joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cdb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
mov dword [ebp - 0x20], 0x680063
mov dword [ebp - 0x1c], 0x630065
mov dword [ebp - 0x18], 0x5f006b
mov dword [ebp - 0x14], 0x64006d
mov dword [ebp - 0x10], 0x5f0035
mov dword [ebp - 0xc], 0x610066
mov dword [ebp - 8], 0x6c0069
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001ce47
mov eax, dword [ecx]
push 2
push 0xe
call dword [eax]
test eax, eax
je 0x1001ce51
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xe
jl 0x1001ce3d
mov dword [eax - 0xc], 0xe
xor eax, eax
mov ecx, dword [esi]
push 0x1c
mov word [ecx + 0x1c], ax
lea eax, [ebp - 0x20]
push eax
push 0x1c
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x1001ce60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x10146c00]
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x6567616d
mov dword [ebp - 8], 0x69616620
mov word [ebp - 4], 0x2e6c
mov byte [ebp - 2], 0
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001cee1
mov eax, dword [ecx]
push 1
push 0x1a
call dword [eax]
test eax, eax
je 0x1001ceeb
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x1a
jl 0x1001ced7
mov dword [eax - 0xc], 0x1a
lea eax, [ebp - 0x1c]
mov ecx, dword [esi]
push 0x1a
push eax
push 0x1a
mov byte [ecx + 0x1a], 0
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x1001cf00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov dword [ebp - 0x18], 0x6c0063
mov dword [ebp - 0x14], 0x73006f
mov dword [ebp - 0x10], 0x5f0065
mov dword [ebp - 0xc], 0x720074
mov dword [ebp - 8], 0x790061
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001cf89
mov eax, dword [ecx]
push 2
push 0xa
call dword [eax]
test eax, eax
je 0x1001cf93
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x1001cf7f
mov dword [eax - 0xc], 0xa
xor eax, eax
mov ecx, dword [esi]
push 0x14
mov word [ecx + 0x14], ax
lea eax, [ebp - 0x18]
push eax
push 0x14
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3
Function at 0x1001d030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov dword [ebp - 0x18], 0x760061
push esi
mov dword [ebp - 0x14], 0x63005f
mov dword [ebp - 0x10], 0x5f006c
mov dword [ebp - 0xc], 0x610066
mov dword [ebp - 8], 0x6c0069
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001d0b9
mov eax, dword [ecx]
push 2
push 0xa
call dword [eax]
test eax, eax
je 0x1001d0c3
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x1001d0af
mov dword [eax - 0xc], 0xa
xor eax, eax
mov ecx, dword [esi]
push 0x14
mov word [ecx + 0x14], ax
lea eax, [ebp - 0x18]
push eax
push 0x14
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x1001d160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 0x750070
mov dword [ebp - 0x1c], 0x680073
mov dword [ebp - 0x18], 0x69005f
mov dword [ebp - 0x14], 0x73006e
mov dword [ebp - 0x10], 0x610074
mov dword [ebp - 0xc], 0x6c006c
mov dword [ebp - 8], 0x640065
mov dword [ebp - 4], 0x5f
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001d1f8
mov eax, dword [ecx]
push 2
push 0xf
call dword [eax]
test eax, eax
je 0x1001d202
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xf
jl 0x1001d1ee
mov dword [eax - 0xc], 0xf
xor eax, eax
mov ecx, dword [esi]
push 0x1e
mov word [ecx + 0x1e], ax
lea eax, [ebp - 0x20]
push eax
push 0x1e
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x1001e020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x10146ba0]
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x67666320
mov dword [ebp - 8], 0x69616620
mov word [ebp - 4], 0x2e6c
mov byte [ebp - 2], 0
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001e0a1
