joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d2f2
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x14], 0x52485e3c
sub esp, 0x18
mov dword [ebp - 0x10], 0x53505f63
lea ecx, [ebp - 0x14]
mov word [ebp - 0xc], 0x594f
mov byte [ebp - 0xa], 0
mov esi, esp
mov edi, dword [ebx + 0x20]
call fcn.10001401
push eax
mov ecx, esi
call fcn.10003ec3
mov ecx, edi
call fcn.1000838f
mov esi, dword [ebx + 0x20]
add esp, 0x18
mov dword [ebx], eax
mov cl, 0x16
mov dword [ebp - 0x14], 0x78627416
xor eax, eax
mov dword [ebp - 0x10], 0x77626549
mov word [ebp - 0xc], 0x6264
mov byte [ebp - 0xa], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 9
jae 0x1000d367
mov cl, byte [ebp - 0x14]
jmp 0x1000d358
sub esp, 0x18
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
mov edi, dword [ebx + 0x20]
lea ecx, [ebp - 0x14]
mov dword [ebx + 4], eax
mov esi, esp
mov dword [ebp - 0x14], 0x7f657311
mov dword [ebp - 0x10], 0x7e65624e
mov word [ebp - 0xc], 0x61
call fcn.1000d4de
push eax
mov ecx, esi
call fcn.10003ec3
mov ecx, edi
call fcn.1000838f
movaps xmm0, xmmword [0x10038440]
add esp, 0x18
mov esi, dword [ebx + 0x20]
xor ecx, ecx
mov dword [ebx + 8], eax
movups xmmword [ebp - 0x1c], xmm0
mov word [ebp - 0xc], 0x4143
mov byte [ebp - 0xa], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x11
jb 0x1000d3d3
sub esp, 0x18
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
mov edi, dword [ebx + 0x20]
lea ecx, [ebp - 0x18]
mov dword [ebx + 0xc], eax
mov esi, esp
mov dword [ebp - 0x18], 0x607a6c0e
mov dword [ebp - 0x14], 0x617a7d51
mov dword [ebp - 0x10], 0x6751656d
mov word [ebp - 0xc], 0x6060
mov byte [ebp - 0xa], 0
call fcn.1000831f
push eax
mov ecx, esi
call fcn.10003ec3
mov ecx, edi
call fcn.1000838f
mov esi, dword [ebx + 0x20]
add esp, 0x18
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebp - 0x13], 0x2213091f
mov dword [ebp - 0xf], 0x1111180e
push 0x7d
pop ecx
mov byte [ebp - 0x14], cl
mov byte [ebp - 0xb], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 8
jae 0x1000d469
mov cl, byte [ebp - 0x14]
jmp 0x1000d45a
sub esp, 0x18
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
movaps xmm0, xmmword [0x100383f0]
add esp, 0x18
mov esi, dword [ebx + 0x20]
xor ecx, ecx
mov dword [ebx + 0x14], eax
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x5f455e44
mov byte [ebp - 8], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x1000d4a3
sub esp, 0x18
mov byte [ebp - 8], 0
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
add esp, 0x18
mov dword [ebx + 0x18], eax
mov ecx, eax
push 3
pop edx
call fcn.10008945
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000d4de
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 8
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x1000d4e8
pop edi
pop esi
mov byte [ecx + 9], 0
ret
Function at 0x1000e029
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x20], 0x4844483c
sub esp, 0x18
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x48554863
mov word [ebp - 0x18], 0x5950
mov esi, esp
mov edi, dword [ebx]
mov byte [ebp - 0x16], 0
call fcn.10001401
push eax
mov ecx, esi
call fcn.10003ec3
mov ecx, edi
call fcn.1000838f
mov edi, dword [ebx]
lea ecx, [ebp - 0x20]
mov dword [ebx + 4], eax
mov esi, esp
mov dword [ebp - 0x20], 0x79647116
mov dword [ebp - 0x1c], 0x74496663
mov dword [ebp - 0x18], 0x736577
call fcn.10007fe3
push eax
mov ecx, esi
call fcn.10003ec3
mov ecx, edi
call fcn.1000838f
add esp, 0x18
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebp - 0xc], 0xa
lea ecx, [ebx + 0x38]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov ebx, dword [ebx]
lea ecx, [ebp - 0x20]
sub esp, 0x18
mov dword [ebp - 0x20], 0x7e637611
mov edi, esp
