joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100053f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x2c], eax
xor al, al
push ebx
mov bl, 0x65
mov cl, 0x53
mov dl, 0x67
mov byte [esp + 0x10], bl
mov byte [esp + 0x12], bl
mov byte [esp + 0x16], bl
mov bl, 0x6e
mov byte [esp + 5], al
mov byte [esp + 7], al
mov byte [esp + 8], al
mov byte [esp + 9], al
mov byte [esp + 0x22], al
mov byte [esp + 0x25], al
mov byte [esp + 0x27], al
mov byte [esp + 0x29], al
mov byte [esp + 0x2f], al
mov byte [esp + 0xc], cl
mov byte [esp + 0xe], cl
mov byte [esp + 0x11], dl
mov byte [esp + 0x13], cl
mov byte [esp + 0x17], bl
mov byte [esp + 0x18], dl
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], cl
mov cl, 0x31
mov byte [esp + 0x21], dl
mov dl, 0x36
push 0x2c
lea eax, [esp + 8]
mov bl, 0x39
push eax
mov byte [esp + 0xc], 5
mov byte [esp + 0xe], 9
mov byte [esp + 0x12], 0x5a
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x15], 0x5f
mov byte [esp + 0x17], 0x69
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x1d], 0x72
mov byte [esp + 0x21], 0x5f
mov byte [esp + 0x22], 0x4f
mov byte [esp + 0x25], 0x75
mov byte [esp + 0x26], 0x62
mov byte [esp + 0x27], 0x44
mov byte [esp + 0x28], 0x6c
mov byte [esp + 0x2b], 2
mov byte [esp + 0x2c], cl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x30], 0x32
mov byte [esp + 0x32], cl
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], dl
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], bl
call fcn.10001270
mov ecx, dword [esp + 0x30]
pop ebx
xor ecx, esp
call fcn.1004309b
add esp, 0x30
ret
Function at 0x100062c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x38
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x34], eax
xor eax, eax
mov cl, 0x31
mov dl, 0x69
mov byte [esp + 0x11], dl
mov byte [esp + 0x14], dl
mov dl, 0x34
push ebx
mov byte [esp + 0x2c], dl
mov byte [esp + 0x2f], dl
mov dl, byte [0x1007c714]
push esi
mov bl, 0x39
add dl, cl
push eax
mov byte [esp + 0x10], 5
mov byte [esp + 0x11], al
mov byte [esp + 0x12], 9
mov byte [esp + 0x13], al
mov byte [esp + 0x14], al
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x54
mov byte [esp + 0x17], cl
mov byte [esp + 0x18], 0x35
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], 0x5f
mov byte [esp + 0x1c], 0x46
mov byte [esp + 0x1e], 0x73
mov byte [esp + 0x1f], 0x68
mov byte [esp + 0x21], 0x6e
mov byte [esp + 0x22], 0x67
mov byte [esp + 0x23], al
mov byte [esp + 0x24], 4
mov byte [esp + 0x25], cl
mov byte [esp + 0x26], al
mov byte [esp + 0x27], cl
mov byte [esp + 0x28], al
mov byte [esp + 0x29], 0x32
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], 0x35
mov byte [esp + 0x2c], cl
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x30], al
mov byte [esp + 0x31], 0x33
mov byte [esp + 0x32], al
mov byte [esp + 0x33], cl
mov byte [esp + 0x35], 0x30
mov byte [esp + 0x36], al
mov byte [esp + 0x38], al
mov byte [esp + 0x39], cl
mov byte [esp + 0x3a], cl
mov byte [esp + 0x3b], 0x30
mov byte [esp + 0x3c], al
mov byte [esp + 0x2f], dl
call fcn.10043bc6
push eax
call fcn.10043c02
add esp, 8
call fcn.10043c0f
cdq
mov ecx, 0xb
idiv ecx
mov esi, 0xa
mov bl, dl
add bl, 0x23
mov cl, dl
movsx eax, bl
cdq
idiv esi
add cl, 5
mov byte [esp + 0xb], cl
add al, 0x30
mov byte [esp + 0x30], al
add dl, 0x30
movsx eax, cl
mov byte [esp + 0x31], dl
cdq
mov ecx, esi
idiv ecx
add al, 0x30
add dl, 0x30
mov byte [esp + 0x37], dl
push 0x2d
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x3e], al
call fcn.10001270
movsx eax, bl
cdq
mov ecx, esi
idiv ecx
push 0x2d
add al, 0x30
mov byte [esp + 0x34], al
add dl, 0x30
mov byte [esp + 0x35], dl
movsx eax, bl
cdq
idiv ecx
add dl, 0x30
mov byte [esp + 0x3b], dl
lea edx, [esp + 0x10]
add al, 0x30
push edx
mov byte [esp + 0x3e], al
call fcn.10001270
movsx eax, byte [esp + 0xb]
cdq
mov ecx, esi
idiv ecx
push 0x2d
add al, 0x30
mov byte [esp + 0x34], al
add dl, 0x30
