joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a25a0
Capabilities:
Contain obfuscated stackstrings
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x498
push esi
push edi
lea edi, [ebp - 0x498]
mov ecx, 0x126
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101f3540]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x101f8d9c
call fcn.100a7f70
push 0x101ad55c
push 0x101f90f0
lea eax, [ebp - 0x210]
push eax
call fcn.1009e500
add esp, 8
push eax
call fcn.1009e440
add esp, 8
mov esi, esp
lea ecx, [ebp - 0x468]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp esi, esp
call fcn.100f3210
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0xffffffff
je 0x100a27a4
lea eax, [ebp - 0x43c]
push eax
call fcn.100a3860
add esp, 4
add eax, 1
mov ecx, 2
mul ecx
mov edx, 0xffffffff
cmovb eax, edx
push eax
call fcn.100f0340
add esp, 4
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x488], eax
lea ecx, [ebp - 0x488]
push ecx
mov ecx, 0x101f8d9c
call fcn.100a82d0
nop
lea edx, [ebp - 0x43c]
push edx
mov ecx, 0x101f8d9c
call fcn.100a7da0
mov eax, dword [eax]
push eax
call fcn.1009e500
add esp, 8
mov byte [ebp - 0x484], 0x5b
mov byte [ebp - 0x483], 0x63
mov byte [ebp - 0x482], 0x6f
mov byte [ebp - 0x481], 0x6e
mov byte [ebp - 0x480], 0x66
mov byte [ebp - 0x47f], 0x69
mov byte [ebp - 0x47e], 0x67
mov byte [ebp - 0x47d], 0x2e
mov byte [ebp - 0x47c], 0x63
mov byte [ebp - 0x47b], 0x70
mov byte [ebp - 0x47a], 0x70
mov byte [ebp - 0x479], 0x3a
mov byte [ebp - 0x478], 0x31
mov byte [ebp - 0x477], 0x34
mov byte [ebp - 0x476], 0x39
mov byte [ebp - 0x475], 0x5d
mov byte [ebp - 0x474], 0x20
mov byte [ebp - 0x473], 0
lea ecx, [ebp - 0x484]
call fcn.100a5890
push eax
push 1
mov ecx, 0x101f3514
call fcn.100efb60
mov dword [ebp - 0x490], eax
push str.found_configuration_file:__
mov ecx, dword [ebp - 0x490]
call fcn.100effb0
mov dword [ebp - 0x494], eax
lea ecx, [ebp - 0x43c]
push ecx
mov ecx, dword [ebp - 0x494]
call fcn.100efff0
mov dword [ebp - 0x498], eax
push 0x101ad584
mov ecx, dword [ebp - 0x498]
call fcn.100effb0
nop
mov esi, esp
lea edx, [ebp - 0x468]
push edx
mov eax, dword [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp esi, esp
call fcn.100f3210
test eax, eax
jne 0x100a2623
mov esi, esp
mov ecx, dword [ebp - 0x470]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, esp
call fcn.100f3210
nop
push edx
mov ecx, ebp
push eax
lea edx, [0x100a27d4]
call fcn.100f31b0
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3240
add esp, 0x498
cmp ebp, esp
call fcn.100f3210
mov esp, ebp
pop ebp
ret
Function at 0x100a2dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push edi
lea edi, [ebp - 0x258]
mov ecx, 0x96
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101f3540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x101f8d9c
call fcn.100a56a0
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
push 0x101f90f0
lea eax, [ebp - 0x214]
push eax
call fcn.1009e500
add esp, 8
push eax
call fcn.1009e440
add esp, 8
lea ecx, [ebp - 0x214]
push ecx
call fcn.100a6490
add esp, 4
movzx edx, al
test edx, edx
je 0x100a2f23
mov byte [ebp - 0x22c], 0x5b
mov byte [ebp - 0x22b], 0x63
mov byte [ebp - 0x22a], 0x6f
mov byte [ebp - 0x229], 0x6e
mov byte [ebp - 0x228], 0x66
mov byte [ebp - 0x227], 0x69
mov byte [ebp - 0x226], 0x67
mov byte [ebp - 0x225], 0x2e
mov byte [ebp - 0x224], 0x63
mov byte [ebp - 0x223], 0x70
mov byte [ebp - 0x222], 0x70
mov byte [ebp - 0x221], 0x3a
mov byte [ebp - 0x220], 0x32
mov byte [ebp - 0x21f], 0x37
mov byte [ebp - 0x21e], 0x36
mov byte [ebp - 0x21d], 0x5d
mov byte [ebp - 0x21c], 0x20
mov byte [ebp - 0x21b], 0
lea ecx, [ebp - 0x22c]
call fcn.100a5890
push eax
push 1
mov ecx, 0x101f3514
call fcn.100efb60
mov dword [ebp - 0x244], eax
push str.saved_configuration_file:__
mov ecx, dword [ebp - 0x244]
call fcn.100effb0