mov dword [ebp - 0x1c], 0x344e6164
mov word [ebp - 0x18], 0x75
push eax
sub esp, 0x18
mov esi, esp
call fcn.1000d4de
push eax
mov ecx, esi
call fcn.10003ec3
push edi
call fcn.10003d99
add esp, 0x20
mov ecx, ebx
call fcn.1000838f
mov edi, esp
mov dword [ebp - 0x2c], 0x505c5024
push dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 0x28], 0x4357497b
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x2c]
sub esp, 0x18
mov dword [ebp - 0x24], 0x40017b
mov esi, esp
mov dword [eax - 0x28], ebx
call fcn.10007fe3
push eax
mov ecx, esi
call fcn.10003ec3
push edi
call fcn.10003d99
add esp, 0x20
mov ecx, ebx
call fcn.1000838f
mov ecx, dword [ebp - 8]
add esp, 0x18
mov ebx, dword [ebp - 0x10]
mov dword [ecx], eax
add ecx, 4
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 8], ecx
sub dword [ebp - 0xc], 1
mov dword [ebp - 4], eax
jne 0x1000e0b8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000ebc9
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 0xf
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x1000ebd3
pop edi
pop esi
mov byte [ecx + 0x10], 0
ret
Function at 0x1000f2f3
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 0xb
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x1000f2fd
pop edi
pop esi
mov byte [ecx + 0xc], 0
ret

Function at 0x1000f643
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x10030b1d
call fcn.1002fc16
mov esi, ecx
mov edx, dword [0x1003ff40]
test edx, edx
js 0x1000f74b
cmp edx, 0x17
jg 0x1000f74b
mov ecx, dword [esi + 0x14]
call fcn.10008d3f
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x18], 0xf
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, ebx
mov eax, dword [0x1003ff40]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
push eax
cmp eax, 0xa
jge 0x1000f6c0
movaps xmm0, xmmword [str.0pwQ_U]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0xa545c
mov word [ebp - 0x30], bx
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x14
jb 0x1000f6ae
mov byte [ebp - 0x2f], bl
jmp 0x1000f6e5
movaps xmm0, xmmword [0x10038580]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x5050f51
mov byte [ebp - 0x30], bl
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x13
jb 0x1000f6d5
mov byte [ebp - 0x30], bl
sub esp, 0x18
lea eax, [ebp - 0x43]
mov ecx, esp
push eax
call fcn.10003ec3
lea eax, [ebp - 0x60]
push eax
call fcn.10003d99
add esp, 0x20
lea ecx, [ebp - 0x2c]
push eax
call fcn.10004988
lea ecx, [ebp - 0x60]
call fcn.100026bd
mov ecx, dword [esi + 0x1c]
lea edx, [ebp - 0x2c]
call fcn.10008e24
mov eax, dword [0x1003ff40]
test eax, eax
jle 0x1000f72b
push ecx
push eax
call fcn.1000f5fa
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
push 0xf
pop edi
cmp edx, edi
jbe 0x1000f742
mov ecx, dword [ebp - 0x2c]
inc edx
call fcn.10002690
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x2c], bl
mov edx, dword [0x1003ff4c]
cmp edx, 0x14
ja 0x1000f78c
mov ecx, dword [esi + 0x18]
call fcn.10008d3f
mov edx, dword [0x1003ff4c]
mov ecx, dword [esi + 0x20]
call fcn.10008e47
movd xmm0, dword [0x1003ff4c]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x10037c60]
movss dword [0x1003e0a4], xmm0
call fcn.1000e7f4
call fcn.1002fbd4
ret
Function at 0x1000f83c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [0x100385e0]
push ebx
mov ebx, ecx
mov word [ebp - 8], 0x594e
push esi
push edi
movups xmmword [ebp - 0x18], xmm0
mov esi, dword [ebx]
xor ecx, ecx
mov byte [ebp - 6], 0
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x11
jb 0x1000f860
sub esp, 0x18
mov byte [ebp - 6], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
mov edi, eax
mov dword [ebp - 0x14], 0x64626516
lea ecx, [ebp - 0x14]
mov dword [ebx + 4], edi
mov dword [ebp - 0x10], 0x70787f49
