joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459df8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x459e0f
add esp, 0xfffffff0
call fcn.004047b0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041baac
mov eax, dword [0x46aaa0]
cmp word [eax + 2], 0
jne 0x459e37
mov eax, dword [0x46aaa0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b8c0
mov eax, dword [0x46ab54]
cmp word [eax + 2], 0
jne 0x459e51
mov eax, dword [0x46ab54]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045bacc
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412f6c]
call fcn.0040445c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412f6c]
call fcn.0040445c
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x412f6c]
call fcn.0040445c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x420214]
call fcn.00427840
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x45a008
mov eax, dword [0x46a9b4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00427c14
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45c19c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46a9b4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d8fc
test eax, eax
je 0x459f58
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004099a4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d930
test eax, eax
je 0x459f6c
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00405528
mov byte [ebx + 0xd4], 0
push ebx
push 0x45b408
call fcn.0041cc28
mov dword [ebx + 0xc8], eax
mov eax, dword [0x46a898]
cmp byte [eax], 0
jne 0x459fbd
mov eax, ebx
call fcn.0045a14c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045c378
mov eax, ebx
call fcn.0045ced8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x459ffd
call fcn.00404808
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a3cc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46e5b0]
cmp dword [eax + 0x30], 0
je 0x45a476
cmp dword [ebx + 0x94], 0
jne 0x45a470
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45a35c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45a470
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45a436
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45a470
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004154a4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45a445
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45b190
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45b1c5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004053a8
jmp 0x45b1d2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040530c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45c55c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45c5ca
mov eax, esi
call fcn.00446ce8
test al, al
je 0x45c5ca
mov eax, dword [ebx + 0x84]
call fcn.00446948
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45c5ca
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45c5be
push 0
mov eax, dword [ebx + 0x84]
call fcn.00446948
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043ec64
jmp 0x45c5ca
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045c398
pop esi
pop ebx
ret
Function at 0x408898
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42b7a4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x4088b5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x4088e3
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4088be
mov dword [ecx*4 + 0x42b7a0], eax
inc ecx
cmp ecx, 0x100
jne 0x4088b7
jmp 0x4088a9
cmp edx, ebx
je 0x4088fc
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x42b7a0]
jmp 0x4088e3
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401533
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401dc7
sub eax, fcn.00401592
push eax
push fcn.00401592
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107a
mov eax, ebx
lea edx, [ebp - 2]
call fcn.00401461
mov eax, ebx
lea ecx, [ebx + 0x1b600]
call fcn.004014b3
mov esi, ecx
mov eax, ebx
or si, 1
cdq
idiv esi
lea edx, [eax + ecx]
mov eax, ebx
lea ebx, [ebp - 2]
or eax, 0x402054
call fcn.00401592
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401533
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ecx
push edx
enter 0x11c, 0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret
Function at 0x10001700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x15
mov byte [ebp - 0x28], 0xe0
mov byte [ebp - 0x27], 0xa8
mov byte [ebp - 0x26], 0xf8
mov byte [ebp - 0x25], 0x17
mov byte [ebp - 0x24], 0x78
mov byte [ebp - 0x23], 0x71
mov byte [ebp - 0x22], 0x64
mov byte [ebp - 0x21], 0x68
mov byte [ebp - 0x20], 0xb1
mov byte [ebp - 0x1f], 0xf1
mov byte [ebp - 0x1e], 0xa6
mov byte [ebp - 0x1d], 0x23
mov byte [ebp - 0x1c], 0x41
mov byte [ebp - 0x1b], 0x54
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x40
mov byte [ebp - 0x18], 0x9e
mov byte [ebp - 0x17], 0xd7
mov byte [ebp - 0x16], 0x91
mov byte [ebp - 0x15], 0x39
mov byte [ebp - 0x14], 1
mov eax, dword [0x1021b8d0]
and eax, 1
jne 0x100017fc
mov ecx, dword [0x1021b8d0]
or ecx, 1
mov dword [0x1021b8d0], ecx
mov byte [0x1021b8cd], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x100017a6
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x100017ef
jb 0x100017b4
cmp dword [ebp - 0x10], 0x15
jae 0x100017ef
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100409b0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x28]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100409b0
mov cl, byte [edi + esi]
mov byte [eax + 0x1021b8b8], cl
jmp 0x10001794
push 0x10051dc0
call fcn.10040990
add esp, 4
mov eax, 0x1021b8b8
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xc
mov byte [ebp - 0x1c], 0x42
mov byte [ebp - 0x1b], 0x33
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x12
mov byte [ebp - 0x18], 0x60
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x15], 0x2f
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0x37
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0x11], 0x65
mov eax, dword [0x1021ba34]
and eax, 1
jne 0x10001ba8
mov ecx, dword [0x1021ba34]
or ecx, 1
mov dword [0x1021ba34], ecx
mov byte [0x1021ba30], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10001b52
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10001b9b
jb 0x10001b60
cmp dword [ebp - 0x10], 0xc
jae 0x10001b9b
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100409b0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100409b0
mov cl, byte [edi + esi]
mov byte [eax + 0x1021ba24], cl
jmp 0x10001b40
push 0x10051f00
call fcn.10040990
add esp, 4
mov eax, 0x1021ba24
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xc
mov byte [ebp - 0x1c], 0xf2
mov byte [ebp - 0x1b], 0x4b
mov byte [ebp - 0x1a], 0x71
mov byte [ebp - 0x19], 0x12
mov byte [ebp - 0x18], 0x60
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x15], 0x2f
mov byte [ebp - 0x14], 0xc5
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0x12], 0x71
mov byte [ebp - 0x11], 0x65
mov eax, dword [0x1021ba48]
and eax, 1
jne 0x10001e18
mov ecx, dword [0x1021ba48]
or ecx, 1
mov dword [0x1021ba48], ecx
mov byte [0x1021ba44], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10001dc2
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10001e0b
jb 0x10001dd0
cmp dword [ebp - 0x10], 0xc
jae 0x10001e0b
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100409b0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100409b0
mov cl, byte [edi + esi]
mov byte [eax + 0x1021ba38], cl
jmp 0x10001db0
push 0x10051f50
call fcn.10040990
add esp, 4
mov eax, 0x1021ba38
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10002900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xd
mov byte [ebp - 0x20], 0x3e
mov byte [ebp - 0x1f], 0x2d
mov byte [ebp - 0x1e], 0x62
mov byte [ebp - 0x1d], 4
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x55
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0xf
mov byte [ebp - 0x17], 0x3a
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x15], 1
mov byte [ebp - 0x14], 1
mov eax, dword [0x1021badc]
and eax, 1
jne 0x100029dc
mov ecx, dword [0x1021badc]
or ecx, 1
mov dword [0x1021badc], ecx
mov byte [0x1021bad9], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10002986
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x100029cf
jb 0x10002994
cmp dword [ebp - 0x10], 0xd
jae 0x100029cf
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100409b0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x20]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100409b0
mov cl, byte [edi + esi]
mov byte [eax + 0x1021bacc], cl
jmp 0x10002974
push 0x10052180
call fcn.10040990
add esp, 4
mov eax, 0x1021bacc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x13
mov byte [ebp - 0x24], 4
mov byte [ebp - 0x23], 0xf8
mov byte [ebp - 0x22], 0xe
mov byte [ebp - 0x21], 0x17
mov byte [ebp - 0x20], 0x6e
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x67
mov byte [ebp - 0x1c], 0x3d
mov byte [ebp - 0x1b], 0xbc
mov byte [ebp - 0x1a], 0x3a
mov byte [ebp - 0x19], 0x2b
mov byte [ebp - 0x18], 0x52
mov byte [ebp - 0x17], 0x2e
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x67
mov byte [ebp - 0x13], 0xa1
mov byte [ebp - 0x12], 0x6d
mov eax, dword [0x1021bac8]
and eax, 1
jne 0x10002d94
mov ecx, dword [0x1021bac8]
or ecx, 1
mov dword [0x1021bac8], ecx
mov byte [0x1021bac7], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10002d3e
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10002d87
jb 0x10002d4c
cmp dword [ebp - 0x10], 0x13
jae 0x10002d87
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100409b0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x24]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100409b0
mov cl, byte [edi + esi]
mov byte [eax + 0x1021bab4], cl
jmp 0x10002d2c
push 0x10052220
call fcn.10040990
add esp, 4
mov eax, 0x1021bab4
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10002eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xc
mov byte [ebp - 0x1c], 0x96
mov byte [ebp - 0x1b], 0x3e
mov byte [ebp - 0x1a], 0x4a
mov byte [ebp - 0x19], 7
mov byte [ebp - 0x18], 0x60
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], 0x2f
mov byte [ebp - 0x14], 0x91
mov byte [ebp - 0x13], 0x3d
mov byte [ebp - 0x12], 0x4b
mov byte [ebp - 0x11], 0x65
mov eax, dword [0x1021bab0]
and eax, 1
jne 0x10002f88
mov ecx, dword [0x1021bab0]
or ecx, 1
mov dword [0x1021bab0], ecx
mov byte [0x1021baac], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10002f32
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10002f7b
jb 0x10002f40
cmp dword [ebp - 0x10], 0xc
jae 0x10002f7b
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100409b0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100409b0
mov cl, byte [edi + esi]
mov byte [eax + 0x1021baa0], cl
jmp 0x10002f20
push 0x10052270
call fcn.10040990
add esp, 4
mov eax, 0x1021baa0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xc
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0x2e
mov byte [ebp - 0x1a], 0x11
mov byte [ebp - 0x19], 0xc
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x2f
mov byte [ebp - 0x14], 0x33
mov byte [ebp - 0x13], 0x2b
mov byte [ebp - 0x12], 0x13
mov byte [ebp - 0x11], 0x65
mov eax, dword [0x1021b97c]
and eax, 1
jne 0x10003668
mov ecx, dword [0x1021b97c]
or ecx, 1
mov dword [0x1021b97c], ecx
mov byte [0x1021b978], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10003612
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x1000365b
jb 0x10003620
cmp dword [ebp - 0x10], 0xc
jae 0x1000365b
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100409b0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100409b0
mov cl, byte [edi + esi]
mov byte [eax + 0x1021b96c], cl
jmp 0x10003600
push 0x10052360
call fcn.10040990
add esp, 4
mov eax, 0x1021b96c
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x10
mov byte [ebp - 0x20], 0x7f
mov byte [ebp - 0x1f], 0x1d
mov byte [ebp - 0x1e], 0xa9
mov byte [ebp - 0x1d], 0x22
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x6d
mov byte [ebp - 0x1a], 0x6e
mov byte [ebp - 0x19], 0x62
mov byte [ebp - 0x18], 0x4c
mov byte [ebp - 0x17], 0x1d
mov byte [ebp - 0x16], 0xa0
mov byte [ebp - 0x15], 0x2b
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0x13], 0x60
mov byte [ebp - 0x12], 0x71
mov byte [ebp - 0x11], 1
mov eax, dword [0x1021b8b4]
and eax, 1
jne 0x10003768
mov ecx, dword [0x1021b8b4]
or ecx, 1
mov dword [0x1021b8b4], ecx
mov byte [0x1021b8b0], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10003712
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x1000375b
jb 0x10003720
cmp dword [ebp - 0x10], 0x10
jae 0x1000375b
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100409b0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x20]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100409b0
mov cl, byte [edi + esi]
mov byte [eax + 0x1021b8a0], cl
jmp 0x10003700
push 0x100523b0
call fcn.10040990
add esp, 4
mov eax, 0x1021b8a0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xb
mov byte [ebp - 0x1c], 0xe8
mov byte [ebp - 0x1b], 0x5c
mov byte [ebp - 0x1a], 0x24
mov byte [ebp - 0x19], 0x37
mov byte [ebp - 0x18], 0x32
mov byte [ebp - 0x17], 0x33
mov byte [ebp - 0x16], 0x2f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0xd1
mov byte [ebp - 0x13], 0x63
mov byte [ebp - 0x12], 0x61
mov eax, dword [0x1021b9a0]
and eax, 1
jne 0x10003e94
mov ecx, dword [0x1021b9a0]
or ecx, 1
mov dword [0x1021b9a0], ecx
mov byte [0x1021b99f], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x10003e3e
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10003e87
jb 0x10003e4c
cmp dword [ebp - 0x10], 0xb
jae 0x10003e87
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100409b0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x1c]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100409b0
mov cl, byte [edi + esi]
mov byte [eax + 0x1021b994], cl
jmp 0x10003e2c
push 0x10052450
call fcn.10040990
add esp, 4
mov eax, 0x1021b994
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100041b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x12
mov byte [ebp - 0x24], 0x15
mov byte [ebp - 0x23], 0xd9
mov byte [ebp - 0x22], 0xb9
mov byte [ebp - 0x21], 0x31
mov byte [ebp - 0x20], 0x64
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x68
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0xd0
mov byte [ebp - 0x1a], 0xa7
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x77
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0x23
mov byte [ebp - 0x13], 0xb5
mov eax, dword [0x1021b8e8]
and eax, 1
jne 0x100042a0
mov ecx, dword [0x1021b8e8]
or ecx, 1
mov dword [0x1021b8e8], ecx
mov byte [0x1021b8e6], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x1000424a
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10004293
jb 0x10004258
cmp dword [ebp - 0x10], 0x12
jae 0x10004293
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100409b0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x24]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100409b0
mov cl, byte [edi + esi]
mov byte [eax + 0x1021b8d4], cl
jmp 0x10004238
push 0x10052540
call fcn.10040990
add esp, 4
mov eax, 0x1021b8d4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x26
mov byte [ebp - 0x38], 0xdd
mov byte [ebp - 0x37], 0xa9
mov byte [ebp - 0x36], 0xa7
mov byte [ebp - 0x35], 0x13
mov byte [ebp - 0x34], 0x72
mov byte [ebp - 0x33], 0x3b
mov byte [ebp - 0x32], 0x2e
mov byte [ebp - 0x31], 0x2e
mov byte [ebp - 0x30], 0xd1
mov byte [ebp - 0x2f], 0xa8
mov byte [ebp - 0x2e], 0xbe
mov byte [ebp - 0x2d], 0xa
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x2b], 0x66
mov byte [ebp - 0x2a], 0x60
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x9b
mov byte [ebp - 0x27], 0xbe
mov byte [ebp - 0x26], 0xbc
mov byte [ebp - 0x25], 0xe
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0xc7
mov byte [ebp - 0x1f], 0xbc
mov byte [ebp - 0x1e], 0xb0
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x18], 0x9b
mov byte [ebp - 0x17], 0xbc
mov byte [ebp - 0x16], 0xa0
mov byte [ebp - 0x15], 0x13
mov byte [ebp - 0x14], 0x79
mov byte [ebp - 0x13], 1
mov eax, dword [0x1021b914]
and eax, 1
jne 0x10004560
mov ecx, dword [0x1021b914]
or ecx, 1
mov dword [0x1021b914], ecx
mov byte [0x1021b912], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jmp 0x1000450a
mov edx, dword [ebp - 0x10]
add edx, 1
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x10004553
jb 0x10004518
cmp dword [ebp - 0x10], 0x26
jae 0x10004553
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100409b0
mov esi, eax
mov eax, 1
imul ecx, eax, 0
lea edi, [ebp + ecx - 0x38]
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100409b0
mov cl, byte [edi + esi]
mov byte [eax + 0x1021b8ec], cl
jmp 0x100044f8
push 0x100525e0
call fcn.10040990
add esp, 4
mov eax, 0x1021b8ec
pop edi
pop esi
mov esp, ebp
pop ebp
ret