joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d31c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015de50
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6b6c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, 0x102b8264
call fcn.10124b2c
mov eax, dword [esi + 0x10]
inc eax
cmp dword [esi + 8], eax
ja 0x100d3203
push 1
mov ecx, esi
call fcn.100a8e90
mov edi, dword [esi + 8]
dec edi
mov eax, edi
and eax, dword [esi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 0x10]
add ecx, eax
mov eax, dword [esi + 4]
and edi, ecx
cmp dword [eax + edi*4], 0
jne 0x100d3232
push 0x90
call fcn.10124b6c
mov ecx, dword [esi + 4]
add esp, 4
mov dword [ecx + edi*4], eax
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + edi*4]
mov eax, dword [ecx]
mov dword [ebp - 0x10], edx
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0xc], eax
movups xmm0, xmmword [ecx + 0x10]
push 0x10088250
push fcn.100a81a0
push 8
push 0xc
lea eax, [ecx + 0x30]
mov dword [ebp - 4], 0
movups xmmword [edx + 0x10], xmm0
push eax
movups xmm0, xmmword [ecx + 0x20]
lea eax, [edx + 0x30]
push eax
movups xmmword [edx + 0x20], xmm0
call fcn.10125d0b
inc dword [esi + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100d95e0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x102b8289
call fcn.10124b2c
mov ecx, esi
mov eax, 0x10262540
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100d9628
test dl, dl
je 0x100d9624
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100d9628
add eax, 2
add ecx, 2
test dl, dl
jne 0x100d9608
xor eax, eax
jmp 0x100d962d
sbb eax, eax
or eax, 1
test eax, eax
je 0x100d9772
cmp byte [esi], 0
jne 0x100d9670
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], 0x6d5f7363
mov edx, esi
mov dword [ebp - 0x110], 0x69746c69
mov eax, ecx
mov word [ebp - 0x10c], 0x61
sub edx, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100d9663
mov ecx, 0x3e
xor edx, edx
mov al, byte [edx + 0x10194270]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x118], al
and ecx, 0x800000ff
jns 0x100d9697
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x100d9677
push esi
lea eax, [ebp - 0x118]
mov byte [ebp - 0x108], 0
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.10026180
lea eax, [ebp - 0x104]
push eax
call fcn.100d9790
add esp, 0x10
test al, al
jne 0x100d96f3
mov ecx, 0x10262540
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x100d96d2
mov byte [0x10262514], al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101ea094]
push 0x10262400
call eax
mov ecx, eax
add esp, 4
mov dword [0x10262518], ecx
test ecx, ecx
jne 0x100d9736
mov ecx, 0x10262540
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x100d9715
mov byte [0x10262514], al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
mov eax, 0x2aaaaaab
mov byte [0x10262514], 1
imul dword [ecx + 0x48]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
sqrtsd xmm0, xmm0
cvttsd2si ecx, xmm0
lea eax, [ecx*4]
mov dword [0x101e6948], eax
lea eax, [ecx + ecx*2]
mov dword [0x101e694c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
Function at 0x100dd250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 2
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax + 0x760b961b]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100dd28d
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xf
jl 0x100dd270
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100dd750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 7
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax + 0x44511c5d]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100dd78d
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100dd770
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100ddc40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x10
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax - 0x1361295d]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100ddc7d
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100ddc60
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100ddc90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x10
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax - 0x1a8c0658]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100ddccd
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100ddcb0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100ded10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x23
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax - 0x3091247e]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100ded4d
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100ded30
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100dfb20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x34
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax + 0x7ef1358c]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100dfb5d
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100dfb40
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100dfcc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x36
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax - 0x40d30cdf]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100dfcfd
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100dfce0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100e0980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x42
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax + 0x7feb2f7]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100e09bd
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100e09a0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100e13c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x4d
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax + 0x73be9875]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100e13fd
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100e13e0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100e1a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x55
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax - 0xe5951e7]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100e1a4d
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100e1a30
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100e2c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x6f
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax + 0x476d6f07]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100e2c6d
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100e2c50
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100e3260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x78
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax + 0x149d8cba]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100e329d
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100e3280
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100e3970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x7d
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax + 0x4f8cfdb8]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100e39ad
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100e3990
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100e40c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x86
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax + 0x15149245]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100e40fd
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100e40e0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100e4580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x8d
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax - 0x5f51d944]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100e45bd
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100e45a0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100e4760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0x8e
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax - 0x324fd7a8]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100e479d
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100e4780
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100e59c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0xa3
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax - 0x7f20b0fb]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100e59fd
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100e59e0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100e7b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0xc
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax + 0x4d9441a8]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100e7b7d
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100e7b60
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100e9bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0xe8
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax - 0x31d6fb0e]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100e9bed
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100e9bd0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100ea200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0xed
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax + 0x1f07f59]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100ea23d
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100ea220
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100ea970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, 0x102b82c6
call fcn.10124b2c
mov edx, dword [ebp + 8]
mov ebx, 0xf3
xor eax, eax
nop dword [eax + eax]
mov cl, byte [edx + eax + 0x3fd91d13]
xor cl, bl
inc ebx
mov byte [eax + esi], cl
and ebx, 0x800000ff
jns 0x100ea9ad
dec ebx
or ebx, 0xffffff00
inc ebx
inc eax
cmp eax, 0xc
jl 0x100ea990
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10105990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x102b8317
push edi
mov edi, dword [ebp + 0xc]
call fcn.10124b2c
movss xmm0, dword [esi]
movss xmm1, dword [0x1016d2c8]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10105a1a
xor ecx, ecx
nop dword [eax]
cmp byte [ecx + 0x10263c08], 0
je 0x10105a09
cmp ecx, 0x1b
je 0x10105a14
movd xmm0, ecx
mov eax, ecx
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101672c0]
cvtpd2ps xmm0, xmm0
ucomiss xmm0, dword [0x101eb89c]
lahf
test ah, 0x44
jnp 0x10105a14
movss dword [esi], xmm0
inc ecx
cmp ecx, 0xff
jb 0x101059d0
jmp 0x10105a1a
mov dword [esi], 0xbf800000
movss xmm0, dword [esi]
ucomiss xmm0, dword [0x10168b2c]
lahf
test ah, 0x44
jp 0x10105a64
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x6b206f4e
push eax
lea eax, [ebp - 0x104]
mov word [ebp - 0x20c], 0x7965
push eax
mov byte [ebp - 0x20a], 0
call fcn.10026180
movaps xmm0, xmmword [0x101989e0]
add esp, 8
jmp 0x10105ae1
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10105aa9
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x73657250
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x20c], 0x656b2073
push eax
mov word [ebp - 0x208], 0x79
call fcn.10026180
movaps xmm0, xmmword [0x10168b90]
add esp, 8
jmp 0x10105ae1
cvttss2si eax, xmm0
push eax
call fcn.10105f80
push eax
lea eax, [ebp - 0x214]
mov word [ebp - 0x214], 0x7325
push eax
lea eax, [ebp - 0x104]
mov byte [ebp - 0x212], 0
push eax
call fcn.10026180
movaps xmm0, xmmword [0x101989f0]
add esp, 0x10
push edi
movups xmmword [ebp - 0x224], xmm0
call fcn.1004b1a0
lea eax, [ebp - 0x224]
push eax
push 0
call fcn.1001d670
push edi
lea eax, [ebp - 0x104]
mov dword [ebp - 0x210], 0x5d73255b
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x20c], 0x73252323
push eax
lea eax, [ebp - 0x204]
mov byte [ebp - 0x208], 0
push eax
call fcn.10026180
add esp, 0x1c
lea eax, [ebp + 0x10]
cmp byte [ebp + 0x18], 0
je 0x10105b50
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.1003f670
add esp, 8
jmp 0x10105b62
push 0
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.10106e90
add esp, 0xc
test al, al
je 0x10105b85
movss xmm0, dword [esi]
ucomiss xmm0, dword [0x10168b2c]
lahf
test ah, 0x44
jp 0x10105b7f
mov dword [esi], 0xc0000000
jmp 0x10105b85
mov dword [esi], 0xbf800000
push 1
call fcn.1001cf90
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
Function at 0x10109c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101619c5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x102b8323
call fcn.10124b2c
push 0x80152576
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x28], 0x437a0000
mov dword [ebp - 0x24], 0xbf800000
call fcn.10108f60
push 0
push 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
push ecx
push eax
call fcn.1000f370
mov dword [ebp - 0x18], 0x6c702323
mov word [ebp - 0x14], 0x3463
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 1
push 0x101eb9e4
push eax
call fcn.10107160
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
mov dword [ebp - 0x18], 0x6867694c
mov word [ebp - 0x14], 0x74
push dword [0x101e6998]
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 2
push 0x101eb59c
push eax
call fcn.10107690
mov dword [ebp - 0x18], 0x676c2323
mov word [ebp - 0x14], 0x3472
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 3
push 0x101eba18
push eax
call fcn.10107160
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
mov dword [ebp - 0x18], 0x776f6c47
mov byte [ebp - 0x14], 0
push dword [0x101e6998]
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 4
push 0x101eb9b0
push eax
call fcn.10107690
mov dword [ebp - 4], 0xffffffff
call fcn.10012580
add esp, 0xc
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
add esp, 8
mov dword [ebp - 0x28], 0x437a0000
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x24], 0xbf800000
push 0x73d14907
call fcn.10109040
push 0
push 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 5
push ecx
push eax
call fcn.1000f370
mov dword [ebp - 0x18], 0x636c2323
mov word [ebp - 0x14], 0x72
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 6
push 0x101eb9e8
push eax
call fcn.10107160
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
mov dword [ebp - 0x20], 0x6d616843
mov word [ebp - 0x1c], 0x73
push dword [0x101e6998]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 7
push 0x101eb998
push eax
call fcn.10107690
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x20], eax
mov word [ebp - 0x1c], ax
call fcn.10012580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret
Function at 0x10109e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10161a2d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x101e6b6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x102b8323
call fcn.10124b2c
push 0x80152576
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x1c], 0x437a0000
mov dword [ebp - 0x18], 0xbf800000
call fcn.10108f60
push 0
push 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
push ecx
push eax
call fcn.1000f370
mov dword [ebp - 0x1c], 0x46206f4e
mov dword [ebp - 0x18], 0x6873616c
mov byte [ebp - 0x14], 0
push dword [0x101e6998]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
push 0x101eb620
push eax
call fcn.10107690
mov dword [ebp - 4], 0xffffffff
call fcn.10012580
add esp, 0x14
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1001fc30
add esp, 8
mov dword [ebp - 0x1c], 0x437a0000
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], 0xbf800000
push 0x73d14907
call fcn.10109040
push 0
push 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 2
push ecx
push eax
call fcn.1000f370
mov dword [ebp - 0x1c], 0x736f7243
mov dword [ebp - 0x18], 0x69616873
mov word [ebp - 0x14], 0x72
push dword [0x101e6998]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 3
push 0x101eb4e8
push eax
call fcn.10107690
mov dword [ebp - 0x24], 0x564f46
push dword [0x101e6998]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 4
push 0x101eb60c
push eax
call fcn.10107690
add esp, 0x28
lea ecx, [ebp - 0x24]
mov eax, 0x10198be0
sub eax, 0x6a0923ef
push eax
call fcn.10109120
push 0x101eba4c
push eax
mov dword [ebp - 4], 5
call fcn.10107160
mov dword [esp + 4], 0xbf800000
mov dword [ebp - 4], 0xffffffff
mov dword [esp], 0
call fcn.1001fc30
mov dword [ebp - 0x28], 0x647548
mov dword [ebp - 4], 6
push dword [0x101e6998]
lea eax, [ebp - 0x28]
push 0x101eb564
push eax
call fcn.10107690
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], 0
call fcn.10012580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10124b5e
mov esp, ebp
pop ebp
ret