mov eax, dword [ecx]
push 1
push 0x1a
call dword [eax]
test eax, eax
je 0x1001e0ab
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x1a
jl 0x1001e097
mov dword [eax - 0xc], 0x1a
lea eax, [ebp - 0x1c]
mov ecx, dword [esi]
push 0x1a
push eax
push 0x1a
mov byte [ecx + 0x1a], 0
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3
Function at 0x1001e0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], 0x760061
mov dword [ebp - 0x20], 0x64005f
mov dword [ebp - 0x1c], 0x77006f
mov dword [ebp - 0x18], 0x5f006e
mov dword [ebp - 0x14], 0x720075
mov dword [ebp - 0x10], 0x5f006c
mov dword [ebp - 0xc], 0x6d0065
mov dword [ebp - 8], 0x740070
mov dword [ebp - 4], 0x79
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001e15f
mov eax, dword [ecx]
push 2
push 0x11
call dword [eax]
test eax, eax
je 0x1001e169
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x11
jl 0x1001e155
mov dword [eax - 0xc], 0x11
xor eax, eax
mov ecx, dword [esi]
push 0x22
mov word [ecx + 0x22], ax
lea eax, [ebp - 0x24]
push eax
push 0x22
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x1001e170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x54], 0x700020
push edi
mov dword [ebp - 0x50], 0x650072
mov dword [ebp - 0x4c], 0x610070
mov dword [ebp - 0x48], 0x650072
mov dword [ebp - 0x44], 0x730020
mov dword [ebp - 0x40], 0x6f0068
mov dword [ebp - 0x3c], 0x200077
mov dword [ebp - 0x38], 0x6e0077
mov dword [ebp - 0x34], 0x200064
mov dword [ebp - 0x30], 0x750062
mov dword [ebp - 0x2c], 0x200074
mov dword [ebp - 0x28], 0x6e006f
mov dword [ebp - 0x24], 0x200065
mov dword [ebp - 0x20], 0x6b0062
mov dword [ebp - 0x1c], 0x690020
mov dword [ebp - 0x18], 0x61006d
mov dword [ebp - 0x14], 0x650067
mov dword [ebp - 0x10], 0x6c0020
mov dword [ebp - 0xc], 0x73006f
mov dword [ebp - 8], 0x2e0065
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001e266
mov eax, dword [ecx]
push 2
push 0x28
call dword [eax]
test eax, eax
je 0x1001e270
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x28
jl 0x1001e25c
mov dword [eax - 0xc], 0x28
xor eax, eax
mov ecx, dword [esi]
push 0x50
mov word [ecx + 0x50], ax
lea eax, [ebp - 0x54]
push eax
push 0x50
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3
Function at 0x1001e310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
mov dword [ebp - 0x24], 0x760061
push esi
mov dword [ebp - 0x20], 0x75005f
mov dword [ebp - 0x1c], 0x7a006e
mov dword [ebp - 0x18], 0x700069
mov dword [ebp - 0x14], 0x62005f
mov dword [ebp - 0x10], 0x5f006b
mov dword [ebp - 0xc], 0x610066
mov dword [ebp - 8], 0x6c0069
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001e3ae
mov eax, dword [ecx]
push 2
push 0x10
call dword [eax]
test eax, eax
je 0x1001e3b8
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x10
jl 0x1001e3a4
mov dword [eax - 0xc], 0x10
xor eax, eax
mov ecx, dword [esi]
push 0x20
mov word [ecx + 0x20], ax
lea eax, [ebp - 0x24]
push eax
push 0x20
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x1001e3c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov dword [ebp - 0x18], 0x70006f
mov dword [ebp - 0x14], 0x6e0065
mov dword [ebp - 0x10], 0x750020
mov dword [ebp - 0xc], 0x6c0072
mov dword [ebp - 8], 0x20003a
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001e449
mov eax, dword [ecx]
push 2
push 0xa
call dword [eax]
test eax, eax
je 0x1001e453
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x1001e43f
mov dword [eax - 0xc], 0xa
xor eax, eax
mov ecx, dword [esi]
push 0x14
mov word [ecx + 0x14], ax
lea eax, [ebp - 0x18]
push eax
push 0x14
