joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017bf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x10017c10
jl 0x10017c07
cmp dword [ebp + 0xc], 0
ja 0x10017c10
xor eax, eax
xor edx, edx
jmp 0x10017d4d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10017c33
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x10017d4d
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x10017ca5
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.10012640
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10013500
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x10017d3e
mov ecx, dword [ebp - 8]
call fcn.10015fc0
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x10017d16
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x10017d14
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x10017d4d
jmp 0x10017cc1
cmp dword [ebp - 4], 0
jbe 0x10017d3e
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10017d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x10017d8c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10017e72
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x10017e23
jg 0x10017db5
cmp dword [ebp + 0xc], 0
jbe 0x10017e23
cmp dword [ebp - 8], 0
jl 0x10017e23
jg 0x10017dc3
cmp dword [ebp - 0xc], 0
jbe 0x10017e23
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x10017de1
jl 0x10017dd5
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x10017de1
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.10013500
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x10017e66
jg 0x10017e31
cmp dword [ebp + 0xc], 0
jbe 0x10017e66
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x10017e66
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10025d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014be7c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xe
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x78
mov byte [ebp - 0x22], 0x4b
mov byte [ebp - 0x21], 0x42
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1f], 0x4d
mov byte [ebp - 0x1e], 0x47
mov byte [ebp - 0x1d], 0x5a
mov byte [ebp - 0x1c], 0x57
mov byte [ebp - 0x1b], 0x7d
mov byte [ebp - 0x1a], 0x47
mov byte [ebp - 0x19], 0x54
mov byte [ebp - 0x18], 0x4b
mov byte [ebp - 0x17], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036fd5c]
cmp eax, dword [edx + 4]
jle 0x10025e45
push 0x1036fd5c
call fcn.1014a06c
add esp, 4
cmp dword [0x1036fd5c], 0xffffffff
jne 0x10025e45
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push ecx
mov ecx, 0x1036fd4c
call fcn.10023330
push 0x101501a0
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036fd5c
call fcn.1014a022
add esp, 4
mov eax, 0x1036fd4c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10025eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014be9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x10
mov byte [ebp - 0x24], 0x48
mov byte [ebp - 0x23], 0x78
mov byte [ebp - 0x22], 0x4b
mov byte [ebp - 0x21], 0x42
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1f], 0x4d
mov byte [ebp - 0x1e], 0x47
mov byte [ebp - 0x1d], 0x5a
mov byte [ebp - 0x1c], 0x57
mov byte [ebp - 0x1b], 0x6d
mov byte [ebp - 0x1a], 0x41
mov byte [ebp - 0x19], 0x42
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0x5c
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0x15], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036fd0c]
cmp eax, dword [edx + 4]
jle 0x10025f7d
push 0x1036fd0c
call fcn.1014a06c
add esp, 4
cmp dword [0x1036fd0c], 0xffffffff
jne 0x10025f7d
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push ecx
mov ecx, 0x1036fcfc
call fcn.10023060
push 0x101501b0
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036fd0c
call fcn.1014a022
add esp, 4
mov eax, 0x1036fcfc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10025f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x28], 0x1c
mov byte [ebp - 0x24], 0xaa
mov byte [ebp - 0x23], 0x9d
mov byte [ebp - 0x22], 0x91
mov byte [ebp - 0x21], 0x86
mov byte [ebp - 0x20], 0xbf
mov byte [ebp - 0x1f], 0x9c
mov byte [ebp - 0x1e], 0x90
mov byte [ebp - 0x1d], 0x90
mov byte [ebp - 0x1c], 0x9a
mov byte [ebp - 0x1b], 0xb2
mov byte [ebp - 0x1a], 0x80
mov byte [ebp - 0x19], 0x9c
mov byte [ebp - 0x18], 0x99
mov byte [ebp - 0x17], 0x8e
mov byte [ebp - 0x16], 0x88
mov byte [ebp - 0x15], 0x98
mov byte [ebp - 0x14], 0xde
mov byte [ebp - 0x13], 0xd7
mov byte [ebp - 0x12], 0x4d
mov byte [ebp - 0x11], 0x60
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xe], 0x76
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0x67
mov byte [ebp - 0xb], 0x6b
mov byte [ebp - 0xa], 0x7b
mov byte [ebp - 9], 0x20
mov byte [ebp - 8], 0xa
xor eax, eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov ecx, 9
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100260d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bebc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x14
mov byte [ebp - 0x28], 0x48
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], 0x5c
mov byte [ebp - 0x25], 0x4b
mov byte [ebp - 0x24], 0x40
mov byte [ebp - 0x23], 0x4f
mov byte [ebp - 0x22], 0x4a
mov byte [ebp - 0x21], 0x4b
mov byte [ebp - 0x20], 0x7e
mov byte [ebp - 0x1f], 0x5c
mov byte [ebp - 0x1e], 0x4b
mov byte [ebp - 0x1d], 0x4a
mov byte [ebp - 0x1c], 0x47
mov byte [ebp - 0x1b], 0x4d
mov byte [ebp - 0x1a], 0x5a
mov byte [ebp - 0x19], 0x47
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0x15], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1037007c]
cmp eax, dword [edx + 4]
jle 0x100261ad
push 0x1037007c
call fcn.1014a06c
add esp, 4
cmp dword [0x1037007c], 0xffffffff
jne 0x100261ad
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, 0x10370068
call fcn.10014650
push 0x101501c0
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1037007c
call fcn.1014a022
add esp, 4
mov eax, 0x10370068
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100262e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bedc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x15
mov byte [ebp - 0x2c], 0x5d
mov byte [ebp - 0x2b], 0x5e
mov byte [ebp - 0x2a], 0x5c
mov byte [ebp - 0x29], 0x47
mov byte [ebp - 0x28], 0x5a
mov byte [ebp - 0x27], 0x4b
mov byte [ebp - 0x26], 0x5d
mov byte [ebp - 0x25], 1
mov byte [ebp - 0x24], 0x5e
mov byte [ebp - 0x23], 0x46
mov byte [ebp - 0x22], 0x57
mov byte [ebp - 0x21], 0x5d
mov byte [ebp - 0x20], 0x4c
mov byte [ebp - 0x1f], 0x4b
mov byte [ebp - 0x1e], 0x4f
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0x58
mov byte [ebp - 0x1a], 0x43
mov byte [ebp - 0x19], 0x5a
mov byte [ebp - 0x18], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x103709bc]
cmp eax, dword [edx + 4]
jle 0x100263c1
push 0x103709bc
call fcn.1014a06c
add esp, 4
cmp dword [0x103709bc], 0xffffffff
jne 0x100263c1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, 0x103709a4
call fcn.10023100
push 0x101501d0
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x103709bc
call fcn.1014a022
add esp, 4
mov eax, 0x103709a4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100263e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014befc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x10
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x6a
mov byte [ebp - 0x22], 0x4b
mov byte [ebp - 0x21], 0x5d
mov byte [ebp - 0x20], 0x57
mov byte [ebp - 0x1f], 0x40
mov byte [ebp - 0x1e], 0x4d
mov byte [ebp - 0x1d], 0x63
mov byte [ebp - 0x1c], 0x4f
mov byte [ebp - 0x1b], 0x5a
mov byte [ebp - 0x1a], 0x4b
mov byte [ebp - 0x19], 0x5c
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x17], 0x4f
mov byte [ebp - 0x16], 0x42
mov byte [ebp - 0x15], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036fb84]
cmp eax, dword [edx + 4]
jle 0x100264ad
push 0x1036fb84
call fcn.1014a06c
add esp, 4
cmp dword [0x1036fb84], 0xffffffff
jne 0x100264ad
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push ecx
mov ecx, 0x1036fb74
call fcn.10023060
push 0x101501e0
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036fb84
call fcn.1014a022
add esp, 4
mov eax, 0x1036fb74
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100264c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bf1c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 9
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1f], 0x6d
mov byte [ebp - 0x1e], 0x42
mov byte [ebp - 0x1d], 0x4f
mov byte [ebp - 0x1c], 0x40
mov byte [ebp - 0x1b], 0x7a
mov byte [ebp - 0x1a], 0x4f
mov byte [ebp - 0x19], 0x49
mov byte [ebp - 0x18], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036fbdc]
cmp eax, dword [edx + 4]
jle 0x10026571
push 0x1036fbdc
call fcn.1014a06c
add esp, 4
cmp dword [0x1036fbdc], 0xffffffff
jne 0x10026571
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x1036fbd0
call fcn.10022fc0
push 0x101501f0
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036fbdc
call fcn.1014a022
add esp, 4
mov eax, 0x1036fbd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10026790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bf3c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xb
mov byte [ebp - 0x20], 0x4c
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x47
mov byte [ebp - 0x1d], 0x42
mov byte [ebp - 0x1c], 0x42
mov byte [ebp - 0x1b], 0x7d
mov byte [ebp - 0x1a], 0x41
mov byte [ebp - 0x19], 0x5b
mov byte [ebp - 0x18], 0x40
mov byte [ebp - 0x17], 0x4a
mov byte [ebp - 0x16], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x10370154]
cmp eax, dword [edx + 4]
jle 0x10026849
push 0x10370154
call fcn.1014a06c
add esp, 4
cmp dword [0x10370154], 0xffffffff
jne 0x10026849
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x10370148
call fcn.100146f0
push 0x10150200
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x10370154
call fcn.1014a022
add esp, 4
mov eax, 0x10370148
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10026860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bf5c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xb
mov byte [ebp - 0x20], 0x4c
mov byte [ebp - 0x1f], 0x6a
mov byte [ebp - 0x1e], 0x4b
mov byte [ebp - 0x1d], 0x4f
mov byte [ebp - 0x1c], 0x4a
mov byte [ebp - 0x1b], 0x7d
mov byte [ebp - 0x1a], 0x41
mov byte [ebp - 0x19], 0x5b
mov byte [ebp - 0x18], 0x40
mov byte [ebp - 0x17], 0x4a
mov byte [ebp - 0x16], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x103701a4]
cmp eax, dword [edx + 4]
jle 0x10026919
push 0x103701a4
call fcn.1014a06c
add esp, 4
cmp dword [0x103701a4], 0xffffffff
jne 0x10026919
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x10370198
call fcn.100146f0
push 0x10150210
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x103701a4
call fcn.1014a022
add esp, 4
mov eax, 0x10370198
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10026a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bf7c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xa
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1f], 0x4f
mov byte [ebp - 0x1e], 0x45
mov byte [ebp - 0x1d], 0x4b
mov byte [ebp - 0x1c], 0x5d
mov byte [ebp - 0x1b], 0x4b
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0x19], 0x5d
mov byte [ebp - 0x18], 0x4b
mov byte [ebp - 0x17], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1037046c]
cmp eax, dword [edx + 4]
jle 0x10026ab5
push 0x1037046c
call fcn.1014a06c
add esp, 4
cmp dword [0x1037046c], 0xffffffff
jne 0x10026ab5
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x10370460
call fcn.10023010
push 0x10150220
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1037046c
call fcn.1014a022
add esp, 4
mov eax, 0x10370460
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10026c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x28], 0x1e
mov byte [ebp - 0x24], 0xb5
mov byte [ebp - 0x23], 0xcf
mov byte [ebp - 0x22], 0xda
mov byte [ebp - 0x21], 0xd1
mov byte [ebp - 0x20], 0xaf
mov byte [ebp - 0x1f], 0xd3
mov byte [ebp - 0x1e], 0xbc
mov byte [ebp - 0x1d], 0x9a
mov byte [ebp - 0x1c], 0x99
mov byte [ebp - 0x1b], 0x9c
mov byte [ebp - 0x1a], 0x91
mov byte [ebp - 0x19], 0x97
mov byte [ebp - 0x18], 0x9d
mov byte [ebp - 0x17], 0xdb
mov byte [ebp - 0x16], 0xb9
mov byte [ebp - 0x15], 0x8b
mov byte [ebp - 0x14], 0x9b
mov byte [ebp - 0x13], 0x91
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x21
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x77
mov byte [ebp - 0xd], 0x71
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 9], 0x7b
mov byte [ebp - 8], 0x79
mov byte [ebp - 7], 1
mov byte [ebp - 6], 0xc
xor eax, eax
mov byte [ebp - 5], al
mov ecx, 9
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10026dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bf9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x16
mov byte [ebp - 0x2c], 0x47
mov byte [ebp - 0x2b], 0x7a
mov byte [ebp - 0x2a], 0x4b
mov byte [ebp - 0x29], 0x42
mov byte [ebp - 0x28], 0x4b
mov byte [ebp - 0x27], 0x5e
mov byte [ebp - 0x26], 0x41
mov byte [ebp - 0x25], 0x5c
mov byte [ebp - 0x24], 0x5a
mov byte [ebp - 0x23], 0x6b
mov byte [ebp - 0x22], 0x56
mov byte [ebp - 0x21], 0x5e
mov byte [ebp - 0x20], 0x42
mov byte [ebp - 0x1f], 0x41
mov byte [ebp - 0x1e], 0x47
mov byte [ebp - 0x1d], 0x5a
mov byte [ebp - 0x1c], 0x7a
mov byte [ebp - 0x1b], 0x47
mov byte [ebp - 0x1a], 0x4d
mov byte [ebp - 0x19], 0x45
mov byte [ebp - 0x18], 0x5d
mov byte [ebp - 0x17], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036fff4]
cmp eax, dword [edx + 4]
jle 0x10026ea5
push 0x1036fff4
call fcn.1014a06c
add esp, 4
cmp dword [0x1036fff4], 0xffffffff
jne 0x10026ea5
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, 0x1036ffdc
call fcn.10023150
push 0x10150230
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036fff4
call fcn.1014a022
add esp, 4
mov eax, 0x1036ffdc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10027030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bfbc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x10
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x78
mov byte [ebp - 0x22], 0x4b
mov byte [ebp - 0x21], 0x42
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1f], 0x4d
mov byte [ebp - 0x1e], 0x47
mov byte [ebp - 0x1d], 0x5a
mov byte [ebp - 0x1c], 0x57
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x5c
mov byte [ebp - 0x19], 0x4f
mov byte [ebp - 0x18], 0x5e
mov byte [ebp - 0x17], 0x46
mov byte [ebp - 0x16], 0x77
mov byte [ebp - 0x15], 0x2e
mov eax, dword [0x10371da0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1036fd98]
cmp eax, dword [edx + 4]
jle 0x100270fd
push 0x1036fd98
call fcn.1014a06c
add esp, 4
cmp dword [0x1036fd98], 0xffffffff
jne 0x100270fd
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push ecx
mov ecx, 0x1036fd88
call fcn.10023060
push 0x10150240
call fcn.10149739
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1036fd98
call fcn.1014a022
add esp, 4
mov eax, 0x1036fd88
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10027110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x30], 0x26
mov byte [ebp - 0x2c], 0x8d
mov byte [ebp - 0x2b], 0x9c
mov byte [ebp - 0x2a], 0x97
mov byte [ebp - 0x29], 0x9e
mov byte [ebp - 0x28], 0xae
mov byte [ebp - 0x27], 0x9e
mov byte [ebp - 0x26], 0x95
mov byte [ebp - 0x25], 0x81
mov byte [ebp - 0x24], 0x93
mov byte [ebp - 0x23], 0x85
mov byte [ebp - 0x22], 0x91
mov byte [ebp - 0x21], 0x98
mov byte [ebp - 0x20], 0x96
mov byte [ebp - 0x1f], 0x88
mov byte [ebp - 0x1e], 0xa0
mov byte [ebp - 0x1d], 0xb2
mov byte [ebp - 0x1c], 0xaa
mov byte [ebp - 0x1b], 0xbc
mov byte [ebp - 0x1a], 0x56
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x17], 0x77
mov byte [ebp - 0x16], 0x61
mov byte [ebp - 0x15], 0x7d
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x7c
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x7f
mov byte [ebp - 0xc], 0x67
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x3e
mov byte [ebp - 9], 0x67
mov byte [ebp - 8], 0x7f
mov byte [ebp - 7], 0x67
mov byte [ebp - 6], 0x14
xor eax, eax
mov byte [ebp - 5], al
mov ecx, 0xb
lea esi, [ebp - 0x30]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4