joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002da70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1008b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x10116ebc]
mov ebx, ecx
push edi
mov dword [ebp - 0x18], ebx
cmp byte [esi + 0x47d3], 0
mov edi, dword [esi + 0x3e28]
je 0x1002daea
cmp byte [esi + 0x47d2], 0
jne 0x1002daea
test ebx, 0x400
jne 0x1002daea
test byte [esi + 0x468c], 4
je 0x1002dabf
test ebx, 0x200
je 0x1002dad7
mov eax, dword [esi + 0x4798]
mov edx, dword [esi + 0x4688]
cmp eax, edx
jne 0x1002dad7
test eax, eax
jne 0x1002dbbe
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007e2f7
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x4690]
test al, 1
je 0x1002dad7
cmp dword [esi + 0x3e2c], edi
je 0x1002db08
test al, al
js 0x1002db08
test ebx, 0x100
je 0x1002dad7
test bl, bl
js 0x1002db2c
mov eax, dword [esi + 0x3e60]
test eax, eax
je 0x1002db2c
cmp eax, dword [esi + 0x4688]
je 0x1002db2c
cmp byte [esi + 0x3e6d], 0
jne 0x1002db2c
cmp eax, dword [edi + 0x54]
jne 0x1002dad7
mov ecx, dword [esi + 0x4794]
test ecx, ecx
je 0x1002db91
mov ecx, dword [ecx + 0x2e4]
test ecx, ecx
je 0x1002db91
cmp byte [ecx + 0x8f], 0
je 0x1002db91
mov eax, dword [edi + 0x2e4]
cmp ecx, eax
je 0x1002db91
mov edx, dword [ecx + 8]
test edx, 0x8000000
jne 0x1002db6b
test edx, 0x4000000
je 0x1002db91
test bl, 0x20
jne 0x1002db91
cmp dword [eax + 0x2e4], ecx
je 0x1002db91
cmp eax, ecx
je 0x1002db91
mov eax, dword [eax + 0x2e0]
test eax, eax
jne 0x1002db73
test dword [esi + 0x468c], 0x100
je 0x1002dad7
test byte [esi + 0x468c], 4
je 0x1002dba6
test ebx, 0x200
je 0x1002dad7
mov edx, dword [esi + 0x4688]
cmp edx, dword [edi + 0x54]
jne 0x1002dbbe
cmp byte [edi + 0x90], 0
jne 0x1002dad7
test ebx, 0x800
je 0x1002dbcd
movss xmm3, dword [esi + 0x3c]
jmp 0x1002dbde
test ebx, 0x1000
je 0x1002dcbe
movss xmm3, dword [esi + 0x40]
xorps xmm0, xmm0
comiss xmm3, xmm0
jbe 0x1002dcbe
test edx, edx
jne 0x1002dc7f
movss xmm1, dword [edi + 0xe4]
mov ebx, 0x10
movss xmm0, dword [esi + 0x4694]
movss xmm2, dword [edi + 0xe8]
subss xmm0, xmm1
mov ecx, dword [edi + 0xc8]
mov eax, dword [edi + 0xd0]
lea edi, [ebp - 0x14]
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [esi + 0x4698]
mov edx, dword [eax + ecx*4 - 4]
subss xmm0, xmm2
not edx
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [esi + 0x469c]
subss xmm0, xmm1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [esi + 0x46a0]
subss xmm0, xmm2
movss dword [ebp - 8], xmm0
movzx eax, byte [edi]
lea edi, [edi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10084760]
sub ebx, 1
jne 0x1002dc60
mov ebx, dword [ebp - 0x18]
not edx
test ebx, 0x2000
je 0x1002dc99
cmp dword [esi + 0x4a48], edx
je 0x1002dc99
mov dword [esi + 0x4a4c], 0
movss xmm0, dword [esi + 0x4a4c]
comiss xmm0, xmm3
mov dword [esi + 0x4a44], edx
setae al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007e2f7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007e2f7
mov esp, ebp
pop ebp
ret
Function at 0x1002e220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10116ebc]
mov cl, 3
push esi
mov dword [ebp - 0x10], 0x41202003
mov dword [ebp - 0xc], 0x64686062
mov eax, dword [eax + 0x4790]
mov dword [ebp - 8], 0x6d766c71
mov word [ebp - 4], 0x67
mov esi, dword [eax]
xor eax, eax
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x1002e262
mov cl, byte [ebp - 0x10]
jmp 0x1002e253
lea eax, [ebp - 0xf]
mov byte [ebp - 3], 0
push eax
xor edx, edx
mov ecx, esi
call fcn.1002e080
