joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492db8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x500c2c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004f10ec
mov dword [esi], 0x73a938
lea edi, [esi + 0x3c]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x30]
mov dword [edi], 0x73a864
call fcn.004959f0
lea ecx, [edi + 0x44]
mov byte [esp + 0x18], 1
call fcn.004959f0
lea ecx, [edi + 0x58]
mov byte [esp + 0x18], 2
call fcn.004959f0
lea ecx, [edi + 0x6c]
mov byte [esp + 0x18], 3
call fcn.004959f0
mov dword [edi], 0x73a85c
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 4
call fcn.004ee1df
mov dword [esi + 0xd8], 0
mov dword [esi + 0xd4], 0x73a92c
mov eax, dword [0x7683a8]
mov dword [esi + 0xdc], eax
lea ecx, [esi + 0xe0]
mov byte [esp + 0x18], 7
call fcn.004959f0
lea ecx, [esi + 0xf4]
mov byte [esp + 0x18], 8
call fcn.004ee1df
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x73a86c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x492ea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x500cb4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x73a86c
lea ecx, [esi + 0xf4]
mov dword [esp + 0x18], 5
call fcn.004ee208
lea ecx, [esi + 0xe0]
mov byte [esp + 0x18], 4
mov dword [ecx], 0x73a858
call fcn.00495bf0
lea ecx, [esi + 0xdc]
mov byte [esp + 0x18], 3
call fcn.004efa52
lea ecx, [esi + 0xd4]
mov dword [esp + 0xc], ecx
mov dword [ecx], 0x73a9f0
mov byte [esp + 0x18], 6
call fcn.004f68bc
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 1
call fcn.004ee208
lea edi, [esi + 0x3c]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x6c]
mov byte [esp + 0x18], 9
mov dword [ecx], 0x73a858
call fcn.00495bf0
lea ecx, [edi + 0x58]
mov byte [esp + 0x18], 8
mov dword [ecx], 0x73a858
call fcn.00495bf0
lea ecx, [edi + 0x44]
mov byte [esp + 0x18], 7
mov dword [ecx], 0x73a858
call fcn.00495bf0
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 0
mov dword [ecx], 0x73a858
call fcn.00495bf0
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.004ede41
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a2450
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x501358
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.004a2760
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x792c0c
call fcn.004cde38
mov ecx, dword [0x73bb9c]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.0049dcf0
mov esi, 0x73bbd8
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x4a24f7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4a24ee
cmp al, 0xff
je 0x4a24ee
dec al
mov byte [ecx], al
jmp 0x4a24f7
push ecx
call fcn.004ef7bc
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.004eb560
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x4a253d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4a2534
cmp al, 0xff
je 0x4a2534
dec al
mov byte [ecx], al
jmp 0x4a253d
push ecx
call fcn.004ef7bc
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.004cdebf
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x4a4c20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x501660
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004a47d0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004a4850
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004a4850
lea ecx, [esi + 0xc]
call fcn.004ef9dd
lea ecx, [esi + 0x10]
call fcn.004ef9dd
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004a5de0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004a5de0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004a5de0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004efa52
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004efa52
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4aa4b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4aa4bb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4aa5be
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x73d6b4]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x73d6b4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x73d6b4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x73d6b4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x73d6b4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x73d6b4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x73d6b4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x73d6b4]
xor eax, edx
inc ecx
dec edi
jne 0x4aa4d6
pop edi
test esi, esi
je 0x4aa5e0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x73d6b4]
xor eax, edx
inc ecx
dec esi
jne 0x4aa5c2
pop esi
pop ebx
not eax
ret