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x248]
call fcn.100efff0
mov dword [ebp - 0x24c], eax
push 0x101ad60c
mov ecx, dword [ebp - 0x24c]
call fcn.100effb0
nop
mov al, 1
jmp 0x100a2ffd
mov byte [ebp - 0x240], 0x5b
mov byte [ebp - 0x23f], 0x63
mov byte [ebp - 0x23e], 0x6f
mov byte [ebp - 0x23d], 0x6e
mov byte [ebp - 0x23c], 0x66
mov byte [ebp - 0x23b], 0x69
mov byte [ebp - 0x23a], 0x67
mov byte [ebp - 0x239], 0x2e
mov byte [ebp - 0x238], 0x63
mov byte [ebp - 0x237], 0x70
mov byte [ebp - 0x236], 0x70
mov byte [ebp - 0x235], 0x3a
mov byte [ebp - 0x234], 0x32
mov byte [ebp - 0x233], 0x38
mov byte [ebp - 0x232], 0x30
mov byte [ebp - 0x231], 0x5d
mov byte [ebp - 0x230], 0x20
mov byte [ebp - 0x22f], 0
lea ecx, [ebp - 0x240]
call fcn.100a5890
push eax
push 2
mov ecx, 0x101f3514
call fcn.100efb60
mov dword [ebp - 0x250], eax
push str.failed_to_save_configuration_file:__
mov ecx, dword [ebp - 0x250]
call fcn.100effb0
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x254]
call fcn.100efff0
mov dword [ebp - 0x258], eax
push 0x101ad638
mov ecx, dword [ebp - 0x258]
call fcn.100effb0
nop
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x100a302c]
call fcn.100f31b0
pop eax
pop edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3240
add esp, 0x258
cmp ebp, esp
call fcn.100f3210
mov esp, ebp
pop ebp
ret
Function at 0x100a3050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push edi
lea edi, [ebp - 0x258]
mov ecx, 0x96
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101f3540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x101f8d9c
call fcn.100a56a0
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
push 0x101f90f0
lea eax, [ebp - 0x214]
push eax
call fcn.1009e500
add esp, 8
push eax
call fcn.1009e440
add esp, 8
lea ecx, [ebp - 0x214]
push ecx
call fcn.100a58a0
add esp, 4
movzx edx, al
test edx, edx
je 0x100a31a3
mov byte [ebp - 0x22c], 0x5b
mov byte [ebp - 0x22b], 0x63
mov byte [ebp - 0x22a], 0x6f
mov byte [ebp - 0x229], 0x6e
mov byte [ebp - 0x228], 0x66
mov byte [ebp - 0x227], 0x69
mov byte [ebp - 0x226], 0x67
mov byte [ebp - 0x225], 0x2e
mov byte [ebp - 0x224], 0x63
mov byte [ebp - 0x223], 0x70
mov byte [ebp - 0x222], 0x70
mov byte [ebp - 0x221], 0x3a
mov byte [ebp - 0x220], 0x32
mov byte [ebp - 0x21f], 0x39
mov byte [ebp - 0x21e], 0x39
mov byte [ebp - 0x21d], 0x5d
mov byte [ebp - 0x21c], 0x20
mov byte [ebp - 0x21b], 0
lea ecx, [ebp - 0x22c]
call fcn.100a5890
push eax
push 1
mov ecx, 0x101f3514
call fcn.100efb60
mov dword [ebp - 0x244], eax
push str.loaded_configuration_file:__
mov ecx, dword [ebp - 0x244]
call fcn.100effb0
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x248]
call fcn.100efff0
mov dword [ebp - 0x24c], eax
push 0x101ad65c
mov ecx, dword [ebp - 0x24c]
call fcn.100effb0
nop
mov al, 1
jmp 0x100a327d
mov byte [ebp - 0x240], 0x5b
mov byte [ebp - 0x23f], 0x63
mov byte [ebp - 0x23e], 0x6f
mov byte [ebp - 0x23d], 0x6e
mov byte [ebp - 0x23c], 0x66
mov byte [ebp - 0x23b], 0x69
mov byte [ebp - 0x23a], 0x67
mov byte [ebp - 0x239], 0x2e
mov byte [ebp - 0x238], 0x63
mov byte [ebp - 0x237], 0x70
mov byte [ebp - 0x236], 0x70
mov byte [ebp - 0x235], 0x3a
mov byte [ebp - 0x234], 0x33
mov byte [ebp - 0x233], 0x30
mov byte [ebp - 0x232], 0x33
mov byte [ebp - 0x231], 0x5d
mov byte [ebp - 0x230], 0x20
mov byte [ebp - 0x22f], 0
lea ecx, [ebp - 0x240]
call fcn.100a5890
push eax
push 2
mov ecx, 0x101f3514
call fcn.100efb60
mov dword [ebp - 0x250], eax
push str.failed_to_load_configuration_file:__
mov ecx, dword [ebp - 0x250]
call fcn.100effb0
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x254]
call fcn.100efff0
mov dword [ebp - 0x258], eax
push 0x101ad688
mov ecx, dword [ebp - 0x258]
call fcn.100effb0
nop
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x100a32ac]
call fcn.100f31b0
pop eax
pop edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3240
add esp, 0x258
cmp ebp, esp
call fcn.100f3210
mov esp, ebp
pop ebp
ret
Function at 0x100a32d0
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push esi
push edi
lea edi, [ebp - 0x258]
mov ecx, 0x96
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101f3540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x101f8d9c
call fcn.100a56a0
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
push 0x101ad68c
mov edx, dword [ebp - 8]
push edx
call fcn.100a3770
add esp, 8
test eax, eax
jne 0x100a3324
jmp 0x100a348f
mov eax, dword [ebp - 8]
push eax
push 0x101f90f0
lea ecx, [ebp - 0x214]
push ecx
call fcn.1009e500
add esp, 8
push eax
call fcn.1009e440
add esp, 8
mov esi, esp
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.100f3210
test eax, eax
je 0x100a348f
lea eax, [ebp - 0x23c]
push eax
mov ecx, 0x101f8d9c
call fcn.100a7f40
mov dword [ebp - 0x24c], eax
sub esp, 0xc
mov ecx, esp
mov edx, dword [ebp + 8]
push edx
push ecx
mov ecx, dword [ebp - 0x24c]
call fcn.100a5740
lea eax, [ebp - 0x248]
push eax
mov ecx, 0x101f8d9c
call fcn.100a8030
lea ecx, [ebp - 0x248]
call fcn.100a55e0
lea ecx, [ebp - 0x23c]
call fcn.100a55b0
nop
mov byte [ebp - 0x22c], 0x5b
mov byte [ebp - 0x22b], 0x63
mov byte [ebp - 0x22a], 0x6f
mov byte [ebp - 0x229], 0x6e
mov byte [ebp - 0x228], 0x66
mov byte [ebp - 0x227], 0x69
mov byte [ebp - 0x226], 0x67
mov byte [ebp - 0x225], 0x2e
mov byte [ebp - 0x224], 0x63
mov byte [ebp - 0x223], 0x70
mov byte [ebp - 0x222], 0x70
mov byte [ebp - 0x221], 0x3a
mov byte [ebp - 0x220], 0x33
mov byte [ebp - 0x21f], 0x32
mov byte [ebp - 0x21e], 0x33
mov byte [ebp - 0x21d], 0x5d
mov byte [ebp - 0x21c], 0x20
mov byte [ebp - 0x21b], 0
lea ecx, [ebp - 0x22c]
call fcn.100a5890
push eax
push 1
mov ecx, 0x101f3514
call fcn.100efb60
mov dword [ebp - 0x250], eax
push str.removed_configuration_file:__
mov ecx, dword [ebp - 0x250]
call fcn.100effb0
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x254]
call fcn.100efff0
mov dword [ebp - 0x258], eax
push 0x101ad6c4
mov ecx, dword [ebp - 0x258]
call fcn.100effb0
nop
push edx
mov ecx, ebp
push eax
lea edx, [0x100a34c0]
call fcn.100f31b0
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3240
add esp, 0x258
cmp ebp, esp
call fcn.100f3210
mov esp, ebp
pop ebp
ret
Function at 0x100a6280
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101f3540]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, esp
call fcn.100f3210
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100a62d6
xor al, al
jmp 0x100a6442
mov esi, esp
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, esp
call fcn.100f3210
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x100a630e
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100f3210
xor al, al
jmp 0x100a6442
mov eax, dword [ebp - 0xc]
push eax
call fcn.100f05e0
add esp, 4
mov dword [ebp - 0x10], eax
mov esi, esp
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, esp
call fcn.100f3210
test eax, eax
jne 0x100a6366
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100f3210
mov edx, dword [ebp - 0x10]
push edx
call fcn.100f0630
add esp, 4
xor al, al
jmp 0x100a6442
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x44], 0x3e8
lea ecx, [ebp - 0x44]
push ecx
push 0x95e97e5e
push 0x4671ae97
lea ecx, [ebp - 0x2c]
call fcn.1009d930
nop
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100a5fb0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100a5800
add esp, 0xc
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x35], 0
cmp dword [ebp - 0x34], 0
je 0x100a6412
mov ecx, dword [ebp + 0xc]
call fcn.100a2340
add eax, 8
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.100a5eb0
add esp, 0xc
mov esi, esp
push 2
push 0
mov edx, dword [ebp - 0x3c]
neg edx
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, esp