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002e280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10116ebc]
mov cl, 0x33
push esi
mov dword [ebp - 0x10], 0x75101033
mov dword [ebp - 0xc], 0x5456415c
mov eax, dword [eax + 0x4790]
mov dword [ebp - 8], 0x5d465c41
mov word [ebp - 4], 0x57
mov esi, dword [eax]
xor eax, eax
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x1002e2c2
mov cl, byte [ebp - 0x10]
jmp 0x1002e2b3
lea eax, [ebp - 0xf]
mov byte [ebp - 3], 0
push eax
mov edx, 1
mov ecx, esi
call fcn.1002e080
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002efa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [0x10116ebc]
push edi
mov edi, ecx
test edi, edi
je 0x1002efe8
andps xmm1, xmmword [0x10086370]
mulss xmm1, dword [0x100856e0]
addss xmm1, dword [esi + 0x3e44]
minss xmm1, dword [0x100856e0]
jmp 0x1002efeb
xorps xmm1, xmm1
movss dword [esi + 0x3e44], xmm1
cmp dword [esi + 0x3e38], edi
je 0x1002f061
test byte [esi + 0x5a50], 0x20
je 0x1002f043
movaps xmm0, xmmword [str.h__a_v]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x401f070c
mov dword [ebp - 8], 0x4d4a4841
mov dword [ebp - 4], 0x624a1b
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x1a
jb 0x1002f026
lea eax, [ebp - 0x1b]
mov byte [ebp - 1], 0
push eax
call fcn.10041400
add esp, 4
mov eax, dword [esi + 0xdb8]
mov ecx, dword [esi + 0xdbc]
mov dword [esi + 0x3e38], edi
mov dword [esi + 0x3e3c], eax
mov dword [esi + 0x3e40], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10032990
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x100329cf
cmp bl, 0x23
jne 0x100329b1
cmp byte [esi], bl
jne 0x100329b1
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10084760]
test bl, bl
jne 0x100329a2
mov ecx, dword [0x10116ebc]
not eax
mov esi, dword [ecx + 0x3e10]
mov edi, dword [ecx + 0x3e18]
lea ebx, [edi + esi*8]
test esi, esi
je 0x10032a0e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10032a08
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10032a0a
mov esi, edx
test esi, esi
jne 0x100329f0
cmp edi, ebx
je 0x10032a1d
cmp dword [edi], eax
jne 0x10032a1d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10038910
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x10116ebc]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3e28]
mov eax, dword [edi + 0xc8]
mov ebx, dword [edi + 0xd0]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10084760]
sub esi, 1
jne 0x10038950
mov eax, dword [0x10116ebc]
not ebx
cmp dword [eax + 0x3e48], ebx
jne 0x1003898a
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.100418d0
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xc8]
call fcn.10042470
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007e2f7
mov esp, ebp
pop ebp
ret
Function at 0x1003a6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1008b040]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
mov esi, dword [0x10116ebc]
mov ebx, ecx
cmp byte [esi + 0x491d], 0
jne 0x1003a6e0
cmp byte [esi + 0x491e], 0
je 0x1003a75d
movss xmm1, dword [esi + 0x3850]
mov ebx, 1
movaps xmm0, xmm1
mulss xmm1, dword [0x10085768]
mulss xmm0, dword [0x10085788]
addss xmm1, dword [esi + 0xdbc]
addss xmm0, dword [esi + 0xdb8]
mov dword [esi + 0x46dc], 0
mov dword [esi + 0x46e0], 0
movss dword [esi + 0x46d8], xmm1
mov dword [esi + 0x46c8], 1
movss dword [esi + 0x46d4], xmm0
movss xmm0, dword [esi + 0x38ac]
mulss xmm0, dword [0x100856d4]
or dword [esi + 0x46c4], 0x41
movss dword [esi + 0x4718], xmm0