mov byte [esp + 0x35], dl
movsx eax, bl
cdq
idiv ecx
add dl, 0x30
mov byte [esp + 0x3b], dl
lea edx, [esp + 0x10]
add al, 0x30
push edx
mov byte [esp + 0x3e], al
call fcn.10001270
mov cl, byte [esp + 0xb]
movsx eax, cl
cdq
idiv esi
push 0x2d
add al, 0x30
mov byte [esp + 0x34], al
add dl, 0x30
movsx eax, cl
mov byte [esp + 0x35], dl
cdq
mov ecx, esi
idiv ecx
add dl, 0x30
mov byte [esp + 0x3b], dl
lea edx, [esp + 0x10]
add al, 0x30
push edx
mov byte [esp + 0x3e], al
call fcn.10001270
mov ecx, dword [esp + 0x3c]
pop esi
pop ebx
xor ecx, esp
call fcn.1004309b
add esp, 0x38
ret
Function at 0x100064c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x1c], eax
xor al, al
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov cl, 0x31
mov byte [esp + 0x13], al
mov byte [esp + 0x16], al
mov byte [esp + 0x18], al
mov dl, 0x69
push 0x19
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x54
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], 0x35
mov byte [esp + 0x11], cl
mov byte [esp + 0x12], 0x39
mov byte [esp + 0x13], 0x5f
mov byte [esp + 0x14], 0x46
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0x73
mov byte [esp + 0x17], 0x68
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x67
mov byte [esp + 0x1c], 1
mov byte [esp + 0x1d], cl
mov byte [esp + 0x1f], 0x32
call fcn.10001270
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1004309b
add esp, 0x20
ret
Function at 0x10006560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x1c], eax
xor al, al
mov cl, 0x31
mov byte [esp + 7], cl
mov byte [esp + 9], cl
mov cl, 0x69
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1a], al
mov dl, 0x46
mov byte [esp + 0x10], cl
mov byte [esp + 0x13], cl
mov cl, 0x6f
push 0x1b
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x54
mov byte [esp + 0x10], 0x35
mov byte [esp + 0x12], 0x39
mov byte [esp + 0x13], 0x5f
mov byte [esp + 0x14], 0x42
mov byte [esp + 0x15], 0x75
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], dl
mov byte [esp + 0x19], 0x73
mov byte [esp + 0x1a], 0x68
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x67
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], 0x64
call fcn.10001270
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1004309b
add esp, 0x20
ret
cmp dword [0x1007c710], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x100066cc
call edi
mov ecx, dword [0x100798f0]
add ecx, 0x1f4
cmp ecx, eax
jae 0x100066cc
mov dword [0x100798f0], eax
call fcn.10006610
cmp dword [0x1007c700], 0
push esi
je 0x10006777
call edi
mov edx, dword [0x100798ec]
mov ecx, dword [0x100798e8]
lea edx, [ecx + edx + 0x3e8]
cmp edx, eax
jae 0x10006777
mov dword [0x100798ec], eax
mov eax, dword [0x1007c704]
sub eax, 0
je 0x10006768
sub eax, 1
jne 0x10006777
push 0x108
mov dword [0x100798e8], 0
call fcn.1003d560
mov esi, eax
push 4
add esi, 0x140
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10006777
cmp dword [esi], eax
je 0x10006777
mov eax, dword [0x100798e4]
add eax, 1
cmp eax, dword [0x1007c718]
mov dword [0x100798e4], eax
jbe 0x10006777
call fcn.100064c0
mov dword [0x100798e4], 0
mov dword [0x1007c704], 0
jmp 0x10006777
call fcn.100062c0
mov dword [0x100798e8], 0x1f40
cmp dword [0x1007c708], 0
pop esi
je 0x100067c7
call edi
mov ecx, dword [0x100798e0]
add ecx, 0x190
cmp ecx, eax
jae 0x100067c7
push 0
push 0x10058044
push 0x1005803c
mov dword [0x100798e0], eax
call fcn.10032410
test eax, eax
jne 0x100067c7
push eax
push 0x1005802c
push 0x1005803c
call fcn.10032410
test eax, eax
jne 0x100067c7
pop edi
jmp 0x10006560
pop edi
ret
Function at 0x100067d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x28], eax
xor al, al
mov cl, 0x47
mov byte [esp + 6], cl
mov byte [esp + 0xd], cl
mov cl, 0x65
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov dl, 0x68
mov byte [esp + 0x1f], al
mov byte [esp + 0x22], al
mov byte [esp + 0x24], al
mov byte [esp + 0xe], cl
mov byte [esp + 0x15], cl