Function at 0x4afd50
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x7c0440]
xor edx, edx
cmp eax, edx
jne 0x4afd76
xor eax, eax
mov byte [eax + 0x7c0340], al
inc eax
cmp eax, 0x100
jl 0x4afd5e
mov dword [0x7c0440], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x7c0340
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4afe07
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4afdda
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4afda8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4afe80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4afed3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4afeba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b6880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x501cee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004b71a0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x73dd2c
call fcn.004ef793
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4b6913
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ef793
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4b690c
push 0
mov ecx, eax
call fcn.004ad990
mov dword [esi + 0xc], eax
jmp 0x4b6915
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b6915
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x10020d2
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x100a034]
and dword [ebp - 0x7c], 0
and dword [ebp - 0x80], 0
push ebx
mov ebx, dword [ebp + 0x94]
push esi
push edi
xor edi, edi
inc edi
test ebx, ebx
mov dword [ebp + 0x84], eax
jne 0x1002106
mov dword [ebp - 0x80], edi
xor eax, eax
cmp dword [ebp - 0x80], eax
je 0x100213e
cmp dword [ebp + 0x90], edi
jne 0x100212b
lea ecx, [ebp - 0x78]
push ecx
push eax
push eax
call fcn.01001f4b
mov esi, eax
test esi, esi
jne 0x10021a1
mov ebx, dword [ebp - 0x70]
jmp 0x1002146
lea ecx, [ebp + 0x30]
push ecx
push eax
call fcn.01002014
mov esi, eax
test esi, esi
jne 0x10021b9
mov ebx, dword [ebp + 0x34]
cmp dword [ebp + 0x90], edi
jne 0x100214e
push ebx
call fcn.01001fd7
jmp 0x1002154
push ebx
call fcn.01002096
mov esi, eax
test esi, esi
jne 0x100215f
inc dword [ebp - 0x7c]
jmp 0x1002195
cmp esi, 0x491
jne 0x1002181
cmp dword [ebp - 0x80], 0
jne 0x1002106
push ebx
push 0x2717
push edi
call fcn.0100916c
add esp, 0xc
jmp 0x1002205
cmp esi, 0x1f
jne 0x10021de
push ebx
push 0x2718
push edi
call fcn.0100916c
add esp, 0xc
cmp dword [ebp - 0x80], 0
jne 0x1002106
jmp 0x1002205
cmp esi, 0x491
je 0x100220d
push edi
push esi
call fcn.01001ec0
push eax
push esi
push 0x2715
jmp 0x10021cf
cmp esi, 0x491
je 0x1002205
push edi
push esi
call fcn.01001ec0
push eax
push esi
push 0x2716
push edi
call fcn.0100916c
add esp, 0x10
push edi
call fcn.01004444
push edi
push esi
call fcn.01001ec0
cmp dword [ebp + 0x90], 0
push eax
push esi
je 0x10021f7
push 0x2719
jmp 0x10021fc
push 0x2748
push edi
call fcn.0100916c
add esp, 0x10
cmp dword [ebp + 0x90], edi
jne 0x1002224
cmp dword [ebp - 0x7c], edi
jne 0x100221a
push edi
push 0x271a
jmp 0x1002239
push dword [ebp - 0x7c]
push 0x2749
jmp 0x1002239
cmp dword [ebp - 0x7c], edi
jne 0x1002231
push edi
push 0x271b
jmp 0x1002239
push dword [ebp - 0x7c]
push 0x274a
push edi
call fcn.0100916c
mov ecx, dword [ebp + 0x84]
add esp, 0xc
pop edi
pop esi
pop ebx
call fcn.01004049
add ebp, 0x88
leave
ret 8

Function at 0x100225a
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp - 0x1c], 0x17
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x100228d
xor eax, eax
jmp 0x10022a9
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push esi
mov esi, dword [eax + 0x18]
add esi, 8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
xor eax, eax
inc eax
pop esi
pop edi
leave
ret 8
Function at 0x10022ae
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100a034]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 4
mov dword [ebp - 4], eax
pop ecx
mov edi, 0x100b764
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
mov ebx, 0x100b728
jne 0x10022e5
mov esi, 0x100114c
mov edi, 0x100b728
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x1002324
mov esi, dword [ebp + 8]
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov word [ebp - 0x20], 0x17
push 2
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
push eax
push eax
movsd dword es:[edi], dword [esi]
push 0x2e
push ebx
movsd dword es:[edi], dword [esi]
push 0x1c
lea eax, [ebp - 0x20]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x1002324
mov esi, 0x1001140
mov edi, 0x100b728
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.01004049
leave
ret 4

