joyce8/EMBER2024-capa huggingface dataset:
Function at 0x527e2c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x59c0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00520273
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00520273
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x527ea3
cmp word [ecx], dx
je 0x527ea3
mov eax, dword [0x583bdc]
push edi
dec eax
push eax
push 0x583ac8
call fcn.00527dcb
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x527f16
cmp word [eax], dx
je 0x527f16
mov eax, dword [edi]
test eax, eax
je 0x527ec7
cmp word [eax], dx
je 0x527ec7
lea eax, [ebp - 0x10]
push eax
call fcn.005277ae
jmp 0x527ed0
lea eax, [ebp - 0x10]
push eax
call fcn.00527849
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x527f40
mov eax, dword [0x583ac4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x5837b8
call fcn.00527dcb
add esp, 0xc
test al, al
je 0x527f40
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x527f0b
cmp word [eax], di
je 0x527f0b
lea eax, [ebp - 0x10]
push eax
call fcn.005277ae
pop ecx
jmp 0x527f42
lea eax, [ebp - 0x10]
push eax
call fcn.00527849
jmp 0x527f08
mov eax, dword [edi]
test eax, eax
je 0x527f2d
cmp word [eax], dx
je 0x527f2d
lea eax, [ebp - 0x10]
push eax
call fcn.00527745
pop ecx
jmp 0x527f40
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x52800b
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00527c50
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x52800b
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x52800b
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x52800b
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x527f98
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00528d19
test ebx, ebx
je 0x528006
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00528d19
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x52800b
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x52800b
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0052df93
add esp, 0x10
xor eax, eax
inc eax
jmp 0x52800d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4f99
leave
ret
Function at 0x52898b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x584e04
push 0x584dfc
push str.FlsAlloc
push 0x1f
call fcn.00528659
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5289bf
push dword [ebp + 8]
mov ecx, esi
call dword [0x53e14c]
call esi
jmp 0x5289c5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x528a09
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x584e14
push 0x584e0c
push str.FlsGetValue
push 0x21
call fcn.00528659
mov esi, eax
add esp, 0x10
test esi, esi
je 0x528a40
push dword [ebp + 8]
mov ecx, esi
call dword [0x53e14c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x528a48
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x584e1c
push 0x584e14
push str.FlsSetValue
push 0x22
call fcn.00528659
mov esi, eax
add esp, 0x10
test esi, esi
je 0x528a82
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x53e14c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x5350fb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x59da30]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x53513b
cmp byte [ebx], 0xa
jne 0x53513b
or byte [edi + eax + 0x28], 4
jmp 0x535140
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x53523f
mov dl, byte [eax]
cmp dl, 0x1a
je 0x535222
inc eax
cmp dl, 0xd
je 0x53516c
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x535192
cmp eax, ecx
jae 0x5351a0
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x535154
jmp 0x53523f
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x53521d
cmp dword [ebp - 0x10], 0
je 0x53521d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x59da30]
test byte [eax + edi + 0x28], 0x48
je 0x5351f7
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x5351e2
mov byte [esi], dl
jmp 0x5351f3
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x59da30]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x53523f
cmp byte [ebp - 1], 0xa
jne 0x535206
cmp esi, ebx
jne 0x535206
mov byte [esi], 0xa
jmp 0x53523e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00534f4d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x53523f
mov byte [esi], 0xd
jmp 0x53523e
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x59da30]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x53523c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x53523f
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x535248
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x59da30]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x53528e
cmp word [ebx], dx
jne 0x53528e
or byte [eax + edi + 0x28], 4
jmp 0x535293
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x5353f6
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x5353d6
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x5352d4
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x53530a
cmp eax, edx
jae 0x535318
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x5352af
jmp 0x5353f6
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5353d1
cmp dword [ebp - 0x18], 0
je 0x5353d1
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x59da30]
test byte [eax + edi + 0x28], 0x48
je 0x5353a7
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x53536b
mov word [esi], cx
jmp 0x5353a2
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x59da30]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x59da30]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x59da30]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x5353f6
pop eax
cmp word [ebp - 4], ax
jne 0x5353b7
cmp esi, ebx
jne 0x5353b7
mov word [esi], ax
jmp 0x5353f3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00534f4d
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x5353f6
push 0xd
pop eax
jmp 0x5353b2
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x59da30]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x5353f0
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x5353f6
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x539ef0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x539f1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x539f1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40135f
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414a34], al
inc ecx
cmp byte [ecx + 0x414a33], 0
jne 0x401380
mov eax, 0x414a34
leave
ret

