joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005920
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10005927
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10005922
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1000590c
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10005914
cmp edx, ebx
jne 0x10005a62
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x100058e3
add eax, dword [eax + 4]
jmp 0x100058d0
mov dword [ebp + 0xc], ebx
jmp 0x10005932
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000594a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10005968
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100059c6
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x100059ad
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100059b6
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x100059c0
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100059a2
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000592c
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10005a13
dec eax
je 0x10005a0a
sub eax, 3
je 0x10005a01
mov dword [ebp - 4], 0x40
jmp 0x10005a30
mov dword [ebp - 4], 4
jmp 0x10005a16
mov dword [ebp - 4], 0x20
jmp 0x10005a16
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10005a62
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x100059e2
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10005273
and eax, 0x75fffdfb
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x10005a6e
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000a4e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x268
mov eax, dword [0x10037c38]
xor eax, esp
mov dword [esp + 0x264], eax
mov eax, dword [esp + 0x26c]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x10]
mov dword [esp + 0x14], eax
cmp dword [esi + 0xc], edi
jbe 0x1000a512
call fcn.10018c77
mov ebx, dword [esi + 0xc]
mov ebp, dword [esi]
cmp ebx, dword [esi + 0x10]
jbe 0x1000a521
call fcn.10018c77
mov eax, dword [esi]
push edi
push ebp
push ebx
push eax
lea ebx, [esp + 0x28]
call fcn.1000bb20
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1000a60a
cmp dword [esp + 0x3c], 0
je 0x1000a559
mov edi, 0x5000
jmp 0x1000a55f
mov edi, dword [esp + 0x40]
shr edi, 1
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000e081
add esp, 4
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [esp + 0x14]
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea ecx, [edi - 2]
cmp eax, ecx
jne 0x1000a5e3
push ebx
call fcn.1000e076
add esp, 4
cmp edi, 0x100000
jge 0x1000a5ac
add edi, edi
jmp 0x1000a5b2
add edi, 0x100000
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000e081
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1000a60a
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea ecx, [edi - 2]
cmp eax, ecx
je 0x1000a597
push esi
mov ecx, ebx
call fcn.1000a3d0
add esp, 4
push ebx
test eax, eax
je 0x1000a602
call fcn.1000e076
add esp, 4
mov eax, 1
jmp 0x1000a60c
call fcn.1000e076
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x274]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100188db
add esp, 0x268
ret
Function at 0x1000aca0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1002cb06
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x10037c38]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push esi
push edi
mov eax, dword [0x10037c38]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x26c]
lea edi, [eax + 0xa0]
mov esi, ecx
call fcn.1000b000
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x56]
push ecx
mov word [esp + 0x58], ax
call fcn.1001a4c0
push 0x104
lea edx, [esp + 0x5c]
push 0
push edx
call fcn.1001a4c0
add esp, 0x18
push esi
push 0x104
lea eax, [esp + 0x54]
push eax
push 0
push str.Description
push str.Skin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000ad40
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x50]
mov esi, edi
call fcn.1000bd90
mov ebx, 1
mov eax, edi
call fcn.1000b4e0
push edi
mov edx, eax
lea esi, [esp + 0x34]
call fcn.1000b0a0
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x26c], 0
call fcn.1000b300
mov dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x1000ada8
mov ecx, dword [esp + 0x34]
push ecx
call fcn.1000e076
add esp, 4
push 0x100319a4
mov esi, edi
lea ebx, [esp + 0x18]
call fcn.1000a750
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x26c], 1
call fcn.1000b300
cmp dword [esp + 0x2c], 8
jb 0x1000ade5
mov edx, dword [esp + 0x18]
push edx
call fcn.1000e076
add esp, 4
cmp dword [edi + 0x18], 8
jb 0x1000adf0
mov eax, dword [edi + 4]
jmp 0x1000adf3
lea eax, [edi + 4]
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.100188db
add esp, 0x258
ret 4
Function at 0x1000da10
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1002c838
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10037c38]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov eax, dword [0x10037c38]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor ebp, ebp
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], ax
mov eax, str.Settings
mov dword [esp + 0x40], ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x1000da62
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1c]
call fcn.1000dce0
push 7
push 0x100319a8
lea eax, [esp + 0x20]
call fcn.1000b5d0
xor ebx, ebx
lea esi, [esp + 0x18]
call fcn.1000af70
mov eax, dword [esp + 0x1c]
mov ebx, 8
mov dword [esp + 0x14], ebp
cmp dword [esp + 0x30], ebx
jae 0x1000daad
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push eax
push reloc.Config.dll_Ordinal_1
call sub.Config.dll_Ordinal_20
add esp, 0x24
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
cmp esi, ebp
jne 0x1000db1f
mov eax, dword [edi + 0x20]
cmp eax, ebp
je 0x1000daef
push eax
call sub.Config.dll_Ordinal_1
add esp, 4
mov dword [edi + 0x20], ebp
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
mov dword [edi + 0x20], eax
push ebp
lea ecx, [edi + 4]
lea eax, [esp + 0x20]
call fcn.1000b300
cmp dword [esp + 0x30], ebx
jb 0x1000db18
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.1000e076
add esp, 4
mov eax, 1
jmp 0x1000db34
cmp dword [esp + 0x30], ebx
jb 0x1000db32
mov edx, dword [esp + 0x1c]
push edx
call fcn.1000e076
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100188db
add esp, 0x34
ret

