joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024746
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.100220b2
add esp, 0xc
lea ebx, [ebx]
test ecx, edi
jp 0x10024782
pushf
add edi, dword [esp]
sub edi, dword [esp]
jae 0x1002476f
popf
lea ebx, [ebx + 0x146e]
lea ebx, [ebx - 0x146e]
jge 0x1002477f
jnp 0x10024782
mov esi, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
call 0x100247bf
add esp, 4
ja 0x100247c9
lea edx, [edx]
jbe 0x100247c9
mov ecx, 0x80f44d8a
jmp 0x44fcfd3
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
std
cld
mov edx, edx
je 0x10024847
jmp 0x10024842
nop
jne 0x10024847
add eax, 0x33ae8fa
add byte [eax], al
call fcn.10024b86
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002485a
jmp 0x1002491c
stc
cmp esi, ebx
nop
cmc
jae 0x1002487b
pushf
not ebx
not ebx
cmp esp, 0x29e4
cmp esi, dword [esp]
lea esi, [esi]
popf
jbe 0x10024876
jne 0x10024878
jb 0x1002487b
mov ebp, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10043d83
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.100220b2
add esp, 0xc
cmp esp, 0xa66
cmp edi, 0xcc7
rol edx, 3
ror edx, 3
shl esp, 0
jb 0x100248c2
lea ecx, [ecx + 0x75b6]
lea ecx, [ecx - 0x75b6]
nop
jae 0x100248c2
add eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x100248ca
jmp 0x1002491c
neg ebx
neg ebx
rol ebx, 0x14
ror ebx, 0x14
jno 0x100248f2
pushf
lea ebx, [ebx + 0x1fbb]
sub ebx, 0x1fbb
nop
jns 0x100248e7
popf
mov esp, esp
jbe 0x100248ed
jno 0x100248ef
jo 0x100248f2
call 0x62fe9e81
mov edx, dword [ebp - 4]
push edx
call fcn.1003f812
add esp, 4
cmp esi, dword [esp]
xor ecx, edx
xor ecx, edx
jb 0x10024907
je 0x10024915
pushf
add esp, 0
popf
jb 0x10024912
jne 0x10024915
ljmp 0x55ff:0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100252b6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.100220b2
add esp, 0xc
js 0x100252d8
lea ecx, [ecx + 0x5485]
lea ecx, [ecx - 0x5485]
je 0x100252fd
pushf
cmp edi, 0xf58
shl esp, 0
jbe 0x100252f3
ror edx, 0
popf
je 0x100252fa
jne 0x100252fd
mov edi, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
xchg esi, esi
jo 0x100253bb
pushf
ja 0x100253ae
mov esi, esi
popf
lea ebx, [ebx]
js 0x100253b6
jo 0x100253b8
jno 0x100253bb
xor eax, 0xfff7c6e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 4], dh
call fcn.10024b86
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100253cd
xor eax, eax
jmp 0x1002544c
jae 0x100253cf
rol ebx, 6
ror ebx, 6
jo 0x100253e4
xchg ecx, ecx
jo 0x100253db
js 0x100253dd
xchg ecx, edi
xchg ecx, edi
jno 0x100253e4
jmp 0x62eaa975
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10043d83
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.100220b2
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1002540e
xor eax, eax
jmp 0x1002544c
js 0x10025410
ja 0x1002541f
pushf
and esi, esi
jp 0x10025418
popf
jmp 0x1002541c
jbe 0x1002541f
mov ebx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.1003f812
add esp, 4
jno 0x1002542d
lea eax, [eax]
jnp 0x10025441
pushf
ror ecx, 0
popf
jge 0x1002543a
je 0x1002543c
jp 0x1002543e
jp 0x10025441
lcall 0x4d8b, 0x500c458b
or byte [ecx - 1], dl
push ebp
cld
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10025f1a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.100220b2
add esp, 0xc
inc ecx
dec ecx
ja 0x10025f37
cld
or esp, 0
je 0x10025f61
pushf
clc
or edx, edx
jge 0x10025f44
lea eax, [eax + 0x4ff8]
lea eax, [eax - 0x4ff8]
popf
lea edi, [edi + 0x19fc]
lea edi, [edi - 0x19fc]
jne 0x10025f61
mov edi, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
jle 0x10025fa3
je 0x10025fb7
pushf
jge 0x10025fa9
xor esp, 0
inc eax
dec eax
popf
jo 0x10025fb2
jl 0x10025fb4
jne 0x10025fb7
mov ebx, 0x80ec4d8a
jmp 0xfc4fe7c1
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.10041083
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002604e
xor eax, eax
jmp 0x100260d2
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.10043d83
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.100220b2
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x100260d0
ja 0x10026076
and esp, 0xffffffff
je 0x1002607b
js 0x1002608a
pushf
jb 0x10026081
mov edi, edi
popf
mov ebx, ebx
jns 0x1002608a