Function at 0x10024bc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0x2d
push ebx
call fcn.01004570
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x1002524
push edi
push 2
pop eax
mov edi, 0x1001158
mov esi, ebx
mov ecx, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x10024fa
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ecx], eax
mov esi, 0x100b764
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x1002515
push dword [ebp + 0xc]
push ebx
call fcn.0100225a
test eax, eax
jne 0x100250f
push ebx
push 0x271c
jmp 0x1002550
mov eax, dword [ebp + 0x14]
and dword [eax], 0
mov edi, dword [ebp + 0x10]
mov esi, 0x100b764
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
jmp 0x100256a
push dword [ebp + 0xc]
mov byte [esi], 0
push ebx
inc esi
call fcn.0100225a
test eax, eax
jne 0x100253d
push ebx
push 0x271d
jmp 0x1002550
push dword [ebp + 0x10]
push esi
call fcn.0100225a
test eax, eax
jne 0x1002561
push esi
push 0x271e
push 1
call fcn.0100916c
add esp, 0xc
push 1
call fcn.01004444
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x100259e
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 3
mov edi, 0x1001168
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x10025b8
push 0x33
jmp 0x10025ca
push 4
mov edi, 0x1001164
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x10025d0
push 0x32
pop eax
pop edi
pop esi
ret 4
mov edi, 0x100115c
mov esi, eax
push 5
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x10025e4
xor eax, eax
jmp 0x10025cb
push eax
push 0x271f
push 1
call fcn.0100916c
add esp, 0xc
push 1
call fcn.01004444
int3
Function at 0x1002628
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0xa
mov edi, 0x1001170
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002646
xor eax, eax
inc eax
pop edi
pop esi
ret 4
mov edi, 0x100117c
mov esi, eax
push 7
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
push 2
jne 0x100265b
pop eax
jmp 0x1002641
mov edi, 0x1001158
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x100266d
xor eax, eax
jmp 0x1002641
push eax
push 0x2720
push 1
call fcn.0100916c
add esp, 0xc
push 1
call fcn.01004444
int3

Function at 0x10026c1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub eax, 0
push esi
push edi
je 0x10026eb
dec eax
je 0x10026dd
dec eax
je 0x10026eb
xor eax, eax
pop edi
inc eax
pop esi
pop ebp
ret 0xc
mov edi, dword [ebp + 0xc]
mov esi, 0x100b764
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x10026d4
mov esi, dword [ebp + 8]
push 2
mov edi, 0x1001158
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x10026dd
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0100225a
test eax, eax
jne 0x10026d4
push 0x2721
push 1
call fcn.0100916c
pop ecx
pop ecx
push 1
call fcn.01004444
int3

Function at 0x100275d
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 4
mov edi, 0x1001184
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002777
push 6
jmp 0x100279d
push 4
mov edi, 0x1001188
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x100278b
push 0x11
jmp 0x100279d
push 5
mov edi, 0x100118c
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x10027a3
push 0x3a
pop eax
pop edi
pop esi
ret 4
mov edi, 0x100114c
mov esi, eax
push 7
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x10027b7
xor eax, eax
jmp 0x100279e
push eax
push 0x2722
push 1
call fcn.0100916c
add esp, 0xc
push 1
call fcn.01004444
int3

Function at 0x100280b
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 4
mov edi, 0x1001184
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002825
push 6
jmp 0x100284b
push 4
mov edi, 0x1001188
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002839
push 0x11
jmp 0x100284b
push 5
mov edi, 0x100118c
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002851
push 0x3a
pop eax
pop edi
pop esi
ret 4
mov edi, 0x1001158
mov esi, eax
push 2
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002865
xor eax, eax
jmp 0x100284c
push eax
push 0x2722
push 1
call fcn.0100916c
add esp, 0xc
push 1
call fcn.01004444
int3
Function at 0x1002a49
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 2
mov edi, 0x1001198
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002a63
inc eax
pop edi
pop esi
ret 4
mov esi, dword [esp + 0xc]
mov edi, 0x1001154
push 2
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1002a5e
push 0x2723
push 1
call fcn.0100916c
pop ecx
pop ecx
push 1
call fcn.01004444
int3

