joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002cd5b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
movaps xmm0, xmmword [0x10088dd0]
push edi
movups xmmword [ebp - 0x1c], xmm0
mov ecx, dword [eax + ecx*4]
mov edi, 0x100e6010
mov eax, dword [0x100e602c]
mov dword [ebp - 0xc], 0x53525449
mov dword [ebp - 8], 0x51525e62
mov word [ebp - 4], 0x4f52
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002cdae
jmp 0x1002cda9
pop esi
mov eax, edi
pop edi
leave
ret
push esi
mov esi, 0x100e602c
push esi
call fcn.1007b2f8
cmp dword [0x100e602c], 0xffffffff
pop ecx
jne 0x1002cda8
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000a910
push 0x100826b0
call fcn.1007b15e
push esi
call fcn.1007b2a7
pop ecx
pop ecx
jmp 0x1002cda8

Function at 0x1002d40a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x555a5453
mov dword [ebp - 8], 0x59525049
mov word [ebp - 4], 0x3d58
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6134]
cmp eax, dword [ecx + 4]
jg 0x1002d44a
jmp 0x1002d443
pop ebx
mov eax, 0x100e6128
leave
ret
push ebx
mov ebx, 0x100e6134
push ebx
call fcn.1007b2f8
cmp dword [0x100e6134], 0xffffffff
pop ecx
jne 0x1002d442
push esi
push edi
mov edi, 0x100e6128
lea esi, [ebp - 0xc]
push 0x10082788
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002d442

Function at 0x1002d5f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x4e5c515b
mov dword [ebp - 8], 0x5a545155
mov word [ebp - 4], 0x4955
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6184]
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002d638
jmp 0x1002d631
pop ebx
mov eax, 0x100e6178
leave
ret
push ebx
mov ebx, 0x100e6184
push ebx
call fcn.1007b2f8
cmp dword [0x100e6184], 0xffffffff
pop ecx
jne 0x1002d630
push esi
push edi
mov edi, 0x100e6178
lea esi, [ebp - 0xc]
push 0x100827c5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002d630
Function at 0x1002d92f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5c4f624f
mov dword [ebp - 0xc], 0x58515354
mov dword [ebp - 8], 0x55495a53
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e61f0]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002d974
jmp 0x1002d96d
pop ebx
mov eax, 0x100e61e0
leave
ret
push ebx
mov ebx, 0x100e61f0
push ebx
call fcn.1007b2f8
cmp dword [0x100e61f0], 0xffffffff
pop ecx
jne 0x1002d96c
push esi
push edi
mov edi, 0x100e61e0
lea esi, [ebp - 0x10]
push 0x10082828
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002d96c

Function at 0x1002da22
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x5c4f624f
mov dword [ebp - 8], 0x4d4e5354
mov dword [ebp - 4], 0x3d595858
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e620c]
cmp eax, dword [ecx + 4]
jg 0x1002da63
jmp 0x1002da5c
pop ebx
mov eax, 0x100e6200
leave
ret
push ebx
mov ebx, 0x100e620c
push ebx
call fcn.1007b2f8
cmp dword [0x100e620c], 0xffffffff
pop ecx
jne 0x1002da5b
push esi
push edi
mov edi, 0x100e6200
lea esi, [ebp - 0xc]
push 0x10082844
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002da5b

Function at 0x1002db12
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5c4f624f
mov dword [ebp - 0xc], 0x5c4f5354
mov dword [ebp - 8], 0x4e485459
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e622c]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002db57
jmp 0x1002db50
pop ebx
mov eax, 0x100e621c
leave
ret
push ebx
mov ebx, 0x100e622c
push ebx
call fcn.1007b2f8
cmp dword [0x100e622c], 0xffffffff
pop ecx
jne 0x1002db4f
push esi
push edi
mov edi, 0x100e621c
lea esi, [ebp - 0x10]
push 0x1008285f
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002db4f
Function at 0x1002dc10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x4a62515e
mov dword [ebp - 0xc], 0x4e595354
mov dword [ebp - 8], 0x5958584d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6250]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002dc55
jmp 0x1002dc4e
pop ebx
mov eax, 0x100e6240
leave
ret
push ebx
mov ebx, 0x100e6250
push ebx
call fcn.1007b2f8
cmp dword [0x100e6250], 0xffffffff
pop ecx
jne 0x1002dc4d
push esi
push edi
mov edi, 0x100e6240
lea esi, [ebp - 0x10]
push 0x1008287c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002dc4d

Function at 0x1002dd03
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x5c4f624f
mov dword [ebp - 8], 0x544a5354
mov dword [ebp - 4], 0x3d554959
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e626c]
cmp eax, dword [ecx + 4]
jg 0x1002dd44
jmp 0x1002dd3d
pop ebx
mov eax, 0x100e6260
leave
ret
push ebx
mov ebx, 0x100e626c
push ebx
call fcn.1007b2f8
cmp dword [0x100e626c], 0xffffffff
pop ecx
jne 0x1002dd3c
push esi
push edi
mov edi, 0x100e6260
lea esi, [ebp - 0xc]
push 0x10082898
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002dd3c

Function at 0x1002ddf4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5859544e
mov dword [ebp - 0xc], 0x51584b1d
mov dword [ebp - 8], 0x49545e52
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6280]
mov word [ebp - 4], 0x3d44
cmp eax, dword [ecx + 4]
jg 0x1002de3b
jmp 0x1002de34
pop ebx
mov eax, 0x100e6270
leave
ret
push ebx
mov ebx, 0x100e6280
push ebx
call fcn.1007b2f8
cmp dword [0x100e6280], 0xffffffff
pop ecx
jne 0x1002de33
push esi
push edi
mov edi, 0x100e6270
lea esi, [ebp - 0x10]
push 0x100828b2
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002de33
Function at 0x1002de76
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5c6f624f
mov dword [ebp - 0xc], 0x546e5354
mov dword [ebp - 8], 0x586b5859
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6294]
mov word [ebp - 4], 0x3d51
cmp eax, dword [ecx + 4]
jg 0x1002debd
jmp 0x1002deb6
pop ebx
mov eax, 0x100e6284
leave
ret
push ebx
mov ebx, 0x100e6294
push ebx
call fcn.1007b2f8
cmp dword [0x100e6294], 0xffffffff
pop ecx
jne 0x1002deb5
push esi
push edi
mov edi, 0x100e6284
lea esi, [ebp - 0x10]
push 0x100828c1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002deb5

Function at 0x1002df6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x5c4f624f
mov dword [ebp - 8], 0x515c5354
mov dword [ebp - 4], 0x3d5c554d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e62b0]
cmp eax, dword [ecx + 4]
jg 0x1002dfad
jmp 0x1002dfa6
pop ebx
mov eax, 0x100e62a4
leave
ret
push ebx
mov ebx, 0x100e62b0
push ebx
call fcn.1007b2f8
cmp dword [0x100e62b0], 0xffffffff
pop ecx
jne 0x1002dfa5
push esi
push edi
mov edi, 0x100e62a4
lea esi, [ebp - 0xc]
push 0x100828de
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002dfa5

Function at 0x1002e248
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
movaps xmm0, xmmword [0x10088ba0]
push edi
movups xmmword [ebp - 0x1c], xmm0
mov ecx, dword [eax + ecx*4]
mov edi, 0x100e6314
mov eax, dword [0x100e6330]
mov dword [ebp - 0xc], 0x6258515e
mov dword [ebp - 8], 0x5251525e
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x1002e297
jmp 0x1002e292
pop esi
mov eax, edi
pop edi
leave
ret
push esi
mov esi, 0x100e6330
push esi
call fcn.1007b2f8
cmp dword [0x100e6330], 0xffffffff
pop ecx
jne 0x1002e291
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1002660b
push 0x10082936
call fcn.1007b15e
push esi
call fcn.1007b2a7
pop ecx
pop ecx
jmp 0x1002e291
Function at 0x1002e514
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x584b1e1e
mov dword [ebp - 0xc], 0x545e5251
mov dword [ebp - 8], 0x51624449
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6394]
mov word [ebp - 4], 0x4a52
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002e55f
jmp 0x1002e558
pop ebx
mov eax, 0x100e6384
leave
ret
push ebx
mov ebx, 0x100e6394
push ebx
call fcn.1007b2f8
cmp dword [0x100e6394], 0xffffffff
pop ecx
jne 0x1002e557
push esi
push edi
mov edi, 0x100e6384
lea esi, [ebp - 0x10]
push 0x10082993
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002e557

Function at 0x1002e76b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5251584b
mov dword [ebp - 0xc], 0x4449545e
mov dword [ebp - 8], 0x5c4f5a1d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6404]
mov word [ebp - 4], 0x554d
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002e7b6
jmp 0x1002e7af
pop ebx
mov eax, 0x100e63f4
leave
ret
push ebx
mov ebx, 0x100e6404
push ebx
call fcn.1007b2f8
cmp dword [0x100e6404], 0xffffffff
pop ecx
jne 0x1002e7ae
push esi
push edi
mov edi, 0x100e63f4
lea esi, [ebp - 0x10]
push 0x100829e0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002e7ae

Function at 0x1002e8e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x505c494e
mov dword [ebp - 0xc], 0x1d5c5354
mov dword [ebp - 8], 0x4d5c4f5a
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6434]
mov word [ebp - 4], 0x3d55
cmp eax, dword [ecx + 4]
jg 0x1002e92e
jmp 0x1002e927
pop ebx
mov eax, 0x100e6424
leave
ret
push ebx
mov ebx, 0x100e6434
push ebx
call fcn.1007b2f8
cmp dword [0x100e6434], 0xffffffff
pop ecx
jne 0x1002e926
push esi
push edi
mov edi, 0x100e6424
lea esi, [ebp - 0x10]
push 0x10082a11
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002e926
Function at 0x1002e9e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x4d5c4f5a
mov dword [ebp - 0xc], 0x58551d55
mov dword [ebp - 8], 0x49555a54
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6464]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002ea2b
jmp 0x1002ea24
pop ebx
mov eax, 0x100e6454
leave
ret
push ebx
mov ebx, 0x100e6464
push ebx
call fcn.1007b2f8
cmp dword [0x100e6464], 0xffffffff
pop ecx
jne 0x1002ea23
push esi
push edi
mov edi, 0x100e6454
lea esi, [ebp - 0x10]
push 0x10082a31
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002ea23

Function at 0x1002ea65
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5e4e5450
mov dword [ebp - 0xc], 0x5c515158
mov dword [ebp - 8], 0x48525853
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6478]
mov word [ebp - 4], 0x3d4e
cmp eax, dword [ecx + 4]
jg 0x1002eaac
jmp 0x1002eaa5
pop ebx
mov eax, 0x100e6468
leave
ret
push ebx
mov ebx, 0x100e6478
push ebx
call fcn.1007b2f8
cmp dword [0x100e6478], 0xffffffff
pop ecx
jne 0x1002eaa4
push esi
push edi
mov edi, 0x100e6468
lea esi, [ebp - 0x10]
push 0x10082a3f
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002eaa4

Function at 0x1002eb69
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x584b584f
mov dword [ebp - 0xc], 0x4f1d515c
mov dword [ebp - 8], 0x4f5c595c
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e64ac]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002ebae
jmp 0x1002eba7
pop ebx
mov eax, 0x100e649c
leave
ret
push ebx
mov ebx, 0x100e64ac
push ebx
call fcn.1007b2f8
cmp dword [0x100e64ac], 0xffffffff
pop ecx
jne 0x1002eba6
push esi
push edi
mov edi, 0x100e649c
lea esi, [ebp - 0x10]
push 0x10082a5e
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002eba6
Function at 0x1002ebe8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5e584d4e
mov dword [ebp - 0xc], 0x52495c49
mov dword [ebp - 8], 0x54511d4f
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e64c0]
mov word [ebp - 4], 0x494e
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002ec33
jmp 0x1002ec2c
pop ebx
mov eax, 0x100e64b0
leave
ret
push ebx
mov ebx, 0x100e64c0
push ebx
call fcn.1007b2f8
cmp dword [0x100e64c0], 0xffffffff
pop ecx
jne 0x1002ec2b
push esi
push edi
mov edi, 0x100e64b0
lea esi, [ebp - 0x10]
push 0x10082a6c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002ec2b

Function at 0x1002ee3a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x4f545549
mov dword [ebp - 8], 0x4f584d59
mov dword [ebp - 4], 0x3d53524e
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6510]
cmp eax, dword [ecx + 4]
jg 0x1002ee7b
jmp 0x1002ee74
pop ebx
mov eax, 0x100e6504
leave
ret
push ebx
mov ebx, 0x100e6510
push ebx
call fcn.1007b2f8
cmp dword [0x100e6510], 0xffffffff
pop ecx
jne 0x1002ee73
push esi
push edi
mov edi, 0x100e6504
lea esi, [ebp - 0xc]
push 0x10082ab4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002ee73