mov esi, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1003f812
add esp, 4
rol esi, 0xc
ror esi, 0xc
ror esp, 0
cmp esp, 0x31fa
jo 0x100260a7
jo 0x100260c7
pushf
add esp, 0
shr ecx, 0
nop
add esi, 0x2aa9
sub esi, 0x2aa9
popf
xchg ebx, edi
xchg ebx, edi
jno 0x100260c7
jmp 0x620ab656
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x100260d2
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100262c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x100146d8], 1
jne 0x10026432
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.100220b2
add esp, 0xc
and eax, 0xffffffff
js 0x10026301
pushf
jb 0x100262f8
jns 0x100262fa
popf
jg 0x100262fe
jns 0x10026301
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
not ecx
not ecx
jb 0x10026356
pushf
shr ecx, 0
clc
ja 0x1002633f
jo 0x10026341
popf
jno 0x10026345
lea ecx, [ecx + 0x2971]
lea ecx, [ecx - 0x2971]
ja 0x10026353
jae 0x10026356
add eax, 0x80e84d8a
jmp 0xf84feb60
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.10024b86
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100263cb
xor eax, eax
jmp 0x1002649d
test esi, 0x6199
rol esi, 0x1c
ror esi, 0x1c
jno 0x100263de
xchg esp, esp
jo 0x100263de
or dword [ebp - 0x74af17bb], 0xe851f44d
cwde
fld dword [ecx]
add byte [ecx + 0xc6af845], cl
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10043d83
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.100220b2
add esp, 0xc
cmp ecx, dword [esp]
jl 0x10026403
jne 0x10026405
jge 0x1002641c
jae 0x10026409
xchg esi, esi
lea ebx, [ebx + 0x275a]
lea ebx, [ebx - 0x275a]
je 0x10026419
jl 0x1002641c
add eax, 0xf87d83
cmp dword [ebp - 8], 0
je 0x1002642c
mov eax, dword [ebp - 8]
mov dword [0x100146d8], eax
jmp 0x10026430
xor eax, eax
jmp 0x1002649d
jmp 0x1002643b
mov ecx, dword [0x100146d8]
mov dword [ebp - 8], ecx
xor edx, dword [esp + 4]
xor edx, dword [esp + 4]
test dword [esp], esi
cmp eax, 0x4137
jne 0x1002645f
pushf
cmp esp, 0x745
shl edi, 0
popf
lea edi, [edi]
je 0x1002645f
call 0x99fab9ee
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
jnp 0x10026467
jge 0x10026469
jmp 0x1002646b
jl 0x1002646d
jbe 0x10026486
pushf
shr esp, 0
dec edx
inc edx
xor esp, 0
jl 0x1002647b
popf
mov esp, esp
xchg esp, esp
jae 0x10026483
ja 0x10026486
mov ecx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.1003f812
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100264a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.100220b2
add esp, 0xc
add edi, 0
js 0x100264dc
pushf
and esi, 0xffffffff
add ecx, dword [esp]
sub ecx, dword [esp]
push edi
pop edi
popf
ja 0x100264d5
mov edx, edx
jne 0x100264d9
jns 0x100264dc
mov ebp, 0x48f045c6
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
xchg esi, esi
jo 0x1002651a
lea esi, [esi + 0x19d8]
lea esi, [esi - 0x19d8]
jbe 0x10026516
jno 0x1002651a
jmp 0x4fefef
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.10041083
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002657a
xor eax, eax
jmp 0x100265f9
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.10043d83
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.100220b2
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x100265f7
call fcn.100265a5
xor eax, eax
Function at 0x10026a6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.100220b2
add esp, 0xc
jne 0x10026a87
mov esp, esp
jb 0x10026aa6
pushf
shr esp, 0
lea ebx, [ebx + 0x723d]
lea ebx, [ebx - 0x723d]
popf
jns 0x10026aa0
lea esp, [esp]
jae 0x10026aa6
call 0x58eeb070
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
test dword [esp], ebx
nop
add esp, 0
jg 0x10026af8
jne 0x10026af1
jno 0x10026af3
jne 0x10026af5
jle 0x10026af8
lcall 0x1e9, 0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.10024b86
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10026b8f
xor eax, eax
jmp 0x10026c65
jne 0x10026b91
xchg edi, ebx
xchg edi, ebx
ja 0x10026ba8
pushf
add edx, dword [esp]
sub edx, dword [esp]
popf
jae 0x10026ba3
jp 0x10026ba5
jbe 0x10026ba8
mov ebx, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.10043d83
mov dword [ebp - 0x18], eax
jns 0x10026bba
call fcn.10026bbf
Function at 0x1002e2ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.100220b2
add esp, 0xc