Function at 0x1002b0c
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 8
mov edi, 0x10011a0
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002b2a
xor eax, eax
inc eax
pop edi
pop esi
ret 4
mov edi, 0x10011a8
mov esi, eax
push 9
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002b3e
push 2
jmp 0x1002b50
push 9
mov edi, 0x10011b4
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002b53
push 3
pop eax
jmp 0x1002b25
push eax
push 0x2724
push 1
call fcn.0100916c
add esp, 0xc
push 1
call fcn.01004444
int3

Function at 0x1002ba2
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 7
mov edi, 0x10011c0
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002bc0
xor eax, eax
inc eax
pop edi
pop esi
ret 4
mov edi, 0x10011c8
mov esi, eax
push 8
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002bd4
push 2
jmp 0x1002bfa
push 6
mov edi, 0x10011d0
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002be8
push 4
jmp 0x1002bfa
push 0xa
mov edi, 0x10011d8
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002bfd
push 8
pop eax
jmp 0x1002bbb
push eax
push 0x2725
push 1
call fcn.0100916c
add esp, 0xc
push 1
call fcn.01004444
int3

Function at 0x1002c55
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 5
mov edi, 0x10011e4
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002c72
xor eax, eax
pop edi
pop esi
ret 4
mov edi, 0x10011ec
mov esi, eax
push 9
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002c87
xor eax, eax
inc eax
jmp 0x1002c6d
push 0xc
mov edi, 0x10011f8
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002c9b
push 2
jmp 0x1002cc1
push 0xa
mov edi, 0x1001204
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002caf
push 3
jmp 0x1002cc1
push 0xd
mov edi, 0x1001210
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002cc4
push 4
pop eax
jmp 0x1002c6d
push eax
push 0x2726
push 1
call fcn.0100916c
add esp, 0xc
push 1
call fcn.01004444
int3
Function at 0x10032b9
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x1b8
mov eax, dword [0x100a034]
push 0x101
push dword [ebp + 0x7c]
mov dword [ebp + 0x70], eax
lea eax, [ebp - 0x140]
push eax
call fcn.010048e0
add esp, 0xc
cmp byte [ebp - 0x40], 0
je 0x10032f9
push 0x2727
push 1
call fcn.0100916c
pop ecx
pop ecx
jmp 0x1003344
push esi
push edi
lea edi, [ebp - 0x140]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003302
mov esi, 0x100140c
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x140]
push 0x1001408
push eax
movsb byte es:[edi], byte [esi]
call fcn.0100488e
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x144], eax
jne 0x100334b
lea eax, [ebp - 0x140]
push eax
push 0x2728
push 1
call fcn.0100916c
add esp, 0xc
push 1
call fcn.01004444
lea eax, [ebp - 0x38]
push eax
push 0
push 0
call fcn.01001f4b
mov esi, eax
test esi, esi
mov edi, 0x2729
je 0x1003384
cmp esi, 0x491
je 0x1003380
push 1
push esi
call fcn.01001ec0
push eax
push esi
push edi
push 1
call fcn.0100916c
add esp, 0x10
xor esi, esi
jmp 0x1003387
mov esi, dword [ebp - 0x30]
push 0x10013f0
push dword [ebp - 0x144]
call fcn.010048a1
pop ecx
pop ecx
push dword [ebp - 0x144]
call fcn.01002f1c
jmp 0x10033ca
lea eax, [ebp - 0x38]
push eax
push esi
push 0
call fcn.01001f4b
mov esi, eax
test esi, esi
jne 0x10033d0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x144]
call fcn.01002d48
mov esi, dword [ebp - 0x2c]
test esi, esi
jne 0x10033a6
jmp 0x10033e5
push 1
push esi
call fcn.01001ec0
push eax
push esi
push edi
push 1
call fcn.0100916c
add esp, 0x10
push dword [ebp - 0x144]
call fcn.01003045
push dword [ebp - 0x144]
call fcn.01004716
lea eax, [ebp - 0x140]
push eax
push 0x272a
push 1
call fcn.0100916c
mov ecx, dword [ebp + 0x70]
add esp, 0x10
pop edi
pop esi
call fcn.01004049
add ebp, 0x74
leave
ret 4