joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ac66
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10082940]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
or esi, 0xffffffff
push edi
mov edi, ecx
cmp ebx, esi
jne 0x1000ac8c
xor eax, eax
jmp 0x1000ad5c
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
test eax, eax
je 0x1000acc0
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const]
mov ecx, edi
mov esi, eax
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp eax, esi
jae 0x1000acbd
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x1000ad5c
or esi, 0xffffffff
cmp dword [edi + 0x4c], 0
je 0x1000ad5a
mov ecx, edi
call fcn.1000a2d1
mov ecx, dword [edi + 0x38]
mov al, bl
test ecx, ecx
jne 0x1000acec
push dword [edi + 0x4c]
push eax
call fcn.10009118
test al, al
pop ecx
pop ecx
cmove ebx, esi
jmp 0x1000acb6
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1000ad29
sub eax, 1
je 0x1000ad29
dec eax
sub eax, 1
jne 0x1000ad5a
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x1000acde
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x1000ad4d
push dword [edi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x1000ad5a
lea eax, [ebp - 0x28]
mov byte [edi + 0x3d], 1
cmp dword [ebp - 0x30], eax
cmovne esi, ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10066b33
leave
ret 4
Function at 0x1000b23c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test esi, esi
jg 0x1000b267
jl 0x1000b25e
test ebx, ebx
jne 0x1000b267
xor eax, eax
xor edx, edx
jmp 0x1000b32b
cmp dword [eax + 0x38], 0
je 0x1000b27d
push esi
push ebx
push ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x1000b32b
push edi
mov ecx, eax
mov edi, ebx
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
test eax, eax
je 0x1000b2bb
mov ecx, dword [ebp - 8]
cmp eax, ebx
mov esi, ebx
cmovb esi, eax
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push esi
push eax
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 8]
add esp, 0xc
add dword [ebp - 4], esi
sub edi, esi
push esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov ecx, edi
cmp dword [eax + 0x4c], 0
je 0x1000b321
mov ecx, eax
call fcn.1000a2d1
mov edx, dword [ebp - 4]
mov ecx, edi
jmp 0x1000b2fe
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push 0xfff
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, dword [ebp - 4]
sub edi, eax
add edx, eax
add esp, 0x10
mov dword [ebp - 4], edx
mov ecx, edi
cmp eax, 0xfff
jne 0x1000b331
cmp edi, 0xfff
ja 0x1000b2d4
test ecx, ecx
je 0x1000b321
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push edi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, edi
add esp, 0x10
sub ecx, eax
sub ebx, ecx
sbb esi, 0
mov eax, ebx
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
sub ebx, edi
jmp 0x1000b323
Function at 0x1000b335
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000b358
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x1000b3f7
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x1000b3eb
jg 0x1000b37e
test esi, esi
je 0x1000b3eb
test ecx, ecx
jl 0x1000b3cd
jg 0x1000b388
test eax, eax
je 0x1000b3cd
cmp edi, ecx
jg 0x1000b398
jl 0x1000b392
cmp esi, eax
jae 0x1000b398
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], eax
mov ecx, ebx
sub esi, eax
sbb edi, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
test edi, edi
jl 0x1000b3eb
jg 0x1000b3cd
test esi, esi
je 0x1000b3eb
cmp dword [ebx + 0x4c], 0
mov eax, dword [ebp + 8]
je 0x1000b3eb
push dword [ebx + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1000b43a
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x26], 0
je 0x1000b44c
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x27
jb 0x1000b442
mov eax, ecx
ret

Function at 0x1000b8be
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x78584e5c
mov dword [ebp - 8], 0x49544953
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cfb04]
mov word [ebp - 4], 0x3d44
cmp eax, dword [ecx + 4]
jg 0x1000b905
jmp 0x1000b8fe
pop ebx
mov eax, 0x105cfaf4
leave
ret
push ebx
mov ebx, 0x105cfb04
push ebx
call fcn.10066acf
cmp dword [0x105cfb04], 0xffffffff
pop ecx
jne 0x1000b8fd
push esi
push edi
mov edi, 0x105cfaf4
lea esi, [ebp - 0x10]
push 0x1006b6bd
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000b8fd
Function at 0x1000ba3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x6d584e5c
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cfd8c]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x1000ba83
jmp 0x1000ba7c
pop ebx
mov eax, 0x105cfd7c
leave
ret
push ebx
mov ebx, 0x105cfd8c
push ebx
call fcn.10066acf
cmp dword [0x105cfd8c], 0xffffffff
pop ecx
jne 0x1000ba7b
push esi
push edi
mov edi, 0x105cfd7c
lea esi, [ebp - 0x10]
push 0x1006b6ea
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000ba7b

Function at 0x1000bbbe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x7c546250
mov dword [ebp - 0xc], 0x48525e5e
mov dword [ebp - 8], 0x79744953
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cfd40]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1000bc03
jmp 0x1000bbfc
pop ebx
mov eax, 0x105cfd30
leave
ret
push ebx
mov ebx, 0x105cfd40
push ebx
call fcn.10066acf
cmp dword [0x105cfd40], 0xffffffff
pop ecx
jne 0x1000bbfb
push esi
push edi
mov edi, 0x105cfd30
lea esi, [ebp - 0x10]
push 0x1006b71a
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000bbfb

Function at 0x1000bf04
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x74546250
mov dword [ebp - 0xc], 0x74505849
mov dword [ebp - 8], 0x5a547579
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cfd74]
mov word [ebp - 4], 0x3d55
cmp eax, dword [ecx + 4]
jg 0x1000bf4b
jmp 0x1000bf44
pop ebx
mov eax, 0x105cfd64
leave
ret
push ebx
mov ebx, 0x105cfd74
push ebx
call fcn.10066acf
cmp dword [0x105cfd74], 0xffffffff
pop ecx
jne 0x1000bf43
push esi
push edi
mov edi, 0x105cfd64
lea esi, [ebp - 0x10]
push 0x1006b784
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000bf43
Function at 0x1000bf86
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x70536250
mov dword [ebp - 0xc], 0x51585952
mov dword [ebp - 8], 0x58595374
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cfb18]
mov word [ebp - 4], 0x3d45
cmp eax, dword [ecx + 4]
jg 0x1000bfcd
jmp 0x1000bfc6
pop ebx
mov eax, 0x105cfb08
leave
ret
push ebx
mov ebx, 0x105cfb18
push ebx
call fcn.10066acf
cmp dword [0x105cfb18], 0xffffffff
pop ecx
jne 0x1000bfc5
push esi
push edi
mov edi, 0x105cfb08
lea esi, [ebp - 0x10]
push 0x1006b793
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000bfc5

Function at 0x1000c177
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x6a556250
mov dword [ebp - 8], 0x524d5c58
mov word [ebp - 4], 0x3d53
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cfb44]
cmp eax, dword [ecx + 4]
jg 0x1000c1b7
jmp 0x1000c1b0
pop ebx
mov eax, 0x105cfb38
leave
ret
push ebx
mov ebx, 0x105cfb44
push ebx
call fcn.10066acf
cmp dword [0x105cfb44], 0xffffffff
pop ecx
jne 0x1000c1af
push esi
push edi
mov edi, 0x105cfb38
lea esi, [ebp - 0xc]
push 0x1006b7d1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000c1af

Function at 0x1000dcc4
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 3], 0
je 0x1000dcd6
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 4
jb 0x1000dccc
mov eax, ecx
ret

Function at 0x1000dcd9
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1b], 0
je 0x1000dceb
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x1c
jb 0x1000dce1
mov eax, ecx
ret

Function at 0x1000e22f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x49455849
mov dword [ebp - 8], 0x59584f48
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d0034]
cmp eax, dword [ecx + 4]
jg 0x1000e26d
jmp 0x1000e266
pop ebx
mov eax, 0x105d0028
leave
ret
push ebx
mov ebx, 0x105d0034
push ebx
call fcn.10066acf
cmp dword [0x105d0034], 0xffffffff
pop ecx
jne 0x1000e265
push esi
push edi
mov edi, 0x105d0028
lea esi, [ebp - 0xc]
push 0x1006b85e
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000e265
Function at 0x1000e31d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x4a52515a
mov dword [ebp - 8], 0x495c5062
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d005c]
cmp eax, dword [ecx + 4]
jg 0x1000e35b
jmp 0x1000e354
pop ebx
mov eax, 0x105d0050
leave
ret
push ebx
mov ebx, 0x105d005c
push ebx
call fcn.10066acf
cmp dword [0x105d005c], 0xffffffff
pop ecx
jne 0x1000e353
push esi
push edi
mov edi, 0x105d0050
lea esi, [ebp - 0xc]
push 0x1006b87a
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000e353

Function at 0x1000e3f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x58595250
mov dword [ebp - 0xc], 0x4d124e51
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d0078]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x1000e43e
jmp 0x1000e437
pop ebx
mov eax, 0x105d0068
leave
ret
push ebx
mov ebx, 0x105d0078
push ebx
call fcn.10066acf
cmp dword [0x105d0078], 0xffffffff
pop ecx
jne 0x1000e436
push esi
push edi
mov edi, 0x105d0068
lea esi, [ebp - 0x10]
push 0x1006b88f
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000e436

Function at 0x1000e4bd
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x108], 0
je 0x1000e4d4
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x109
jb 0x1000e4c8
ret

Function at 0x1000e4d5
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xc2], 0
je 0x1000e4ec
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0xc3
jb 0x1000e4e0
ret

Function at 0x1000f5cf
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x11], 0
je 0x1000f5e1
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x12
jb 0x1000f5d7
mov eax, ecx
ret

Function at 0x1000f5e4
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x14], 0
je 0x1000f5f6
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x15
jb 0x1000f5ec
mov eax, ecx
ret

Function at 0x1000f5f9
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x20], 0
je 0x1000f60b
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x21
jb 0x1000f601
mov eax, ecx
ret

Function at 0x1000f60e
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x28], 0
je 0x1000f620
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x29
jb 0x1000f616
mov eax, ecx
ret

Function at 0x1000f623
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x4b], 0
je 0x1000f635
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x4c
jb 0x1000f62b
mov eax, ecx
ret
Function at 0x1000f638
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x56], 0
je 0x1000f64a
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x57
jb 0x1000f640
mov eax, ecx
ret

Function at 0x1000f885
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d0158]
cmp eax, dword [ecx + 4]
jg 0x1000f8c6
jmp 0x1000f8bf
pop ebx
mov eax, 0x105d014c
leave
ret
push ebx
mov ebx, 0x105d0158
push ebx
call fcn.10066acf
cmp dword [0x105d0158], 0xffffffff
pop ecx
jne 0x1000f8be
push esi
push edi
mov edi, 0x105d014c
lea esi, [ebp - 0xc]
push 0x1006b8f8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000f8be

Function at 0x1000f8ff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d012c]
cmp eax, dword [ecx + 4]
jg 0x1000f940
jmp 0x1000f939
pop ebx
mov eax, 0x105d0120
leave
ret
push ebx
mov ebx, 0x105d012c
push ebx
call fcn.10066acf
cmp dword [0x105d012c], 0xffffffff
pop ecx
jne 0x1000f938
push esi
push edi
mov edi, 0x105d0120
lea esi, [ebp - 0xc]
push 0x1006b905
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000f938

Function at 0x1000f979
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d00e0]
cmp eax, dword [ecx + 4]
jg 0x1000f9ba
jmp 0x1000f9b3
pop ebx
mov eax, 0x105d00d4
leave
ret
push ebx
mov ebx, 0x105d00e0
push ebx
call fcn.10066acf
cmp dword [0x105d00e0], 0xffffffff
pop ecx
jne 0x1000f9b2
push esi
push edi
mov edi, 0x105d00d4
lea esi, [ebp - 0xc]
push 0x1006b912
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000f9b2
Function at 0x1000f9f3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d0108]
cmp eax, dword [ecx + 4]
jg 0x1000fa34
jmp 0x1000fa2d
pop ebx
mov eax, 0x105d00fc
leave
ret
push ebx
mov ebx, 0x105d0108
push ebx
call fcn.10066acf
cmp dword [0x105d0108], 0xffffffff
pop ecx
jne 0x1000fa2c
push esi
push edi
mov edi, 0x105d00fc
lea esi, [ebp - 0xc]
push 0x1006b91f
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000fa2c

Function at 0x1000fa6d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x6d584e5c
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d0188]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x1000fab4
jmp 0x1000faad
pop ebx
mov eax, 0x105d0178
leave
ret
push ebx
mov ebx, 0x105d0188
push ebx
call fcn.10066acf
cmp dword [0x105d0188], 0xffffffff
pop ecx
jne 0x1000faac
push esi
push edi
mov edi, 0x105d0178
lea esi, [ebp - 0x10]
push 0x1006b92c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000faac

Function at 0x1000faef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d01b4]
cmp eax, dword [ecx + 4]
jg 0x1000fb30
jmp 0x1000fb29
pop ebx
mov eax, 0x105d01a8
leave
ret
push ebx
mov ebx, 0x105d01b4
push ebx
call fcn.10066acf
cmp dword [0x105d01b4], 0xffffffff
pop ecx
jne 0x1000fb28
push esi
push edi
mov edi, 0x105d01a8
lea esi, [ebp - 0xc]
push 0x1006b93b
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000fb28
Function at 0x1000fe5b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x745f6250
mov dword [ebp - 0xc], 0x5b58794e
mov dword [ebp - 8], 0x53544e48
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d00f4]
mov word [ebp - 4], 0x3d5a
cmp eax, dword [ecx + 4]
jg 0x1000fea2
jmp 0x1000fe9b
pop ebx
mov eax, 0x105d00e4
leave
ret
push ebx
mov ebx, 0x105d00f4
push ebx
call fcn.10066acf
cmp dword [0x105d00f4], 0xffffffff
pop ecx
jne 0x1000fe9a
push esi
push edi
mov edi, 0x105d00e4
lea esi, [ebp - 0x10]
push 0x1006b9a9
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000fe9a

Function at 0x1000fedd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7c546250
mov dword [ebp - 8], 0x48525e5e
mov word [ebp - 4], 0x4953
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d0118]
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1000ff21
jmp 0x1000ff1a
pop ebx
mov eax, 0x105d010c
leave
ret
push ebx
mov ebx, 0x105d0118
push ebx
call fcn.10066acf
cmp dword [0x105d0118], 0xffffffff
pop ecx
jne 0x1000ff19
push esi
push edi
mov edi, 0x105d010c
lea esi, [ebp - 0xc]
push 0x1006b9b8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000ff19

Function at 0x1000ffd5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x515b6250
mov dword [ebp - 8], 0x505c496e
mov dword [ebp - 4], 0x3d5c5354
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d01c4]
cmp eax, dword [ecx + 4]
jg 0x10010016
jmp 0x1001000f
pop ebx
mov eax, 0x105d01b8
leave
ret
push ebx
mov ebx, 0x105d01c4
push ebx
call fcn.10066acf
cmp dword [0x105d01c4], 0xffffffff
pop ecx
jne 0x1001000e
push esi
push edi
mov edi, 0x105d01b8
lea esi, [ebp - 0xc]
push 0x1006b9d7
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001000e