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x1001e460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], 0x55005c
mov dword [ebp - 0x18], 0x690074
mov dword [ebp - 0x14], 0x73006c
mov dword [ebp - 0x10], 0x37005c
mov dword [ebp - 0xc], 0x2e007a
mov dword [ebp - 8], 0x6c0064
mov dword [ebp - 4], 0x6c
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001e4f1
mov eax, dword [ecx]
push 2
push 0xd
call dword [eax]
test eax, eax
je 0x1001e4fb
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xd
jl 0x1001e4e7
mov dword [eax - 0xc], 0xd
xor eax, eax
mov ecx, dword [esi]
push 0x1a
mov word [ecx + 0x1a], ax
lea eax, [ebp - 0x1c]
push eax
push 0x1a
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3
Function at 0x1001e510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10187468]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x1a
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x650072
mov dword [ebp - 0x38], 0x650063
mov dword [ebp - 0x34], 0x760069
mov dword [ebp - 0x30], 0x640065
mov dword [ebp - 0x2c], 0x710020
mov dword [ebp - 0x28], 0x690075
mov dword [ebp - 0x24], 0x2c0074
mov dword [ebp - 0x20], 0x650020
mov dword [ebp - 0x1c], 0x690078
mov dword [ebp - 0x18], 0x200074
mov dword [ebp - 0x14], 0x6f0063
mov dword [ebp - 0x10], 0x650064
mov dword [ebp - 0xc], 0x20003a
call fcn.10009e50
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c55ab
mov esp, ebp
pop ebp
ret 4

Function at 0x1001e5c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
mov dword [ebp - 0x1c], 0x6b0062
mov dword [ebp - 0x18], 0x69005f
mov dword [ebp - 0x14], 0x61006d
mov dword [ebp - 0x10], 0x650067
mov dword [ebp - 0xc], 0x70002e
mov dword [ebp - 8], 0x67006e
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001e650
mov eax, dword [ecx]
push 2
push 0xc
call dword [eax]
test eax, eax
je 0x1001e65a
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xc
jl 0x1001e646
mov dword [eax - 0xc], 0xc
xor eax, eax
mov ecx, dword [esi]
push 0x18
mov word [ecx + 0x18], ax
lea eax, [ebp - 0x1c]
push eax
push 0x18
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x1001e700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x10146bf0]
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x6e757220
mov dword [ebp - 8], 0x61747320
mov word [ebp - 4], 0x74
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001e77d
mov eax, dword [ecx]
push 1
push 0x19
call dword [eax]
test eax, eax
je 0x1001e787
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x19
jl 0x1001e773
mov dword [eax - 0xc], 0x19
lea eax, [ebp - 0x1c]
mov ecx, dword [esi]
push 0x19
push eax
push 0x19
mov byte [ecx + 0x19], 0
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3
Function at 0x1001e820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov dword [ebp - 0x18], 0x6f0064
mov dword [ebp - 0x14], 0x6e0077
mov dword [ebp - 0x10], 0x66005f
mov dword [ebp - 0xc], 0x690061
mov dword [ebp - 8], 0x5f006c
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001e8a9
mov eax, dword [ecx]
push 2
push 0xa
call dword [eax]
test eax, eax
je 0x1001e8b3
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x1001e89f
mov dword [eax - 0xc], 0xa
xor eax, eax
mov ecx, dword [esi]
push 0x14
mov word [ecx + 0x14], ax
lea eax, [ebp - 0x18]
push eax
push 0x14
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x1001e8c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
mov dword [ebp - 0x1c], 0x690070
mov dword [ebp - 0x18], 0x740063
mov dword [ebp - 0x14], 0x720075
mov dword [ebp - 0x10], 0x5f0065
mov dword [ebp - 0xc], 0x610066
mov dword [ebp - 8], 0x6c0069