mov esi, esp
mov dword [ebp - 0xc], 0x274979
call fcn.10007fe3
push eax
mov ecx, esi
call fcn.10003ec3
mov ecx, edi
call fcn.1000838f
mov esi, dword [ebx + 4]
add esp, 0x18
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebp - 0x13], 0x4e636562
mov dword [ebp - 0xf], 0x7e777f78
push 0x11
pop ecx
mov byte [ebp - 0x14], cl
mov word [ebp - 0xb], 0x234e
mov byte [ebp - 9], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x1000f8f1
mov cl, byte [ebp - 0x14]
jmp 0x1000f8e2
sub esp, 0x18
mov byte [ebp - 9], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
mov edi, dword [ebx + 4]
lea ecx, [ebp - 0x14]
mov dword [ebx + 0xc], eax
mov esi, esp
mov dword [ebp - 0x14], 0x56505724
mov dword [ebp - 0x10], 0x424a4d7b
mov dword [ebp - 0xc], 0x177b4b
call fcn.10007fe3
push eax
mov ecx, esi
call fcn.10003ec3
mov ecx, edi
call fcn.1000838f
mov esi, dword [ebx + 4]
add esp, 0x18
mov dword [ebx + 0x10], eax
mov cl, 0xe
mov dword [ebp - 0x14], 0x6963670e
xor eax, eax
mov dword [ebp - 0x10], 0x6f7a7d51
mov dword [ebp - 0xc], 0x60677a7c
mov word [ebp - 8], 0x69
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x1000f975
mov cl, byte [ebp - 0x14]
jmp 0x1000f966
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
mov esi, dword [ebx + 4]
add esp, 0x18
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebp - 0x13], 0x221a1014
mov dword [ebp - 0xf], 0x90e041f
push 0x7d
pop ecx
mov byte [ebp - 0x14], cl
mov dword [ebp - 0xb], 0x19131c
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x1000f9c3
mov cl, byte [ebp - 0x14]
jmp 0x1000f9b4
sub esp, 0x18
mov byte [ebp - 8], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
add esp, 0x18
mov dword [ebx + 0x1c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000fe04
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 6
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x1000fe0e
pop edi
pop esi
mov byte [ecx + 7], 0
ret

Function at 0x1000ffb9
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x10030be9
call fcn.1002fbe3
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x100100ee
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esi + 0x20], 1
mov word [esi + 0x28], ax
call fcn.10010373
movaps xmm0, xmmword [0x10038400]
mov ecx, ebx
push 0x17
mov byte [ebp - 0x28], bl
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x43432853
mov dword [ebp - 0x2c], 0x2e434349
pop ebx
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, ebx
jb 0x1001000c
lea eax, [ebp - 0x3f]
mov byte [ebp - 0x28], 0
push eax
lea ecx, [ebp - 0x24]
call fcn.10003ec3
mov byte [ebp - 4], 1
lea edx, [ebp - 0x24]
mov ecx, dword [esi + 0xc]
call fcn.10008e24
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.100026bd
cmp dword [ebp + 0x1c], 0
jne 0x1001008e
mov byte [ebp - 0x18], bl
xor eax, eax
mov dword [ebp - 0x17], 0x70727e44
mov dword [ebp - 0x13], 0x7b543772
mov word [ebp - 0xf], 0x7976
mov byte [ebp - 0xd], 0
xor byte [ebp + eax - 0x17], bl
inc eax
cmp eax, 0xa
jae 0x10010075
mov bl, byte [ebp - 0x18]
jmp 0x10010066
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], 0
push eax
lea ecx, [ebp - 0x40]
call fcn.10003ec3
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
jmp 0x100100de
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x10038730]
cmova eax, dword [ebp + 0xc]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 0x44
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x100100ad
sub esp, 0x18
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003ec3
lea eax, [ebp - 0x40]
push eax
call fcn.10003d99
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10008e24
lea ecx, [ebp - 0x40]
call fcn.100026bd
lea ecx, [ebp + 0xc]
call fcn.100026bd