movaps xmm0, xmmword [0x100859a0]
xor ecx, ecx
movsx edx, word [esi + 0x599a]
movups xmmword [esp + 0xc], xmm0
mov al, byte [esp + 0xc]
xor byte [esp + ecx + 0xd], al
inc ecx
cmp ecx, 0xe
jb 0x1003a772
push edx
lea eax, [esp + 0x11]
mov byte [esp + 0x1f], 0
push eax
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.1002aec0
add esp, 0x10
test bl, 1
je 0x1003a808
lea ecx, [esp + 0x1c]
call fcn.10032990
test eax, eax
je 0x1003a808
cmp byte [eax + 0x8e], 0
je 0x1003a808
movaps xmm0, xmmword [0x100859d0]
mov byte [eax + 0x95], 1
mov byte [eax + 0xb0], 1
inc word [esi + 0x599a]
xor ecx, ecx
movsx edx, word [esi + 0x599a]
movups xmmword [esp + 0xc], xmm0
nop
mov al, byte [esp + 0xc]
xor byte [esp + ecx + 0xd], al
inc ecx
cmp ecx, 0xe
jb 0x1003a7e0
push edx
lea eax, [esp + 0x11]
mov byte [esp + 0x1f], 0
push eax
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.1002aec0
add esp, 0x10
push 0x20c0347
xor edx, edx
lea ecx, [esp + 0x20]
call fcn.10035850
mov ecx, dword [esp + 0x30]
add esp, 4
pop esi
pop ebx
xor ecx, esp
call fcn.1007e2f7
mov esp, ebp
pop ebp
ret

Function at 0x1003a8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [0x10116ebc]
push esi
push edi
mov edi, ecx
mov eax, dword [ebx + 0x3e28]
mov edx, dword [eax + 0xc8]
mov eax, dword [eax + 0xd0]
push dword [eax + edx*4 - 4]
xor edx, edx
call fcn.1002af80
mov esi, eax
add esp, 4
cmp dword [ebx + 0x3e48], esi
jne 0x1003a8ec
push ecx
push edi
mov edx, 0xb
mov ecx, esi
call fcn.100418d0
add esp, 8
test byte [ebx + 0x5a50], 4
je 0x1003a936
movaps xmm0, xmmword [0x10086090]
xor eax, eax
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 4], 0x3260
movaps xmm0, xmmword [0x10085960]
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 2], 0
mov cl, byte [ebp - 0x24]
xor byte [ebp + eax - 0x23], cl
inc eax
cmp eax, 0x21
jb 0x1003a917
push esi
lea eax, [ebp - 0x23]
mov byte [ebp - 2], 0
push edi
push eax
call fcn.10041400
add esp, 0xc
xor edx, edx
mov ecx, esi
call fcn.1003a950
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ab40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov ecx, dword [0x10116ebc]
mov eax, dword [ecx + 0x476c]
test eax, eax
je 0x1003ac7e
xor ebx, ebx
test edi, edi
je 0x1003ac03
test eax, eax
jle 0x1003ac03
mov eax, dword [ecx + 0x4774]
xor edx, edx
mov dword [ebp - 0x10], eax
add eax, 4
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov eax, dword [eax]
test eax, eax
je 0x1003abeb
test dword [eax + 8], 0x1000000
jne 0x1003abeb
mov esi, ebx
cmp ebx, dword [ecx + 0x476c]
jge 0x1003ac7e
mov eax, dword [ebp - 0x10]
add eax, 4
add edx, eax
nop dword [eax]
mov ecx, dword [edx]
test ecx, ecx
je 0x1003abce
mov eax, edi
cmp dword [edi + 0x2e4], ecx
je 0x1003abe2
cmp eax, ecx
je 0x1003abe2
mov eax, dword [eax + 0x2e0]
test eax, eax
jne 0x1003abc0
mov ecx, dword [0x10116ebc]
inc esi
add edx, 0x28
cmp esi, dword [ecx + 0x476c]
jl 0x1003abb0
jmp 0x1003ac0b
mov edx, dword [ebp - 8]
mov ecx, dword [0x10116ebc]
mov eax, dword [ebp - 0xc]
inc ebx
add edx, 0x28
add eax, 0x28
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
cmp ebx, dword [ecx + 0x476c]
jl 0x1003ab88
cmp ebx, dword [ecx + 0x476c]
jge 0x1003ac7e
test byte [ecx + 0x5a50], 4
mov dword [ebp - 0x1c], 0x554e3c4a
mov dword [ebp - 0x18], 0x203e4c4c
mov byte [ebp - 0x14], 0
je 0x1003ac74
test edi, edi
je 0x1003ac2e
mov edx, dword [edi]
jmp 0x1003ac31
lea edx, [ebp - 0x1b]
movaps xmm0, xmmword [0x10086070]
xor ecx, ecx
