joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010189
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x494f584b
mov dword [ebp - 8], 0x515c5e54
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d074c]
cmp eax, dword [ecx + 4]
jg 0x100101c7
jmp 0x100101c0
pop ebx
mov eax, 0x105d0740
leave
ret
push ebx
mov ebx, 0x105d074c
push ebx
call fcn.10066acf
cmp dword [0x105d074c], 0xffffffff
pop ecx
jne 0x100101bf
push esi
push edi
mov edi, 0x105d0740
lea esi, [ebp - 0xc]
push 0x1006ba05
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100101bf

Function at 0x10010200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x4d524f59
mov dword [ebp - 8], 0x4d504857
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d075c]
cmp eax, dword [ecx + 4]
jg 0x1001023e
jmp 0x10010237
pop ebx
mov eax, 0x105d0750
leave
ret
push ebx
mov ebx, 0x105d075c
push ebx
call fcn.10066acf
cmp dword [0x105d075c], 0xffffffff
pop ecx
jne 0x10010236
push esi
push edi
mov edi, 0x105d0750
lea esi, [ebp - 0xc]
push 0x1006ba12
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10010236

Function at 0x1001626d
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1e], 0
je 0x1001627f
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x1f
jb 0x10016275
mov eax, ecx
ret

Function at 0x10016282
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x23], 0
je 0x10016294
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x24
jb 0x1001628a
mov eax, ecx
ret

Function at 0x10016297
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x25], 0
je 0x100162a9
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x26
jb 0x1001629f
mov eax, ecx
ret

Function at 0x100162ac
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x27], 0
je 0x100162be
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x28
jb 0x100162b4
mov eax, ecx
ret

Function at 0x100162c1
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x2a], 0
je 0x100162d3
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x2b
jb 0x100162c9
mov eax, ecx
ret

Function at 0x100162d6
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x2b], 0
je 0x100162e8
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x2c
jb 0x100162de
mov eax, ecx
ret

Function at 0x100162eb
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x2d], 0
je 0x100162fd
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x2e
jb 0x100162f3
mov eax, ecx
ret
Function at 0x1001630c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x30], 0
je 0x1001631e
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x31
jb 0x10016314
mov eax, ecx
ret

Function at 0x10016321
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x32], 0
je 0x10016333
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x33
jb 0x10016329
mov eax, ecx
ret

Function at 0x10016336
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x33], 0
je 0x10016348
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x34
jb 0x1001633e
mov eax, ecx
ret

Function at 0x1001634b
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x36], 0
je 0x1001635d
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x37
jb 0x10016353
mov eax, ecx
ret

Function at 0x10016360
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x3a], 0
je 0x10016372
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x3b
jb 0x10016368
mov eax, ecx
ret

Function at 0x10016375
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x3c], 0
je 0x10016387
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x3d
jb 0x1001637d
mov eax, ecx
ret

Function at 0x1001638a
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x3e], 0
je 0x1001639c
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x3f
jb 0x10016392
mov eax, ecx
ret

Function at 0x1001639f
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x42], 0
je 0x100163b1
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x43
jb 0x100163a7
mov eax, ecx
ret

Function at 0x100163b4
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x65], 0
je 0x100163c6
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x66
jb 0x100163bc
mov eax, ecx
ret

Function at 0x100164e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
movaps xmm0, xmmword [0x1006f200]
movups xmmword [ebp - 0x40], xmm0
push edi
mov ecx, dword [eax + ecx*4]
mov edi, 0x105d0a38
movaps xmm0, xmmword [0x1006f0e0]
mov eax, dword [0x105d0a78]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x10], 0x495c5949
movaps xmm0, xmmword [0x1006f020]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0xc], 0x541d5958
mov dword [ebp - 8], 0x45585953
mov word [ebp - 4], 0x1402
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10016559
jmp 0x10016554
pop esi
mov eax, edi
pop edi
leave
ret
push esi
mov esi, 0x105d0a78
push esi
call fcn.10066acf
cmp dword [0x105d0a78], 0xffffffff
pop ecx
jne 0x10016553
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.10016130
push 0x1006ba73
call fcn.10066a3e
push esi
call fcn.10066a7e
pop ecx
pop ecx
jmp 0x10016553
Function at 0x10016c32
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x5348524f
mov dword [ebp - 8], 0x494e6259
mov dword [ebp - 4], 0x3d494f5c
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d0ef4]
cmp eax, dword [ecx + 4]
jg 0x10016c73
jmp 0x10016c6c
pop ebx
mov eax, 0x105d0ee8
leave
ret
push ebx
mov ebx, 0x105d0ef4
push ebx
call fcn.10066acf
cmp dword [0x105d0ef4], 0xffffffff
pop ecx
jne 0x10016c6b
push esi
push edi
mov edi, 0x105d0ee8
lea esi, [ebp - 0xc]
push 0x1006bb4f
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10016c6b

Function at 0x10016e5f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
movaps xmm0, xmmword [0x1006f200]
movups xmmword [ebp - 0x40], xmm0
push edi
mov ecx, dword [eax + ecx*4]
mov edi, 0x105d0cb8
movaps xmm0, xmmword [0x1006f220]
mov eax, dword [0x105d0cf8]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x10], 0x495c5949
movaps xmm0, xmmword [0x1006f030]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0xc], 0x541d5958
mov dword [ebp - 8], 0x45585953
mov word [ebp - 4], 0x1402
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10016ecf
jmp 0x10016eca
pop esi
mov eax, edi
pop edi
leave
ret
push esi
mov esi, 0x105d0cf8
push esi
call fcn.10066acf
cmp dword [0x105d0cf8], 0xffffffff
pop ecx
jne 0x10016ec9
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.10016130
push 0x1006bb92
call fcn.10066a3e
push esi
call fcn.10066a7e
pop ecx
pop ecx
jmp 0x10016ec9

Function at 0x10017017
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
movaps xmm0, xmmword [0x1006f200]
movups xmmword [ebp - 0x40], xmm0
push edi
mov ecx, dword [eax + ecx*4]
mov edi, 0x105d0d68
movaps xmm0, xmmword [0x1006f0d0]
mov eax, dword [0x105d0da8]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x10], 0x495c5949
movaps xmm0, xmmword [0x1006f040]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0xc], 0x541d5958
mov dword [ebp - 8], 0x45585953
mov word [ebp - 4], 0x1402
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10017087
jmp 0x10017082
pop esi
mov eax, edi
pop edi
leave
ret
push esi
mov esi, 0x105d0da8
push esi
call fcn.10066acf
cmp dword [0x105d0da8], 0xffffffff
pop ecx
jne 0x10017081
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.10016130
push 0x1006bbc8
call fcn.10066a3e
push esi
call fcn.10066a7e
pop ecx
pop ecx
jmp 0x10017081
Function at 0x1001748a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x445c514d
mov dword [ebp - 0xc], 0x59624f58
mov dword [ebp - 8], 0x55495c58
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d0f08]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x100174cf
jmp 0x100174c8
pop ebx
mov eax, 0x105d0ef8
leave
ret
push ebx
mov ebx, 0x105d0f08
push ebx
call fcn.10066acf
cmp dword [0x105d0f08], 0xffffffff
pop ecx
jne 0x100174c7
push esi
push edi
mov edi, 0x105d0ef8
lea esi, [ebp - 0x10]
push 0x1006bc4d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100174c7

Function at 0x1001778d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x445c514d
mov dword [ebp - 8], 0x55624f58
mov dword [ebp - 4], 0x3d494f48
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d0f18]
cmp eax, dword [ecx + 4]
jg 0x100177ce
jmp 0x100177c7
pop ebx
mov eax, 0x105d0f0c
leave
ret
push ebx
mov ebx, 0x105d0f18
push ebx
call fcn.10066acf
cmp dword [0x105d0f18], 0xffffffff
pop ecx
jne 0x100177c6
push esi
push edi
mov edi, 0x105d0f0c
lea esi, [ebp - 0xc]
push 0x1006bcba
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100177c6

Function at 0x10017f09
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x2f], 0
je 0x10017f28
xor eax, eax
movups xmm0, xmmword [eax + ecx]
xorps xmm0, xmmword [0x1006d700]
movups xmmword [eax + ecx], xmm0
add eax, 0x10
cmp eax, 0x30
jb 0x10017f11
ret

Function at 0x10019ad6
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 4], 0
je 0x10019ae8
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 5
jb 0x10019ade
mov eax, ecx
ret

Function at 0x10019aeb
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 5], 0
je 0x10019afd
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 6
jb 0x10019af3
mov eax, ecx
ret

Function at 0x10019b00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 6], 0
je 0x10019b12
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 7
jb 0x10019b08
mov eax, ecx
ret

Function at 0x10019b15
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 7], 0
je 0x10019b27
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 8
jb 0x10019b1d
mov eax, ecx
ret

Function at 0x10019b2a
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x15], 0
je 0x10019b3c
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x16
jb 0x10019b32
mov eax, ecx
ret

Function at 0x10019b3f
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xe], 0
je 0x10019b51
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0xf
jb 0x10019b47
mov eax, ecx
ret
Function at 0x10019d9b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x5e584d4e
mov dword [ebp - 0xc], 0x52495c49
mov dword [ebp - 8], 0x54511d4f
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d1720]
mov word [ebp - 4], 0x494e
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10019de6
jmp 0x10019ddf
pop ebx
mov eax, 0x105d1710
leave
ret
push ebx
mov ebx, 0x105d1720
push ebx
call fcn.10066acf
cmp dword [0x105d1720], 0xffffffff
pop ecx
jne 0x10019dde
push esi
push edi
mov edi, 0x105d1710
lea esi, [ebp - 0x10]
push 0x1006bdc6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10019dde

Function at 0x10019e22
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x5f44564e
mov dword [ebp - 0xc], 0x5e1d4552
mov dword [ebp - 8], 0x5a535c55
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d1734]
mov word [ebp - 4], 0x4f58
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10019e6d
jmp 0x10019e66
pop ebx
mov eax, 0x105d1724
leave
ret
push ebx
mov ebx, 0x105d1734
push ebx
call fcn.10066acf
cmp dword [0x105d1734], 0xffffffff
pop ecx
jne 0x10019e65
push esi
push edi
mov edi, 0x105d1724
lea esi, [ebp - 0x10]
push 0x1006bdd6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10019e65

Function at 0x1001a174
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x5251584b
mov dword [ebp - 0xc], 0x4449545e
mov dword [ebp - 8], 0x51525e1d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d17e0]
mov word [ebp - 4], 0x4f52
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1001a1bf
jmp 0x1001a1b8
pop ebx
mov eax, 0x105d17d0
leave
ret
push ebx
mov ebx, 0x105d17e0
push ebx
call fcn.10066acf
cmp dword [0x105d17e0], 0xffffffff
pop ecx
jne 0x1001a1b7
push esi
push edi
mov edi, 0x105d17d0
lea esi, [ebp - 0x10]
push 0x1006be3a
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001a1b7
Function at 0x1001a1fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x5251584b
mov dword [ebp - 0xc], 0x4449545e
mov dword [ebp - 8], 0x5c4f5a1d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d17f4]
mov word [ebp - 4], 0x554d
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1001a246
jmp 0x1001a23f
pop ebx
mov eax, 0x105d17e4
leave
ret
push ebx
mov ebx, 0x105d17f4
push ebx
call fcn.10066acf
cmp dword [0x105d17f4], 0xffffffff
pop ecx
jne 0x1001a23e
push esi
push edi
mov edi, 0x105d17e4
lea esi, [ebp - 0x10]
push 0x1006be4a
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001a23e

Function at 0x1001a282
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x505c494e
mov dword [ebp - 0xc], 0x1d5c5354
mov dword [ebp - 8], 0x4d5c4f5a
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d1808]
mov word [ebp - 4], 0x3d55
cmp eax, dword [ecx + 4]
jg 0x1001a2c9
jmp 0x1001a2c2
pop ebx
mov eax, 0x105d17f8
leave
ret
push ebx
mov ebx, 0x105d1808
push ebx
call fcn.10066acf
cmp dword [0x105d1808], 0xffffffff
pop ecx
jne 0x1001a2c1
push esi
push edi
mov edi, 0x105d17f8
lea esi, [ebp - 0x10]
push 0x1006be5a
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001a2c1

Function at 0x1001a304
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x4d5c4f5a
mov dword [ebp - 0xc], 0x58551d55
mov dword [ebp - 8], 0x49555a54
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d181c]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1001a349
jmp 0x1001a342
pop ebx
mov eax, 0x105d180c
leave
ret
push ebx
mov ebx, 0x105d181c
push ebx
call fcn.10066acf
cmp dword [0x105d181c], 0xffffffff
pop ecx
jne 0x1001a341
push esi
push edi
mov edi, 0x105d180c
lea esi, [ebp - 0x10]
push 0x1006be69
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001a341
Function at 0x1001a4f5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x4d5c584a
mov dword [ebp - 0xc], 0x5a1d5352
mov dword [ebp - 8], 0x4d48524f
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d11a4]
mov word [ebp - 4], 0x3d4e
cmp eax, dword [ecx + 4]
jg 0x1001a53c
jmp 0x1001a535
pop ebx
mov eax, 0x105d1194
leave
ret
push ebx
mov ebx, 0x105d11a4
push ebx
call fcn.10066acf
cmp dword [0x105d11a4], 0xffffffff
pop ecx
jne 0x1001a534
push esi
push edi
mov edi, 0x105d1194
lea esi, [ebp - 0x10]
push 0x1006beb3
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001a534

Function at 0x1001a6e1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x585a5958
mov dword [ebp - 0xc], 0x1d5a485f
mov dword [ebp - 8], 0x58505449
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d189c]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1001a726
jmp 0x1001a71f
pop ebx
mov eax, 0x105d188c
leave
ret
push ebx
mov ebx, 0x105d189c
push ebx
call fcn.10066acf
cmp dword [0x105d189c], 0xffffffff
pop ecx
jne 0x1001a71e
push esi
push edi
mov edi, 0x105d188c
lea esi, [ebp - 0x10]
push 0x1006beef
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001a71e

Function at 0x1001ac8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x5354564e
mov dword [ebp - 0xc], 0x5c555e1d
mov dword [ebp - 8], 0x4f585a53
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d195c]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1001acd1
jmp 0x1001acca
pop ebx
mov eax, 0x105d194c
leave
ret
push ebx
mov ebx, 0x105d195c
push ebx
call fcn.10066acf
cmp dword [0x105d195c], 0xffffffff
pop ecx
jne 0x1001acc9
push esi
push edi
mov edi, 0x105d194c
lea esi, [ebp - 0x10]
push 0x1006bfa6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001acc9
Function at 0x1001aef9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x4b52515a
mov dword [ebp - 0xc], 0x555e1d58
mov dword [ebp - 8], 0x585a535c
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d19a0]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x1001af40
jmp 0x1001af39
pop ebx
mov eax, 0x105d1990
leave
ret
push ebx
mov ebx, 0x105d19a0
push ebx
call fcn.10066acf
cmp dword [0x105d19a0], 0xffffffff
pop ecx
jne 0x1001af38
push esi
push edi
mov edi, 0x105d1990
lea esi, [ebp - 0x10]
push 0x1006bfed
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001af38

Function at 0x1001b063
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x5953525e
mov dword [ebp - 8], 0x52544954
mov word [ebp - 4], 0x3d53
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d19cc]
cmp eax, dword [ecx + 4]
jg 0x1001b0a3
jmp 0x1001b09c
pop ebx
mov eax, 0x105d19c0
leave
ret
push ebx
mov ebx, 0x105d19cc
push ebx
call fcn.10066acf
cmp dword [0x105d19cc], 0xffffffff
pop ecx
jne 0x1001b09b
push esi
push edi
mov edi, 0x105d19c0
lea esi, [ebp - 0xc]
push 0x1006c01a
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001b09b

Function at 0x1001b6bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x4b515c6b
mov dword [ebp - 8], 0xc0d0d58
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105d1a44]
cmp eax, dword [ecx + 4]
jg 0x1001b6fa
jmp 0x1001b6f3
pop ebx
mov eax, 0x105d1a38
leave
ret
push ebx
mov ebx, 0x105d1a44
push ebx
call fcn.10066acf
cmp dword [0x105d1a44], 0xffffffff
pop ecx
jne 0x1001b6f2
push esi
push edi
mov edi, 0x105d1a38
lea esi, [ebp - 0xc]
push 0x1006c0da
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1001b6f2