joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43eec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43eed9
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43eeea
cmp eax, 2
je 0x43ef5c
jmp 0x43ef89
push 0xbbf966b4
push dword [0x451b38]
call fcn.00444600
add esp, 8
test eax, eax
je 0x43ef27
mov ecx, dword [esi]
test ecx, ecx
je 0x43ef54
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43ef30
cmp dword [esp], 0
je 0x43ef30
mov dword [esi + 4], 3
jmp 0x43ef54
mov dword [esi + 4], 1
jmp 0x43ef89
lea eax, [esp + 0xc]
push eax
call fcn.00444f10
add esp, 4
test al, al
je 0x43ef54
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43ef51
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43ef89
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x459b60]
call fcn.00444600
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43f037
mov eax, dword [esi]
mov dword [esp + 8], eax
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
xor eax, eax
nop
mov esi, eax
xor esi, 0xcb1c73a
mov edx, eax
or edx, 5
and edx, esi
mov esi, eax
and esi, 5
mov ecx, edx
and ecx, 2
or edx, 2
imul edx, ecx
xor ecx, 2
imul ecx, esi
mov ebx, eax
xor ebx, 0xc5
add ebx, edx
add ebx, ecx
xor bl, byte [esp + eax]
add bl, 0x27
mov byte [esp + eax], bl
inc eax
cmp eax, 6
jne 0x43efa0
mov eax, dword [esp]
mov edx, dword [0x451b44]
test edx, edx
je 0x43f037
xor esi, esi
mov ebx, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x43f010
inc esi
cmp edx, esi
jne 0x43f000
jmp 0x43f037
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43f037
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x18]
push 5
push edx
push dword [0x451b4c]
call fcn.00441940
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x441890
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44fe10]

Function at 0x44249b
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, dword [esp + 0x40]
movzx eax, word [esi]
mov dword [esp], 0x2126cdd3
mov word [esp + 4], 0
mov ecx, 0x9616db6a
mov dl, 0x14
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dh, cl
xor dh, 0x8f
add dh, dl
xor dh, byte [esp + ecx + 0x69e92496]
add dh, 0x23
mov byte [esp + ecx + 0x69e92496], dh
inc ecx
add dl, 2
cmp ecx, 0x9616db70
jne 0x4424c0
xor ecx, ecx
cmp dword [esp], eax
setne cl
jmp dword [ecx*4 + 0x4501b8]
Function at 0x442b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x30]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x2c]
jb 0x442b72
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x442d41
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x442d41
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
mov edi, 0x1888ee2
mov ecx, 0x77711d
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + edi - 0x1888ee2]
mov ebp, ecx
and ebp, 0x417117
mov eax, edi
and eax, 0x10004a8
or eax, ebp
xor eax, edx
lea edx, [eax + eax]
mov esi, eax
xor esi, 0xc2
mov ebp, edx
and ebp, 2
and eax, 1
or edx, 0xd5
sub edx, esi
and edx, 0xfe
or edx, eax
not edx
add edx, ebp
mov byte [esp + edi - 0x1888ee2], dl
inc edi
dec ecx
cmp edi, 0x1888ee8
jne 0x442b90
mov eax, dword [esp]
mov ecx, dword [0x451b44]
test ecx, ecx
je 0x442c10
xor edx, edx
mov edi, dword [0x451b48]
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
cmp dword [edi + edx*8], 0x89c57e52
je 0x442c1a
inc edx
cmp ecx, edx
jne 0x442c00
jmp 0x442c44
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
jmp 0x442c44
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x442c44
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push ecx
push dword [0x451b4c]
call fcn.00441940
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x28]
js 0x442d41
push 0x732f71fd
push dword [0x459b60]
call fcn.00444600
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
mov edx, 0x1888ee2
mov esi, 0x77711d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x1888ee2]
mov ebp, esi
and ebp, 0x417117
mov edi, edx
and edi, 0x10004a8
or edi, ebp
xor edi, ebx
lea ebx, [edi + edi]
mov ecx, edi
xor ecx, 0xc2
mov ebp, ebx
and ebp, 2
and edi, 1
or ebx, 0xd5
sub ebx, ecx
and ebx, 0xfe
or ebx, edi
not ebx
add ebx, ebp