call fcn.1002fbc0
ret 0x1c
Function at 0x100100fe
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x10030c33
call fcn.1002fbe3
mov esi, ecx
mov di, word [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test di, di
je 0x10010294
cmp word [esi + 0x28], bx
jg 0x10010294
movaps xmm0, xmmword [str._hOZU_RUeoRV]
mov ecx, ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x24], ebx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x10b0b60
mov dword [ebp - 0x14], 0x660b0b
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x16
jb 0x10010149
lea eax, [ebp - 0x27]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10003ec3
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, dword [esi + 8]
call fcn.10008e24
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.100026bd
movaps xmm0, xmmword [0x10038350]
mov ecx, ebx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x4e4e255e
mov dword [ebp - 0x14], 0x234e4e44
mov byte [ebp - 0x10], bl
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x17
jb 0x1001019d
lea eax, [ebp - 0x27]
mov byte [ebp - 0x10], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10003ec3
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
mov ecx, dword [esi + 0xc]
call fcn.10008e24
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.100026bd
cmp dword [ebp + 0x1c], 0
jne 0x10010219
mov cl, 0x2e
mov dword [ebp - 0x1c], 0x4b477d2e
mov dword [ebp - 0x18], 0x6d0e4b49
mov eax, ebx
mov dword [ebp - 0x14], 0x404f42
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xa
jae 0x10010201
mov cl, byte [ebp - 0x1c]
jmp 0x100101f2
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10003ec3
mov byte [ebp - 4], 3
lea edx, [ebp - 0x40]
jmp 0x10010268
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x100385a0]
mov ecx, ebx
cmova eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x74
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x10010238
sub esp, 0x18
mov byte [ebp - 0x13], bl
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.10003ec3
lea eax, [ebp - 0x40]
push eax
call fcn.10003d99
add esp, 0x20
mov byte [ebp - 4], 4
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10008e24
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.100026bd
mov ecx, dword [esi]
push 2
call dword [0x10037bbc]
mov ecx, esi
mov word [esi + 0x28], di
mov byte [esi + 0x21], 1
call fcn.10010373
lea ecx, [ebp + 0xc]
call fcn.100026bd
call fcn.1002fbc0
ret 0x1c
Function at 0x100102a4
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x10030c6d
call fcn.1002fbe3
mov esi, ecx
mov ax, word [ebp + 8]
xor edx, edx
mov dword [ebp - 4], edx
mov word [esi + 0x28], ax
cmp dword [ebp + 0x1c], edx
jne 0x10010304
mov cl, 0x25
mov dword [ebp - 0x1c], 0x404c7625
mov dword [ebp - 0x18], 0x66054042
mov eax, edx
mov dword [ebp - 0x14], 0x4b4449
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xa
jae 0x100102ec
mov cl, byte [ebp - 0x1c]
jmp 0x100102dd
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], dl
push eax
lea ecx, [ebp - 0x3c]
call fcn.10003ec3
mov byte [ebp - 4], 1
lea edx, [ebp - 0x3c]
jmp 0x10010353
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x10038190]
mov ecx, edx
cmova eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 1
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x10010323
sub esp, 0x18
mov byte [ebp - 0xf], dl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003ec3
lea eax, [ebp - 0x3c]
push eax
call fcn.10003d99
add esp, 0x20
mov byte [ebp - 4], 2
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10008e24
lea ecx, [ebp - 0x3c]
call fcn.100026bd
lea ecx, [ebp + 0xc]
call fcn.100026bd
call fcn.1002fbc0
ret 0x1c
Function at 0x100106f5