mov cl, 0x69
push 0x25
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xf], 0x59
mov byte [esp + 0x10], 0x5f
mov byte [esp + 0x11], 0x43
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], 0x61
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x17], 0x53
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x5f
mov byte [esp + 0x1c], 0x48
mov byte [esp + 0x1e], cl
mov byte [esp + 0x1f], 0x59
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], 0x5f
mov byte [esp + 0x22], 0x43
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], 0x75
mov byte [esp + 0x25], 0x4c
mov byte [esp + 0x26], cl
mov byte [esp + 0x28], 1
mov byte [esp + 0x29], 0x31
mov byte [esp + 0x2b], 0x33
call fcn.10001270
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1004309b
add esp, 0x2c
ret

Function at 0x100068b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x28], eax
xor al, al
mov dl, 0x59
mov cl, 0x61
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x20], al
mov byte [esp + 0x23], al
mov byte [esp + 0x25], al
mov byte [esp + 7], dl
mov byte [esp + 0xb], cl
mov byte [esp + 0x11], cl
mov cl, 0x31
mov byte [esp + 0x16], dl
mov dl, 0x69
push 0x25
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x47
mov byte [esp + 0x10], 0x5f
mov byte [esp + 0x11], 0x43
mov byte [esp + 0x12], 0x68
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x15], 0x47
mov byte [esp + 0x16], 0x65
mov byte [esp + 0x17], 0x53
mov byte [esp + 0x18], 0x68
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x5f
mov byte [esp + 0x1c], 0x4c
mov byte [esp + 0x1d], 0x76
mov byte [esp + 0x1f], dl
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], 0x5f
mov byte [esp + 0x22], 0x46
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x73
mov byte [esp + 0x27], 0x68
mov byte [esp + 0x29], 1
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2c], cl
call fcn.10001270
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1004309b
add esp, 0x2c
ret
Function at 0x10006b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x4f
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x21], al
mov al, byte [0x1007c750]
mov byte [esp + 9], cl
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], cl
mov dl, 0x53
push 0x22
lea ecx, [esp + 4]
add al, 0x31
push ecx
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x5a
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0x5a
mov byte [esp + 0x17], 0x6a
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], 0x47
mov byte [esp + 0x22], 0x44
mov byte [esp + 0x23], dl
mov byte [esp + 0x25], 1
mov byte [esp + 0x26], 0x32
mov byte [esp + 0x28], al
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1004309b
add esp, 0x28
ret
sub esp, 0x28
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x4f
mov dl, 0x5a
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x21], al
mov byte [esp + 0x23], al
mov al, byte [0x1007c750]
mov byte [esp + 9], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], cl
mov byte [esp + 6], dl
mov byte [esp + 0xe], dl
mov dl, 0x73
push 0x24
lea ecx, [esp + 4]
add al, 0x31
push ecx
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], 0x53
mov byte [esp + 0x17], 0x6a
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], dl
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x21], 0x47
mov byte [esp + 0x24], 0x44
mov byte [esp + 0x25], 0x53
mov byte [esp + 0x27], 1
mov byte [esp + 0x28], 0x32
mov byte [esp + 0x2a], al
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1004309b
add esp, 0x28
ret
cmp dword [0x1007c738], 0
je 0x10006d0a
call fcn.1000de90
mov ecx, dword [0x100798fc]
add ecx, 0xee48
cmp ecx, eax
jae 0x10006d0a
cmp dword [0x100798f8], 0
mov dword [0x100798fc], eax
jne 0x10006cfb
mov dword [0x100798f8], 1
jmp 0x10006b00
mov dword [0x100798f8], 0
jmp 0x10006be0
ret
Function at 0x10006be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x4f