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001e950
mov eax, dword [ecx]
push 2
push 0xc
call dword [eax]
test eax, eax
je 0x1001e95a
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xc
jl 0x1001e946
mov dword [eax - 0xc], 0xc
xor eax, eax
mov ecx, dword [esi]
push 0x18
mov word [ecx + 0x18], ax
lea eax, [ebp - 0x1c]
push eax
push 0x18
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x1001e9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], 0x70006f
mov dword [ebp - 0x18], 0x6e0065
mov dword [ebp - 0x14], 0x75005f
mov dword [ebp - 0x10], 0x6c0072
mov dword [ebp - 0xc], 0x73005f
mov dword [ebp - 8], 0x630075
mov dword [ebp - 4], 0x5f
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1001ea81
mov eax, dword [ecx]
push 2
push 0xd
call dword [eax]
test eax, eax
je 0x1001ea8b
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xd
jl 0x1001ea77
mov dword [eax - 0xc], 0xd
xor eax, eax
mov ecx, dword [esi]
push 0x1a
mov word [ecx + 0x1a], ax
lea eax, [ebp - 0x1c]
push eax
push 0x1a
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3
Function at 0x10020f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 0x760061
mov dword [ebp - 0x1c], 0x62005f
mov dword [ebp - 0x18], 0x5f006b
mov dword [ebp - 0x14], 0x690066
mov dword [ebp - 0x10], 0x65006c
mov dword [ebp - 0xc], 0x6c005f
mov dword [ebp - 8], 0x73006f
mov dword [ebp - 4], 0x65
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x10021008
mov eax, dword [ecx]
push 2
push 0xf
call dword [eax]
test eax, eax
je 0x10021012
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xf
jl 0x10020ffe
mov dword [eax - 0xc], 0xf
xor eax, eax
mov ecx, dword [esi]
push 0x1e
mov word [ecx + 0x1e], ax
lea eax, [ebp - 0x20]
push eax
push 0x1e
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3
Function at 0x10026b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
mov dword [ebp - 0x1c], 0x6c0063
mov dword [ebp - 0x18], 0x630069
mov dword [ebp - 0x14], 0x20006b
mov dword [ebp - 0x10], 0x61006e
mov dword [ebp - 0xc], 0x65006d
mov dword [ebp - 8], 0x20003a
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x10026bb0
mov eax, dword [ecx]
push 2
push 0xc
call dword [eax]
test eax, eax
je 0x10026bba
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xc
jl 0x10026ba6
mov dword [eax - 0xc], 0xc
xor eax, eax
mov ecx, dword [esi]
push 0x18
mov word [ecx + 0x18], ax
lea eax, [ebp - 0x1c]
push eax
push 0x18
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x10026bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x73756f6d
mov dword [ebp - 8], 0x6e692065
mov word [ebp - 4], 0x20
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x10026c32
mov eax, dword [ecx]
push 1
push 9
call dword [eax]
test eax, eax
je 0x10026c3c
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 9
jl 0x10026c28
mov dword [eax - 0xc], 9
lea eax, [ebp - 0xc]
mov ecx, dword [esi]
push 9
push eax
push 9
mov byte [ecx + 9], 0
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x10026c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], 0x740062
mov dword [ebp - 0x18], 0x5f006e
mov dword [ebp - 0x14], 0x720064
mov dword [ebp - 0x10], 0x70006f
mov dword [ebp - 0xc], 0x6d005f
mov dword [ebp - 8], 0x6e0065
mov dword [ebp - 4], 0x75
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x10026ce1
mov eax, dword [ecx]
push 2
push 0xd
call dword [eax]
test eax, eax
je 0x10026ceb
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xd
jl 0x10026cd7
mov dword [eax - 0xc], 0xd
xor eax, eax
mov ecx, dword [esi]
push 0x1a
mov word [ecx + 0x1a], ax
lea eax, [ebp - 0x1c]
push eax
