], 0x740066
mov dword [ebp - 0x48], 0x57005c
mov dword [ebp - 0x44], 0x6e0069
mov dword [ebp - 0x40], 0x6f0064
mov dword [ebp - 0x3c], 0x730077
mov dword [ebp - 0x38], 0x43005c
mov dword [ebp - 0x34], 0x720075
mov dword [ebp - 0x30], 0x650072
mov dword [ebp - 0x2c], 0x74006e
mov dword [ebp - 0x28], 0x650056
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x6f0069
mov dword [ebp - 0x1c], 0x5c006e
mov dword [ebp - 0x18], 0x6e0055
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x6c0061
mov dword [ebp - 8], 0x6c
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffc9]
test ecx, ecx
je 0x10022a0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10022a0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100229f0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x10115298
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x10022a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10115210
mov dword [ebp - 0x84], 0x4f0053
lea esi, [ebp - 0x84]
mov dword [ebp - 0x80], 0x540046
push edi
mov dword [ebp - 0x7c], 0x410057
mov edx, 0x41
mov dword [ebp - 0x78], 0x450052
sub esi, eax
mov dword [ebp - 0x74], 0x57005c
mov dword [ebp - 0x70], 0x57004f
mov dword [ebp - 0x6c], 0x340036
mov dword [ebp - 0x68], 0x320033
mov dword [ebp - 0x64], 0x6f004e
mov dword [ebp - 0x60], 0x650064
mov dword [ebp - 0x5c], 0x4d005c
mov dword [ebp - 0x58], 0x630069
mov dword [ebp - 0x54], 0x6f0072
mov dword [ebp - 0x50], 0x6f0073
mov dword [ebp - 0x4c], 0x740066
mov dword [ebp - 0x48], 0x57005c
mov dword [ebp - 0x44], 0x6e0069
mov dword [ebp - 0x40], 0x6f0064
mov dword [ebp - 0x3c], 0x730077
mov dword [ebp - 0x38], 0x43005c
mov dword [ebp - 0x34], 0x720075
mov dword [ebp - 0x30], 0x650072
mov dword [ebp - 0x2c], 0x74006e
mov dword [ebp - 0x28], 0x650056
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x6f0069
mov dword [ebp - 0x1c], 0x5c006e
mov dword [ebp - 0x18], 0x6e0055
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x6c0061
mov dword [ebp - 8], 0x6c
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x10022b6e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10022b6e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10022b50
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x10115210
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x10023860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x750052
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x10115314
mov dword [ebp - 0x18], 0x44006e
mov dword [ebp - 0x14], 0x6c006c
mov edx, 0xc
mov dword [ebp - 0x10], 0x65002e
sub esi, eax
mov dword [ebp - 0xc], 0x650078
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x100238ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x100238ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100238b0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10115314
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x100238f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x750072
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x1011532c
mov dword [ebp - 0x18], 0x64006e
mov dword [ebp - 0x14], 0x6c006c
mov edx, 0xc
mov dword [ebp - 0x10], 0x65002e
sub esi, eax
mov dword [ebp - 0xc], 0x650078
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x1002395e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1002395e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10023940
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x1011532c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10023980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3c], 0x6f0043
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x3c]
mov eax, 0x10115344
mov dword [ebp - 0x38], 0x70006d
push edi
mov dword [ebp - 0x34], 0x740075
mov edx, 0x1c
mov dword [ebp - 0x30], 0x720065
sub esi, eax
mov dword [ebp - 0x2c], 0x31005a
mov dword [ebp - 0x28], 0x5f0032
mov dword [ebp - 0x24], 0x650068
mov dword [ebp - 0x20], 0x70006c
mov dword [ebp - 0x1c], 0x720065
mov dword [ebp - 0x18], 0x78005f
mov dword [ebp - 0x14], 0x340036
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffe2]
test ecx, ecx
je 0x10023a20
movzx ecx, word [esi + eax]
test cx, cx
je 0x10023a20
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10023a02
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x10115344
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x100242c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x100243f0
push esi
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.100a5d20
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x1002433b
push 0
call dword [sym.imp.USER32.dll_GetDC]
push edi
push 0x100240e0
mov esi, eax
push 0
push esi
call dword [sym.imp.GDI32.dll_EnumFontFamiliesW]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x1002433f
or dword [edi + 0xc], 8
mov eax, dword [edi + 0xc]
test al, 0x20
je 0x10024358
push 6
push str.Tahoma
lea ecx, [edi + 8]
call fcn.100045a0
mov eax, dword [edi + 0xc]
test al, 0x10
je 0x1002436e
push 4
push 0x100e1a08
lea ecx, [edi + 8]
call fcn.100045a0
mov eax, dword [edi + 0xc]
test al, 8
je 0x10024384
push 2
push 0x100e1a00
lea ecx, [edi + 8]
call fcn.100045a0
mov eax, dword [edi + 0xc]
test al, 4
je 0x1002439a
push 0x12
push str.Microsoft_YaHei_UI
lea ecx, [edi + 8]
call fcn.100045a0
mov eax, dword [edi + 0xc]
test al, 2
je 0x100243b0
push 0xf
push str.Microsoft_YaHei
lea ecx, [edi + 8]
call fcn.100045a0
mov eax, dword [edi + 0xc]
test al, 1
je 0x100243c3
push 4
push 0x100e19ac
lea ecx, [edi + 8]
call fcn.100045a0
push dword [edi + 8]
push 0x20
push 0
push 0
push 0
push 0x86
push 0
push 0
push 0
push 0x190
push 0
push 0
push 0
push 0xfffffffffffffff4
call dword [sym.imp.GDI32.dll_CreateFontW]
mov dword [edi + 4], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10024e70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x1011544c
mov dword [ebp - 0x24], 0x540046
mov dword [ebp - 0x20], 0x410057
mov edx, 0x12
mov dword [ebp - 0x1c], 0x450052
sub esi, eax
mov dword [ebp - 0x18], 0x4c005c
mov dword [ebp - 0x14], 0x640075
mov dword [ebp - 0x10], 0x730061
mov dword [ebp - 0xc], 0x690068
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x10024eee
movzx ecx, word [esi + eax]
test cx, cx
je 0x10024eee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10024ed0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x1011544c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret