joyce8/EMBER2024-capa huggingface dataset:
Function at 0x99ffb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x99ffd2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x99ffc0
mov byte [esi + 7], 0
mov eax, esi
pop esi
ret
Function at 0x9a3ac0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x9a3ae2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x9a3ad0
mov byte [esi + 0x1d], 0
mov eax, esi
pop esi
ret
Function at 0x9a4700
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
nop
nop
nop
nop
nop
nop
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x9a4740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push 0x100
lea eax, [ebp - 0x118]
mov dword [ebp - 0x10], 0x100
push 0
push eax
mov dword [ebp - 0x14], 0x100
call fcn.00a6e210
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x118]
push eax
nop
nop
nop
nop
nop
nop
push 0x100
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00a6e210
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x218]
push eax
nop
nop
nop
nop
nop
nop
mov dword [ebp - 9], 0x1f180024
xor ecx, ecx
mov dword [ebp - 5], 0x111c36
mov byte [ebp - 1], 1
nop dword [eax]
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 9], al
inc ecx
cmp ecx, 7
jb 0x9a47c0
lea eax, [ebp - 9]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00a6d880
add esp, 8
test eax, eax
jne 0x9a4826
mov dword [ebp - 8], 0x483c2e26
xor ecx, ecx
mov dword [ebp - 4], 0x1003b26
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 6
jb 0x9a47f8
lea eax, [ebp - 8]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00a6d880
add esp, 8
test eax, eax
jne 0x9a4826
xor al, al
mov esp, ebp
pop ebp
ret
push 0
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x9a4880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x10]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x10], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov ebx, dword [ebp - 8]
shr ebx, 0x1f
and bl, 1
mov dword [ebp - 0xe], 0x1f020a05
mov dword [ebp - 0xa], 0x47471f17
xor eax, eax
mov dword [ebp - 6], 0x15141358
mov word [ebp - 2], 0x100
lea ecx, [eax + 0x6e]
xor byte [ebp + eax - 0xe], cl
inc eax
cmp eax, 0xc
jb 0x9a48d1
lea eax, [ebp - 0xe]
mov byte [ebp - 1], 0
push eax
nop
nop
nop
nop
nop
nop
test eax, eax
movzx ecx, bl
mov eax, 1
pop edi
cmove ecx, eax
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x9a4910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
xor bl, bl
nop
nop
nop
nop
nop
nop
test eax, eax
jne 0x9a4931
push 0x15
nop
nop
nop
nop
nop
nop
test eax, eax
je 0x9a4933
mov bl, 1
movaps xmm0, xmmword [0xab4410]
xor ecx, ecx
movups xmmword [ebp - 0x4d], xmm0
mov dword [ebp - 0x2d], 0xfce6d3fd
movaps xmm0, xmmword [0xab5630]
movups xmmword [ebp - 0x3d], xmm0
mov dword [ebp - 0x29], 0xe6f2f4fa
mov word [ebp - 0x25], 0x100
nop
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 0x4d], al
inc ecx
cmp ecx, 0x28
jb 0x9a4960
mov esi, dword [0xa9b004]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x4d]
mov byte [ebp - 0x24], 0
push eax
push 0x80000002
call esi
test eax, eax
je 0x9a49ed
movaps xmm0, xmmword [0xab4410]
xor ecx, ecx
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x30], 0xd3c6d3fd
movaps xmm0, xmmword [0xab5630]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0xe0d3ebfd
mov dword [ebp - 0x28], 0xece4f3
mov byte [ebp - 0x24], 1
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 0x50], al
inc ecx
cmp ecx, 0x2b
jb 0x9a49c2
lea eax, [ebp - 4]
mov byte [ebp - 0x24], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x50]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x9a49f8
push dword [ebp - 4]
mov bl, 1
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x10
push eax
lea eax, [ebp - 0x20]
push eax
nop
nop
nop
nop
nop
nop
test eax, eax
je 0x9a4b22
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x3c], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x9a4a30
sub ecx, edx
lea eax, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.00992810
mov dword [ebp - 0xe], 0x293f2d38
xor ecx, ecx
mov word [ebp - 0xa], 0x100
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 0xe], al
inc ecx
cmp ecx, 4
jb 0x9a4a55
lea edx, [ebp - 0xe]
mov byte [ebp - 9], 0
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x9a4a70
mov edi, dword [ebp - 0x3c]
lea eax, [ebp - 0xe]
sub edx, ecx
cmp dword [ebp - 0x28], 0x10
push edx
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
push eax
cmovae ecx, edi
push 0
call fcn.009fa650
add esp, 0xc
cmp eax, 0xffffffff
jne 0x9a4af1
mov dword [ebp - 0x10], 0x30272238
xor ecx, ecx
mov dword [ebp - 0xc], 0x1003620
nop dword [eax]
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 6
jb 0x9a4ab0
lea esi, [ebp - 0x10]
mov byte [ebp - 9], 0
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x9a4ac7
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
sub esi, ecx
cmp dword [ebp - 0x28], 0x10
push esi
push eax
lea ecx, [ebp - 0x3c]
cmovae ecx, edi
push 0
call fcn.009fa650
add esp, 0xc
cmp eax, 0xffffffff
je 0x9a4af3
mov bl, 1
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
jb 0x9a4b22
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x9a4b18
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x9a4b2b
push ecx
push edi
call fcn.00a6c232
add esp, 8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00a714d0
int3
Function at 0x9a4b40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x29], 0
je 0x9a4b62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x28
jb 0x9a4b50
mov byte [esi + 0x29], 0
mov eax, esi
pop esi
ret

Function at 0x9a4b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
xor bl, bl
nop
nop
nop
nop
nop
nop
test eax, eax
jne 0x9a4b92
push 0x15
nop
nop
nop
nop
nop
nop
test eax, eax
je 0x9a4b94
mov bl, 1
mov dword [ebp - 5], 0x2c552d
xor ecx, ecx
mov byte [ebp - 1], 1
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 5], al
inc ecx
cmp ecx, 3
jb 0x9a4ba1
push 0x105
lea eax, [ebp - 0x120]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x105
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 5]
push eax
nop
nop
nop
nop
nop
nop
test eax, eax
je 0x9a4d10
mov dword [ebp - 9], 0x91f2d38
xor ecx, ecx
mov dword [ebp - 5], 0x20136
mov byte [ebp - 1], 1
nop dword [eax]
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 9], al
inc ecx
cmp ecx, 7
jb 0x9a4c00
mov byte [ebp - 1], 0
lea ecx, [ebp - 9]
lea eax, [ebp - 0x120]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x9a4c40
test dl, dl
je 0x9a4c3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x9a4c40
add eax, 2
add ecx, 2
test dl, dl
jne 0x9a4c20
xor eax, eax
jmp 0x9a4c45
sbb eax, eax
or eax, 1
test eax, eax
je 0x9a4d09
mov dword [ebp - 8], 0x91f2d38
xor ecx, ecx
mov dword [ebp - 4], 0x1003521
nop dword [eax]
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 6
jb 0x9a4c60
mov byte [ebp - 1], 0
lea ecx, [ebp - 8]
lea eax, [ebp - 0x120]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x9a4ca0
test dl, dl
je 0x9a4c9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x9a4ca0
add eax, 2
add ecx, 2
test dl, dl
jne 0x9a4c80
xor eax, eax
jmp 0x9a4ca5
sbb eax, eax
or eax, 1
test eax, eax
je 0x9a4d09
mov dword [ebp - 0xb], 0x91f2d38
xor ecx, ecx
mov dword [ebp - 7], 0x6110635
mov word [ebp - 3], 2
mov byte [ebp - 1], 1
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x9a4cc3
mov byte [ebp - 1], 0
lea ecx, [ebp - 0xb]
lea eax, [ebp - 0x120]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x9a4d00
test dl, dl
je 0x9a4cfc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x9a4d00
add eax, 2
add ecx, 2
test dl, dl
jne 0x9a4ce0
xor eax, eax
jmp 0x9a4d05
sbb eax, eax
or eax, 1
test eax, eax
jne 0x9a4d10
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x9a5b20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x9a5b42
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x2a
jb 0x9a5b30
mov byte [esi + 0x2b], 0
mov eax, esi
pop esi
ret

Function at 0x9a5b50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x9a5b72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x9a5b60
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
ret
Function at 0x9a5fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
push 0x200
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.00a6e210
add esp, 0xc
lea eax, [ebp - 0x230]
push 0x200
push eax
push 0
nop
nop
nop
nop
nop
nop
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x9a5ff4
sub ecx, edx
lea eax, [ebp - 0x230]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00992810
mov dword [ebp - 0xd], 0x10170a22
xor ecx, ecx
mov dword [ebp - 9], 0x19113b1e
mov dword [ebp - 5], 0xa1206
mov byte [ebp - 1], 1
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 0xd], al
inc ecx
cmp ecx, 0xb
jb 0x9a6028
lea edx, [ebp - 0xd]
mov byte [ebp - 1], 0
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x9a6040
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0xd]
mov edi, dword [ebp - 0x28]
sub edx, ecx
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push edx
cmp ebx, 0x10
mov edx, esi
push eax
cmovae ecx, edi
push 0
call fcn.009fa650
add esp, 0xc
cmp eax, 0xffffffff
jne 0x9a613d
mov dword [ebp - 0xe], 0x3151f21
xor ecx, ecx
mov dword [ebp - 0xa], 0x1b1b3013
mov dword [ebp - 6], 0xd1b1218
mov word [ebp - 2], 0x100
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 0xe], al
inc ecx
cmp ecx, 0xc
jb 0x9a6092
lea edx, [ebp - 0xe]
mov byte [ebp - 1], 0
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x9a60b0
sub edx, ecx
lea eax, [ebp - 0xe]
push edx
cmp ebx, 0x10
lea ecx, [ebp - 0x28]
push eax
cmovae ecx, edi
mov edx, esi
push 0
call fcn.009fa650
add esp, 0xc
cmp eax, 0xffffffff
jne 0x9a613d
mov dword [ebp - 0xb], 0x1252a27
xor ecx, ecx
mov dword [ebp - 7], 0x10001216
mov word [ebp - 3], 4
mov byte [ebp - 1], 1
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x9a60f2
lea esi, [ebp - 0xb]
mov byte [ebp - 1], 0
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x9a6110
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xb]
sub esi, ecx
cmp ebx, 0x10
push esi
push eax
lea ecx, [ebp - 0x28]
cmovae ecx, edi
push 0
call fcn.009fa650
add esp, 0xc
cmp eax, 0xffffffff
jne 0x9a613d
xor bl, bl
jmp 0x9a613f
mov bl, 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x9a616c
inc ecx
mov eax, edi
cmp ecx, 0x1000
jb 0x9a6162
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x9a6175
push ecx
push edi
call fcn.00a6c232
add esp, 8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00a714d0
int3
Function at 0x9a7ca0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2e], 0
je 0x9a7cc2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x2d
jb 0x9a7cb0
mov byte [esi + 0x2e], 0
mov eax, esi
pop esi
ret
Function at 0x9ad530
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x9ad552
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x9ad540
mov byte [esi + 0x17], 0
mov eax, esi
pop esi
ret

Function at 0x9ad560
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x23], 0
je 0x9ad582
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x22
jb 0x9ad570
mov byte [esi + 0x23], 0
mov eax, esi
pop esi
ret

Function at 0x9ae7a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa93b28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x24
push esi
push 0xac5070
mov dword [ebp - 4], 0
call fcn.00a6b533
add esp, 4
test eax, eax
jne 0x9ae945
mov dword [ebp - 0x1c], 0xd202e23
xor ecx, ecx
mov word [ebp - 0x18], 0x2e
mov byte [ebp - 0x16], 1
nop
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 5
jb 0x9ae800
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x16], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x9ae817
sub ecx, edx
mov eax, 0x7fffffff
mov edx, dword [ebx + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x9ae94b
cmp dword [ebx + 0x1c], 0x10
lea eax, [ebx + 8]
push edx
cmovae eax, dword [ebx + 8]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
push ecx