Function at 0x1002f11e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5652504e
mov dword [ebp - 0xc], 0x5b581d58
mov dword [ebp - 8], 0x495e585b
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e65ac]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002f163
jmp 0x1002f15c
pop ebx
mov eax, 0x100e659c
leave
ret
push ebx
mov ebx, 0x100e65ac
push ebx
call fcn.1007b2f8
cmp dword [0x100e65ac], 0xffffffff
pop ecx
jne 0x1002f15b
push esi
push edi
mov edi, 0x100e659c
lea esi, [ebp - 0x10]
push 0x10082b0f
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002f15b
Function at 0x1002f378
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5c4e5459
mov dword [ebp - 0xc], 0x1d58515f
mov dword [ebp - 8], 0x5252515f
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6608]
mov word [ebp - 4], 0x3d50
cmp eax, dword [ecx + 4]
jg 0x1002f3bf
jmp 0x1002f3b8
pop ebx
mov eax, 0x100e65f8
leave
ret
push ebx
mov ebx, 0x100e6608
push ebx
call fcn.1007b2f8
cmp dword [0x100e6608], 0xffffffff
pop ecx
jne 0x1002f3b7
push esi
push edi
mov edi, 0x100e65f8
lea esi, [ebp - 0x10]
push 0x10082b57
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002f3b7

Function at 0x1002f481
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x5c4e5459
mov dword [ebp - 0xc], 0x1d58515f
mov dword [ebp - 8], 0x4e5c4f5a
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6630]
mov word [ebp - 4], 0x3d4e
cmp eax, dword [ecx + 4]
jg 0x1002f4c8
jmp 0x1002f4c1
pop ebx
mov eax, 0x100e6620
leave
ret
push ebx
mov ebx, 0x100e6630
push ebx
call fcn.1007b2f8
cmp dword [0x100e6630], 0xffffffff
pop ecx
jne 0x1002f4c0
push esi
push edi
mov edi, 0x100e6620
lea esi, [ebp - 0x10]
push 0x10082b76
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002f4c0

Function at 0x1002f66a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x584b5250
mov dword [ebp - 8], 0x49535850
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e668c]
cmp eax, dword [ecx + 4]
jg 0x1002f6a8
jmp 0x1002f6a1
pop ebx
mov eax, 0x100e6680
leave
ret
push ebx
mov ebx, 0x100e668c
push ebx
call fcn.1007b2f8
cmp dword [0x100e668c], 0xffffffff
pop ecx
jne 0x1002f6a0
push esi
push edi
mov edi, 0x100e6680
lea esi, [ebp - 0xc]
push 0x10082bb5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002f6a0
Function at 0x1002f93b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x545b5354
mov dword [ebp - 0xc], 0x58495453
mov dword [ebp - 8], 0x5e48591d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e66f4]
mov word [ebp - 4], 0x3d56
cmp eax, dword [ecx + 4]
jg 0x1002f982
jmp 0x1002f97b
pop ebx
mov eax, 0x100e66e4
leave
ret
push ebx
mov ebx, 0x100e66f4
push ebx
call fcn.1007b2f8
cmp dword [0x100e66f4], 0xffffffff
pop ecx
jne 0x1002f97a
push esi
push edi
mov edi, 0x100e66e4
lea esi, [ebp - 0x10]
push 0x10082c0b
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002f97a

Function at 0x1002fa31
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x59581e1e
mov dword [ebp - 0xc], 0x485f585a
mov dword [ebp - 8], 0x4458565a
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6714]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1002fa76
jmp 0x1002fa6f
pop ebx
mov eax, 0x100e6704
leave
ret
push ebx
mov ebx, 0x100e6714
push ebx
call fcn.1007b2f8
cmp dword [0x100e6714], 0xffffffff
pop ecx
jne 0x1002fa6e
push esi
push edi
mov edi, 0x100e6704
lea esi, [ebp - 0x10]
push 0x10082c29
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002fa6e

Function at 0x1002fab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x585a5958
mov dword [ebp - 0xc], 0x1d5a485f
mov dword [ebp - 8], 0x565e5449
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100e6728]
mov word [ebp - 4], 0x3d4e
cmp eax, dword [ecx + 4]
jg 0x1002faf7
jmp 0x1002faf0
pop ebx
mov eax, 0x100e6718
leave
ret
push ebx
mov ebx, 0x100e6728
push ebx
call fcn.1007b2f8
cmp dword [0x100e6728], 0xffffffff
pop ecx
jne 0x1002faef
push esi
push edi
mov edi, 0x100e6718
lea esi, [ebp - 0x10]
push 0x10082c37
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1002faef