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 7
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x100106ff
pop edi
pop esi
mov byte [ecx + 8], 0
ret

Function at 0x1001078d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x100384b0]
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x554f6359
push edi
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0xc], 0x485d4948
xor ecx, ecx
mov edi, dword [esi]
mov dword [ebp - 8], 0x525355
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x1a
jb 0x100107bb
sub esp, 0x18
mov byte [ebp - 5], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, edi
call fcn.1000838f
add esp, 0x18
mov dword [esi + 4], eax
pop edi
pop esi
leave
ret
Function at 0x10011898
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [str._HRcOH_HcNYOYH]
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
movups xmmword [ebp - 0x18], xmm0
mov esi, dword [ebx]
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0xe
jb 0x100118b2
sub esp, 0x18
mov byte [ebp - 9], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
mov esi, dword [ebx]
add esp, 0x18
mov dword [ebx + 4], eax
mov cl, 0x16
mov dword [ebp - 0x14], 0x78625416
xor eax, eax
mov dword [ebp - 0x10], 0x64624549
mov dword [ebp - 0xc], 0x62717873
mov word [ebp - 8], 0x7e
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x1001190e
mov cl, byte [ebp - 0x14]
jmp 0x100118ff
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
mov esi, dword [ebx]
add esp, 0x18
mov dword [ebx + 8], eax
mov cl, 0x11
mov dword [ebp - 0x14], 0x7f655311
xor eax, eax
mov dword [ebp - 0x10], 0x7065424e
mov dword [ebp - 0xc], 0x707f787c
mov byte [ebp - 8], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x1001195b
mov cl, byte [ebp - 0x14]
jmp 0x1001194c
sub esp, 0x18
mov byte [ebp - 8], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
mov esi, dword [ebx]
add esp, 0x18
mov dword [ebx + 0xc], eax
mov cl, 0x24
mov dword [ebp - 0x18], 0x4a506624
xor eax, eax
mov dword [ebp - 0x14], 0x5c41607b
mov dword [ebp - 0x10], 0x4d564150
mov word [ebp - 0xc], 0x5d50
mov byte [ebp - 0xa], 0
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xd
jae 0x100119ae
mov cl, byte [ebp - 0x18]
jmp 0x1001199f
sub esp, 0x18
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
movaps xmm0, xmmword [0x100386c0]
lea ecx, [ebp - 0x18]
mov edi, dword [ebx]
mov esi, esp
mov dword [ebx + 0x10], eax
movups xmmword [ebp - 0x18], xmm0
mov byte [ebp - 8], 0
call fcn.1000ebc9
push eax
mov ecx, esi
call fcn.10003ec3
mov ecx, edi
call fcn.1000838f
movaps xmm0, xmmword [0x10038080]
add esp, 0x18
mov esi, dword [ebx]
xor ecx, ecx
mov dword [ebx + 0x14], eax
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0x18
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x10
jb 0x10011a0f
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10003ec3
mov ecx, esi
call fcn.1000838f
add esp, 0x18
mov dword [ebx + 0x18], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10012fa5
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 0x10
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x10012faf
pop edi
pop esi
mov byte [ecx + 0x11], 0
ret
Function at 0x10015457
Capabilities:
Encode data using xor

Disassembly:
push 8
push 0x88
mov eax, 0x10031248
call fcn.1002fd11
lea edi, [ecx + 0x130]
mov dword [ebp - 0x24], 3
lea esi, [ecx + 0x44]
mov ecx, dword [esi]
call fcn.100042b8
test eax, eax
je 0x100154df
movzx ecx, word [esi + 4]
movups xmm0, xmmword [0x10037cd0]
movzx eax, word [edi]
push ecx
push eax
movups xmmword [ebp - 0x38], xmm0
xor ecx, ecx
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0xe
jb 0x10015499
sub esp, 0x18
mov byte [ebp - 0x29], 0
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10003ec3
lea eax, [ebp - 0x68]
push eax
call fcn.10003d99
add esp, 0x24
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 0xf
jbe 0x100154d0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10003ec3
mov byte [ebp - 4], 1
jmp 0x1001555a
cmp dword [esi], 1
jne 0x10015593
cmp byte [esi + 6], 0
je 0x10015593
movzx ecx, word [esi + 4]
movzx eax, word [edi]
push ecx
push eax
mov cl, 0x78
mov dword [ebp - 0x20], 0x581c5d78
mov dword [ebp - 0x1c], 0x1c5d5857
xor eax, eax
mov byte [ebp - 0x18], 0
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 7
jae 0x10015520
mov cl, byte [ebp - 0x20]
jmp 0x10015511
sub esp, 0x18
mov byte [ebp - 0x18], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003ec3
lea eax, [ebp - 0x68]
push eax
call fcn.10003d99
add esp, 0x24
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 0xf
jbe 0x1001554d
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10003ec3
mov byte [ebp - 4], 3
mov ecx, dword [esi + 0xc]
lea edx, [ebp - 0x50]
call fcn.10008e24
lea ecx, [ebp - 0x50]
call fcn.100026bd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.100026bd
movzx eax, word [edi]
xorps xmm3, xmm3
mov ecx, dword [esi + 0x10]
xorps xmm2, xmm2
movd xmm1, eax
cvtdq2ps xmm1, xmm1
call fcn.10008cc2
jmp 0x100155fd
movzx eax, word [esi + 4]
push eax
sub esp, 0x18
mov word [ebp - 0x14], 0xf
lea eax, [ebp - 0x13]
mov byte [ebp - 0x13], 0
mov ecx, esp
push eax
call fcn.10003ec3
lea eax, [ebp - 0x98]
push eax
call fcn.10003d99
add esp, 0x20
mov dword [ebp - 4], 4
cmp dword [eax + 0x14], 0xf
jbe 0x100155ce
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x80]
call fcn.10003ec3
mov byte [ebp - 4], 5
lea edx, [ebp - 0x80]
mov ecx, dword [esi + 0xc]
call fcn.10008e24
lea ecx, [ebp - 0x80]
call fcn.100026bd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.100026bd
mov ax, word [edi]
cmp ax, word [esi + 4]
jb 0x10015613
mov ecx, dword [esi + 0xc]
mov edx, 0xff80ff00
call fcn.10008e6a
add edi, 2
add esi, 0x18
sub dword [ebp - 0x24], 1
jne 0x10015478
call fcn.1002fc8e
ret
Function at 0x10015629
Capabilities:
Encode data using xor

Disassembly:
push 0x74
mov eax, 0x100312a7
call fcn.1002fbe3
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
movzx eax, word [esi + 0x136]
mov ecx, eax
mov word [esi + 0x13e], ax
movzx eax, word [esi + 0x140]
push eax
push ecx
cmp byte [esi + 0x13c], bl
je 0x100156a6
movaps xmm0, xmmword [0x100382b0]
mov ecx, ebx
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x612c6d60
mov byte [ebp - 0x24], bl
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x13
jb 0x10015674
sub esp, 0x18
mov byte [ebp - 0x24], bl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10003ec3
lea eax, [ebp - 0x80]
push eax
call fcn.10003d99
add esp, 0x24
mov dword [ebp - 4], ebx
xor ebx, ebx
inc ebx
jmp 0x100156f4
mov cl, 0x60
mov dword [ebp - 0x20], 0x40044560
mov dword [ebp - 0x1c], 0x4540060f
mov eax, ebx
mov word [ebp - 0x18], 4
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 8
jae 0x100156cd
mov cl, byte [ebp - 0x20]
jmp 0x100156be
sub esp, 0x18
mov byte [ebp - 0x17], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003ec3
lea eax, [ebp - 0x68]
push eax
call fcn.10003d99
add esp, 0x24
push 2
mov dword [ebp - 4], 1
pop ebx
cmp dword [eax + 0x14], 0xf
mov dword [ebp - 0x10], ebx
jbe 0x100156ff
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10003ec3
mov dword [ebp - 4], 2
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0xc]
call fcn.10008e24
lea ecx, [ebp - 0x50]
call fcn.100026bd
test bl, 2
je 0x10015732
lea ecx, [ebp - 0x68]
and ebx, 0xfffffffd
call fcn.100026bd
test bl, 1
je 0x1001573f
lea ecx, [ebp - 0x80]
call fcn.100026bd
call fcn.1002fbc0
ret