push dword [ebp - 0x19]
lea ecx, [ebp - 0x34]
call fcn.009fca20
mov byte [ebp - 4], 1
mov eax, dword [0xac5168]
cmp eax, dword [0xac516c]
je 0x9ae884
movups xmm0, xmmword [ebp - 0x34]
mov ecx, 0xf
mov byte [ebp - 0x34], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [eax + 0x10], xmm0
add dword [0xac5168], 0x18
jmp 0x9ae896
lea ecx, [ebp - 0x34]
push ecx
push eax
mov ecx, 0xac5164
call fcn.00a01bd0
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 4], 0
cmp ecx, 0x10
jb 0x9ae8cb
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x9ae8c1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x9ae950
push ecx
push edx
call fcn.00a6c232
add esp, 8
push 0xac5070
call fcn.00a6b544
mov esi, dword [0xac2aac]
lea eax, [ebx + 8]
sub esp, 0x14
mov ecx, esp
push eax
call fcn.009f5110
mov edx, 0x2714
mov ecx, esi
call fcn.009ad750
mov ecx, dword [ebx + 0x1c]
add esp, 0x18
test eax, eax
setg al
mov byte [ebp - 0x11], al
cmp ecx, 0x10
jb 0x9ae933
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x9ae926
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x9ae950
push ecx
push edx
call fcn.00a6c232
mov al, byte [ebp - 0x11]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push eax
call fcn.00a6b1dc
call fcn.00992040
call fcn.00a714d0
int3
Function at 0x9b38c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x9b38e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x20
jb 0x9b38d0
mov byte [esi + 0x21], 0
mov eax, esi
pop esi
ret
Function at 0x9b7740
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x86], 0
je 0x9b7767
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x85
jb 0x9b7750
mov byte [esi + 0x86], 0
mov eax, esi
pop esi
ret

Function at 0x9b7770
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x57], 0
je 0x9b7792
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x56
jb 0x9b7780
mov byte [esi + 0x57], 0
mov eax, esi
pop esi
ret
Function at 0x9b9960
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x66], 0
je 0x9b9982
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x65
jb 0x9b9970
mov byte [esi + 0x66], 0
mov eax, esi
pop esi
ret
Function at 0x9c5f60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4b], 0
je 0x9c5f82
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x4a
jb 0x9c5f70
mov byte [esi + 0x4b], 0
mov eax, esi
pop esi
ret
Function at 0x9c8650
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2a], 0
je 0x9c8672
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x29
jb 0x9c8660
mov byte [esi + 0x2a], 0
mov eax, esi
pop esi
ret
Function at 0x9ce760
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa9635d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x58
push esi
push edi
push 0xff
call fcn.00a7ac4c
push 0xff
mov edi, eax
push 0
push edi
call fcn.00a6e210
push 0xff
call fcn.00a7ac4c
push 0xff
push 0
push eax
mov dword [ebp - 0x18], eax
call fcn.00a6e210
movaps xmm0, xmmword [0xab4130]
add esp, 0x20
movups xmmword [ebp - 0x64], xmm0
xor ecx, ecx
mov dword [ebp - 0x44], 0xcdfeeafe
movaps xmm0, xmmword [0xab5380]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x40], 0xf8f9fcf1
mov dword [ebp - 0x3c], 0xfcf9f7
mov byte [ebp - 0x38], 1
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 0x64], al
inc ecx
cmp ecx, 0x2b
jb 0x9ce7f8
lea eax, [ebp - 0x14]
mov byte [ebp - 0x38], 0
push eax
push 1
push 0
lea eax, [ebp - 0x64]
push eax
push 0x80000002
nop
nop
nop
nop
nop
nop
test eax, eax
jne 0x9ce960
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xff
push eax
push edi
push 0
push 0
push 0
push dword [ebp - 0x14]
nop
nop
nop
nop
nop
nop
push dword [ebp - 0x14]
mov esi, eax
nop
nop
nop
nop
nop
nop
test esi, esi
jne 0x9ce960
mov ecx, edi
mov dword [ebp - 0x24], esi
xorps xmm0, xmm0
mov dword [ebp - 0x20], esi
movups xmmword [ebp - 0x34], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x9ce868
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x34]
call fcn.00992810
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
