joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10111230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10162895
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x102b833e
call fcn.10124b2c
mov dword [ebp - 0x50], 0x437a0000
mov dword [ebp - 0x4c], 0xbf800000
mov dword [ebp - 0x18], 0x736e2323
mov word [ebp - 0x14], 0x31
push 0
push 0
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f370
mov dword [ebp - 0x18], 0x62616e45
mov word [ebp - 0x14], 0x656c
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 1
push 0x101eb2ac
push eax
call fcn.10107160
add esp, 0x18
mov ecx, 0xb1
xor edx, edx
mov al, byte [edx + 0x10199320]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x34], al
and ecx, 0x800000ff
jns 0x101112e2
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x1a
jl 0x101112c5
mov byte [ebp - 0x1a], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 2
push 0x101eb2b4
push eax
call fcn.10107160
add esp, 8
mov ecx, 0x74
xor edx, edx
nop dword [eax + eax]
mov al, byte [edx + 0x1019933c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x48], al
and ecx, 0x800000ff
jns 0x1011132d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x11
jl 0x10111310
mov byte [ebp - 0x37], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 3
push 0x101eb2b8
push eax
call fcn.10107160
mov dword [ebp - 4], 0xffffffff
call fcn.10012580
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
mov dword [ebp - 0x50], 0x437a0000
mov dword [ebp - 0x4c], 0xbf800000
mov dword [ebp - 0x18], 0x736e2323
mov word [ebp - 0x14], 0x32
push 0
push 0
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f370
movd xmm0, dword [0x101e6990]
add esp, 0x14
cvtdq2ps xmm0, xmm0
mov dword [ebp - 4], 0xffffffff
movss dword [esp], xmm0
call fcn.1001d440
add esp, 4
mov ecx, 0xf6
xor edx, edx
nop dword [eax + eax]
mov al, byte [edx + 0x10199358]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x2c], al
and ecx, 0x800000ff
jns 0x101113ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x12
jl 0x101113d0
mov byte [ebp - 0x1a], 0
push str._.0fs
sub esp, 8
mov dword [ebp - 4], 5
lea eax, [ebp - 0x2c]
mov dword [esp + 4], 0x41700000
mov dword [esp], 0x40000000
push 0x101eb2b0
push eax
call fcn.10107a60
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
mov word [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0x1a], 0
call fcn.1001cf40
call fcn.10012580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
Function at 0x10114080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10162de5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x102b8344
call fcn.10124b2c
mov dword [ebp - 0x20], 0x437a0000
mov dword [ebp - 0x1c], 0xbf800000
mov dword [ebp - 0x18], 0x66722323
mov word [ebp - 0x14], 0x316c
mov byte [ebp - 0x12], 0
push 0
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f370
mov dword [ebp - 0x18], 0x62616e45
mov word [ebp - 0x14], 0x656c
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 1
push 0x101eb294
push eax
call fcn.10107160
add esp, 0x18
mov ecx, 0xba
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x101999d8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x30], al
and ecx, 0x800000ff
jns 0x1011413d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x10114120
mov byte [ebp - 0x22], 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 2
push 0x101eb3c8
push eax
call fcn.10107160
mov dword [ebp - 0x2c], 0x6f747541
mov dword [ebp - 0x28], 0x6d754a20
mov word [ebp - 0x24], 0x70
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 3
push 0x101eb3c0
push eax
call fcn.10107160
mov dword [ebp - 4], 0xffffffff
call fcn.10012580
add esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
mov dword [ebp - 0x2c], 0x437a0000
mov dword [ebp - 0x28], 0xbf800000
mov dword [ebp - 0x20], 0x66722323
mov word [ebp - 0x1c], 0x326c
mov byte [ebp - 0x1a], 0
push 0
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1000f370
movd xmm0, dword [0x101e6990]
add esp, 0x14
cvtdq2ps xmm0, xmm0
mov dword [ebp - 4], 0xffffffff
movss dword [esp], xmm0
call fcn.1001d440
add esp, 4
mov dword [ebp - 0x18], 0x65657053
mov word [ebp - 0x14], 0x64
push 0x10168bf4
sub esp, 8
mov dword [ebp - 4], 5
lea eax, [ebp - 0x18]
mov dword [esp + 4], 0x42800000
mov dword [esp], 0x40000000
push 0x101eb298
push eax
call fcn.10107a60
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
call fcn.1001cf40
call fcn.10012580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
Function at 0x101145d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10162e45
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x102b834a
call fcn.10124b2c
mov dword [ebp - 0x30], 0x437a0000
mov dword [ebp - 0x2c], 0xbf800000
mov dword [ebp - 0x18], 0x64762323
mov word [ebp - 0x14], 0x31
push 0
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f370
mov dword [ebp - 0x18], 0x62616e45
mov word [ebp - 0x14], 0x656c
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 1
push 0x101eb7f8
push eax
call fcn.10107160
mov dword [ebp - 0x18], 0x776f6c47
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 2
push 0x101eb804
push eax
call fcn.10107160
mov dword [ebp - 4], 0xffffffff
call fcn.10012580
add esp, 0x18
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
mov dword [ebp - 0x30], 0x437a0000
mov dword [ebp - 0x2c], 0xbf800000
mov dword [ebp - 0x18], 0x64762323
mov word [ebp - 0x14], 0x32
push 0
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 3
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f370
movd xmm0, dword [0x101e6990]
add esp, 0x14
cvtdq2ps xmm0, xmm0
mov dword [ebp - 4], 0xffffffff
movss dword [esp], xmm0
call fcn.1001d440
add esp, 4
mov dword [ebp - 0x18], 0x79617453
mov word [ebp - 0x14], 0x73
push str._.0fs
sub esp, 8
mov dword [ebp - 4], 4
lea eax, [ebp - 0x18]
mov dword [esp + 4], 0x41000000
mov dword [esp], 0
push 0x101eb7fc
push eax
call fcn.10107a60
add esp, 0x14
mov ecx, 0xae
xor edx, edx
mov al, byte [edx + 0x10199ea0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x10114753
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x10114736
mov byte [ebp - 0x1c], 0
push 0x10168bf4
sub esp, 8
mov dword [ebp - 4], 5
lea eax, [ebp - 0x28]
mov dword [esp + 4], 0x43000000
mov dword [esp], 0
push 0x101eb800
push eax
call fcn.10107a60
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x28], xmm0
mov byte [ebp - 0x1c], 0
call fcn.1001cf40
call fcn.10012580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
Function at 0x10114e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10162f6d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x102b834a
call fcn.10124b2c
mov dword [ebp - 0x24], 0x437a0000
mov dword [ebp - 0x20], 0xbf800000
mov dword [ebp - 0x18], 0x726c2323
mov word [ebp - 0x14], 0x3170
mov byte [ebp - 0x12], 0
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f370
mov dword [ebp - 0x24], 0x77617244
mov dword [ebp - 0x20], 0x564f4620
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
push 0x101eb608
push eax
call fcn.10107160
mov dword [ebp - 0x28], 0x736f7243
mov dword [ebp - 0x24], 0x69616873
mov word [ebp - 0x20], 0x72
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push 0x101eb4e4
push eax
call fcn.10107160
add esp, 0x20
mov ecx, 0x4c
xor edx, edx
mov al, byte [edx + 0x10199d60]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x10114f20
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10114f03
mov byte [ebp - 0x1d], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 3
push 0x101eb560
push eax
call fcn.10107160
add esp, 8
mov ecx, 0xb2
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x10199d6c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x2c], al
and ecx, 0x800000ff
jns 0x10114f6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x10114f50
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 4
push 0x101ea2bc
push eax
call fcn.10107160
mov dword [ebp - 4], 0xffffffff
call fcn.10012580
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
mov dword [ebp - 0x24], 0x437a0000
mov dword [ebp - 0x20], 0xbf800000
mov dword [ebp - 0x18], 0x726c2323
mov word [ebp - 0x14], 0x3270
mov byte [ebp - 0x12], 0
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 5
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f370
movd xmm0, dword [0x101e6990]
add esp, 0x14
cvtdq2ps xmm0, xmm0
mov dword [ebp - 4], 0xffffffff
movss dword [esp], xmm0
call fcn.1001d440
add esp, 4
mov ecx, 0x80
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x10199d88]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x48], al
and ecx, 0x800000ff
jns 0x1011502d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x19
jl 0x10115010
mov byte [ebp - 0x2f], 0
push str._.2f
sub esp, 8
mov dword [ebp - 4], 6
lea eax, [ebp - 0x48]
mov dword [esp + 4], 0x40400000
mov dword [esp], 0x3dcccccd
push 0x101ea2c0
push eax
call fcn.10107a60
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
mov word [ebp - 0x30], 0
movups xmmword [ebp - 0x48], xmm0
movq qword [ebp - 0x38], xmm0
call fcn.1001cf40
call fcn.10012580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
Function at 0x10115750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101630dd
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x102b834a
call fcn.10124b2c
mov dword [ebp - 0x5c], 0x437a0000
mov dword [ebp - 0x58], 0xbf800000
mov dword [ebp - 0x18], 0x6f762323
mov word [ebp - 0x14], 0x31
push 0
push 0
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f370
add esp, 0x10
mov ecx, 0x6d
xor edx, edx
nop
mov al, byte [edx + 0x10199d04]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x54], al
and ecx, 0x800000ff
jns 0x101157dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x19
jl 0x101157c0
mov byte [ebp - 0x3b], 0
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 1
push 0x101eb4c0
push eax
call fcn.10107160
mov dword [ebp - 4], 0xffffffff
call fcn.10012580
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
mov dword [ebp - 0x5c], 0x437a0000
mov dword [ebp - 0x58], 0xbf800000
mov dword [ebp - 0x18], 0x6f762323
mov word [ebp - 0x14], 0x32
push 0
push 0
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f370
movd xmm0, dword [0x101e6990]
add esp, 0x14
cvtdq2ps xmm0, xmm0
mov dword [ebp - 4], 0xffffffff
movss dword [esp], xmm0
call fcn.1001d440
add esp, 4
mov ecx, 0x2c
xor edx, edx
nop dword [eax + eax]
mov al, byte [edx + str._D_J0__Q]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x38], al
and ecx, 0x800000ff
jns 0x1011589d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x10115880
mov byte [ebp - 0x25], 0
mov dword [ebp - 4], 3
mov dword [ebp - 0x24], 0x63617254
mov dword [ebp - 0x20], 0x79742065
mov word [ebp - 0x1c], 0x6570
mov byte [ebp - 0x1a], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x24]
push 0x101eb604
push eax
call fcn.10107750
add esp, 0x10
mov word [ebp - 0x1c], 0
xorps xmm0, xmm0
mov byte [ebp - 0x1a], 0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 4], 0xffffffff
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0
call fcn.1001cf40
call fcn.10012580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
Function at 0x101173c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10163565
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x102b834a
call fcn.10124b2c
mov dword [ebp - 0x20], 0x437a0000
mov dword [ebp - 0x1c], 0xbf800000
mov dword [ebp - 0x18], 0x70762323
mov word [ebp - 0x14], 0x3163
mov byte [ebp - 0x12], 0
push 0
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f370
add esp, 0x10
mov ecx, 0xe9
xor edx, edx
mov al, byte [edx + 0x10199b1c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x34], al
and ecx, 0x800000ff
jns 0x10117450
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x10117433
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 1
push 0x101eb470
push eax
call fcn.10107160
mov dword [ebp - 4], 0xffffffff
call fcn.10012580
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
mov dword [ebp - 0x2c], 0x437a0000
mov dword [ebp - 0x28], 0xbf800000
mov dword [ebp - 0x20], 0x70762323
mov word [ebp - 0x1c], 0x3263
mov byte [ebp - 0x1a], 0
push 0
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1000f370
movd xmm0, dword [0x101e6990]
add esp, 0x14
cvtdq2ps xmm0, xmm0
mov dword [ebp - 4], 0xffffffff
movss dword [esp], xmm0
call fcn.1001d440
add esp, 4
mov dword [ebp - 0x2c], 0x6d676553
mov dword [ebp - 0x28], 0x73746e65
mov byte [ebp - 0x24], 0
push 0x10168bf4
sub esp, 8
mov dword [ebp - 4], 3
lea eax, [ebp - 0x2c]
mov dword [esp + 4], 0x42c80000
mov dword [esp], 0x40800000
push 0x101eb474
push eax
call fcn.10107a60
add esp, 0x14
mov ecx, 0xac
xor edx, edx
mov al, byte [edx + 0x10199b30]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x34], al
and ecx, 0x800000ff
jns 0x1011754d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x11
jl 0x10117530
mov byte [ebp - 0x23], 0
push 0x10168948
sub esp, 8
mov dword [ebp - 4], 4
lea eax, [ebp - 0x34]
mov dword [esp + 4], 0x40a00000
mov dword [esp], 0x3dcccccd
push 0x101eb478
push eax
call fcn.10107a60
add esp, 0x14
mov dword [ebp - 0x18], 0x69646152
mov word [ebp - 0x14], 0x7375
mov byte [ebp - 0x12], 0
push 0x10168bf4
sub esp, 8
mov dword [ebp - 4], 5
lea eax, [ebp - 0x18]
mov dword [esp + 4], 0x42340000
mov dword [esp], 0x40a00000
push 0x101eb47c
push eax
call fcn.10107a60
xor eax, eax
mov dword [ebp - 4], 0xffffffff
add esp, 0x14
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov byte [ebp - 0x12], al
call fcn.1001cf40
call fcn.10012580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
Function at 0x10117600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101635bd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x102b834a
call fcn.10124b2c
mov dword [ebp - 0x30], 0x437a0000
mov dword [ebp - 0x2c], 0xbf800000
mov dword [ebp - 0x18], 0x72762323
mov word [ebp - 0x14], 0x31
push 0
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f370
add esp, 0x10
mov ecx, 0x18
xor edx, edx
nop
mov al, byte [edx + str._wypx_mAECQ]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x34], al
and ecx, 0x800000ff
jns 0x1011768d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x10117670
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 1
push 0x101eb8d4
push eax
call fcn.10107160
mov dword [ebp - 4], 0xffffffff
call fcn.10012580
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
mov dword [ebp - 0x30], 0x437a0000
mov dword [ebp - 0x2c], 0xbf800000
mov dword [ebp - 0x18], 0x72762323
mov word [ebp - 0x14], 0x32
push 0
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f370
movd xmm0, dword [0x101e6990]
add esp, 0x14
cvtdq2ps xmm0, xmm0
mov dword [ebp - 4], 0xffffffff
movss dword [esp], xmm0
call fcn.1001d440
add esp, 4
mov dword [ebp - 0x18], 0x6d6f6f5a
mov byte [ebp - 0x14], 0
push 0x10168948
sub esp, 8
mov dword [ebp - 4], 3
lea eax, [ebp - 0x18]
mov dword [esp + 4], 0x41200000
mov dword [esp], 0x3f800000
push 0x101eb8d8
push eax
call fcn.10107a60
add esp, 0x14
mov dword [ebp - 0x24], 0x6e696f50
mov dword [ebp - 0x20], 0x69732074
mov word [ebp - 0x1c], 0x657a
mov byte [ebp - 0x1a], 0
push 0x10168948
sub esp, 8
mov dword [ebp - 4], 4
lea eax, [ebp - 0x24]
mov dword [esp + 4], 0x41c80000
mov dword [esp], 0x40a00000
push 0x101eb8dc
push eax
call fcn.10107a60
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
mov word [ebp - 0x1c], 0
movq qword [ebp - 0x24], xmm0
mov byte [ebp - 0x1a], 0
call fcn.1001cf40
call fcn.10012580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
Function at 0x101177e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016363d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x102b834a
call fcn.10124b2c
mov dword [ebp - 0x1c], 0x437a0000
mov dword [ebp - 0x18], 0xbf800000
mov dword [ebp - 0x24], 0x6f762323
mov word [ebp - 0x20], 0x31
push 0
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1000f370
mov dword [ebp - 0x1c], 0x46206f4e
mov dword [ebp - 0x18], 0x6873616c
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
push 0x101eb61c
push eax
call fcn.10107160
mov dword [ebp - 0x1c], 0x48206f4e
mov dword [ebp - 0x18], 0x73646e61
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push 0x101eb548
push eax
call fcn.10107160
mov dword [ebp - 0x1c], 0x53206f4e
mov dword [ebp - 0x18], 0x656b6f6d
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 3
push 0x101eb770
push eax
call fcn.10107160
mov dword [ebp - 0x1c], 0x53206f4e
mov dword [ebp - 0x18], 0x65706f63
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 4
push 0x101eb7b8
push eax
call fcn.10107160
add esp, 0x30
mov ecx, 0xb
xor edx, edx
nop dword [eax + eax]
mov al, byte [edx + str.Ec_zjq]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x34], al
and ecx, 0x800000ff
jns 0x1011790d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x101178f0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 5
push 0x101eb7b4
push eax
call fcn.10107160
mov dword [ebp - 0x34], 0x20647548
mov dword [ebp - 0x30], 0x61656c43
mov word [ebp - 0x2c], 0x72
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 6
push 0x101eb658
push eax
call fcn.10107160
mov dword [ebp - 0x34], 0x636f6c42
mov dword [ebp - 0x30], 0x6f6d206b
mov word [ebp - 0x2c], 0x6474
mov byte [ebp - 0x2a], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 7
push 0x101eb2d0
push eax
call fcn.10107160
mov dword [ebp - 4], 0xffffffff
call fcn.10012580
add esp, 0x10
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
mov dword [ebp - 0x1c], 0x437a0000
mov dword [ebp - 0x18], 0xbf800000
mov dword [ebp - 0x24], 0x6f762323
mov word [ebp - 0x20], 0x32
push 0
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 8
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1000f370
movd xmm0, dword [0x101e6990]
add esp, 0x14
cvtdq2ps xmm0, xmm0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], eax
mov word [ebp - 0x20], ax
movss dword [esp], xmm0
call fcn.1001d440
add esp, 4
call fcn.1001cf40
call fcn.10012580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
Function at 0x1011a410
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10163a5d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x102b839c
call fcn.10124b2c
mov eax, dword fs:[0x2c]
mov ecx, dword [0x102b5bf8]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10268d48]
cmp eax, dword [ecx + 4]
jg 0x1011a633
call esi
movzx ecx, byte [0x101e699d]
xor edx, edx
cmp dword [0x10268d44], eax
cmovb ecx, edx
mov byte [0x101e699d], cl
cmp byte [0x101e699e], dl
je 0x1011a4a7
test cl, cl
jne 0x1011a4a7
cmp byte [0x10263bae], dl
jne 0x1011a4a0
call fcn.100141d0
mov byte [eax + 0x58], 0
mov byte [0x101e699e], 0
call esi
sub eax, dword [0x101ea270]
cmp eax, 0x64
ja 0x1011a4c0
mov byte [0x101e699d], 0
jmp 0x1011a619
cmp byte [0x101e699d], 0
je 0x1011a619
cmp byte [0x101e699f], 0
je 0x1011a4e6
call fcn.100141d0
mov byte [0x101e699f], 0
mov byte [eax + 0x58], 1
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x34], 0
push 2
push eax
mov dword [ebp - 0x1c], 0x42c80000
mov dword [ebp - 0x18], 0x42c80000
call fcn.10020e40
add esp, 8
lea eax, [ebp - 0x40]
mov dword [esp], 0x3f333333
push eax
call fcn.10105910
movups xmm0, xmmword [eax]
lea eax, [ebp - 0x24]
push eax
push 2
movups xmmword [ebp - 0x24], xmm0
call fcn.1001d670
mov dword [ebp - 0x1c], 0x6f6e2323
mov dword [ebp - 0x18], 0x656d616e
mov byte [ebp - 0x14], 0
push 0x63
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push 0x101e699d
push eax
call fcn.1000cc40
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
test al, al
je 0x1011a60a
push 0
call fcn.100175d0
movzx ecx, byte [0x101e699d]
xor edx, edx
push dword [0x10263bfc]
test al, al
cmovne ecx, edx
mov byte [0x101e699d], cl
call fcn.1001d120
add esp, 8
mov ecx, 5
xor edx, edx
mov al, byte [edx + 0x101c3b74]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x2c], al
and ecx, 0x800000ff
jns 0x1011a5be
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x19
jl 0x1011a5a1
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 1
push eax
call fcn.1004b1a0
mov word [ebp - 0x30], 0xa20
mov byte [ebp - 0x2e], 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 2
push eax
call fcn.1004b1a0
add esp, 8
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov word [ebp - 0x30], ax
mov byte [ebp - 0x2e], al
call fcn.1001ce80
push 1
call fcn.1001cf90
add esp, 4
call fcn.100121d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
push 0x10268d48
call fcn.101253c2
add esp, 4
cmp dword [0x10268d48], 0xffffffff
jne 0x1011a469
call esi
add eax, 0x5208
push 0x10268d48
mov dword [0x10268d44], eax
call fcn.10125378
add esp, 4
jmp 0x1011a469