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x24], 0x308590f
movaps xmm0, xmmword [str.Z_ZYeOXCDNE_]
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x20], 0x20
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x24
jb 0x1003ac56
push edx
lea eax, [ebp - 0x43]
mov byte [ebp - 0x1f], 0
push eax
call fcn.10041400
add esp, 8
mov dl, byte [ebp - 1]
mov ecx, ebx
call fcn.1003ac90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ac90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov ah, dl
mov edx, dword [0x10116ebc]
push ebx
push esi
push edi
test byte [edx + 0x5a50], 4
mov ebx, ecx
mov byte [ebp - 1], ah
mov dword [ebp - 0xc], edx
je 0x1003ad15
movaps xmm0, xmmword [0x10086270]
xor ecx, ecx
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x18], 0x3a777277
movaps xmm0, xmmword [0x10085b60]
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x14], 0xd6322
movaps xmm0, xmmword [0x10086290]
movups xmmword [ebp - 0x38], xmm0
movaps xmm0, xmmword [0x100862a0]
movups xmmword [ebp - 0x28], xmm0
nop
mov al, byte [ebp - 0x58]
xor byte [ebp + ecx - 0x57], al
inc ecx
cmp ecx, 0x46
jb 0x1003acf0
movzx eax, ah
push eax
lea eax, [ebp - 0x57]
mov byte [ebp - 0x11], 0
push ebx
push eax
call fcn.10041400
mov edx, dword [ebp - 0xc]
add esp, 0xc
mov eax, dword [edx + 0x4774]
lea ecx, [ebx + ebx*4]
mov edi, dword [eax + ecx*8 + 4]
mov esi, dword [eax + ecx*8 + 8]
lea eax, [edx + 0x476c]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
cmp ebx, eax
jle 0x1003ad63
test eax, eax
je 0x1003ad49
cdq
sub eax, edx
mov edx, dword [ebp - 8]
mov ecx, eax
sar ecx, 1
add ecx, dword [edx + 4]
jmp 0x1003ad51
mov edx, dword [ebp - 8]
mov ecx, 8
cmp ecx, ebx
mov eax, ebx
cmovg eax, ecx
mov ecx, edx
push eax
call fcn.10042900
mov edx, dword [ebp - 0xc]
cmp byte [ebp - 1], 0
mov dword [edx + 0x476c], ebx
je 0x1003adca
test edi, edi
je 0x1003ad82
test dword [edi + 8], 0x10000000
je 0x1003ad82
mov esi, dword [edi + 0x2dc]
test esi, esi
je 0x1003ada1
cmp byte [esi + 0x8f], 0
jne 0x1003ada1
test edi, edi
je 0x1003ada1
mov ecx, edi
call fcn.10038300
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edx + 0x47cc], 0
jne 0x1003adc3
test esi, esi
je 0x1003adc3
mov eax, dword [esi + 0x2f4]
test eax, eax
je 0x1003adc3
cmp byte [eax + 0x8f], 0
je 0x1003adc3
mov esi, eax
mov ecx, esi
call fcn.10038150
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ade0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [0x10116ebc]
mov ebx, dword [edi + 0x4778]
sub ebx, 1
mov esi, ebx
js 0x1003aebf
cmp esi, dword [edi + 0x476c]
jge 0x1003aebf
mov eax, dword [edi + 0x4780]
lea edx, [esi + esi*4]
mov ecx, dword [edi + 0x4774]
shl edx, 3
mov eax, dword [edx + eax]
cmp eax, dword [edx + ecx]
jne 0x1003aebf
test esi, esi
jle 0x1003ae5a
lea eax, [ecx - 0x24]
add eax, edx
mov edx, dword [eax + 0x28]
mov ecx, dword [eax]
test edx, edx
je 0x1003ae5a
test dword [edx + 8], 0x10000000
je 0x1003ae5a
test ecx, ecx
je 0x1003ae5a
test dword [ecx + 8], 0x400
jne 0x1003ae5a
dec esi
sub eax, 0x28
test esi, esi
jg 0x1003ae33
test byte [edi + 0x5a50], 4
je 0x1003aea5
movaps xmm0, xmmword [0x10085c70]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 8], 0x4729686d
movaps xmm0, xmmword [0x10086310]
movups xmmword [ebp - 0x18], xmm0
mov byte [ebp - 4], 0
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x23
jb 0x1003ae86
push esi
lea eax, [ebp - 0x27]
mov byte [ebp - 4], 0
push ebx
push eax
call fcn.10041400
add esp, 0xc
mov dl, 1
mov ecx, esi