Function at 0x100188db
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10037c38]
jne 0x100188e5
repz ret
jmp fcn.1001c77b
Function at 0x1002764b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1001d1d2
and dword [ebp - 4], 0
cmp dword [0x1003b9b8], 0
mov ebx, eax
jne 0x100276fc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100277ad
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100277ad
push eax
call fcn.1001d160
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1003b9b8], eax
call esi
push eax
call fcn.1001d160
mov dword [esp], 0x100316e0
push edi
mov dword [0x1003b9bc], eax
call esi
push eax
call fcn.1001d160
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1003b9c0], eax
call esi
push eax
call fcn.1001d160
pop ecx
mov dword [0x1003b9c8], eax
test eax, eax
je 0x100276fc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001d160
pop ecx
mov dword [0x1003b9c4], eax
mov eax, dword [0x1003b9c4]
cmp eax, ebx
je 0x10027754
cmp dword [0x1003b9c8], ebx
je 0x10027754
push eax
call fcn.1001d1db
push dword [0x1003b9c8]
mov esi, eax
call fcn.1001d1db
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10027754
test edi, edi
je 0x10027754
call esi
test eax, eax
je 0x1002774b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1002774b
test byte [ebp - 0xc], 1
jne 0x10027754
or dword [ebp + 0x10], 0x200000
jmp 0x1002778d
mov eax, dword [0x1003b9bc]
cmp eax, ebx
je 0x1002778d
push eax
call fcn.1001d1db
pop ecx
test eax, eax
je 0x1002778d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1002778d
mov eax, dword [0x1003b9c0]
cmp eax, ebx
je 0x1002778d
push eax
call fcn.1001d1db
pop ecx
test eax, eax
je 0x1002778d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1003b9b8]
call fcn.1001d1db
pop ecx
test eax, eax
je 0x100277ad
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100277af
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002114
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x10], 0
je 0x10002126
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x11
jb 0x1000211c
mov eax, ecx
ret

Function at 0x10002129
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x12], 0
je 0x1000213b
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x13
jb 0x10002131
mov eax, ecx
ret

Function at 0x1000213e
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x16], 0
je 0x10002150
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x17
jb 0x10002146
mov eax, ecx
ret

Function at 0x10002153
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x17], 0
je 0x10002165
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x18
jb 0x1000215b
mov eax, ecx
ret

Function at 0x10002168
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xa], 0
je 0x1000217a
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0xb
jb 0x10002170
mov eax, ecx
ret

Function at 0x1000217d
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xb], 0
je 0x1000218f
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0xc
jb 0x10002185
mov eax, ecx
ret

Function at 0x10002192
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xc], 0
je 0x100021a4
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0xd
jb 0x1000219a
mov eax, ecx
ret

Function at 0x100021a7
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xd], 0
je 0x100021b9
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0xe
jb 0x100021af
mov eax, ecx
ret

Function at 0x10002306
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dd0c]
cmp eax, dword [ecx + 4]
jg 0x10002347
jmp 0x10002340
pop ebx
mov eax, 0x1009dd00
leave
ret
push ebx
mov ebx, 0x1009dd0c
push ebx
call fcn.1007b2f8
cmp dword [0x1009dd0c], 0xffffffff
pop ecx
jne 0x1000233f
push esi
push edi
mov edi, 0x1009dd00
lea esi, [ebp - 0xc]
push 0x10081603
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000233f
Function at 0x10002380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dd80]
cmp eax, dword [ecx + 4]
jg 0x100023c1
jmp 0x100023ba
pop ebx
mov eax, 0x1009dd74
leave
ret
push ebx
mov ebx, 0x1009dd80
push ebx
call fcn.1007b2f8
cmp dword [0x1009dd80], 0xffffffff
pop ecx
jne 0x100023b9
push esi
push edi
mov edi, 0x1009dd74
lea esi, [ebp - 0xc]
push 0x10081610
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100023b9

Function at 0x100023fa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dd34]
cmp eax, dword [ecx + 4]
jg 0x1000243b
jmp 0x10002434
pop ebx
mov eax, 0x1009dd28
leave
ret
push ebx
mov ebx, 0x1009dd34
push ebx
call fcn.1007b2f8
cmp dword [0x1009dd34], 0xffffffff
pop ecx
jne 0x10002433
push esi
push edi
mov edi, 0x1009dd28
lea esi, [ebp - 0xc]
push 0x1008161d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10002433

Function at 0x100024f2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dd5c]
cmp eax, dword [ecx + 4]
jg 0x10002533
jmp 0x1000252c
pop ebx
mov eax, 0x1009dd50
leave
ret
push ebx
mov ebx, 0x1009dd5c
push ebx
call fcn.1007b2f8
cmp dword [0x1009dd5c], 0xffffffff
pop ecx
jne 0x1000252b
push esi
push edi
mov edi, 0x1009dd50
lea esi, [ebp - 0xc]
push 0x10081639
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000252b
Function at 0x1000256c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x6d584e5c
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dc58]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x100025b3
jmp 0x100025ac
pop ebx
mov eax, 0x1009dc48
leave
ret
push ebx
mov ebx, 0x1009dc58
push ebx
call fcn.1007b2f8
cmp dword [0x1009dc58], 0xffffffff
pop ecx
jne 0x100025ab
push esi
push edi
mov edi, 0x1009dc48
lea esi, [ebp - 0x10]
push 0x10081646
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100025ab

Function at 0x100025ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dcac]
cmp eax, dword [ecx + 4]
jg 0x1000262f
jmp 0x10002628
pop ebx
mov eax, 0x1009dca0
leave
ret
push ebx
mov ebx, 0x1009dcac
push ebx
call fcn.1007b2f8
cmp dword [0x1009dcac], 0xffffffff
pop ecx
jne 0x10002627
push esi
push edi
mov edi, 0x1009dca0
lea esi, [ebp - 0xc]
push 0x10081655
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10002627

Function at 0x10002668
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x6d584e5c
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dc80]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x100026af
jmp 0x100026a8
pop ebx
mov eax, 0x1009dc70
leave
ret
push ebx
mov ebx, 0x1009dc80
push ebx
call fcn.1007b2f8
cmp dword [0x1009dc80], 0xffffffff
pop ecx
jne 0x100026a7
push esi
push edi
mov edi, 0x1009dc70
lea esi, [ebp - 0x10]
push 0x10081662
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100026a7
Function at 0x1000276b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x4f7c6250
mov dword [ebp - 0xc], 0x6b4f5250
mov dword [ebp - 8], 0x5848515c
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dd20]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x100027b0
jmp 0x100027a9
pop ebx
mov eax, 0x1009dd10
leave
ret
push ebx
mov ebx, 0x1009dd20
push ebx
call fcn.1007b2f8
cmp dword [0x1009dd20], 0xffffffff
pop ecx
jne 0x100027a8
push esi
push edi
mov edi, 0x1009dd10
lea esi, [ebp - 0x10]
push 0x10081683
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100027a8

Function at 0x1000285e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x755f6250
mov dword [ebp - 0xc], 0x58754e5c
mov dword [ebp - 8], 0x49585051
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dd48]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x100028a3
jmp 0x1000289c
pop ebx
mov eax, 0x1009dd38
leave
ret
push ebx
mov ebx, 0x1009dd48
push ebx
call fcn.1007b2f8
cmp dword [0x1009dd48], 0xffffffff
pop ecx
jne 0x1000289b
push esi
push edi
mov edi, 0x1009dd38
lea esi, [ebp - 0x10]
push 0x100816a0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000289b

Function at 0x1000295e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x54516250
mov dword [ebp - 8], 0x496e585b
mov dword [ebp - 4], 0x3d58495c
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dd6c]
cmp eax, dword [ecx + 4]
jg 0x1000299f
jmp 0x10002998
pop ebx
mov eax, 0x1009dd60
leave
ret
push ebx
mov ebx, 0x1009dd6c
push ebx
call fcn.1007b2f8
cmp dword [0x1009dd6c], 0xffffffff
pop ecx
jne 0x10002997
push esi
push edi
mov edi, 0x1009dd60
lea esi, [ebp - 0xc]
push 0x100816c0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10002997
Function at 0x100029d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x584b6250
mov dword [ebp - 8], 0x544f725e
mov dword [ebp - 4], 0x3d53545a
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dc68]
cmp eax, dword [ecx + 4]
jg 0x10002a19
jmp 0x10002a12
pop ebx
mov eax, 0x1009dc5c
leave
ret
push ebx
mov ebx, 0x1009dc68
push ebx
call fcn.1007b2f8
cmp dword [0x1009dc68], 0xffffffff
pop ecx
jne 0x10002a11
push esi
push edi
mov edi, 0x1009dc5c
lea esi, [ebp - 0xc]
push 0x100816cd
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10002a11

Function at 0x10002a52
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x69546250
mov dword [ebp - 8], 0x73505c58
mov word [ebp - 4], 0x5048
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dcbc]
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10002a96
jmp 0x10002a8f
pop ebx
mov eax, 0x1009dcb0
leave
ret
push ebx
mov ebx, 0x1009dcbc
push ebx
call fcn.1007b2f8
cmp dword [0x1009dcbc], 0xffffffff
pop ecx
jne 0x10002a8e
push esi
push edi
mov edi, 0x1009dcb0
lea esi, [ebp - 0xc]
push 0x100816da
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10002a8e