joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004b1b
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 8], 0
je 0x10004b2d
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 9
jb 0x10004b23
mov eax, ecx
ret

Function at 0x10004b30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 9], 0
je 0x10004b42
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0xa
jb 0x10004b38
mov eax, ecx
ret

Function at 0x10004b45
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x11], 0
je 0x10004b57
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x12
jb 0x10004b4d
mov eax, ecx
ret

Function at 0x10004b5a
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x13], 0
je 0x10004b6c
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x14
jb 0x10004b62
mov eax, ecx
ret

Function at 0x10004b6f
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x15], 0
je 0x10004b81
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x16
jb 0x10004b77
mov eax, ecx
ret

Function at 0x10004b84
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x28], 0
je 0x10004b96
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x29
jb 0x10004b8c
mov eax, ecx
ret

Function at 0x10004c18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x6d584e5c
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dfd0]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x10004c5f
jmp 0x10004c58
pop ebx
mov eax, 0x1009dfc0
leave
ret
push ebx
mov ebx, 0x1009dfd0
push ebx
call fcn.1007b2f8
cmp dword [0x1009dfd0], 0xffffffff
pop ecx
jne 0x10004c57
push esi
push edi
mov edi, 0x1009dfc0
lea esi, [ebp - 0x10]
push 0x1008175c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10004c57

Function at 0x10004d11
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dfa8]
cmp eax, dword [ecx + 4]
jg 0x10004d52
jmp 0x10004d4b
pop ebx
mov eax, 0x1009df9c
leave
ret
push ebx
mov ebx, 0x1009dfa8
push ebx
call fcn.1007b2f8
cmp dword [0x1009dfa8], 0xffffffff
pop ecx
jne 0x10004d4a
push esi
push edi
mov edi, 0x1009df9c
lea esi, [ebp - 0xc]
push 0x1008177a
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10004d4a
Function at 0x10004d8b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009df58]
cmp eax, dword [ecx + 4]
jg 0x10004dcc
jmp 0x10004dc5
pop ebx
mov eax, 0x1009df4c
leave
ret
push ebx
mov ebx, 0x1009df58
push ebx
call fcn.1007b2f8
cmp dword [0x1009df58], 0xffffffff
pop ecx
jne 0x10004dc4
push esi
push edi
mov edi, 0x1009df4c
lea esi, [ebp - 0xc]
push 0x10081787
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10004dc4

Function at 0x10004e05
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dff8]
cmp eax, dword [ecx + 4]
jg 0x10004e46
jmp 0x10004e3f
pop ebx
mov eax, 0x1009dfec
leave
ret
push ebx
mov ebx, 0x1009dff8
push ebx
call fcn.1007b2f8
cmp dword [0x1009dff8], 0xffffffff
pop ecx
jne 0x10004e3e
push esi
push edi
mov edi, 0x1009dfec
lea esi, [ebp - 0xc]
push 0x10081794
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10004e3e

Function at 0x10004e7f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dee0]
cmp eax, dword [ecx + 4]
jg 0x10004ec0
jmp 0x10004eb9
pop ebx
mov eax, 0x1009ded4
leave
ret
push ebx
mov ebx, 0x1009dee0
push ebx
call fcn.1007b2f8
cmp dword [0x1009dee0], 0xffffffff
pop ecx
jne 0x10004eb8
push esi
push edi
mov edi, 0x1009ded4
lea esi, [ebp - 0xc]
push 0x100817a1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10004eb8
Function at 0x10004ef9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009df84]
cmp eax, dword [ecx + 4]
jg 0x10004f3a
jmp 0x10004f33
pop ebx
mov eax, 0x1009df78
leave
ret
push ebx
mov ebx, 0x1009df84
push ebx
call fcn.1007b2f8
cmp dword [0x1009df84], 0xffffffff
pop ecx
jne 0x10004f32
push esi
push edi
mov edi, 0x1009df78
lea esi, [ebp - 0xc]
push 0x100817ae
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10004f32

Function at 0x10004f73
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009df34]
cmp eax, dword [ecx + 4]
jg 0x10004fb4
jmp 0x10004fad
pop ebx
mov eax, 0x1009df28
leave
ret
push ebx
mov ebx, 0x1009df34
push ebx
call fcn.1007b2f8
cmp dword [0x1009df34], 0xffffffff
pop ecx
jne 0x10004fac
push esi
push edi
mov edi, 0x1009df28
lea esi, [ebp - 0xc]
push 0x100817bb
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10004fac

Function at 0x10005064
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009df0c]
cmp eax, dword [ecx + 4]
jg 0x100050a5
jmp 0x1000509e
pop ebx
mov eax, 0x1009df00
leave
ret
push ebx
mov ebx, 0x1009df0c
push ebx
call fcn.1007b2f8
cmp dword [0x1009df0c], 0xffffffff
pop ecx
jne 0x1000509d
push esi
push edi
mov edi, 0x1009df00
lea esi, [ebp - 0xc]
push 0x100817d7
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000509d

Function at 0x100051db
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e546250
mov dword [ebp - 8], 0xc4d5451
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009decc]
cmp eax, dword [ecx + 4]
jg 0x10005219
jmp 0x10005212
pop ebx
mov eax, 0x1009dec0
leave
ret
push ebx
mov ebx, 0x1009decc
push ebx
call fcn.1007b2f8
cmp dword [0x1009decc], 0xffffffff
pop ecx
jne 0x10005211
push esi
push edi
mov edi, 0x1009dec0
lea esi, [ebp - 0xc]
push 0x10081804
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10005211
Function at 0x10005252
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7b5b6250
mov dword [ebp - 8], 0x4e5a5c51
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009dfb8]
cmp eax, dword [ecx + 4]
jg 0x10005290
jmp 0x10005289
pop ebx
mov eax, 0x1009dfac
leave
ret
push ebx
mov ebx, 0x1009dfb8
push ebx
call fcn.1007b2f8
cmp dword [0x1009dfb8], 0xffffffff
pop ecx
jne 0x10005288
push esi
push edi
mov edi, 0x1009dfac
lea esi, [ebp - 0xc]
push 0x10081811
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10005288

Function at 0x10005433
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x75546250
mov dword [ebp - 8], 0x49515c58
mov word [ebp - 4], 0x3d55
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009df94]
cmp eax, dword [ecx + 4]
jg 0x10005473
jmp 0x1000546c
pop ebx
mov eax, 0x1009df88
leave
ret
push ebx
mov ebx, 0x1009df94
push ebx
call fcn.1007b2f8
cmp dword [0x1009df94], 0xffffffff
pop ecx
jne 0x1000546b
push esi
push edi
mov edi, 0x1009df88
lea esi, [ebp - 0xc]
push 0x1008184c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000546b

Function at 0x100054ad
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x745f6250
mov dword [ebp - 8], 0x525e6e4e
mov dword [ebp - 4], 0x3d59584d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009df44]
cmp eax, dword [ecx + 4]
jg 0x100054ee
jmp 0x100054e7
pop ebx
mov eax, 0x1009df38
leave
ret
push ebx
mov ebx, 0x1009df44
push ebx
call fcn.1007b2f8
cmp dword [0x1009df44], 0xffffffff
pop ecx
jne 0x100054e6
push esi
push edi
mov edi, 0x1009df38
lea esi, [ebp - 0xc]
push 0x1008185a
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100054e6
Function at 0x100055a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x6e546250
mov dword [ebp - 0xc], 0x4e495255
mov dword [ebp - 8], 0x584f547b
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009df20]
mov word [ebp - 4], 0x3d59
cmp eax, dword [ecx + 4]
jg 0x100055eb
jmp 0x100055e4
pop ebx
mov eax, 0x1009df10
leave
ret
push ebx
mov ebx, 0x1009df20
push ebx
call fcn.1007b2f8
cmp dword [0x1009df20], 0xffffffff
pop ecx
jne 0x100055e3
push esi
push edi
mov edi, 0x1009df10
lea esi, [ebp - 0x10]
push 0x10081878
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100055e3
Function at 0x10006819
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x1009dc24]
sub esp, 0xc
mov eax, dword [ecx]
push ebx
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1000693b
mov ecx, dword [0x100e7400]
test ecx, ecx
je 0x1000693b
call fcn.10006717
cmp dword [eax], 0
jle 0x1000693b
mov ecx, dword [0x100e7400]
call fcn.10002d83
mov ebx, eax
test ebx, ebx
je 0x1000693b
mov ecx, ebx
call fcn.10006be0
test al, al
jne 0x10006890
mov ecx, ebx
call fcn.100034d7
cmp dword [eax + 0xc8], 1
je 0x10006890
mov ecx, ebx
call fcn.10006b13
test al, al
je 0x1000693b
push esi
push edi
mov ecx, ebx
call fcn.100034d7
mov esi, dword [0x100e73b8]
call fcn.10006275
mov dword [ebp - 4], eax
lea ecx, [esi + 0x30]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10004889
push 0x19
pop ecx
mov edi, 0x1009d038
mov esi, dword [eax]
add esi, 0x14
rep movsd dword es:[edi], dword [esi]
cmp byte [0x1009d038], 0
pop edi
pop esi
je 0x1000693b
mov ecx, ebx
call fcn.10003a3c
cmp word [eax], 9
je 0x100068eb
mov ecx, ebx
call fcn.10003a3c
cmp word [eax], 0x28
jne 0x10006904
cmp byte [0x1009d04c], 0
je 0x10006904
mov ecx, dword [0x100e7400]
call fcn.10006b3a
cmp byte [eax], 0
je 0x1000693b
mov ecx, ebx
call fcn.10006650
test al, al
je 0x1000693b
mov ecx, ebx
call fcn.10006ae1
test al, al
jne 0x1000693b
cmp byte [0x1009d041], al
je 0x10006937
push dword [0x1009d054]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x10006937
xor eax, eax
jmp 0x1000693d
mov al, 1
jmp 0x1000693d
xor al, al
pop ebx
leave
ret
Function at 0x10007a18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009e084]
cmp eax, dword [ecx + 4]
jg 0x10007a59
jmp 0x10007a52
pop ebx
mov eax, 0x1009e078
leave
ret
push ebx
mov ebx, 0x1009e084
push ebx
call fcn.1007b2f8
cmp dword [0x1009e084], 0xffffffff
pop ecx
jne 0x10007a51
push esi
push edi
mov edi, 0x1009e078
lea esi, [ebp - 0xc]
push 0x10081891
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10007a51