push 0x1a
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3
Function at 0x10026d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov dword [ebp - 0x18], 0x6c0063
mov dword [ebp - 0x14], 0x73006f
mov dword [ebp - 0x10], 0x5f0065
mov dword [ebp - 0xc], 0x750061
mov dword [ebp - 8], 0x6f0074
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x10026d89
mov eax, dword [ecx]
push 2
push 0xa
call dword [eax]
test eax, eax
je 0x10026d93
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x10026d7f
mov dword [eax - 0xc], 0xa
xor eax, eax
mov ecx, dword [esi]
push 0x14
mov word [ecx + 0x14], ax
lea eax, [ebp - 0x18]
push eax
push 0x14
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x10026e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10187468]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0xf
mov ecx, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0x650072
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x20], 0x6f0063
mov dword [ebp - 0x1c], 0x70006d
mov dword [ebp - 0x18], 0x70006f
mov dword [ebp - 0x14], 0x6e0077
mov dword [ebp - 0x10], 0x2e0064
mov dword [ebp - 0xc], 0x6d0078
mov dword [ebp - 8], 0x6c
call fcn.10009e50
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100c55ab
mov esp, ebp
pop ebp
ret 4

Function at 0x10026f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0x6c0063
mov dword [ebp - 0x14], 0x73006f
mov dword [ebp - 0x10], 0x5f0065
mov dword [ebp - 0xc], 0x74006f
mov dword [ebp - 8], 0x650068
mov dword [ebp - 4], 0x72
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x10026fea
mov eax, dword [ecx]
push 2
push 0xb
call dword [eax]
test eax, eax
je 0x10026ff4
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xb
jl 0x10026fe0
mov dword [eax - 0xc], 0xb
xor eax, eax
mov ecx, dword [esi]
push 0x16
mov word [ecx + 0x16], ax
lea eax, [ebp - 0x18]
push eax
push 0x16
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3
Function at 0x10027000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov dword [ebp - 0x18], 0x6c0063
mov dword [ebp - 0x14], 0x73006f
mov dword [ebp - 0x10], 0x5f0065
mov dword [ebp - 0xc], 0x680073
mov dword [ebp - 8], 0x740075
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x10027089
mov eax, dword [ecx]
push 2
push 0xa
call dword [eax]
test eax, eax
je 0x10027093
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x1002707f
mov dword [eax - 0xc], 0xa
xor eax, eax
mov ecx, dword [esi]
push 0x14
mov word [ecx + 0x14], ax
lea eax, [ebp - 0x18]
push eax
push 0x14
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x10027130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x10187468]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x2e
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], 0x6f006d
mov dword [ebp - 0x60], 0x730075
mov dword [ebp - 0x5c], 0x200065
mov dword [ebp - 0x58], 0x6f006e
mov dword [ebp - 0x54], 0x200074
mov dword [ebp - 0x50], 0x6e0069
mov dword [ebp - 0x4c], 0x630020
mov dword [ebp - 0x48], 0x720074
mov dword [ebp - 0x44], 0x2e006c
mov dword [ebp - 0x40], 0x690020
mov dword [ebp - 0x3c], 0x73006e
mov dword [ebp - 0x38], 0x610074
mov dword [ebp - 0x34], 0x6c006c
mov dword [ebp - 0x30], 0x6f0020
mov dword [ebp - 0x2c], 0x200072
mov dword [ebp - 0x28], 0x61006c
mov dword [ebp - 0x24], 0x75006e
mov dword [ebp - 0x20], 0x680063
mov dword [ebp - 0x1c], 0x700020
mov dword [ebp - 0x18], 0x730075
mov dword [ebp - 0x14], 0x200068
mov dword [ebp - 0x10], 0x700061
mov dword [ebp - 0xc], 0x2e0070
call fcn.10009e50
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c55ab
mov esp, ebp
pop ebp
ret 4