movups xmmword [ebp - 0x50], xmm0
cmp eax, 1
jb 0x9ce975
lea ecx, [eax - 5]
dec eax
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push ecx
inc eax
lea ecx, [ebp - 0x50]
push eax
call fcn.00992810
cmp dword [ebp - 0x3c], 0x10
lea ecx, [ebp - 0x50]
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
cmovae ecx, esi
add eax, 0xffffffef
push eax
push ecx
push dword [ebp - 0x18]
call fcn.00a6dc90
mov eax, dword [ebp - 0x3c]
add esp, 0xc
cmp eax, 0x10
jb 0x9ce911
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x9ce907
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x9ce97a
push ecx
push esi
call fcn.00a6c232
add esp, 8
push edi
call fcn.00a7a4f6
mov ecx, dword [ebp - 0x20]
add esp, 4
cmp ecx, 0x10
jb 0x9ce94a
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x9ce940
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x9ce97f
push ecx
push edx
call fcn.00a6c232
add esp, 8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.009f86d0
call fcn.00a714d0
call fcn.00a714d0
int3
Function at 0x9d1a4f
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa9670f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x50
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x2b], 0x10151b1d
mov dword [ebp - 0x27], 0xd115d1f
mov word [ebp - 0x23], 0x13
mov byte [ebp - 0x21], 1
nop dword [eax]
lea eax, [ecx + 0x6e]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 9
jb 0x9d1aa0
xorps xmm0, xmm0
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x2b]
mov dword [ebp - 0x4c], 0
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x48], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x9d1ad0
sub ecx, edx
lea eax, [ebp - 0x2b]
push ecx
push eax
lea ecx, [ebp - 0x5c]
call fcn.00992810
lea ecx, [ebp - 0x5c]
call fcn.009d1970
mov ecx, dword [ebp - 0x48]
mov edi, eax
cmp ecx, 0x10
jb 0x9d1b24
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x9d1b1a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x9d1c4e
push ecx
push edx
call fcn.00a6c232
add esp, 8
test edi, edi
je 0x9d1c39
cmp edi, 0xea60
jae 0x9d1c39
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x44], xmm0
mov edx, edi
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
mov dword [ebp - 0x18], 3
call fcn.009d1380
xor ecx, ecx
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x2c]
mov eax, 0x2aaaaaab
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x28]
sub ecx, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x9d1bd6
xor esi, esi
nop
lea eax, [edi + esi]
lea ecx, [ebp - 0x44]
cmp ecx, eax
je 0x9d1bb2
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x9d1ba5
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.009f4cf0
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov eax, 0x2aaaaaab
inc dword [ebp - 0x14]
sub ecx, edi
imul ecx
add esi, 0x18
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x14], eax
jb 0x9d1b90
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.009f7300
cmp dword [ebp - 0x34], 0
jbe 0x9d1c09
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x44]
push ecx
cmp eax, dword [esi + 8]
je 0x9d1c01
mov ecx, eax
call fcn.009f5110
add dword [esi + 4], 0x18
jmp 0x9d1c09
push eax
mov ecx, esi
call fcn.00a01cf0
mov ecx, dword [ebp - 0x30]
cmp ecx, 0x10
jb 0x9d1c39
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x9d1c2f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x9d1c4e
push ecx
push edx
call fcn.00a6c232
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00a714d0
int3
Function at 0x9d4940
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x9d4962
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x1d
jb 0x9d4950
mov byte [esi + 0x1e], 0
mov eax, esi
pop esi
ret

Function at 0x9d4970
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x37], 0
je 0x9d4992
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6e]
inc eax
xor byte [edx], cl
cmp eax, 0x36
jb 0x9d4980
mov byte [esi + 0x37], 0
mov eax, esi
pop esi
ret