call fcn.1003ac90
mov eax, dword [edi + 0x4794]
test eax, eax
je 0x1003aebf
mov byte [eax + 0x134], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003b060
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [0x10116ebc]
mov ebx, ecx
push edi
cmp byte [esi + 0x3717], 0
mov edi, dword [esi + 0x3e28]
je 0x1003b0f7
mov ecx, 0x282
call fcn.1002a3d0
cmp byte [eax + 8], 0
jne 0x1003b0f7
mov ecx, 0x20
call fcn.1002da70
test al, al
je 0x1003b0f7
test ebx, ebx
je 0x1003b0e2
mov ecx, dword [edi + 0xc8]
xor edx, edx
mov eax, dword [edi + 0xd0]
push dword [eax + ecx*4 - 4]
mov ecx, ebx
call fcn.1002af80
mov edi, eax
add esp, 4
cmp dword [esi + 0x3e48], edi
jne 0x1003b0e8
push ecx
push ebx
mov edx, 0xb
mov ecx, edi
call fcn.100418d0
add esp, 8
mov edx, 1
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.1003a950
mov edi, dword [esi + 0x4688]
mov edx, 1
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.1003a950
pop edi
pop esi
pop ebx
ret
Function at 0x1003b700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10116ebc]
sub esp, 0x28
push esi
mov esi, eax
push edi
mov edi, ecx
cmp dword [esi + 0x4794], edi
je 0x1003b78a
test byte [esi + 0x5a50], 2
mov dword [ebp - 8], 0x554e3c35
mov dword [ebp - 4], 0x3e4c4c
je 0x1003b784
test edi, edi
je 0x1003b738
mov edx, dword [edi]
jmp 0x1003b73b
lea edx, [ebp - 7]
movaps xmm0, xmmword [0x10086340]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x404b4146
mov dword [ebp - 0x14], 0xa0d0758
mov dword [ebp - 0x10], 0x25060d5c
mov byte [ebp - 0xc], 0
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x1b
jb 0x1003b761
push edx
lea eax, [ebp - 0x27]
mov byte [ebp - 0xc], 0
push eax
call fcn.10041400
mov eax, dword [0x10116ebc]
add esp, 8
mov dword [esi + 0x4794], edi
mov word [esi + 0x47ec], 0
mov byte [esi + 0x47d5], 0
cmp byte [eax + 0x47ed], 0
jne 0x1003b7ba
cmp byte [eax + 0x47d5], 0
jne 0x1003b7ba
xor cl, cl
mov byte [eax + 0x47d4], cl
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov cl, 1
pop edi
mov byte [eax + 0x47d4], cl
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1003c530
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [0x10116ebc]
mov esi, ecx
test edi, edi
jne 0x1003c5dc
mov edx, dword [esi + 0x4794]
mov eax, dword [edx + 0x2f4]
test eax, eax
je 0x1003c564
cmp byte [eax + 0x8f], 0
jne 0x1003c566
mov eax, edx
mov dword [esi + 0x4794], eax
test edx, edx
je 0x1003c5dc
test byte [esi + 0x5a50], 2
je 0x1003c5dc
mov ebx, dword [eax]
xor ecx, ecx
movaps xmm0, xmmword [0x10085c60]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0xc], 0x6b342c27
movaps xmm0, xmmword [0x100861f0]
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 8], 0x61306661
movaps xmm0, xmmword [0x10085bb0]
movups xmmword [ebp - 0x1c], xmm0
mov word [ebp - 4], 0x496a
mov byte [ebp - 2], 0
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x39
jb 0x1003c5b6
push ebx
push dword [edx]
lea eax, [ebp - 0x3b]
mov byte [ebp - 2], 0
push eax
call fcn.10041400
mov ecx, dword [0x10116ebc]
add esp, 0xc
mov ebx, dword [esi + 0x4794]
mov edx, dword [ebx + edi*4 + 0x2f8]
test edx, edx
je 0x1003c62a
mov eax, dword [ecx + 0x4794]
mov dword [ecx + 0x4798], edx
mov dword [ecx + 0x47cc], edi
mov dword [ecx + 0x479c], 0
mov dword [eax + edi*4 + 0x2f8], edx
lea eax, [edi + 0x30]
mov ecx, dword [ecx + 0x4794]
add eax, eax
movups xmm0, xmmword [ebx + eax*8]
movups xmmword [ecx + eax*8], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dl, 1
mov dword [esi + 0x47cc], edi