Function at 0x40139d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x411680]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414d50], al
inc ecx
cmp byte [ecx + 0x414d4f], 0
jne 0x4013b4
mov eax, 0x414d50
leave
ret

Function at 0x4013fb
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b04], al
inc ecx
cmp byte [ecx + 0x414b03], 0
jne 0x40141c
mov eax, 0x414b04
leave
ret

Function at 0x401439
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x31343a19
xor ecx, ecx
mov dword [ebp - 0xc], 0x27373c19
mov dword [ebp - 8], 0x142c2734
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c74], al
inc ecx
cmp byte [ecx + 0x414c73], 0
jne 0x40145a
mov eax, 0x414c74
leave
ret

Function at 0x4014a1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414bbc], al
inc ecx
cmp byte [ecx + 0x414bbb], 0
jne 0x4014c2
mov eax, 0x414bbc
leave
ret

Function at 0x4014df
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x5213012
xor ecx, ecx
mov dword [ebp - 0xc], 0x14363a27
mov dword [ebp - 8], 0x30273131
mov word [ebp - 4], 0x2626
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b14], al
inc ecx
cmp byte [ecx + 0x414b13], 0
jne 0x401506
mov eax, 0x414b14
leave
ret

Function at 0x40154d
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414d2c], al
inc ecx
cmp byte [ecx + 0x414d2b], 0
jne 0x40156e
mov eax, 0x414d2c
leave
ret
Function at 0x40158b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x4116a0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x5526
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414a70], al
inc ecx
cmp byte [ecx + 0x414a6f], 0
jne 0x4015a4
mov eax, 0x414a70
leave
ret

Function at 0x4015eb
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414d64], al
inc ecx
cmp byte [ecx + 0x414d63], 0
jne 0x40160c
mov eax, 0x414d64
leave
ret

Function at 0x401629
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x4116a0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 4], 0x55311c26
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414bf0], al
inc ecx
cmp byte [ecx + 0x414bef], 0
jne 0x401643
mov eax, 0x414bf0
leave
ret

Function at 0x40168a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b40], al
inc ecx
cmp byte [ecx + 0x414b3f], 0
jne 0x4016ab
mov eax, 0x414b40
leave
ret

Function at 0x4016c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x213c2d10
xor ecx, ecx
mov dword [ebp - 8], 0x363a2705
mov dword [ebp - 4], 0x55262630
mov al, byte [ebp + ecx - 0xc]
xor al, 0x55
mov byte [ecx + 0x414a50], al
inc ecx
cmp byte [ecx + 0x414a4f], 0
jne 0x4016e5
mov eax, 0x414a50
leave
ret

Function at 0x40172c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c54], al
inc ecx
cmp byte [ecx + 0x414c53], 0
jne 0x40174d
mov eax, 0x414c54
leave
ret

Function at 0x40176a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x4116e0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x5521
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414ad0], al
inc ecx
cmp byte [ecx + 0x414acf], 0
jne 0x401783
mov eax, 0x414ad0
leave
ret
Function at 0x4017ca
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c44], al
inc ecx
cmp byte [ecx + 0x414c43], 0
jne 0x4017eb
mov eax, 0x414c44
leave
ret

Function at 0x401808
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x21273c03
xor ecx, ecx
mov dword [ebp - 0xc], 0x14393420
mov dword [ebp - 8], 0x363a3939
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414cb4], al
inc ecx
cmp byte [ecx + 0x414cb3], 0
jne 0x401829
mov eax, 0x414cb4
leave
ret

Function at 0x401870
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414a5c], al
inc ecx
cmp byte [ecx + 0x414a5b], 0
jne 0x401891
mov eax, 0x414a5c
leave
ret

Function at 0x4018ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x21273c03
xor ecx, ecx
mov dword [ebp - 0xc], 0x14393420
mov dword [ebp - 8], 0x363a3939
mov word [ebp - 4], 0x2d10
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c64], al
inc ecx
cmp byte [ecx + 0x414c63], 0
jne 0x4018d5
mov eax, 0x414c64
leave
ret

