joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002fba6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x48571e1e
mov dword [ebp - 0xc], 0x485f4d50
mov dword [ebp - 8], 0x4458565a
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6748]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002fbeb
jmp 0x1002fbe4
pop ebx
mov eax, 0x100e6738
leave
ret
push ebx
mov ebx, 0x100e6748
push ebx
call fcn.1007b2f8
cmp dword [0x100e6748], 0xffffffff
pop ecx
jne 0x1002fbe3
push esi
push edi
mov edi, 0x100e6738
lea esi, [ebp - 0x10]
push 0x10082c55
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002fbe3

Function at 0x1002fc25
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x585a5958
mov dword [ebp - 8], 0x4d504857
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6758]
cmp eax, dword [ecx + 4]
jg 0x1002fc63
jmp 0x1002fc5c
pop ebx
mov eax, 0x100e674c
leave
ret
push ebx
mov ebx, 0x100e6758
push ebx
call fcn.1007b2f8
cmp dword [0x100e6758], 0xffffffff
pop ecx
jne 0x1002fc5b
push esi
push edi
mov edi, 0x100e674c
lea esi, [ebp - 0xc]
push 0x10082c63
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002fc5b

Function at 0x1002fc9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x59581e1e
mov dword [ebp - 0xc], 0x4857585a
mov dword [ebp - 8], 0x58564d50
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e676c]
mov word [ebp - 4], 0x3d44
cmp eax, dword [ecx + 4]
jg 0x1002fce3
jmp 0x1002fcdc
pop ebx
mov eax, 0x100e675c
leave
ret
push ebx
mov ebx, 0x100e676c
push ebx
call fcn.1007b2f8
cmp dword [0x100e676c], 0xffffffff
pop ecx
jne 0x1002fcdb
push esi
push edi
mov edi, 0x100e675c
lea esi, [ebp - 0x10]
push 0x10082c70
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002fcdb
Function at 0x1002fe8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x4b515c6b
mov dword [ebp - 8], 0xc0d0d58
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6bc0]
cmp eax, dword [ecx + 4]
jg 0x1002feca
jmp 0x1002fec3
pop ebx
mov eax, 0x100e6bb4
leave
ret
push ebx
mov ebx, 0x100e6bc0
push ebx
call fcn.1007b2f8
cmp dword [0x100e6bc0], 0xffffffff
pop ecx
jne 0x1002fec2
push esi
push edi
mov edi, 0x100e6bb4
lea esi, [ebp - 0xc]
push 0x10082c9d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002fec2

Function at 0x1002ff03
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x4e51524e
mov dword [ebp - 8], 0x585e5449
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e58cc]
cmp eax, dword [ecx + 4]
jg 0x1002ff41
jmp 0x1002ff3a
pop ebx
mov eax, 0x100e58c0
leave
ret
push ebx
mov ebx, 0x100e58cc
push ebx
call fcn.1007b2f8
cmp dword [0x100e58cc], 0xffffffff
pop ecx
jne 0x1002ff39
push esi
push edi
mov edi, 0x100e58c0
lea esi, [ebp - 0xc]
push 0x10082caa
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002ff39

Function at 0x100300f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5a535251
mov dword [ebp - 0xc], 0x4d504857
mov dword [ebp - 8], 0x5e54491d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e67b4]
mov word [ebp - 4], 0x4e56
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1003013b
jmp 0x10030134
pop ebx
mov eax, 0x100e67a4
leave
ret
push ebx
mov ebx, 0x100e67b4
push ebx
call fcn.1007b2f8
cmp dword [0x100e67b4], 0xffffffff
pop ecx
jne 0x10030133
push esi
push edi
mov edi, 0x100e67a4
lea esi, [ebp - 0x10]
push 0x10082ce2
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10030133
Function at 0x100301e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x4949584e
mov dword [ebp - 8], 0x4e5a5354
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e67d8]
cmp eax, dword [ecx + 4]
jg 0x10030225
jmp 0x1003021e
pop ebx
mov eax, 0x100e67cc
leave
ret
push ebx
mov ebx, 0x100e67d8
push ebx
call fcn.1007b2f8
cmp dword [0x100e67d8], 0xffffffff
pop ecx
jne 0x1003021d
push esi
push edi
mov edi, 0x100e67cc
lea esi, [ebp - 0xc]
push 0x10082d00
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1003021d

Function at 0x100302d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5e5c1e1e
mov dword [ebp - 0xc], 0x4953585e
mov dword [ebp - 8], 0x51525e62
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6804]
mov word [ebp - 4], 0x4f52
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1003031f
jmp 0x10030318
pop ebx
mov eax, 0x100e67f4
leave
ret
push ebx
mov ebx, 0x100e6804
push ebx
call fcn.1007b2f8
cmp dword [0x100e6804], 0xffffffff
pop ecx
jne 0x10030317
push esi
push edi
mov edi, 0x100e67f4
lea esi, [ebp - 0x10]
push 0x10082d1d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10030317

Function at 0x100305bb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5354564e
mov dword [ebp - 0xc], 0x5c555e1d
mov dword [ebp - 8], 0x4f585a53
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6878]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10030600
jmp 0x100305f9
pop ebx
mov eax, 0x100e6868
leave
ret
push ebx
mov ebx, 0x100e6878
push ebx
call fcn.1007b2f8
cmp dword [0x100e6878], 0xffffffff
pop ecx
jne 0x100305f8
push esi
push edi
mov edi, 0x100e6868
lea esi, [ebp - 0x10]
push 0x10082d79
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100305f8
Function at 0x100307b2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x4b52515a
mov dword [ebp - 0xc], 0x555e1d58
mov dword [ebp - 8], 0x585a535c
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e68bc]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x100307f9
jmp 0x100307f2
pop ebx
mov eax, 0x100e68ac
leave
ret
push ebx
mov ebx, 0x100e68bc
push ebx
call fcn.1007b2f8
cmp dword [0x100e68bc], 0xffffffff
pop ecx
jne 0x100307f1
push esi
push edi
mov edi, 0x100e68ac
lea esi, [ebp - 0x10]
push 0x10082db2
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100307f1

Function at 0x10030992
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x5953525e
mov dword [ebp - 8], 0x52544954
mov word [ebp - 4], 0x3d53
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e68e8]
cmp eax, dword [ecx + 4]
jg 0x100309d2
jmp 0x100309cb
pop ebx
mov eax, 0x100e68dc
leave
ret
push ebx
mov ebx, 0x100e68e8
push ebx
call fcn.1007b2f8
cmp dword [0x100e68e8], 0xffffffff
pop ecx
jne 0x100309ca
push esi
push edi
mov edi, 0x100e68dc
lea esi, [ebp - 0xc]
push 0x10082deb
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100309ca

Function at 0x10031140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x524b584f
mov dword [ebp - 8], 0x4f584b51
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e69a4]
cmp eax, dword [ecx + 4]
jg 0x1003117e
jmp 0x10031177
pop ebx
mov eax, 0x100e6998
leave
ret
push ebx
mov ebx, 0x100e69a4
push ebx
call fcn.1007b2f8
cmp dword [0x100e69a4], 0xffffffff
pop ecx
jne 0x10031176
push esi
push edi
mov edi, 0x100e6998
lea esi, [ebp - 0xc]
push 0x10082ed8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10031176
Function at 0x10032123
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x525e1e1e
mov dword [ebp - 0xc], 0x5a545b53
mov dword [ebp - 8], 0x505c5362
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6b10]
mov word [ebp - 4], 0x3d58
cmp eax, dword [ecx + 4]
jg 0x1003216a
jmp 0x10032163
pop ebx
mov eax, 0x100e6b00
leave
ret
push ebx
mov ebx, 0x100e6b10
push ebx
call fcn.1007b2f8
cmp dword [0x100e6b10], 0xffffffff
pop ecx
jne 0x10032162
push esi
push edi
mov edi, 0x100e6b00
lea esi, [ebp - 0x10]
push 0x10083069
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10032162

Function at 0x10032547
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x585e6113
mov dword [ebp - 0xc], 0x494e5851
mov dword [ebp - 8], 0x61515c54
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6b70]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1003258c
jmp 0x10032585
pop ebx
mov eax, 0x100e6b60
leave
ret
push ebx
mov ebx, 0x100e6b70
push ebx
call fcn.1007b2f8
cmp dword [0x100e6b70], 0xffffffff
pop ecx
jne 0x10032584
push esi
push edi
mov edi, 0x100e6b60
lea esi, [ebp - 0x10]
push 0x100830e6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10032584

Function at 0x1003279c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x5249485c
mov dword [ebp - 8], 0x51515c4a
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e5a50]
cmp eax, dword [ecx + 4]
jg 0x100327da
jmp 0x100327d3
pop ebx
mov eax, 0x100e5a44
leave
ret
push ebx
mov ebx, 0x100e5a50
push ebx
call fcn.1007b2f8
cmp dword [0x100e5a50], 0xffffffff
pop ecx
jne 0x100327d2
push esi
push edi
mov edi, 0x100e5a44
lea esi, [ebp - 0xc]
push 0x10083130
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100327d2
Function at 0x10032da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x5252504e
mov dword [ebp - 8], 0x53545549
mov word [ebp - 4], 0x3d5a
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e5b0c]
cmp eax, dword [ecx + 4]
jg 0x10032de0
jmp 0x10032dd9
pop ebx
mov eax, 0x100e5b00
leave
ret
push ebx
mov ebx, 0x100e5b0c
push ebx
call fcn.1007b2f8
cmp dword [0x100e5b0c], 0xffffffff
pop ecx
jne 0x10032dd8
push esi
push edi
mov edi, 0x100e5b00
lea esi, [ebp - 0xc]
push 0x100831e7
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10032dd8

Function at 0x100330e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x565e5c5f
mov dword [ebp - 0xc], 0x5e5c4f49
mov dword [ebp - 8], 0x4e501d56
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e5bac]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1003312e
jmp 0x10033127
pop ebx
mov eax, 0x100e5b9c
leave
ret
push ebx
mov ebx, 0x100e5bac
push ebx
call fcn.1007b2f8
cmp dword [0x100e5bac], 0xffffffff
pop ecx
jne 0x10033126
push esi
push edi
mov edi, 0x100e5b9c
lea esi, [ebp - 0x10]
push 0x10083250
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10033126

Function at 0x100331dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x5a544f49
mov dword [ebp - 8], 0x5f4f585a
mov word [ebp - 4], 0x4952
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e5bbc]
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10033220
jmp 0x10033219
pop ebx
mov eax, 0x100e5bb0
leave
ret
push ebx
mov ebx, 0x100e5bbc
push ebx
call fcn.1007b2f8
cmp dword [0x100e5bbc], 0xffffffff
pop ecx
jne 0x10033218
push esi
push edi
mov edi, 0x100e5bb0
lea esi, [ebp - 0xc]
push 0x1008326c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10033218
Function at 0x1003325b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x5a544f49
mov dword [ebp - 8], 0x5f4f585a
mov word [ebp - 4], 0x4952
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e5bcc]
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1003329f
jmp 0x10033298
pop ebx
mov eax, 0x100e5bc0
leave
ret
push ebx
mov ebx, 0x100e5bcc
push ebx
call fcn.1007b2f8
cmp dword [0x100e5bcc], 0xffffffff
pop ecx
jne 0x10033297
push esi
push edi
mov edi, 0x100e5bc0
lea esi, [ebp - 0xc]
push 0x1008327b
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10033297

Function at 0x100333ca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x5e495455
mov dword [ebp - 8], 0x5e535c55
mov word [ebp - 4], 0x3d58
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e5bf8]
cmp eax, dword [ecx + 4]
jg 0x1003340a
jmp 0x10033403
pop ebx
mov eax, 0x100e5bec
leave
ret
push ebx
mov ebx, 0x100e5bf8
push ebx
call fcn.1007b2f8
cmp dword [0x100e5bf8], 0xffffffff
pop ecx
jne 0x10033402
push esi
push edi
mov edi, 0x100e5bec
lea esi, [ebp - 0xc]
push 0x100832a5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10033402

Function at 0x100338d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x1d4e5e4f
mov dword [ebp - 0xc], 0x5252504e
mov dword [ebp - 8], 0x53545549
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e5c94]
mov word [ebp - 4], 0x3d5a
cmp eax, dword [ecx + 4]
jg 0x1003391d
jmp 0x10033916
pop ebx
mov eax, 0x100e5c84
leave
ret
push ebx
mov ebx, 0x100e5c94
push ebx
call fcn.1007b2f8
cmp dword [0x100e5c94], 0xffffffff
pop ecx
jne 0x10033915
push esi
push edi
mov edi, 0x100e5c84
lea esi, [ebp - 0x10]
push 0x1008333f
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10033915
Function at 0x10033c1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x4f5c494e
mov dword [ebp - 0xc], 0x5a535449
mov dword [ebp - 8], 0x52554e1d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e5d00]
mov word [ebp - 4], 0x3d49
cmp eax, dword [ecx + 4]
jg 0x10033c63
jmp 0x10033c5c
pop ebx
mov eax, 0x100e5cf0
leave
ret
push ebx
mov ebx, 0x100e5d00
push ebx
call fcn.1007b2f8
cmp dword [0x100e5d00], 0xffffffff
pop ecx
jne 0x10033c5b
push esi
push edi
mov edi, 0x100e5cf0
lea esi, [ebp - 0x10]
push 0x100833a0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10033c5b

Function at 0x10033d84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x544e544b
mov dword [ebp - 0xc], 0x1d58515f
mov dword [ebp - 8], 0x50585358
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e5d34]
mov word [ebp - 4], 0x3d44
cmp eax, dword [ecx + 4]
jg 0x10033dcb
jmp 0x10033dc4
pop ebx
mov eax, 0x100e5d24
leave
ret
push ebx
mov ebx, 0x100e5d34
push ebx
call fcn.1007b2f8
cmp dword [0x100e5d34], 0xffffffff
pop ecx
jne 0x10033dc3
push esi
push edi
mov edi, 0x100e5d24
lea esi, [ebp - 0x10]
push 0x100833cb
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10033dc3

Function at 0x10033f5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x50585358
mov dword [ebp - 0xc], 0x5c501d44
mov dword [ebp - 8], 0x544f5849
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e5d88]
mov word [ebp - 4], 0x515c
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10033fa7
jmp 0x10033fa0
pop ebx
mov eax, 0x100e5d78
leave
ret
push ebx
mov ebx, 0x100e5d88
push ebx
call fcn.1007b2f8
cmp dword [0x100e5d88], 0xffffffff
pop ecx
jne 0x10033f9f
push esi
push edi
mov edi, 0x100e5d78
lea esi, [ebp - 0x10]
push 0x10083406
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10033f9f
Function at 0x100342b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
movaps xmm0, xmmword [0x10088b40]
push edi
movups xmmword [ebp - 0x1c], xmm0
mov ecx, dword [eax + ecx*4]
mov edi, 0x100e5e00
mov eax, dword [0x100e5e1c]
mov dword [ebp - 0xc], 0x58515f54
mov dword [ebp - 8], 0x51525e62
mov word [ebp - 4], 0x4f52
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10034303
jmp 0x100342fe
pop esi
mov eax, edi
pop edi
leave
ret
push esi
mov esi, 0x100e5e1c
push esi
call fcn.1007b2f8
cmp dword [0x100e5e1c], 0xffffffff
pop ecx
jne 0x100342fd
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000a910
push 0x10083474
call fcn.1007b15e
push esi
call fcn.1007b2a7
pop ecx
pop ecx
jmp 0x100342fd

Function at 0x10034338
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
movaps xmm0, xmmword [0x10088b10]
push edi
movups xmmword [ebp - 0x20], xmm0
mov ecx, dword [eax + ecx*4]
mov edi, 0x100e5e20
mov eax, dword [0x100e5e40]
mov dword [ebp - 0x10], 0x5f544e54
mov dword [ebp - 0xc], 0x5e625851
mov dword [ebp - 8], 0x4f525152
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1003438c
jmp 0x10034387
pop esi
mov eax, edi
pop edi
leave
ret
push esi
mov esi, 0x100e5e40
push esi
call fcn.1007b2f8
cmp dword [0x100e5e40], 0xffffffff
pop ecx
jne 0x10034386
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.1002c26c
push 0x10083486
call fcn.1007b15e
push esi
call fcn.1007b2a7
pop ecx
pop ecx
jmp 0x10034386

Function at 0x10034435
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x50585358
mov dword [ebp - 0xc], 0x51591d44
mov dword [ebp - 8], 0x49555a54
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e5e6c]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1003447a
jmp 0x10034473
pop ebx
mov eax, 0x100e5e5c
leave
ret
push ebx
mov ebx, 0x100e5e6c
push ebx
call fcn.1007b2f8
cmp dword [0x100e5e6c], 0xffffffff
pop ecx
jne 0x10034472
push esi
push edi
mov edi, 0x100e5e5c
lea esi, [ebp - 0x10]
push 0x100834a5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10034472