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x21], al
mov al, byte [0x1007c750]
mov byte [esp + 9], cl
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], cl
mov dl, 0x53
push 0x22
lea ecx, [esp + 4]
add al, 0x31
push ecx
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x5a
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0x5a
mov byte [esp + 0x17], 0x6a
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], 0x47
mov byte [esp + 0x22], 0x44
mov byte [esp + 0x23], dl
mov byte [esp + 0x25], 1
mov byte [esp + 0x26], 0x32
mov byte [esp + 0x28], al
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1004309b
add esp, 0x28
ret
sub esp, 0x28
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x4f
mov dl, 0x5a
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x21], al
mov byte [esp + 0x23], al
mov al, byte [0x1007c750]
mov byte [esp + 9], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], cl
mov byte [esp + 6], dl
mov byte [esp + 0xe], dl
mov dl, 0x73
push 0x24
lea ecx, [esp + 4]
add al, 0x31
push ecx
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], 0x53
mov byte [esp + 0x17], 0x6a
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], dl
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x21], 0x47
mov byte [esp + 0x24], 0x44
mov byte [esp + 0x25], 0x53
mov byte [esp + 0x27], 1
mov byte [esp + 0x28], 0x32
mov byte [esp + 0x2a], al
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1004309b
add esp, 0x28
ret
cmp dword [0x1007c738], 0
je 0x10006d0a
call fcn.1000de90
mov ecx, dword [0x100798fc]
add ecx, 0xee48
cmp ecx, eax
jae 0x10006d0a
cmp dword [0x100798f8], 0
mov dword [0x100798fc], eax
jne 0x10006cfb
mov dword [0x100798f8], 1
jmp 0x10006b00
mov dword [0x100798f8], 0
jmp 0x10006be0
ret
Function at 0x10006d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x68
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x64], eax
mov al, 0x6e
mov cl, 0x63
push ebx
xor bl, bl
mov dl, 0x5f
mov byte [esp + 0x20], cl
mov byte [esp + 0x23], al
mov byte [esp + 0x28], cl
mov byte [esp + 0x2c], al
mov al, 0x33
mov cl, 0x39
push esi
mov byte [esp + 0x21], dl
mov byte [esp + 0x2a], dl
mov byte [esp + 0x31], al
mov dl, 0x38
mov byte [esp + 0x38], cl
mov byte [esp + 0x3c], al
mov byte [esp + 0xb], cl
mov cl, 0x34
mov byte [esp + 0xe], al
push 0xa
lea eax, [esp + 0x54]
mov byte [esp + 0x1c], 5
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], 9
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0x47
mov byte [esp + 0x23], 0x58
mov byte [esp + 0x24], 0x54
mov byte [esp + 0x26], 0x45
mov byte [esp + 0x27], 0x78
mov byte [esp + 0x29], 0x68
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2c], 0x67
mov byte [esp + 0x2d], 0x65
mov byte [esp + 0x2f], 0x41
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x32], 0x69
mov byte [esp + 0x33], 0x6f
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], 4
mov byte [esp + 0x38], 0x31
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], 0x31
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3d], 0x30
mov byte [esp + 0x3e], dl
mov byte [esp + 0x3f], 0x37
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], bl
mov byte [esp + 0x4e], bl
mov byte [esp + 0x4f], bl
mov byte [esp + 0x50], bl
mov byte [esp + 0x51], bl
mov byte [esp + 0xc], bl
mov byte [esp + 0xd], 0x32
mov byte [esp + 0xe], bl
mov byte [esp + 0x10], cl
mov byte [esp + 0x11], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], 0x31
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], bl
mov byte [esp + 0x18], 0x31
mov byte [esp + 0x19], bl
push eax
call fcn.10033080
push eax
call fcn.10043c71
lea eax, [esp + 0x5c]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10006e73
sub eax, esi
mov esi, eax
push esi
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x3e]
push edx
call fcn.100431c0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + esi + 0x42], eax
mov ax, word [esp + 0x20]
mov dword [esp + esi + 0x46], ecx
mov cl, byte [esp + 0x80]
mov dword [esp + esi + 0x4a], edx
mov word [esp + esi + 0x4e], ax
add esp, 0xc
lea eax, [esi + 0x2c]
push eax
lea edx, [esp + 0x1c]
add cl, 0x31
push edx
mov byte [esp + eax + 0x1e], cl
call fcn.10001270
mov ecx, dword [esp + 0x6c]
pop esi
pop ebx
xor ecx, esp
call fcn.1004309b
add esp, 0x68
ret 4
Function at 0x10007050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x2c], eax
xor al, al
mov cl, 0x5f
mov dl, 0x31
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x20], al
mov byte [esp + 0x28], al
mov byte [esp + 0x2a], al
mov byte [esp + 0xc], cl
mov byte [esp + 0x10], cl
mov byte [esp + 0x19], cl
mov cl, 0x30
push 0x2b
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x5a
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x11], 0x4f
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x15], 0x4e
mov byte [esp + 0x16], 0x50
mov byte [esp + 0x17], 0x43
mov byte [esp + 0x19], 0x70
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x66
mov byte [esp + 0x1d], 0x61
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x1f], 0x67
mov byte [esp + 0x20], 0x34
mov byte [esp + 0x22], dl
mov byte [esp + 0x24], 2
mov byte [esp + 0x25], dl
mov byte [esp + 0x27], dl
mov byte [esp + 0x29], 0x33
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], cl
mov byte [esp + 0x2c], cl
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], dl
mov byte [esp + 0x31], dl
call fcn.10001270
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1004309b
add esp, 0x30
ret
Function at 0x100079c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x20], eax
xor al, al
mov cl, 0x69
mov dl, 0x74
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x19], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1e], al
mov byte [esp + 0xc], dl
mov byte [esp + 0xe], cl
mov byte [esp + 0x10], dl
mov dl, 0x51
mov byte [esp + 0x13], cl
mov byte [esp + 0x17], cl
mov cl, 0x31
push 0x1f
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x48
mov byte [esp + 0xf], 0x58
mov byte [esp + 0x10], 0x42
mov byte [esp + 0x11], 0x5f
mov byte [esp + 0x12], 0x50
mov byte [esp + 0x13], 0x61
mov byte [esp + 0x15], 0x72
mov byte [esp + 0x17], 0x6f
mov byte [esp + 0x19], 0x5f
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x67
mov byte [esp + 0x1e], dl
mov byte [esp + 0x20], 0x75
mov byte [esp + 0x22], 1
mov byte [esp + 0x23], cl
mov byte [esp + 0x25], cl
call fcn.10001270
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1004309b
add esp, 0x24
ret
cmp dword [0x1007c60c], 0
je 0x10007ba4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x10079920]
add ecx, 0xc8
cmp ecx, eax
jae 0x10007ba4
push 0xc7e6
mov dword [0x10079920], eax
call fcn.10034820
cmp eax, 3
jbe 0x10007b88
jmp 0x100079c0
mov edx, dword [0x10079884]
push 0x10057c84
push edx
mov dword [0x1007c60c], 0
call dword [sym.imp.USER32.dll_SetWindowTextA]
ret

Function at 0x10007a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x100782d8]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x72
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov dl, 0x5f
mov byte [esp + 0x1b], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x20], al
mov byte [esp + 0xc], cl
mov byte [esp + 0x12], cl
mov cl, 0x65
push 0x21
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x46
mov byte [esp + 0xf], 0x4d
mov byte [esp + 0x10], 0x5a
mov byte [esp + 0x11], dl
mov byte [esp + 0x12], 0x43
mov byte [esp + 0x13], 0x68
mov byte [esp + 0x15], 0x69
mov byte [esp + 0x16], 0x73
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], 0x54
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], dl
mov byte [esp + 0x1e], 0x4d
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x61
mov byte [esp + 0x22], 0x6c
mov byte [esp + 0x24], 1
mov byte [esp + 0x25], 0x31
mov byte [esp + 0x27], 0x30
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1004309b
add esp, 0x28
ret