cmp esp, 0x2d33
jns 0x1002e2dc
pushf
push esi
pop esi
mov esp, esp
popf
jne 0x1002e2d7
jle 0x1002e2d9
js 0x1002e2dc
add eax, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
xor esi, ebx
xor esi, ebx
rol eax, 0
nop
jg 0x1002e32e
mov esi, esi
jbe 0x1002e326
xchg ecx, ebx
xchg ecx, ebx
jle 0x1002e32e
mov edi, 0xec4d8acd
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.10024b86
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002e3bb
jmp 0x1002e440
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10043d83
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.100220b2
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x1002e440
mov ecx, ecx
mov esp, esp
xchg ebx, eax
xchg ebx, eax
jo 0x1002e400
pushf
lea edx, [edx]
popf
lea eax, [eax + 0x16ab]
lea eax, [eax - 0x16ab]
je 0x1002e3fd
jno 0x1002e400
mov ecx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.1003f812
add esp, 4
xchg esp, esp
add esp, 0
jge 0x1002e42d
pushf
xor edx, 0xb0b
xor edx, 0xb0b
lea eax, [eax]
popf
xchg edx, edx
lea esp, [esp]
jl 0x1002e42d
mov ebx, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002f7e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.100220b2
add esp, 0xc
lea esi, [esi + 0x23d7]
sub esi, 0x23d7
test eax, 0x7e2c
ror ecx, 0xd
rol ecx, 0xd
jl 0x1002f821
jle 0x1002f81c
js 0x1002f81e
jge 0x1002f821
mov ebx, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
call fcn.1002f872
Function at 0x1002f9e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.100220b2
add esp, 0xc
rol esp, 0
jns 0x1002fa1f
pushf
lea edx, [edx + 0x425c]
lea edx, [edx - 0x425c]
or esi, esi
jb 0x1002fa16
popf
jns 0x1002fa1a
jle 0x1002fa1c
js 0x1002fa1f
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
xor esp, 0
nop
cmc
jnp 0x1002fa76
pushf
and esi, 0xffffffff
lea ebx, [ebx + 0x7fa6]
sub ebx, 0x7fa6
mov esp, esp
popf
jg 0x1002fa71
jge 0x1002fa73
jp 0x1002fa76
mov eax, 0x80e84d8a
jmp 0xf8508280
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
cmp edx, 0x3c28
jns 0x1002faee
xchg ecx, ecx
ja 0x1002faea
js 0x1002faee
lcall 0xffff, 0x5093e85d
call fcn.10024b86
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002fb03
xor eax, eax
jmp 0x1002fbad
mov esp, esp
test dword [esp + 0x10], eax
xchg edi, edi
ror esi, 0
jbe 0x1002fb15
mov esp, esp
ja 0x1002fb15
mov edx, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.10043d83
mov dword [ebp - 4], eax
jbe 0x1002fb27
jne 0x1002fb40
pushf
lea edi, [edi + 0x7da4]
lea edi, [edi - 0x7da4]
nop
cld
popf
jb 0x1002fb3d
je 0x1002fb40
add eax, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.100220b2
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1002fb5a
xor eax, eax
jmp 0x1002fbad
jb 0x1002fb5c
ror edx, 0
jae 0x1002fb6c
pushf
cmp edi, ebx
popf
ja 0x1002fb69
jb 0x1002fb6c
mov edi, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.1003f812
add esp, 4
xor ecx, 0x48bb
xor ecx, 0x48bb
not eax
not eax
or esp, 0
add esi, 0x9d5
sub esi, 0x9d5
jnp 0x1002fbaa
pushf
rol eax, 0
ror ecx, 0
popf
je 0x1002fba5
jnp 0x1002fba7
jp 0x1002fbaa
cmp edi, 0x5e5ffc55
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a6b5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.100220b2
add esp, 0xc
or esp, 0
jge 0x1003a6da
xchg edx, edx
xchg edx, eax
xchg edx, eax
jnp 0x1003a6eb
lea esp, [esp]
mov esi, esi
je 0x1003a6e7
jp 0x1003a6eb
mov edx, 0xf045c649
dec esi
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
and esp, 0xffffffff
jb 0x1003a72b
jo 0x1003a722
jb 0x1003a724
jge 0x1003a726
jmp 0x1003a728
jae 0x1003a72b
ljmp 0x1e9:0x80f04d8a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
inc esi
dec esi
or esp, 0
ror esp, 0
jmp 0x1003a795
je 0x1003a79f
js 0x1003a799
xchg esp, esp
jne 0x1003a79f
mov esi, 0x68dfe8a1
add byte [eax], al
call fcn.10041083
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003a7b1
xor eax, eax
jmp 0x1003a7f0
xor ebx, 0
clc
ja 0x1003a7cd
pushf
rol ecx, 0
test eax, 0x3c0f
and eax, 0xffffffff
lea ebx, [ebx]
popf
jae 0x1003a7ca
jbe 0x1003a7cd
ljmp 0x4d8b:0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10043d83
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.100220b2
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret