joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a3a68
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100c60c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x340031
mov dword [ebp - 0x50], 0x330032
mov dword [ebp - 0x4c], 0x450031
mov dword [ebp - 0x48], 0x380043
mov dword [ebp - 0x44], 0x460039
mov dword [ebp - 0x40], 0x420034
mov dword [ebp - 0x3c], 0x460034
mov dword [ebp - 0x38], 0x380037
mov dword [ebp - 0x34], 0x440039
mov dword [ebp - 0x30], 0x410034
mov dword [ebp - 0x2c], 0x450037
mov dword [ebp - 0x28], 0x420033
mov dword [ebp - 0x24], 0x430034
mov dword [ebp - 0x20], 0x360042
mov dword [ebp - 0x1c], 0x450043
mov dword [ebp - 0x18], 0x310039
mov word [ebp - 0x14], ax
call fcn.10009700
mov ecx, eax
test ecx, ecx
je 0x10039f2b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100094a0
test al, al
jne 0x10039f0b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10039ef0
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000a190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003ff0d
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009480
int3
Function at 0x10039f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a3a68
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100c60c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x450038
mov dword [ebp - 0x50], 0x310032
mov dword [ebp - 0x4c], 0x300035
mov dword [ebp - 0x48], 0x450031
mov dword [ebp - 0x44], 0x390033
mov dword [ebp - 0x40], 0x320046
mov dword [ebp - 0x3c], 0x310034
mov dword [ebp - 0x38], 0x380030
mov dword [ebp - 0x34], 0x340039
mov dword [ebp - 0x30], 0x450038
mov dword [ebp - 0x2c], 0x300044
mov dword [ebp - 0x28], 0x420039
mov dword [ebp - 0x24], 0x380041
mov dword [ebp - 0x20], 0x370031
mov dword [ebp - 0x1c], 0x390046
mov dword [ebp - 0x18], 0x360031
mov word [ebp - 0x14], ax
call fcn.10009700
mov ecx, eax
test ecx, ecx
je 0x1003a05b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100094a0
test al, al
jne 0x1003a03b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003a020
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000a190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003ff0d
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009480
int3
Function at 0x1003c760
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a3f83
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x100c60c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x1003c81b
cmp word [esi], di
je 0x1003c81b
test eax, eax
je 0x1003c7cc
cmp word [eax], di
je 0x1003c7cc
push edi
push edi
push eax
push esi
push edi
call fcn.1007bc10
push eax
call fcn.1003d720
add esp, 4
call eax
test eax, eax
js 0x1003c81b
jmp 0x1003c816
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1007dc10
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call fcn.1007bb70
push eax
call fcn.1003d720
add esp, 4
call eax
test eax, eax
js 0x1003c81b
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1003c892
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x1003c87d
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x1003c84b
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x1003c86c
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x1003c8b2
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x1003c87d
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1003c892
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003ff0d
mov esp, ebp
pop ebp
ret 0x30
call fcn.1002ff40
int3
Function at 0x1003dc90
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a417a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100c60c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10009700
mov ecx, eax
test ecx, ecx
je 0x1003de54
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10009700
mov ecx, eax
test ecx, ecx
je 0x1003de5e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10009700
mov ecx, eax
test ecx, ecx
je 0x1003de68
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x1003dd72
xor ecx, ecx
jmp 0x1003dd90
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003dd80
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.1000a190
push edi
mov ecx, ebx
call fcn.10009080
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1003ddac
xor ecx, ecx
jmp 0x1003ddc4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003ddb4
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.1000a190
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.1003e6d0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.10009080
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003de05
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1003de3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1003de3e
cmp dword [esi + 0x10], 0
je 0x1003de35
push dword [edi]
call fcn.1008efb8
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10009480
push 0x80004005
call fcn.10009480
push 0x80004005
call fcn.10009480
int3
Function at 0x1003e4d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a4268
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x100c60c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x1003e6a4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003e525
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x1003e6a4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003e543
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x1003e6a4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003e561
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x1003e6a4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003e57f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x1003e6a4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003e6a4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1003e5a4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x1003e5d7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x1003e5ef
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x1003e62d
mov esi, ecx
mov eax, 0x7ffffffe
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.10012980
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.1007d110
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x100ad6dc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.1003f090
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003e65b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x1003e694
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1003e694
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.10016070
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10011580
lea ecx, [ebp - 0x28]
call fcn.10011580
lea ecx, [ebp - 0x34]
call fcn.1003dea0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003ff0d
mov esp, ebp
pop ebp
ret 4
Function at 0x1003ec30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a4357
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100c60c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x1003ec7a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003ec86
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.10032b3b
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x1003ecf3
push 0x48
call fcn.1003fb6c
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x1003ece7
push 0x48
push 0
push ebx
call fcn.1007dc10
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.1003dc90
jmp 0x1003ece9
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003ed20
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.10032b3b
push 3
push 0x100ad6dc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10032adc
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003ed6f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x1003edbe
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1003edbe
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.10032b3b
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.10011580
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1003edf4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003edea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003ee31
push edx
push ecx
call fcn.1003fb9c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x1003ee13
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003ff0d
mov esp, ebp
pop ebp
ret 0x14
call fcn.10081039
int3
Function at 0x1003f4f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a4458
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x100c60c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1003fb6c
mov edi, eax
add esp, 4
test edi, edi
je 0x1003f593
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10031390
add esp, 4
mov dword [edi + 4], eax
jmp 0x1003f595
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.100106c0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x1003f5f5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x1003f5f5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x1003f619
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1003f63b
cmp byte [ebp + 0xc], 0
je 0x1003f628
push esi
call fcn.100317a8
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1003f647
mov esi, str.ios_base::badbit_set
jmp 0x1003f657
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.10013320
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.10011180
push 0x100bdf70
lea eax, [ebp - 0x30]
push eax
call fcn.1007ccf7
int3
Function at 0x10041760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a45cb
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x100c60c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 0x6f0043
mov dword [ebp - 0x90], 0x66006e
mov dword [ebp - 0x8c], 0x670069
mov dword [ebp - 0x88], 0x650043
mov dword [ebp - 0x84], 0x74006e
mov dword [ebp - 0x80], 0x720065
mov dword [ebp - 0x7c], 0x690053
mov dword [ebp - 0x78], 0x6c006e
mov dword [ebp - 0x74], 0x650067
mov dword [ebp - 0x70], 0x6e0049
mov dword [ebp - 0x6c], 0x740073
mov dword [ebp - 0x68], 0x6e0061
mov dword [ebp - 0x64], 0x650063
mov dword [ebp - 0x60], 0x7b005f
mov dword [ebp - 0x5c], 0x380030
mov dword [ebp - 0x58], 0x370039
mov dword [ebp - 0x54], 0x350035
mov dword [ebp - 0x50], 0x310044
mov dword [ebp - 0x4c], 0x41002d
mov dword [ebp - 0x48], 0x350032
mov dword [ebp - 0x44], 0x2d0042
mov dword [ebp - 0x40], 0x420034
mov dword [ebp - 0x3c], 0x450035
mov dword [ebp - 0x38], 0x41002d
mov dword [ebp - 0x34], 0x350045
mov dword [ebp - 0x30], 0x2d0045
mov dword [ebp - 0x2c], 0x330036
mov dword [ebp - 0x28], 0x340030
mov dword [ebp - 0x24], 0x360031
mov dword [ebp - 0x20], 0x340041
mov dword [ebp - 0x1c], 0x460044
mov dword [ebp - 0x18], 0x340041
mov dword [ebp - 0x14], 0x7d
call fcn.10009700
mov ecx, eax
test ecx, ecx
je 0x10041902
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100094a0
test al, al
jne 0x100418e2
lea ecx, [ebp - 0x94]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100418c4
sub ecx, edx
lea eax, [ebp - 0x94]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000a190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003ff0d
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009480
int3
Function at 0x10041c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a4648
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x100c60c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], 0x720054
mov dword [ebp - 0x70], 0x630061
mov dword [ebp - 0x6c], 0x6c0065
mov dword [ebp - 0x68], 0x730065
mov dword [ebp - 0x64], 0x630073
mov dword [ebp - 0x60], 0x610068
mov dword [ebp - 0x5c], 0x430074
mov dword [ebp - 0x58], 0x6e006f
mov dword [ebp - 0x54], 0x690066
mov dword [ebp - 0x50], 0x430067
mov dword [ebp - 0x4c], 0x6e0065
mov dword [ebp - 0x48], 0x650074
mov dword [ebp - 0x44], 0x530072
mov dword [ebp - 0x40], 0x750074
mov dword [ebp - 0x3c], 0x500062
mov dword [ebp - 0x38], 0x650072
mov dword [ebp - 0x34], 0x690066
mov dword [ebp - 0x30], 0x570078
mov dword [ebp - 0x2c], 0x64006e
mov dword [ebp - 0x28], 0x6c0043
mov dword [ebp - 0x24], 0x730061
mov dword [ebp - 0x20], 0x4e0073
mov dword [ebp - 0x1c], 0x6d0061
mov dword [ebp - 0x18], 0x5f0065
mov word [ebp - 0x14], ax
call fcn.10009700
mov ecx, eax
test ecx, ecx
je 0x10041d6b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100094a0
test al, al
jne 0x10041d4b
lea ecx, [ebp - 0x74]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10041d30
sub ecx, edx
lea eax, [ebp - 0x74]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000a190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003ff0d
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009480
int3
Function at 0x10041ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a46a8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x100c60c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], 0x610048
mov dword [ebp - 0x60], 0x6f006c
mov dword [ebp - 0x5c], 0x700077
mov dword [ebp - 0x58], 0x6f0043
mov dword [ebp - 0x54], 0x66006e
mov dword [ebp - 0x50], 0x670069
mov dword [ebp - 0x4c], 0x650043
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x740053
mov dword [ebp - 0x3c], 0x620075
mov dword [ebp - 0x38], 0x720050
mov dword [ebp - 0x34], 0x660065
mov dword [ebp - 0x30], 0x780069
mov dword [ebp - 0x2c], 0x6e0057
mov dword [ebp - 0x28], 0x430064
mov dword [ebp - 0x24], 0x61006c
mov dword [ebp - 0x20], 0x730073
mov dword [ebp - 0x1c], 0x61004e
mov dword [ebp - 0x18], 0x65006d
mov dword [ebp - 0x14], 0x5f
call fcn.10009700
mov ecx, eax
test ecx, ecx
je 0x10042020
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100094a0
test al, al
jne 0x10042000
lea ecx, [ebp - 0x64]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10041fe5
sub ecx, edx
lea eax, [ebp - 0x64]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000a190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003ff0d
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009480
int3