joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x10]
push ecx
push edx
lea esi, [eax + 0x954]
push esi
push eax
mov dword [ebp - 0x10], 0x65746e49
mov dword [ebp - 0xc], 0x74656e72
mov dword [ebp - 8], 0x6e65704f
mov word [ebp - 4], 0x41
call fcn.0041b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41a9ce
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a9e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x958]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x6e6e6f43
mov dword [ebp - 8], 0x41746365
mov byte [ebp - 4], 0
call fcn.0041b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41aa4f
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41aa60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x95c]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41aacf
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41aae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x960]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41ab43
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41ab50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x964]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.0041b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41abaf
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41abc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x968]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.0041b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41ac16
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41b466
cmp dword [esi + 0x18], 0
je 0x41b481
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041cd10
add esp, 8
test eax, eax
jne 0x41b45e
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b440
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41b481
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41b481
cmp eax, ecx
je 0x41b45e
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41b474
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000156e
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xa], 0
je 0x1000158c
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 9
jb 0x10001579
mov byte [edx + 0xa], 0
pop ebx
mov eax, edx
ret

Function at 0x1000158f
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x13], 0
je 0x100015ad
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0x12
jb 0x1000159a
mov byte [edx + 0x13], 0
pop ebx
mov eax, edx
ret

Function at 0x100015b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x11], 0
je 0x100015ce
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0x10
jb 0x100015bb
mov byte [edx + 0x11], 0
pop ebx
mov eax, edx
ret

Function at 0x100015d1
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x100ce350]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x124
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.1007eb10
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x10001645
lea eax, [ebp - 0x10c]
push eax
push edi
call fcn.10081798
pop ecx
pop ecx
test eax, eax
je 0x10001660
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10001624
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1007c2ab
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x128]
jmp 0x10001652
Function at 0x10001e59
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 9], 0
je 0x10001e77
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 8
jb 0x10001e64
mov byte [edx + 9], 0
pop ebx
mov eax, edx
ret

Function at 0x10001e7a
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xe], 0
je 0x10001e98
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0xd
jb 0x10001e85
mov byte [edx + 0xe], 0
pop ebx
mov eax, edx
ret

Function at 0x10001e9b
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x12], 0
je 0x10001eb9
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0x11
jb 0x10001ea6
mov byte [edx + 0x12], 0
pop ebx
mov eax, edx
ret

Function at 0x10001ebc
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xc], 0
je 0x10001eda
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0xb
jb 0x10001ec7
mov byte [edx + 0xc], 0
pop ebx
mov eax, edx
ret

Function at 0x10001edd
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 8], 0
je 0x10001efb
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 7
jb 0x10001ee8
mov byte [edx + 8], 0
pop ebx
mov eax, edx
ret

Function at 0x10001efe
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xb], 0
je 0x10001f1c
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0xa
jb 0x10001f09
mov byte [edx + 0xb], 0
pop ebx
mov eax, edx
ret

Function at 0x10001f1f
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xd], 0
je 0x10001f3d
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0xc
jb 0x10001f2a
mov byte [edx + 0xd], 0
pop ebx
mov eax, edx
ret
Function at 0x100025fc
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x10], 0
je 0x1000261a
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0xf
jb 0x10002607
mov byte [edx + 0x10], 0
pop ebx
mov eax, edx
ret

Function at 0x100026a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100ce350]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], 0xe3eaf9e2
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 0xfff6bffc
mov word [ebp - 0xc], 0xf8
mov byte [ebp - 0xa], 1
call fcn.1000156e
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
movaps xmm0, xmmword [0x100c60b0]
mov edx, eax
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0xedcef3f3
mov ecx, ebx
mov dword [ebp - 0x1c], 0xd0c7c2cf
mov word [ebp - 0x18], 0xd7
mov byte [ebp - 0x16], 1
lea eax, [ecx - 0x74]
xor byte [ebp + ecx - 0x30], al
inc ecx
cmp ecx, 0x19
jb 0x1000270a
lea eax, [ebp - 0x30]
mov byte [ebp - 0x16], bl
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
mov esi, eax
lea eax, [ebp - 8]
push 4
push eax
push 0x1f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x10002742
cmp dword [ebp - 8], ebx
je 0x10002752
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1007c2ab
leave
ret
sub esp, 0x18
mov ecx, esp
push str.ProcessDebugFlags
call fcn.100034c3
call fcn.1000166f
int3