mov byte [esp + edx - 0x1888ee2], bl
inc edx
dec esi
cmp edx, 0x1888ee8
jne 0x442ca0
mov edx, dword [0x451b44]
test edx, edx
je 0x442d41
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x442d20
inc edi
cmp edx, edi
jne 0x442d10
jmp 0x442d41
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x442d41
push dword [esp + 0xc]
push 1
push edx
push dword [0x451b4c]
mov esi, eax
call fcn.00441940
mov eax, esi
add esp, 0x10
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x232221f0
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0xf8
xor cl, byte [esp + eax + 8]
add cl, 0x28
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 7
jne case.default.0x444027
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x2c], 0
sete cl
jmp dword [ecx*4 + 0x450574]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov esi, dword [0x4505ac]
mov dword [esp], 0
mov edi, dword [0x4505cc]
mov ecx, dword [edx]
xor eax, eax
cmp ecx, edx
setne al
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edi
jmp dword [eax*4 + 0x45058c]
jmp esi
jmp dword [0x45059c]
jmp dword [0x450588]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4444f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x232221f0
mov word [esp + 4], 0
mov eax, 0x7d1d5d87
mov edx, 0x7d1d5e78
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x7d1d5e78]
lea edi, [eax - 0x7d1d5d00]
and edi, eax
not edi
and edi, esi
or esi, edx
sub esi, edi
mov edi, esi
and edi, 0xc0d07a7
xor esi, 0x8e6d27a7
lea ebx, [esi + edi*2]
add ebx, 0x462ba442
mov esi, ebx
xor esi, 0x41
and ebx, 0x3e
add ebx, ebx
sub ebx, esi
mov byte [esp + edx - 0x7d1d5e78], bl
dec eax
inc edx
cmp eax, 0x7d1d5d81
jne 0x444520
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x450694]
Function at 0x445110
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x445130
mov ebx, eax
sar ebx, 1
add ebx, 4
and eax, 2
mov ecx, ebx
xor ecx, 1
add ecx, eax
jns 0x445155
mov ecx, 0xffffffff
jmp 0x445157
add ecx, ecx
push ecx
call fcn.0040cc60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x4451a1
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x445190
mov word [ecx], 0
lea ecx, [ebx + ebx]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
xor ecx, ecx
xor ebp, ebp
movzx esi, byte [esp + ebp]
mov ebx, ecx
and ebx, 4
mov edx, ebp
xor edx, 0xbb888ee2
add edx, ebx
xor edx, esi
add edx, 0x56553595
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + ebp], dl
inc ebp
add ecx, 2
cmp ebp, 6
jne 0x445200
mov esi, dword [esp]
mov ecx, dword [0x451b44]
test ecx, ecx
je 0x445294
xor edx, edx
mov ebx, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x445260
inc edx
cmp ecx, edx
jne 0x445250
jmp 0x445294
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x445294
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push ecx
push dword [0x451b4c]
mov edi, eax
call fcn.00441940
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040cc70
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4452b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x4452d0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x4452eb
mov eax, 0xffffffff
jmp 0x4452ee
add eax, 0xa
push eax
call fcn.0040cc60
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x445331
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x445320
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp], si
add ecx, edx
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x8c8d8a8b
mov word [esp + 0x24], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x20]
mov edi, ecx
and edi, 4
mov ebx, edx
xor ebx, 0xbb888ee2
add ebx, edi
xor ebx, esi
add ebx, 0x56553595
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
mov byte [esp + edx + 0x20], bl
inc edx
add ecx, 2
cmp edx, 6
jne 0x4453b0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x451b44]
test ecx, ecx
je 0x445439
xor edx, edx
mov edi, dword [0x451b48]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x50dc24c7
je 0x445410
inc edx
cmp ecx, edx
jne 0x445400
jmp 0x445439
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x445439
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push ecx
push dword [0x451b4c]
mov edi, eax
call fcn.00441940
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.0040cc70
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44544f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
xor eax, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + esi]
mov ebx, eax
and ebx, 4
mov edx, esi
xor edx, 0xbb888ee2
add edx, ebx
xor edx, ecx
add edx, 0x56553595
mov ecx, edx
and ecx, 1
xor edx, 1
lea ecx, [edx + ecx*2]
mov byte [esp + esi], cl
inc esi
add eax, 2
cmp esi, 6
jne 0x445490
mov eax, dword [esp]
mov edx, dword [0x451b44]
test edx, edx
je 0x445518
xor ebx, ebx
mov ecx, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x7cde1e50
je 0x4454f0
inc ebx
cmp edx, ebx
jne 0x4454e0
jmp 0x445518
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x445518
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push edx
push dword [0x451b4c]
call fcn.00441940
add esp, 0x20
test edi, edi
je 0x445522
mov ecx, dword [esp + 8]
mov dword [edi], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x445531
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
xor eax, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebp, eax
and ebp, 4
mov ebx, esi
xor ebx, 0xbb888ee2
add ebx, ebp
xor ebx, edi
add ebx, 0x56553595
mov edi, ebx
and edi, 1
xor ebx, 1
lea ebx, [ebx + edi*2]
mov byte [esp + esi], bl
inc esi
add eax, 2
cmp esi, 6
jne 0x445570
mov eax, dword [esp]
mov ebx, dword [0x451b44]
test ebx, ebx
je 0x4455fe
xor ebp, ebp
mov edi, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xc81e0bf6
je 0x4455d0
inc ebp
cmp ebx, ebp
jne 0x4455c0
jmp 0x4455fe
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x4455fe
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push ebx
push dword [0x451b4c]
call fcn.00441940
add esp, 0x30
cmp eax, 0x103
jne 0x4456a9
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
mov esi, eax
and esi, 4
mov edi, ecx
xor edi, 0xbb888ee2
add edi, esi
xor edi, edx
add edi, 0x56553595
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 6
jne 0x445620
mov eax, dword [esp]
mov ecx, dword [0x451b44]
test ecx, ecx
je 0x4456a1
xor edx, edx
mov edi, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x445680
inc edx
cmp ecx, edx
jne 0x445670
jmp 0x4456a1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x4456a1
push 0
push 0
push dword [esp + 0x2c]
push 3
push ecx
push dword [0x451b4c]
call fcn.00441940
add esp, 0x18
test eax, eax
js 0x4456a9
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x4456c0
xor ecx, ecx
cmp eax, 0xc0000011
je 0x4456be
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445850
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x445870
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 8], bx
add ebx, 2
mov word [esp + 0xa], bx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx]
mov ebp, eax
and ebp, 4
mov edi, ecx
xor edi, 0xbb888ee2
add edi, ebp
xor edi, ebx
add edi, 0x56553595
mov ebx, edi
and ebx, 1
xor edi, 1
lea ebx, [edi + ebx*2]
mov byte [esp + ecx], bl
inc ecx
add eax, 2
cmp ecx, 6
jne 0x4458e0
mov eax, dword [esp]
mov edi, dword [0x451b44]
test edi, edi
je 0x445965
xor ebx, ebx
mov ebp, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x445941
inc ebx
cmp edi, ebx
jne 0x445930
jmp 0x445965
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x445965
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 4
push edi
push dword [0x451b4c]
call fcn.00441940
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001990
Capabilities:
Check for debugger via api
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1001f018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
call fcn.100018f0
test eax, eax
jne 0x10001a8f
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 8], 0
jne 0x10001a8f
movaps xmm0, xmmword [0x1001b060]
xor eax, eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x241a1b1d
mov dword [ebp - 0x24], 0x11171b06
mov word [ebp - 0x20], 0x707
mov byte [ebp - 0x1e], 0
mov cl, byte [ebp - 0x38]
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0x19
jb 0x100019f7
push ebx
mov byte [ebp - 0x1c], 0x29
mov al, 0x47
xor al, byte [ebp - 0x1c]
mov bl, 0x45
mov ah, bl
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x1c]
mov dl, 0x4d
mov bh, ah
mov byte [ebp - 0xd], ah
xor bl, al
mov byte [ebp - 0x12], 0
xor ah, al
mov byte [ebp - 0x1e], 0
xor bh, al
mov byte [ebp - 0x17], ah
mov dh, dl
mov byte [ebp - 0x18], bl
xor dl, al
mov byte [ebp - 0x14], bh
xor dh, al
mov byte [ebp - 0x19], dl
mov cl, 0x5d
mov byte [ebp - 0x15], dh
xor cl, al
mov byte [ebp - 0x12], 0
mov ch, 7
mov byte [ebp - 0x1a], cl
xor ch, al
mov al, byte [ebp - 0xd]
xor al, byte [ebp - 0x1c]
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x37]
push eax
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x16], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ebx
test eax, eax
je 0x10001a97
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 7
push 0xffffffffffffffff
call eax
test eax, eax
je 0x10001a97
cmp dword [ebp - 0xc], 0
je 0x10001a97
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012830
mov esp, ebp
pop ebp
ret

Function at 0x10001ab0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x1001b100]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x33290523
mov dword [ebp - 0x18], 0x34233228
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x17
jb 0x10001ad5
mov byte [ebp - 0x14], 0
mov cl, 9
mov dword [ebp - 0x10], 0x7b6c6209
xor eax, eax
mov dword [ebp - 0xc], 0x3a656c67
mov dword [ebp - 8], 0x656d273b
mov word [ebp - 4], 0x65
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x10001b14
mov cl, byte [ebp - 0x10]
jmp 0x10001b05
lea eax, [ebp - 0x2b]
mov byte [ebp - 3], 0
push eax
lea eax, [ebp - 0xf]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000a470
cmp al, 0xe9
jne 0x10001b40
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10001b50
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov cl, 0x32
mov dword [ebp - 0x10], 0x5f5b4632
mov dword [ebp - 0xc], 0x46577557
xor eax, eax
mov dword [ebp - 8], 0x575f5b66
mov byte [ebp - 4], 0
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xb
jae 0x10001b82
mov cl, byte [ebp - 0x10]
jmp 0x10001b73
mov byte [ebp - 4], 0
mov cl, 0x18
mov dword [ebp - 0x20], 0x6a7d7318
xor eax, eax
mov dword [ebp - 0x1c], 0x2b747d76
mov dword [ebp - 0x18], 0x747c362a
mov word [ebp - 0x14], 0x74
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001bb4
mov cl, byte [ebp - 0x20]
jmp 0x10001ba5
lea eax, [ebp - 0xf]
mov byte [ebp - 0x13], 0
push eax
lea eax, [ebp - 0x1f]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000a470
cmp al, 0xe9
jne 0x10001be0
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov cl, 0xe
mov dword [ebp - 0x10], 0x7a6b490e
mov dword [ebp - 0xc], 0x656d675a
xor eax, eax
mov dword [ebp - 8], 0x607b614d
mov word [ebp - 4], 0x7a
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x10001c24
mov cl, byte [ebp - 0x10]
jmp 0x10001c15
mov byte [ebp - 3], 0
mov cl, 0x77
mov dword [ebp - 0x20], 0x5121c77
xor eax, eax
mov dword [ebp - 0x1c], 0x441b1219
mov dword [ebp - 0x18], 0x1b135945
mov word [ebp - 0x14], 0x1b
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001c56
mov cl, byte [ebp - 0x20]
jmp 0x10001c47
lea eax, [ebp - 0xf]
mov byte [ebp - 0x13], 0
push eax
lea eax, [ebp - 0x1f]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000a470
cmp al, 0xe9
jne 0x10001c82
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x10001c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1001f018]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1001b070]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
nop dword [eax]
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xe
jb 0x10001cb0
mov byte [ebp - 0x19], 0
mov cl, 0x35
mov dword [ebp - 0x18], 0x67707e35
xor eax, eax
mov dword [ebp - 0x14], 0x679707b
mov dword [ebp - 0x10], 0x59511b07
mov word [ebp - 0xc], 0x59
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x10001cef
mov cl, byte [ebp - 0x18]
jmp 0x10001ce0
lea eax, [ebp - 0x27]
mov byte [ebp - 0xb], 0
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.10012830
mov esp, ebp
pop ebp
ret