joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016576
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1009d640]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x100165ce
cmp byte [esi + 0x3d], bl
je 0x100165ce
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10016608
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, ebx
je 0x100165df
sub eax, 1
je 0x100165e2
dec eax
sub eax, 1
jne 0x10016608
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007b173
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10016600
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10016608
cmp byte [esi + 0x3d], bl
sete al
jmp 0x100165d0
xor al, al
jmp 0x100165d0

Function at 0x100168f2
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1f], 0
je 0x10016911
xor eax, eax
movups xmm0, xmmword [eax + ecx]
xorps xmm0, xmmword [str.PbTPmHSUSZQX]
movups xmmword [eax + ecx], xmm0
add eax, 0x10
cmp eax, 0x20
jb 0x100168fa
ret
Function at 0x10017179
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1009d640]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
or esi, 0xffffffff
push edi
mov edi, ecx
cmp ebx, esi
jne 0x1001719f
xor eax, eax
jmp 0x1001726f
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
test eax, eax
je 0x100171d3
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const]
mov ecx, edi
mov esi, eax
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp eax, esi
jae 0x100171d0
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x1001726f
or esi, 0xffffffff
cmp dword [edi + 0x4c], 0
je 0x1001726d
mov ecx, edi
call fcn.10016796
mov ecx, dword [edi + 0x38]
mov al, bl
test ecx, ecx
jne 0x100171ff
push dword [edi + 0x4c]
push eax
call fcn.10015652
test al, al
pop ecx
pop ecx
cmove ebx, esi
jmp 0x100171c9
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001723c
sub eax, 1
je 0x1001723c
dec eax
sub eax, 1
jne 0x1001726d
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x100171f1
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x10017260
push dword [edi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x1001726d
lea eax, [ebp - 0x28]
mov byte [edi + 0x3d], 1
cmp dword [ebp - 0x34], eax
cmovne esi, ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007b173
leave
ret 4
Function at 0x1001771d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, ecx
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jg 0x10017741
jl 0x10017738
test edi, edi
jne 0x10017741
xor eax, eax
xor edx, edx
jmp 0x1001780b
cmp dword [eax + 0x38], 0
je 0x10017757
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x1001780b
push ebx
mov ebx, edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
test eax, eax
je 0x10017795
mov ecx, dword [ebp - 4]
cmp eax, edi
mov esi, edi
cmovb esi, eax
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push esi
push eax
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 4]
add esp, 0xc
add dword [ebp + 8], esi
sub ebx, esi
push esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov esi, dword [ebp + 0x10]
jmp 0x1001779b
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
mov ecx, ebx
cmp dword [eax + 0x4c], 0
je 0x10017801
mov ecx, eax
call fcn.10016796
mov edx, dword [ebp + 8]
mov ecx, ebx
jmp 0x100177de
mov eax, dword [ebp - 4]
push dword [eax + 0x4c]
push 0xfff
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, dword [ebp + 8]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [ebp + 8], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x10017811
cmp ebx, 0xfff
ja 0x100177b4
test ecx, ecx
je 0x10017801
mov eax, dword [ebp - 4]
push dword [eax + 0x4c]
push ebx
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
leave
ret 0xc
sub edi, ebx
jmp 0x10017803
Function at 0x10017815
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10017838
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x100178d7
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x100178cb
jg 0x1001785e
test esi, esi
je 0x100178cb
test ecx, ecx
jl 0x100178ad
jg 0x10017868
test eax, eax
je 0x100178ad
cmp edi, ecx
jg 0x10017878
jl 0x10017872
cmp esi, eax
jae 0x10017878
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], eax
mov ecx, ebx
sub esi, eax
sbb edi, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
test edi, edi
jl 0x100178cb
jg 0x100178ad
test esi, esi
je 0x100178cb
cmp dword [ebx + 0x4c], 0
mov eax, dword [ebp + 8]
je 0x100178cb
push dword [ebx + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10017d4b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x78584e5c
mov dword [ebp - 8], 0x49544953
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100defa4]
mov word [ebp - 4], 0x3d44
cmp eax, dword [ecx + 4]
jg 0x10017d92
jmp 0x10017d8b
pop ebx
mov eax, 0x100def94
leave
ret
push ebx
mov ebx, 0x100defa4
push ebx
call fcn.1007b2f8
cmp dword [0x100defa4], 0xffffffff
pop ecx
jne 0x10017d8a
push esi
push edi
mov edi, 0x100def94
lea esi, [ebp - 0x10]
push 0x10081dbf
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10017d8a
Function at 0x10017ec9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x6d584e5c
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100df22c]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x10017f10
jmp 0x10017f09
pop ebx
mov eax, 0x100df21c
leave
ret
push ebx
mov ebx, 0x100df22c
push ebx
call fcn.1007b2f8
cmp dword [0x100df22c], 0xffffffff
pop ecx
jne 0x10017f08
push esi
push edi
mov edi, 0x100df21c
lea esi, [ebp - 0x10]
push 0x10081dec
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10017f08

Function at 0x1001804b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x7c546250
mov dword [ebp - 0xc], 0x48525e5e
mov dword [ebp - 8], 0x79744953
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100df1e0]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10018090
jmp 0x10018089
pop ebx
mov eax, 0x100df1d0
leave
ret
push ebx
mov ebx, 0x100df1e0
push ebx
call fcn.1007b2f8
cmp dword [0x100df1e0], 0xffffffff
pop ecx
jne 0x10018088
push esi
push edi
mov edi, 0x100df1d0
lea esi, [ebp - 0x10]
push 0x10081e1c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10018088

Function at 0x10018391
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x74546250
mov dword [ebp - 0xc], 0x74505849
mov dword [ebp - 8], 0x5a547579
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100df214]
mov word [ebp - 4], 0x3d55
cmp eax, dword [ecx + 4]
jg 0x100183d8
jmp 0x100183d1
pop ebx
mov eax, 0x100df204
leave
ret
push ebx
mov ebx, 0x100df214
push ebx
call fcn.1007b2f8
cmp dword [0x100df214], 0xffffffff
pop ecx
jne 0x100183d0
push esi
push edi
mov edi, 0x100df204
lea esi, [ebp - 0x10]
push 0x10081e86
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100183d0
Function at 0x10018413
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x70536250
mov dword [ebp - 0xc], 0x51585952
mov dword [ebp - 8], 0x58595374
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100defb8]
mov word [ebp - 4], 0x3d45
cmp eax, dword [ecx + 4]
jg 0x1001845a
jmp 0x10018453
pop ebx
mov eax, 0x100defa8
leave
ret
push ebx
mov ebx, 0x100defb8
push ebx
call fcn.1007b2f8
cmp dword [0x100defb8], 0xffffffff
pop ecx
jne 0x10018452
push esi
push edi
mov edi, 0x100defa8
lea esi, [ebp - 0x10]
push 0x10081e95
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10018452

Function at 0x10018604
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x6a556250
mov dword [ebp - 8], 0x524d5c58
mov word [ebp - 4], 0x3d53
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100defe4]
cmp eax, dword [ecx + 4]
jg 0x10018644
jmp 0x1001863d
pop ebx
mov eax, 0x100defd8
leave
ret
push ebx
mov ebx, 0x100defe4
push ebx
call fcn.1007b2f8
cmp dword [0x100defe4], 0xffffffff
pop ecx
jne 0x1001863c
push esi
push edi
mov edi, 0x100defd8
lea esi, [ebp - 0xc]
push 0x10081ed3
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001863c

Function at 0x1001a077
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x14], 0
je 0x1001a089
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x15
jb 0x1001a07f
mov eax, ecx
ret

Function at 0x1001a08c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1b], 0
je 0x1001a09e
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x1c
jb 0x1001a094
mov eax, ecx
ret

Function at 0x1001a0a1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x58595250
mov dword [ebp - 0xc], 0x4d124e51
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100df75c]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x1001a0e8
jmp 0x1001a0e1
pop ebx
mov eax, 0x100df74c
leave
ret
push ebx
mov ebx, 0x100df75c
push ebx
call fcn.1007b2f8
cmp dword [0x100df75c], 0xffffffff
pop ecx
jne 0x1001a0e0
push esi
push edi
mov edi, 0x100df74c
lea esi, [ebp - 0x10]
push 0x10081ef5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001a0e0
Function at 0x1001a7b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x49455849
mov dword [ebp - 8], 0x59584f48
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100df6f8]
cmp eax, dword [ecx + 4]
jg 0x1001a7f5
jmp 0x1001a7ee
pop ebx
mov eax, 0x100df6ec
leave
ret
push ebx
mov ebx, 0x100df6f8
push ebx
call fcn.1007b2f8
cmp dword [0x100df6f8], 0xffffffff
pop ecx
jne 0x1001a7ed
push esi
push edi
mov edi, 0x100df6ec
lea esi, [ebp - 0xc]
push 0x10081f8c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001a7ed

Function at 0x1001a8a5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x4a52515a
mov dword [ebp - 8], 0x495c5062
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100df730]
cmp eax, dword [ecx + 4]
jg 0x1001a8e3
jmp 0x1001a8dc
pop ebx
mov eax, 0x100df724
leave
ret
push ebx
mov ebx, 0x100df730
push ebx
call fcn.1007b2f8
cmp dword [0x100df730], 0xffffffff
pop ecx
jne 0x1001a8db
push esi
push edi
mov edi, 0x100df724
lea esi, [ebp - 0xc]
push 0x10081fa8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001a8db

Function at 0x1001aa8a
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x141], 0
je 0x1001aaa1
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x142
jb 0x1001aa95
ret