call fcn.100f3210
cmp eax, 0xffffffff
je 0x100a6412
mov byte [ebp - 0x35], 1
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100f3210
mov edx, dword [ebp - 0x10]
push edx
call fcn.100f0630
add esp, 4
mov al, byte [ebp - 0x35]
mov byte [ebp - 0x45], al
lea ecx, [ebp - 0x2c]
call fcn.100a0d80
mov al, byte [ebp - 0x45]
push edx
mov ecx, ebp
push eax
lea edx, [0x100a6470]
call fcn.100f31b0
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3240
add esp, 0x48
cmp ebp, esp
call fcn.100f3210
mov esp, ebp
pop ebp
ret
Function at 0x100a8cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, 0xcccccccc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x101f3540]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x101f92f8]
call fcn.100aa430
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call fcn.100aa5c0
nop
jmp 0x100a8d12
mov ecx, dword [ebp - 8]
call fcn.100aa590
nop
mov ecx, dword [ebp - 8]
call fcn.100aa560
movzx eax, al
test eax, eax
je 0x100a8d4c
mov ecx, dword [ebp - 8]
call fcn.100aa460
mov dword [ebp - 0xc], eax
push 0x811c9dc5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
call fcn.100aa4c0
add esp, 8
cmp eax, dword [ebp + 8]
jne 0x100a8d4a
mov eax, dword [ebp - 0xc]
jmp 0x100a8dbc
jmp 0x100a8d09
mov byte [ebp - 0x20], 0x5b
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x2e
mov byte [ebp - 0x18], 0x63
mov byte [ebp - 0x17], 0x70
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x15], 0x3a
mov byte [ebp - 0x14], 0x31
mov byte [ebp - 0x13], 0x36
mov byte [ebp - 0x12], 0x38
mov byte [ebp - 0x11], 0x5d
mov byte [ebp - 0x10], 0x20
mov byte [ebp - 0xf], 0
lea ecx, [ebp - 0x20]
call fcn.100a5890
push eax
push 3
mov ecx, 0x101f3514
call fcn.100efb60
mov dword [ebp - 0x24], eax
push str.failed_to_find_convar
mov ecx, dword [ebp - 0x24]
call fcn.100effb0
nop
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3240
add esp, 0x24
cmp ebp, esp
call fcn.100f3210
mov esp, ebp
pop ebp
ret

Function at 0x100aa4c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
push eax
call fcn.100a3830
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x100aa4f5
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 4]
jae 0x100aa518
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movsx ecx, byte [eax]
xor ecx, dword [ebp + 0xc]
mov dword [ebp + 0xc], ecx
imul edx, dword [ebp + 0xc], 0x1000193
mov dword [ebp + 0xc], edx
jmp 0x100aa4ec
mov eax, dword [ebp + 0xc]
add esp, 8
cmp ebp, esp
call fcn.100f3210
mov esp, ebp
pop ebp
ret
Function at 0x100ad070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push edi
lea edi, [ebp - 0x28]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101f3540]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp + 8]
push eax
push 0x101f9378
mov ecx, dword [0x101f9374]
call fcn.100ad970
movzx ecx, al
test ecx, ecx
jne 0x100ad15a
mov byte [ebp - 0x1c], 0x5b
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x69
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x2e
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x70
mov byte [ebp - 0xa], 0x3a
mov byte [ebp - 9], 0x34
mov byte [ebp - 8], 0x37
mov byte [ebp - 7], 0x5d
mov byte [ebp - 6], 0x20
mov byte [ebp - 5], 0
lea ecx, [ebp - 0x1c]
call fcn.100ade90
push eax
push 2
mov ecx, 0x101f3514
call fcn.100efb60
mov dword [ebp - 0x20], eax
push str.failed_to_add_event:__
mov ecx, dword [ebp - 0x20]
call fcn.100effb0
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.100effb0
mov dword [ebp - 0x28], eax
push str.__to_the_listener
mov ecx, dword [ebp - 0x28]
call fcn.100effb0
nop
xor al, al
jmp 0x100ad15c
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3240
add esp, 0x28
cmp ebp, esp
call fcn.100f3210
mov esp, ebp
pop ebp
ret
Function at 0x100b4650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push edi
push ecx