mov ecx, ebx
call fcn.1003c640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
mov esi, ecx
mov bh, dl
mov edx, dword [0x10116ebc]
push edi
mov edi, edx
mov eax, dword [esi + 8]
test eax, 0x40000
je 0x1003c67c
mov dword [edi + 0x4798], 0
mov eax, dword [esi + 0x320]
mov dword [edi + 0x479c], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor bl, bl
cmp esi, dword [esi + 0x2e4]
je 0x1003c69a
test eax, 0x4000000
jne 0x1003c69a
cmp dword [esi + 0x2f8], 0
je 0x1003c69a
test bh, bh
je 0x1003c69c
mov bl, 1
test byte [edi + 0x5a50], 8
je 0x1003c71f
movaps xmm0, xmmword [0x10086160]
xor ecx, ecx
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 8], 0x355b1a02
movaps xmm0, xmmword [0x10086330]
movups xmmword [ebp - 0x48], xmm0
mov byte [ebp - 4], 0
movaps xmm0, xmmword [0x10086110]
movups xmmword [ebp - 0x38], xmm0
movaps xmm0, xmmword [0x10086100]
movups xmmword [ebp - 0x28], xmm0
movaps xmm0, xmmword [0x100860b0]
movups xmmword [ebp - 0x18], xmm0
nop dword [eax]
mov al, byte [ebp - 0x58]
xor byte [ebp + ecx - 0x57], al
inc ecx
cmp ecx, 0x53
jb 0x1003c6f0
push dword [edi + 0x47cc]
movzx eax, bl
push dword [esi]
mov byte [ebp - 4], 0
push eax
lea eax, [ebp - 0x57]
push eax
call fcn.10041400
mov edx, dword [0x10116ebc]
add esp, 0x10
test bl, bl
je 0x1003c7b6
mov eax, dword [esi + 0x320]
xorps xmm0, xmm0
mov ecx, dword [edi + 0x47cc]
mov dword [edx + 0x479c], eax
mov eax, dword [edx + 0x4794]
mov dword [edx + 0x4798], 0
mov dword [edx + 0x47cc], ecx
mov dword [eax + ecx*4 + 0x2f8], 0
lea eax, [ecx + 0x30]
shl eax, 4
add eax, dword [edx + 0x4794]
movups xmmword [eax], xmm0
mov word [edi + 0x47d5], 1
mov dword [edi + 0x47d8], 0
movups xmmword [edi + 0x47dc], xmm0
cmp byte [edx + 0x47ed], 0
jne 0x1003c7a7
cmp byte [edx + 0x47d5], 0
jne 0x1003c7a7
xor al, al
mov byte [edx + 0x47d4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
mov byte [edx + 0x47d4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x2f8]
mov dword [edi + 0x4798], eax
mov eax, dword [esi + 0x320]
mov dword [edi + 0x479c], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [0x10116ebc]
push edi
mov edi, esi
mov eax, dword [edi + 0x4794]
test eax, eax
je 0x1003d526
test byte [edi + 0x5a50], 8
push ebx
je 0x1003d4c0
mov edx, dword [eax]
xor ecx, ecx
movaps xmm0, xmmword [0x10085ad0]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0xc], 0x50071f14
movaps xmm0, xmmword [0x10085a10]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 8], 0x52035552
movaps xmm0, xmmword [0x10085b80]
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 4], 0x7a
movaps xmm0, xmmword [0x10085b20]
movups xmmword [ebp - 0x1c], xmm0
nop dword [eax]
mov al, byte [ebp - 0x4c]
xor byte [ebp + ecx - 0x4b], al
inc ecx
cmp ecx, 0x48
jb 0x1003d490
push edx
push dword [edi + 0x47cc]
lea eax, [ebp - 0x4b]
mov byte [ebp - 3], 0
push dword [edi + 0x47d8]
push eax
call fcn.10041400
mov esi, dword [0x10116ebc]
add esp, 0x10
mov edx, dword [edi + 0x47cc]
mov eax, dword [esi + 0x4794]
mov ecx, dword [edi + 0x47d8]
mov dword [esi + 0x4798], ecx
mov dword [esi + 0x47cc], edx
mov dword [esi + 0x479c], 0
mov dword [eax + edx*4 + 0x2f8], ecx
lea eax, [edx + 0x30]
movups xmm0, xmmword [edi + 0x47dc]
shl eax, 4
add eax, dword [esi + 0x4794]
pop ebx
movups xmmword [eax], xmm0
cmp byte [edi + 0x47d6], 0
mov byte [edi + 0x47d0], 1
je 0x1003d526
mov word [esi + 0x47d1], 1
mov byte [esi + 0x47d3], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret