joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a5c0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push 0
mov eax, dword [ebp + 8]
push eax
push 0x41422c
call fcn.00412f70
add esp, 0xc
test eax, eax
jne 0x40a618
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0x4141fc
call fcn.00412ed0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40a616
mov edx, dword [ebp - 0xc]
push edx
call fcn.00409720
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.00412e30
add esp, 4
jmp 0x40a5e0
jmp 0x40a5c9
push 0x10000
call fcn.00412e00
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40a7af
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 0x403bc8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea ecx, [ebp - 0x26c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x40a714
mov eax, dword [ebp - 0x26c]
and eax, 0x10
je 0x40a6ec
mov dword [ebp - 8], 0
jmp 0x40a68a
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x22
jae 0x40a6b2
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x414130]
push eax
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x40a6b0
jmp 0x40a6ec
jmp 0x40a681
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 0x403bd0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040a5c0
add esp, 4
lea edx, [ebp - 0x26c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x40a66d
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
jmp 0x40a7a3
cmp dword [0x41425c], 0
je 0x40a7a3
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00412e00
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0x403bd4
call fcn.00404cb0
add esp, 0xc
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00412e30
add esp, 4
mov edx, dword [ebp - 4]
push edx
call fcn.00412e30
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x40a8b0
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], 0x4000
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x13
push 0
push 2
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x40a97c
mov edx, dword [ebp - 8]
push edx
call fcn.00412e00
add esp, 4
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x40a973
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x40a967
mov dword [ebp - 4], 0
jmp 0x40a91f
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jae 0x40a965
mov eax, dword [ebp - 4]
shl eax, 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0xc]
and edx, 2
je 0x40a94d
mov eax, dword [ebp - 4]
shl eax, 5
add eax, dword [ebp + 8]
push eax
call fcn.0040a8b0
add esp, 4
jmp 0x40a963
mov ecx, dword [ebp - 4]
shl ecx, 5
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x14]
push eax
call fcn.0040a5c0
add esp, 4
jmp 0x40a916
jmp 0x40a8f4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00412e30
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
call sub.MPR.dll_WNetCloseEnum
mov esp, ebp
pop ebp
ret

Function at 0x40a980
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call sub.NETAPI32.dll_NetShareEnum
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40a9d1
cmp dword [ebp - 0xc], 0xea
jne 0x40aa9e
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 1
jmp 0x40a9e9
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x10]
ja 0x40aa95
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x40aa0a
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0x80000000
jne 0x40aa87
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 2
jle 0x40aa87
push 0x403bec
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
je 0x40aa87
push 0x403bfc
lea edx, [ebp - 0xe4]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xe4]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push 0x403c04
lea edx, [ebp - 0xe4]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0xe4]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0xe4]
push eax
call fcn.0040a5c0
add esp, 4
mov ecx, dword [ebp - 4]
add ecx, 0xc
mov dword [ebp - 4], ecx
jmp 0x40a9e0
mov edx, dword [ebp - 0x14]
push edx
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0xc], 0xea
je 0x40a99e
mov esp, ebp
pop ebp
ret
Function at 0x40aab0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0xe
call fcn.00412e00
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ab8d
push 0x403c08
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 0x403c14
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
mov edx, 2
shl edx, 2
mov eax, dword [ebp - 4]
mov cx, word [ebp + 8]
mov word [eax + edx], cx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40ab81
cmp dword [ebp - 0xc], 5
je 0x40ab81
cmp dword [ebp - 0xc], 4
je 0x40ab2e
mov eax, dword [ebp - 4]
push eax
call fcn.0040a5c0
add esp, 4
jmp 0x40ab81
mov dword [ebp - 0x10], 0x104
mov ecx, dword [ebp - 0x10]
shl ecx, 1
push ecx
call fcn.00412e00
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40ab81
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, 2
shl ecx, 2
add ecx, dword [ebp - 4]
push ecx
call sub.MPR.dll_WNetGetConnectionW
test eax, eax
jne 0x40ab81
mov edx, dword [ebp - 8]
push edx
call fcn.0040a5c0
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.00412e30
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.00412e30
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x65300031
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x37861c2b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x10476058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104761a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1047607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1047606a
add dl, dl
jne 0x10476089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104760dc
xor eax, eax
add dl, dl
jne 0x10476096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1047617d
add dl, dl
jne 0x104760a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104760b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104760bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104760c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104760d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10476075
mov eax, 1
add dl, dl
jne 0x104760ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104760f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104760e1
sub eax, ebx
mov ebx, 1
jne 0x10476128
mov ecx, 1
add dl, dl
jne 0x1047610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10476119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10476105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10476075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1047613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1047614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10476136
cmp eax, 0x7d00
jae 0x1047616d
cmp eax, 0x500
jb 0x10476168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10476075
cmp eax, 0x7f
ja 0x10476170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10476075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1047619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10476075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x100094f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10009549
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10009549
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000953a
cmp esi, edx
jae 0x10009549
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10009528
cmp esi, edx
jae 0x10009549
cmp word [esi], 0
je 0x10009549
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1000adb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100bf8b0
mov dword [ebp - 0x10c], 0x740068
lea esi, [ebp - 0x10c]
mov dword [ebp - 0x108], 0x700074
push edi
mov dword [ebp - 0x104], 0x2f003a
mov edx, 0x84
mov dword [ebp - 0x100], 0x73002f
sub esi, eax
mov dword [ebp - 0xfc], 0x2e0073
mov dword [ebp - 0xf8], 0x610068
mov dword [ebp - 0xf4], 0x6f006c
mov dword [ebp - 0xf0], 0x610070
mov dword [ebp - 0xec], 0x650070
mov dword [ebp - 0xe8], 0x2e0072
mov dword [ebp - 0xe4], 0x6e0063
mov dword [ebp - 0xe0], 0x64002f
mov dword [ebp - 0xdc], 0x74006f
mov dword [ebp - 0xd8], 0x70003f
mov dword [ebp - 0xd4], 0x790074
mov dword [ebp - 0xd0], 0x650070
mov dword [ebp - 0xcc], 0x68003d
mov dword [ebp - 0xc8], 0x6c0061
mov dword [ebp - 0xc4], 0x77006f
mov dword [ebp - 0xc0], 0x260070
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop
lea ecx, [edx + 0x7fffff7a]
test ecx, ecx
je 0x1000b02e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000b02e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000b010
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100395fd
mov esp, ebp
pop ebp
ret
Function at 0x1000b130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100c0148
mov dword [ebp - 0x10c], 0x740068
lea esi, [ebp - 0x10c]
mov dword [ebp - 0x108], 0x700074
push edi
mov dword [ebp - 0x104], 0x2f003a
mov edx, 0x84
mov dword [ebp - 0x100], 0x73002f
sub esi, eax
mov dword [ebp - 0xfc], 0x2e0073
mov dword [ebp - 0xf8], 0x610068
mov dword [ebp - 0xf4], 0x6f006c
mov dword [ebp - 0xf0], 0x650070
mov dword [ebp - 0xec], 0x2e0074
mov dword [ebp - 0xe8], 0x6e0063
mov dword [ebp - 0xe4], 0x64002f
mov dword [ebp - 0xe0], 0x74006f
mov dword [ebp - 0xdc], 0x70003f
mov dword [ebp - 0xd8], 0x790074
mov dword [ebp - 0xd4], 0x650070
mov dword [ebp - 0xd0], 0x68003d
mov dword [ebp - 0xcc], 0x6c0061
mov dword [ebp - 0xc8], 0x70006f
mov dword [ebp - 0xc4], 0x740065
mov dword [ebp - 0xc0], 0x260073
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop
lea ecx, [edx + 0x7fffff7a]
test ecx, ecx
je 0x1000b3ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000b3ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000b390
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100395fd
mov esp, ebp
pop ebp
ret
Function at 0x1000b4b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x114], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x114]
mov eax, 0x100c0280
mov dword [ebp - 0x110], 0x700074
push edi
mov dword [ebp - 0x10c], 0x2f003a
mov edx, 0x87
mov dword [ebp - 0x108], 0x73002f
sub esi, eax
mov dword [ebp - 0x104], 0x2e0073
mov dword [ebp - 0x100], 0x6f006c
mov dword [ebp - 0xfc], 0x650076
mov dword [ebp - 0xf8], 0x770032
mov dword [ebp - 0xf4], 0x72006f
mov dword [ebp - 0xf0], 0x2e006b
mov dword [ebp - 0xec], 0x6e0063
mov dword [ebp - 0xe8], 0x64002f
mov dword [ebp - 0xe4], 0x74006f
mov dword [ebp - 0xe0], 0x70003f
mov dword [ebp - 0xdc], 0x790074
mov dword [ebp - 0xd8], 0x650070
mov dword [ebp - 0xd4], 0x61003d
mov dword [ebp - 0xd0], 0x730069
mov dword [ebp - 0xcc], 0x610068
mov dword [ebp - 0xc8], 0x67006e
mov dword [ebp - 0xc4], 0x700077
mov dword [ebp - 0xc0], 0x700026
mov dword [ebp - 0xbc], 0x640069
mov dword [ebp - 0xb8], 0x7b003d
mov dword [ebp - 0xb4], 0x690070
mov dword [ebp - 0xb0], 0x7d0064
mov dword [ebp - 0xac], 0x6d0026
mov dword [ebp - 0xa8], 0x640069
mov dword [ebp - 0xa4], 0x7b003d
mov dword [ebp - 0xa0], 0x69006d
mov dword [ebp - 0x9c], 0x7d0064
mov dword [ebp - 0x98], 0x6d0026
mov dword [ebp - 0x94], 0x640069
mov dword [ebp - 0x90], 0x3d0032
mov dword [ebp - 0x8c], 0x6d007b
mov dword [ebp - 0x88], 0x640069
mov dword [ebp - 0x84], 0x7d0032
mov dword [ebp - 0x80], 0x610026
mov dword [ebp - 0x7c], 0x700070
mov dword [ebp - 0x78], 0x650076
mov dword [ebp - 0x74], 0x3d0072
mov dword [ebp - 0x70], 0x61007b
mov dword [ebp - 0x6c], 0x700070
mov dword [ebp - 0x68], 0x650076
mov dword [ebp - 0x64], 0x7d0072
mov dword [ebp - 0x60], 0x6d0026
mov dword [ebp - 0x5c], 0x64006f
mov dword [ebp - 0x58], 0x650076
mov dword [ebp - 0x54], 0x3d0072
mov dword [ebp - 0x50], 0x6d007b
mov dword [ebp - 0x4c], 0x64006f
mov dword [ebp - 0x48], 0x650076
mov dword [ebp - 0x44], 0x7d0072
mov dword [ebp - 0x40], 0x740026
mov dword [ebp - 0x3c], 0x700079
mov dword [ebp - 0x38], 0x3d0065
mov dword [ebp - 0x34], 0x74007b
mov dword [ebp - 0x30], 0x700079
mov dword [ebp - 0x2c], 0x7d0065
mov dword [ebp - 0x28], 0x610026
mov dword [ebp - 0x24], 0x740063
mov dword [ebp - 0x20], 0x6f0069
mov dword [ebp - 0x1c], 0x3d006e
mov dword [ebp - 0x18], 0x61007b
mov dword [ebp - 0x14], 0x740063
mov dword [ebp - 0x10], 0x6f0069
mov dword [ebp - 0xc], 0x7d006e
lea ecx, [edx + 0x7fffff77]
test ecx, ecx
je 0x1000b740
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000b740
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000b722
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100395fd
mov esp, ebp
pop ebp
ret
Function at 0x1000ba00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100bf660
mov dword [ebp - 0xf8], 0x740068
lea esi, [ebp - 0xf8]
mov dword [ebp - 0xf4], 0x700074
push edi
mov dword [ebp - 0xf0], 0x2f003a
mov edx, 0x7a
mov dword [ebp - 0xec], 0x73002f
sub esi, eax
mov dword [ebp - 0xe8], 0x2e0073
mov dword [ebp - 0xe4], 0x680073
mov dword [ebp - 0xe0], 0x6e0061
mov dword [ebp - 0xdc], 0x750068
mov dword [ebp - 0xd8], 0x650074
mov dword [ebp - 0xd4], 0x680063
mov dword [ebp - 0xd0], 0x63002e
mov dword [ebp - 0xcc], 0x2f006e
mov dword [ebp - 0xc8], 0x690062
mov dword [ebp - 0xc4], 0x68007a
mov dword [ebp - 0xc0], 0x3f0069
mov dword [ebp - 0xbc], 0x690070
mov dword [ebp - 0xb8], 0x3d0064
mov dword [ebp - 0xb4], 0x70007b
mov dword [ebp - 0xb0], 0x640069
mov dword [ebp - 0xac], 0x26007d
mov dword [ebp - 0xa8], 0x69006d
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x6d007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x69006d
mov dword [ebp - 0x90], 0x320064
mov dword [ebp - 0x8c], 0x7b003d
mov dword [ebp - 0x88], 0x69006d
mov dword [ebp - 0x84], 0x320064
mov dword [ebp - 0x80], 0x26007d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x760070
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x7b003d
mov dword [ebp - 0x6c], 0x700061
mov dword [ebp - 0x68], 0x760070
mov dword [ebp - 0x64], 0x720065
mov dword [ebp - 0x60], 0x26007d
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x760064
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x7b003d
mov dword [ebp - 0x4c], 0x6f006d
mov dword [ebp - 0x48], 0x760064
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x26007d
mov dword [ebp - 0x3c], 0x790074
mov dword [ebp - 0x38], 0x650070
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x790074
mov dword [ebp - 0x2c], 0x650070
mov dword [ebp - 0x28], 0x26007d
mov dword [ebp - 0x24], 0x630061
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x630061
mov dword [ebp - 0x10], 0x690074
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], 0x7d
nop dword [eax]
lea ecx, [edx + 0x7fffff84]
test ecx, ecx
je 0x1000bc4e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000bc4e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000bc30
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100395fd
mov esp, ebp
pop ebp
ret