lea edi, [ebp - 0x40]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x101f3540]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
je 0x100b4681
cmp dword [ebp + 0xc], 0
jne 0x100b4688
xor al, al
jmp 0x100b47ba
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 8]
add ecx, 0xc
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call fcn.1009abb0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100b47a5
mov byte [ebp - 0x20], 0x5b
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x6f
mov byte [ebp - 0x1b], 0x75
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x68
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x6b
mov byte [ebp - 0x15], 0x2e
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x36
mov byte [ebp - 0x10], 0x5d
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0
lea ecx, [ebp - 0x20]
call fcn.100b4bc0
push eax
push 3
mov ecx, 0x101f3514
call fcn.100efb60
mov dword [ebp - 0x28], eax
push str.failed_to_create_hook__status:__
mov ecx, dword [ebp - 0x28]
call fcn.100effb0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.1009b1d0
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.100effb0
mov dword [ebp - 0x34], eax
push str.__with_base_address:
mov ecx, dword [ebp - 0x34]
call fcn.100effb0
mov dword [ebp - 0x38], eax
push 6
call fcn.100f01d0
add esp, 4
mov word [ebp - 0x22], ax
mov dx, word [ebp - 0x22]
mov word [ebp - 0x24], dx
movzx eax, word [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.100eff30
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x3c]
call fcn.1009dc30
nop
xor ecx, ecx
jne 0x100b47a1
int3
xor al, al
jmp 0x100b47ba
mov ecx, dword [ebp - 8]
call fcn.100b5ad0
movzx eax, al
test eax, eax
jne 0x100b47b8
xor al, al
jmp 0x100b47ba
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3240
add esp, 0x40
cmp ebp, esp
call fcn.100f3210
mov esp, ebp
pop ebp
ret 8
Function at 0x100b47e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push edi
push ecx
lea edi, [ebp - 0x40]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x101f3540]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
je 0x100b4811
cmp dword [ebp + 0xc], 0
jne 0x100b4818
xor al, al
jmp 0x100b494a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 8]
add ecx, 0xc
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call fcn.1009abb0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100b4935
mov byte [ebp - 0x20], 0x5b
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x6f
mov byte [ebp - 0x1b], 0x75
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x68
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x6b
mov byte [ebp - 0x15], 0x2e
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x36
mov byte [ebp - 0x10], 0x5d
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0
lea ecx, [ebp - 0x20]
call fcn.100b4bc0
push eax
push 3
mov ecx, 0x101f3514
call fcn.100efb60
mov dword [ebp - 0x28], eax
push str.failed_to_create_hook__status:__
mov ecx, dword [ebp - 0x28]
call fcn.100effb0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.1009b1d0
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.100effb0
mov dword [ebp - 0x34], eax
push str.__with_base_address:
mov ecx, dword [ebp - 0x34]
call fcn.100effb0
mov dword [ebp - 0x38], eax
push 6
call fcn.100f01d0
add esp, 4
mov word [ebp - 0x22], ax
mov dx, word [ebp - 0x22]
mov word [ebp - 0x24], dx
movzx eax, word [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.100eff30
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x3c]
call fcn.1009dc30
nop
xor ecx, ecx
jne 0x100b4931
int3
xor al, al
jmp 0x100b494a
mov ecx, dword [ebp - 8]
call fcn.100b5c40
movzx eax, al
test eax, eax
jne 0x100b4948
xor al, al
jmp 0x100b494a
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3240
add esp, 0x40
cmp ebp, esp
call fcn.100f3210
mov esp, ebp
pop ebp
ret 8