Function at 0x1001aaa2
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x192], 0
je 0x1001aab9
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x193
jb 0x1001aaad
ret

Function at 0x1001aaba
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xc2], 0
je 0x1001aad1
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0xc3
jb 0x1001aac5
ret

Function at 0x1001c4ae
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x20], 0
je 0x1001c4c0
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x21
jb 0x1001c4b6
mov eax, ecx
ret

Function at 0x1001c4c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x4e51524e
mov dword [ebp - 8], 0x585e5449
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100dffb8]
cmp eax, dword [ecx + 4]
jg 0x1001c501
jmp 0x1001c4fa
pop ebx
mov eax, 0x100dffac
leave
ret
push ebx
mov ebx, 0x100dffb8
push ebx
call fcn.1007b2f8
cmp dword [0x100dffb8], 0xffffffff
pop ecx
jne 0x1001c4f9
push esi
push edi
mov edi, 0x100dffac
lea esi, [ebp - 0xc]
push 0x10081feb
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001c4f9
Function at 0x1001c53a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x5c49495c
mov dword [ebp - 8], 0x4f58565e
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100dff2c]
cmp eax, dword [ecx + 4]
jg 0x1001c578
jmp 0x1001c571
pop ebx
mov eax, 0x100dff20
leave
ret
push ebx
mov ebx, 0x100dff2c
push ebx
call fcn.1007b2f8
cmp dword [0x100dff2c], 0xffffffff
pop ecx
jne 0x1001c570
push esi
push edi
mov edi, 0x100dff20
lea esi, [ebp - 0xc]
push 0x10081ff8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001c570

Function at 0x1001c632
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
movaps xmm0, xmmword [0x10087f20]
push edi
movups xmmword [ebp - 0x1c], xmm0
mov ecx, dword [eax + ecx*4]
mov edi, 0x100dfefc
mov eax, dword [0x100dff18]
mov dword [ebp - 0xc], 0x62595c58
mov dword [ebp - 8], 0x4a52554e
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1001c67f
jmp 0x1001c67a
pop esi
mov eax, edi
pop edi
leave
ret
push esi
mov esi, 0x100dff18
push esi
call fcn.1007b2f8
cmp dword [0x100dff18], 0xffffffff
pop ecx
jne 0x1001c679
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000a8d4
push 0x10082017
call fcn.1007b15e
push esi
call fcn.1007b2a7
pop ecx
pop ecx
jmp 0x1001c679

Function at 0x1001c6b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x62495c50
mov dword [ebp - 0xc], 0x5151485b
mov dword [ebp - 8], 0x5a544f5f
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100dfe14]
mov word [ebp - 4], 0x4955
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1001c6ff
jmp 0x1001c6f8
pop ebx
mov eax, 0x100dfe04
leave
ret
push ebx
mov ebx, 0x100dfe14
push ebx
call fcn.1007b2f8
cmp dword [0x100dfe14], 0xffffffff
pop ecx
jne 0x1001c6f7
push esi
push edi
mov edi, 0x100dfe04
lea esi, [ebp - 0x10]
push 0x10082027
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001c6f7
Function at 0x1001c880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x5c49495c
mov dword [ebp - 8], 0x4f58565e
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100dffd8]
cmp eax, dword [ecx + 4]
jg 0x1001c8be
jmp 0x1001c8b7
pop ebx
mov eax, 0x100dffcc
leave
ret
push ebx
mov ebx, 0x100dffd8
push ebx
call fcn.1007b2f8
cmp dword [0x100dffd8], 0xffffffff
pop ecx
jne 0x1001c8b6
push esi
push edi
mov edi, 0x100dffcc
lea esi, [ebp - 0xc]
push 0x10082055
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001c8b6

Function at 0x1001c8f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5e62515e
mov dword [ebp - 0xc], 0x4e62504e
mov dword [ebp - 8], 0x52595c55
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100dfe30]
mov word [ebp - 4], 0x4e4a
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1001c942
jmp 0x1001c93b
pop ebx
mov eax, 0x100dfe20
leave
ret
push ebx
mov ebx, 0x100dfe30
push ebx
call fcn.1007b2f8
cmp dword [0x100dfe30], 0xffffffff
pop ecx
jne 0x1001c93a
push esi
push edi
mov edi, 0x100dfe20
lea esi, [ebp - 0x10]
push 0x10082072
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001c93a

Function at 0x1001cbc9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100df7d0]
cmp eax, dword [ecx + 4]
jg 0x1001cc0a
jmp 0x1001cc03
pop ebx
mov eax, 0x100df7c4
leave
ret
push ebx
mov ebx, 0x100df7d0
push ebx
call fcn.1007b2f8
cmp dword [0x100df7d0], 0xffffffff
pop ecx
jne 0x1001cc02
push esi
push edi
mov edi, 0x100df7c4
lea esi, [ebp - 0xc]
push 0x100820cf
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001cc02