Function at 0x40191c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414ab0], al
inc ecx
cmp byte [ecx + 0x414aaf], 0
jne 0x40193d
mov eax, 0x414ab0
leave
ret

Function at 0x40195a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x21273c03
xor ecx, ecx
mov dword [ebp - 8], 0x13393420
mov dword [ebp - 4], 0x55303027
mov al, byte [ebp + ecx - 0xc]
xor al, 0x55
mov byte [ecx + 0x414cd4], al
inc ecx
cmp byte [ecx + 0x414cd3], 0
jne 0x401977
mov eax, 0x414cd4
leave
ret

Function at 0x4019be
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414ac0], al
inc ecx
cmp byte [ecx + 0x414abf], 0
jne 0x4019df
mov eax, 0x414ac0
leave
ret
Function at 0x4019fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x21273c03
xor ecx, ecx
mov dword [ebp - 0xc], 0x5393420
mov dword [ebp - 8], 0x30213a27
mov word [ebp - 4], 0x2136
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b24], al
inc ecx
cmp byte [ecx + 0x414b23], 0
jne 0x401a23
mov eax, 0x414b24
leave
ret

Function at 0x401a6a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c84], al
inc ecx
cmp byte [ecx + 0x414c83], 0
jne 0x401a8b
mov eax, 0x414c84
leave
ret

Function at 0x401aa8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x4116b0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414a10], al
inc ecx
cmp byte [ecx + 0x414a0f], 0
jne 0x401abf
mov eax, 0x414a10
leave
ret

Function at 0x401b06
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c34], al
inc ecx
cmp byte [ecx + 0x414c33], 0
jne 0x401b27
mov eax, 0x414c34
leave
ret

Function at 0x401b44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x4116d0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x2c27
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414c20], al
inc ecx
cmp byte [ecx + 0x414c1f], 0
jne 0x401b61
mov eax, 0x414c20
leave
ret

Function at 0x401ba8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414a24], al
inc ecx
cmp byte [ecx + 0x414a23], 0
jne 0x401bc9
mov eax, 0x414a24
leave
ret

Function at 0x401be6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [0x4116f0]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x3d363416
mov word [ebp - 4], 0x5530
mov al, byte [ebp + ecx - 0x18]
xor al, 0x55
mov byte [ecx + 0x414bd0], al
inc ecx
cmp byte [ecx + 0x414bcf], 0
jne 0x401c06
mov eax, 0x414bd0
leave
ret
Function at 0x401c4d
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414cc4], al
inc ecx
cmp byte [ecx + 0x414cc3], 0
jne 0x401c6e
mov eax, 0x414cc4
leave
ret

Function at 0x401c8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x411690]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x3b3a3c21
mov dword [ebp - 8], 0x313b341d
mov dword [ebp - 4], 0x55273039
mov al, byte [ebp + ecx - 0x1c]
xor al, 0x55
mov byte [ecx + 0x414d90], al
inc ecx
cmp byte [ecx + 0x414d8f], 0
jne 0x401cb3
mov eax, 0x414d90
leave
ret

Function at 0x401cfa
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414ca4], al
inc ecx
cmp byte [ecx + 0x414ca3], 0
jne 0x401d1b
mov eax, 0x414ca4
leave
ret

Function at 0x401d38
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x4116c0]
xor ecx, ecx
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x21253036
mov dword [ebp - 0xc], 0x1d3b3a3c
mov dword [ebp - 8], 0x39313b34
mov word [ebp - 4], 0x2730
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x20]
xor al, 0x55
mov byte [ecx + 0x414a90], al
inc ecx
cmp byte [ecx + 0x414a8f], 0
jne 0x401d6a
mov eax, 0x414a90
leave
ret

Function at 0x401db1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c04], al
inc ecx
cmp byte [ecx + 0x414c03], 0
jne 0x401dd2
mov eax, 0x414c04
leave
ret

Function at 0x401def
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x411700]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x25343b06
mov dword [ebp - 8], 0x213a3d26
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x1c]
xor al, 0x55
mov byte [ecx + 0x414ce0], al
inc ecx
cmp byte [ecx + 0x414cdf], 0
jne 0x401e14
mov eax, 0x414ce0
leave
ret

Function at 0x401e5b
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414cfc], al
inc ecx
cmp byte [ecx + 0x414cfb], 0
jne 0x401e7c
mov eax, 0x414cfc
leave
ret