Function at 0x100083d3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009e3d8]
cmp eax, dword [ecx + 4]
jg 0x10008414
jmp 0x1000840d
pop ebx
mov eax, 0x1009e3cc
leave
ret
push ebx
mov ebx, 0x1009e3d8
push ebx
call fcn.1007b2f8
cmp dword [0x1009e3d8], 0xffffffff
pop ecx
jne 0x1000840c
push esi
push edi
mov edi, 0x1009e3cc
lea esi, [ebp - 0xc]
push 0x100818cd
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000840c

Function at 0x1000844d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x745f6250
mov dword [ebp - 0xc], 0x5b58794e
mov dword [ebp - 8], 0x53544e48
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1009e3ec]
mov word [ebp - 4], 0x3d5a
cmp eax, dword [ecx + 4]
jg 0x10008494
jmp 0x1000848d
pop ebx
mov eax, 0x1009e3dc
leave
ret
push ebx
mov ebx, 0x1009e3ec
push ebx
call fcn.1007b2f8
cmp dword [0x1009e3ec], 0xffffffff
pop ecx
jne 0x1000848c
push esi
push edi
mov edi, 0x1009e3dc
lea esi, [ebp - 0x10]
push 0x100818da
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000848c
Function at 0x10008cb7
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x26], 0
je 0x10008cc9
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x27
jb 0x10008cbf
mov eax, ecx
ret

Function at 0x10008ccc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xe], 0
je 0x10008cde
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0xf
jb 0x10008cd4
mov eax, ecx
ret

Function at 0x10008d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100a2f44]
cmp eax, dword [ecx + 4]
jg 0x10008da1
jmp 0x10008d9a
pop ebx
mov eax, 0x100a2f38
leave
ret
push ebx
mov ebx, 0x100a2f44
push ebx
call fcn.1007b2f8
cmp dword [0x100a2f44], 0xffffffff
pop ecx
jne 0x10008d99
push esi
push edi
mov edi, 0x100a2f38
lea esi, [ebp - 0xc]
push 0x10081940
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10008d99

Function at 0x10008dda
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x6d584e5c
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100a2f18]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x10008e21
jmp 0x10008e1a
pop ebx
mov eax, 0x100a2f08
leave
ret
push ebx
mov ebx, 0x100a2f18
push ebx
call fcn.1007b2f8
cmp dword [0x100a2f18], 0xffffffff
pop ecx
jne 0x10008e19
push esi
push edi
mov edi, 0x100a2f08
lea esi, [ebp - 0x10]
push 0x1008194d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10008e19

Function at 0x10008f67
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x515b6250
mov dword [ebp - 0xc], 0x565e4879
mov dword [ebp - 8], 0x4852507c
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100a2f58]
mov word [ebp - 4], 0x4953
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10008fb2
jmp 0x10008fab
pop ebx
mov eax, 0x100a2f48
leave
ret
push ebx
mov ebx, 0x100a2f58
push ebx
call fcn.1007b2f8
cmp dword [0x100a2f58], 0xffffffff
pop ecx
jne 0x10008faa
push esi
push edi
mov edi, 0x100a2f48
lea esi, [ebp - 0x10]
push 0x1008197d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10008faa
Function at 0x1000a98b
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x18], 0
je 0x1000a99d
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x19
jb 0x1000a993
mov eax, ecx
ret

Function at 0x1000a9a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1a], 0
je 0x1000a9b2
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x1b
jb 0x1000a9a8
mov eax, ecx
ret

Function at 0x1000a9b5
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x21], 0
je 0x1000a9c7
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x22
jb 0x1000a9bd
mov eax, ecx
ret

Function at 0x1000aa49
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x5c49495c
mov dword [ebp - 8], 0x4f58565e
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100a8064]
cmp eax, dword [ecx + 4]
jg 0x1000aa87
jmp 0x1000aa80
pop ebx
mov eax, 0x100a8058
leave
ret
push ebx
mov ebx, 0x100a8064
push ebx
call fcn.1007b2f8
cmp dword [0x100a8064], 0xffffffff
pop ecx
jne 0x1000aa7f
push esi
push edi
mov edi, 0x100a8058
lea esi, [ebp - 0xc]
push 0x10081a09
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000aa7f

Function at 0x1000aac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
movaps xmm0, xmmword [0x100849e0]
push edi
movups xmmword [ebp - 0x1c], xmm0
mov ecx, dword [eax + ecx*4]
mov edi, 0x100a7fb4
mov eax, dword [0x100a7fd0]
mov dword [ebp - 0xc], 0x58535862
mov dword [ebp - 8], 0x4e585450
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1000ab0d
jmp 0x1000ab08
pop esi
mov eax, edi
pop edi
leave
ret
push esi
mov esi, 0x100a7fd0
push esi
call fcn.1007b2f8
cmp dword [0x100a7fd0], 0xffffffff
pop ecx
jne 0x1000ab07
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000a8d4
push 0x10081a16
call fcn.1007b15e
push esi
call fcn.1007b2a7
pop ecx
pop ecx
jmp 0x1000ab07

Function at 0x1000ab42
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100a7f88]
cmp eax, dword [ecx + 4]
jg 0x1000ab83
jmp 0x1000ab7c
pop ebx
mov eax, 0x100a7f7c
leave
ret
push ebx
mov ebx, 0x100a7f88
push ebx
call fcn.1007b2f8
cmp dword [0x100a7f88], 0xffffffff
pop ecx
jne 0x1000ab7b
push esi
push edi
mov edi, 0x100a7f7c
lea esi, [ebp - 0xc]
push 0x10081a26
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000ab7b
Function at 0x1000abbc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x6d584e5c
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100a7f64]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x1000ac03
jmp 0x1000abfc
pop ebx
mov eax, 0x100a7f54
leave
ret
push ebx
mov ebx, 0x100a7f64
push ebx
call fcn.1007b2f8
cmp dword [0x100a7f64], 0xffffffff
pop ecx
jne 0x1000abfb
push esi
push edi
mov edi, 0x100a7f54
lea esi, [ebp - 0x10]
push 0x10081a33
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000abfb

Function at 0x1000ac3e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0x10], 0x584f6d7e
mov dword [ebp - 0xc], 0x544d545e
mov dword [ebp - 8], 0x54495c49
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100a8054]
mov word [ebp - 4], 0x5352
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1000ac89
jmp 0x1000ac82
pop ebx
mov eax, 0x100a8044
leave
ret
push ebx
mov ebx, 0x100a8054
push ebx
call fcn.1007b2f8
cmp dword [0x100a8054], 0xffffffff
pop ecx
jne 0x1000ac81
push esi
push edi
mov edi, 0x100a8044
lea esi, [ebp - 0x10]
push 0x10081a42
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000ac81

Function at 0x1000adce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e7624]
mov dword [ebp - 0xc], 0x6e5f6250
mov dword [ebp - 8], 0x4949524d
mov word [ebp - 4], 0x5958
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100a7f74]
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x1000ae12
jmp 0x1000ae0b
pop ebx
mov eax, 0x100a7f68
leave
ret
push ebx
mov ebx, 0x100a7f74
push ebx
call fcn.1007b2f8
cmp dword [0x100a7f74], 0xffffffff
pop ecx
jne 0x1000ae0a
push esi
push edi
mov edi, 0x100a7f68
lea esi, [ebp - 0xc]
push 0x10081a75
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.1007b15e
push ebx
call fcn.1007b2a7
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000ae0a