Function at 0x10002767
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100ce350]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
movaps xmm0, xmmword [0x100c60c0]
mov edx, eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0xfef3eff3
xor ecx, ecx
mov dword [ebp - 0x10], 0xcdcdc8d4
mov word [ebp - 0xc], 0x100
lea eax, [ecx - 0x74]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0x18
jb 0x100027ab
lea eax, [ebp - 0x24]
mov byte [ebp - 0xb], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 2
lea ecx, [ebp - 8]
push ecx
push 0x23
call eax
test eax, eax
jne 0x100027e5
mov ax, word [ebp - 8]
test al, al
je 0x100027e5
test ah, ah
je 0x100027f1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007c2ab
leave
ret
sub esp, 0x18
mov ecx, esp
push str.SystemKernelDebuggerInformation
call fcn.100034c3
call fcn.1000166f
int3
Function at 0x10002878
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x100a3e1e
call fcn.1007d600
push 4
call fcn.1007c2ea
mov dword [ebp - 0x14], eax
mov dword [eax], 0x10002806
xor esi, esi
lea ecx, [ebp - 0x18]
push ecx
push esi
push eax
push 0x10003c67
push esi
push esi
mov dword [ebp - 4], esi
call fcn.10081c92
add esp, 0x1c
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100028d1
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x18], esi
je 0x100028de
push dword [ebp - 0x18]
push eax
call fcn.1007aa8f
pop ecx
pop ecx
test eax, eax
jne 0x100028e4
jmp 0x100028d8
mov dword [ebp - 0x18], esi
push 6
jmp 0x100028df
call fcn.1007d5af
ret
push ecx
call fcn.1007aa5a
push eax
call fcn.1007aa2d
int3

Function at 0x100028eb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x68
xor ecx, ecx
mov byte [ebp - 0x13], 0x68
mov byte [ebp - 0x12], 0x3a
mov byte [ebp - 0x11], 0x68
mov byte [ebp - 0x10], 0x62
mov byte [ebp - 0xf], 0x4e
mov byte [ebp - 0xe], 0x7b
mov byte [ebp - 0xd], 0x84
mov byte [ebp - 0xc], 0x59
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0x75
mov byte [ebp - 8], 0x5e
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x7e
mov byte [ebp - 5], 0x50
mov byte [ebp - 4], 0x5a
mov byte [ebp - 3], cl
mov al, byte [ebp - 0x14]
mov eax, ecx
sub byte [ebp + eax - 0x14], 0xc
inc eax
cmp eax, 0x11
jb 0x1000293f
push ecx
push 0x80
push 3
push ecx
push 1
push connect
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x10002974
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
leave
ret
xor al, al
leave
ret
Function at 0x1000308c
Capabilities:
Terminate process

Disassembly:
push 0x54
mov eax, 0x100a3e52
call fcn.1007d600
mov dword [0x100e3f7c], 0x3e8
mov byte [0x100e3f7a], 1
mov byte [0x100e3f79], 1
mov byte [0x100e3f78], 1
call fcn.10002878
mov ecx, 0x11d
mov eax, 0x10002f37
add eax, ecx
push ecx
push eax
call fcn.10003586
mov ebx, eax
mov ecx, 0x10002f5b
mov eax, 0x261
add ecx, eax
push eax
push ecx
call fcn.10003586
mov esi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
lea ecx, [ebp - 0x48]
and dword [ebp - 0x58], 0
add esp, 0x10
and dword [ebp - 0x54], 0
add esi, 0x16b
mov dword [ebp - 0x5c], eax
call fcn.10003a46
xor ecx, ecx
lea edi, [ebp - 0x29]
mov word [ebp - 0x2c], cx
xor eax, eax
xorps xmm0, xmm0
movlpd qword [ebp - 0x26], xmm0
movlpd qword [ebp - 0x1e], xmm0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x58]
push 0x16b
push esi
call fcn.10003760
mov esi, dword [ebp - 0x54]
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x48]
call fcn.100038fa
mov ecx, 0x205
mov eax, 0x10002fd0
add eax, ecx
push ecx
push eax
call fcn.10003586
pop ecx
pop ecx
test ebx, ebx
jne 0x10003178
cmp dword [ebp - 0x5c], ebx
jne 0x10003178
test esi, esi
jne 0x10003178
test eax, eax
jne 0x10003178
call fcn.1007d5af
ret
push 0
call fcn.10081b20
int3

Function at 0x10003180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 6], 0
je 0x100031a1
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 5
jb 0x1000318e
mov byte [edx + 6], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 5]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4

Function at 0x100031b6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 7], 0
je 0x100031d7
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 6
jb 0x100031c4
mov byte [edx + 7], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 6]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4

Function at 0x100031ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 0xd], 0
je 0x1000320d
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0xc
jb 0x100031fa
mov byte [edx + 0xd], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 0xc]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4

Function at 0x10003222
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 0xb], 0
je 0x10003243
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0xa
jb 0x10003230
mov byte [edx + 0xb], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 0xa]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4
Function at 0x10003258
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 8], 0
je 0x10003279
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 7
jb 0x10003266
mov byte [edx + 8], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 7]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4

Function at 0x1000328e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 4], 0
je 0x100032af
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 3
jb 0x1000329c
mov byte [edx + 4], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 3]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4

Function at 0x100032c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 0x10], 0
je 0x100032e5
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0xf
jb 0x100032d2
mov byte [edx + 0x10], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 0xf]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4

Function at 0x100032fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 0xc], 0
je 0x1000331b
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0xb
jb 0x10003308
mov byte [edx + 0xc], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 0xb]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4

Function at 0x10003330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 0xf], 0
je 0x10003351
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0xe
jb 0x1000333e
mov byte [edx + 0xf], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 0xe]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4

Function at 0x10003366
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 0x12], 0
je 0x10003387
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0x11
jb 0x10003374
mov byte [edx + 0x12], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 0x11]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4

Function at 0x1000339c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 0x16], 0
je 0x100033bd
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0x15
jb 0x100033aa
mov byte [edx + 0x16], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 0x15]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4
Function at 0x100033d2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 0xe], 0
je 0x100033f3
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0xd
jb 0x100033e0
mov byte [edx + 0xe], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 0xd]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4

Function at 0x10003408
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 9], 0
je 0x10003429
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 8
jb 0x10003416
mov byte [edx + 9], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 8]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4

Function at 0x1000343e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 0x11], 0
je 0x1000345f
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x74]
xor byte [ecx], al
inc ebx
cmp ebx, 0x10
jb 0x1000344c
mov byte [edx + 0x11], 0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 0x10]
push eax
push edx
call fcn.100035ea
mov eax, dword [ebp + 8]
pop ebp
ret 4
Function at 0x1000914b
Capabilities:
Encode data using xor

Disassembly:
push 0x8c
mov eax, 0x100a491c
call fcn.1007d600
push 0xa
xor ebx, ebx
lea ecx, [ebp - 0x58]
pop edx
mov dword [ebp - 4], ebx
call fcn.100153a8
sub esp, 0xc
mov byte [ebp - 4], 1
mov ecx, esp
push ecx
call fcn.1000b67d
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.10016214
add esp, 0xc
push 0xf
pop esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
mov byte [ebp - 4], 3
call fcn.1002a5b0
mov edi, eax
test edi, edi
je 0x100092fe
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x40], bl
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x40]
call fcn.1000b852
mov dword [ebp - 0x80], 0x19
mov edx, ebx
mov byte [ebp - 0x7c], 0x26
mov byte [ebp - 0x7b], 0x7a
mov byte [ebp - 0x7a], 0x76
mov byte [ebp - 0x79], 0x7d
mov byte [ebp - 0x78], 0x7c
mov byte [ebp - 0x77], 0x24
mov al, byte [ebp - 0x7c]
mov byte [ebp - 0x76], bl
mov al, byte [ebp + edx - 0x7c]
mov ecx, dword [ebp - 0x80]
xor cl, al
mov byte [ebp + edx - 0x7c], cl
inc edx
cmp edx, 6
jb 0x100091ec
lea eax, [ebp - 0x7c]
mov byte [ebp - 0x76], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.1000b7a7
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x40]
call fcn.1000b821
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.1000661f
call fcn.100157ce
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
push 0x2712
push edi
call fcn.1002e0f0
push 0x1000864b
push 0x4e2b
push edi
call fcn.1002e0f0
lea eax, [ebp - 0x28]
push eax
push 0x2711
push edi
call fcn.1002e0f0
push edi
call fcn.1002a610
add esp, 0x40
mov esi, eax
push edi
call fcn.1002a590
pop ecx
test esi, esi
je 0x1000928e
lea ecx, [ebp - 0x40]
call fcn.100034e6
jmp 0x1000932a
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.1000661f
call fcn.100157ce
add esp, 0x18
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x98]
call fcn.100161ab
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x100092cd
mov byte [ebp - 0x74], bl
push dword [ebp - 0x74]
push eax
call fcn.1000c1df
lea ecx, [ebp - 0x98]
call fcn.100034e6
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.1000661f
call fcn.100157ce
add esp, 0x18
lea ecx, [ebp - 0x40]
call fcn.100034e6
cmp dword [ebp - 0x44], 0x10
lea ecx, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push ecx
cmovae eax, dword [ebp - 0x28]
push dword [ebp - 0x18]
push eax
call fcn.1000dab2
add esp, 0x10
test al, al
je 0x1000932a
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.100034e6
lea ecx, [ebp - 0x70]
call fcn.100034e6
lea ecx, [ebp - 0x58]
call fcn.100034e6
lea ecx, [ebp + 8]
call fcn.100034e6
mov al, bl
call fcn.1007d5af
ret