joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fcbc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
mov edi, dword [0x10057860]
call fcn.10007400
mov dword [edi], eax
lea eax, [edi + 8]
push eax
call fcn.100074c5
lea eax, [edi + 0x20]
xor ebx, ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.100074c5
mov ecx, eax
call fcn.10007572
mov byte [edi + 0x38], al
call fcn.10007572
mov byte [edi + 0x39], al
call fcn.10007550
mov word [edi + 0x3e], ax
call fcn.10007572
mov byte [edi + 0x3a], al
call fcn.10007572
mov byte [edi + 0x3b], al
call fcn.10007572
mov byte [edi + 0x3c], al
call fcn.10007572
mov byte [edi + 0x68], al
call fcn.10007572
mov byte [edi + 0x69], al
call fcn.10007572
mov byte [edi + 0x6a], al
call fcn.10007572
mov byte [edi + 0x6b], al
call fcn.10007572
mov byte [edi + 0x6c], al
call fcn.10007400
mov dword [edi + 0x4c], eax
call fcn.10007400
mov ecx, dword [0x10057868]
mov dword [edi + 0x50], eax
mov byte [0x100578dc], 1
test ecx, ecx
je 0x1000fd77
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x1000fd77
call fcn.10014d0a
mov eax, dword [0x10057864]
test eax, eax
je 0x1000fda2
cmp byte [eax], bl
jne 0x1000fda2
push ebx
push ebx
push eax
push 0x1001114c
push ebx
push ebx
mov byte [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000fda2
mov ecx, eax
call fcn.10010e37
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10010ac8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10054040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1004d200]
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], 0x424e4403
push esi
mov esi, ecx
mov byte [ebp - 0x20], bl
movups xmmword [ebp - 0x34], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x13
jb 0x10010af5
lea eax, [ebp - 0x33]
mov byte [ebp - 0x20], bl
push eax
mov edx, 0x10055488
lea ecx, [ebp - 0x1c]
call fcn.1000c34d
mov eax, dword [esi + 0x1fc]
pop ecx
test eax, eax
je 0x10010b28
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
push 0x8010
cmova eax, dword [ebp - 0x1c]
push ebx
push ebx
push 1
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esi + 0x1fc], eax
test eax, eax
je 0x10010b62
mov dword [esi + 0x14], eax
cmp byte [esi + 0x200], bl
je 0x10010b62
push esi
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
lea ecx, [ebp - 0x1c]
call fcn.10003b97
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c3d4
leave
ret
Function at 0x10010cb1
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x10054040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x2f4], 0x637b5d0f
push esi
mov cl, 0xf
mov dword [ebp - 0x2f0], 0x6b6e6043
mov dword [ebp - 0x2ec], 0x667d7b5c
mov eax, ebx
mov word [ebp - 0x2e8], 0x6861
mov byte [ebp - 0x2e6], bl
xor byte [ebp + eax - 0x2f3], cl
inc eax
cmp eax, 0xd
jae 0x10010d0e
mov cl, byte [ebp - 0x2f4]
jmp 0x10010cf9
mov byte [ebp - 0x2e6], bl
mov cl, 0x2d
mov dword [ebp - 0x2e4], 0x4959432d
mov eax, ebx
mov dword [ebp - 0x2e0], 0x49034141
mov word [ebp - 0x2dc], 0x4141
mov byte [ebp - 0x2da], bl
xor byte [ebp + eax - 0x2e3], cl
inc eax
cmp eax, 9
jae 0x10010d50
mov cl, byte [ebp - 0x2e4]
jmp 0x10010d3b
lea eax, [ebp - 0x2e3]
mov byte [ebp - 0x2da], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2f3]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
je 0x10010e27
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10010e27
push 0x2c8
lea eax, [ebp - 0x2d4]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10010e27
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10010e27
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10010e27
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x100019e9
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x10010e27
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
jmp 0x10010e29
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c3d4
leave
ret
Function at 0x10010e37
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], 0x2120866
mov esi, ecx
mov dword [ebp - 8], 0x2480a0a
push edi
mov cl, 0x66
mov word [ebp - 4], 0xa0a
mov byte [ebp - 2], bl
mov eax, ebx
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 9
jae 0x10010e6e
mov cl, byte [ebp - 0xc]
jmp 0x10010e5f
lea eax, [ebp - 0xb]
mov byte [ebp - 2], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
je 0x10010ed8
movaps xmm0, xmmword [0x1004d350]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x4f556953
mov dword [ebp - 0x10], 0x595c58
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x16
jb 0x10010e9c
lea eax, [ebp - 0x23]
mov byte [ebp - 0xd], bl
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10010ed8
test esi, esi
jne 0x10010ec9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push ebx
push ebx
push 0x11
push esi
call edi
neg eax
sbb al, al
inc al
jmp 0x10010eda
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10010edf
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x10010f19
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10010f1d
cmp edx, esi
jne 0x10010f02
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10010f3d
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10010f41
cmp edx, esi
jne 0x10010f26
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10010f61
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10010f65
cmp edx, esi
jne 0x10010f4a
popfd
popal
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10010fef
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10054040]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.1000ab3e
test eax, eax
jne 0x10011010
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movaps xmm0, xmmword [0x1004c9f0]
push ebx
push esi
xor ebx, ebx
push edi
movups xmmword [ebp - 0x24], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xe
jb 0x10011022
mov byte [ebp - 0x15], bl
mov cl, 0x73
mov dword [ebp - 0x14], 0x17071d73
mov eax, ebx
mov dword [ebp - 0x10], 0x175d1f1f
mov word [ebp - 0xc], 0x1f1f
mov byte [ebp - 0xa], bl
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 9
jae 0x1001105c
mov cl, byte [ebp - 0x14]
jmp 0x1001104d
lea eax, [ebp - 0x13]
mov byte [ebp - 0xa], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x23]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x116e058
mov edi, eax
call fcn.1000d24b
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x100110b5
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push esi
call edi
test eax, eax
js 0x10011008
cmp dword [ebp - 8], ebx
ja 0x10011008
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c3d4
leave
ret

Function at 0x100110c4
Capabilities:
Resume thread

Disassembly:
push 0xc
push 0x1004fd58
call fcn.1003d320
mov esi, dword [0x10057954]
test esi, esi
jne 0x100110df
or eax, 0xffffffff
jmp 0x1001113c
and dword [ebp - 4], 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x100110ff
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x1001113c
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x10011116
mov dword [ebp - 4], 0xfffffffe
push 2
pop eax
jmp 0x1001113c
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
test eax, eax
jns 0x10011133
mov dword [ebp - 4], 0xfffffffe
push 3
jmp 0x10011113
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001137e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0x425f4a2d
xor ebx, ebx
mov word [ebp - 8], 0x5d58
push edi
mov dl, 0x2d
mov byte [ebp - 6], bl
mov edi, dword [esi]
mov eax, ebx
xor byte [ebp + eax - 0xb], dl
inc eax
cmp eax, 5
jae 0x100113b0
mov dl, byte [ebp - 0xc]
jmp 0x100113a1
sub esp, 0x18
mov byte [ebp - 6], bl
lea eax, [ebp - 0xb]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, eax
mov dword [ebp - 0x1c], 0x617b6d0f
add esp, 0x18
mov dword [ebp - 0x18], 0x6e636c50
mov cl, 0xf
mov dword [ebp - 0x14], 0x6e6d5061
mov word [ebp - 0x10], 0x6461
mov eax, ebx
mov byte [ebp - 0xe], bl
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xd
jae 0x100113fe
mov cl, byte [ebp - 0x1c]
jmp 0x100113ef
sub esp, 0x18
mov byte [ebp - 0xe], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
add esp, 0x18
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10011a46
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x5e4c4f2d
push edi
mov cl, 0x2d
mov dword [ebp - 0xc], 0x424e7248
mov word [ebp - 8], 0x5e
xor eax, eax
mov edi, dword [esi]
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 8
jae 0x10011a79
mov cl, byte [ebp - 0x10]
jmp 0x10011a6a
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0xf]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
add esp, 0x18
mov dword [esi + 4], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10011aa9
and dword [esi + 4], 0
movaps xmm0, xmmword [0x1004ca40]
xor ecx, ecx
mov edi, dword [esi + 4]
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x10011ab9
sub esp, 0x18
mov byte [ebp - 5], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
add esp, 0x18
mov dword [esi + 8], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10011af6
and dword [esi + 8], 0
cmp dword [esi + 8], 0
je 0x10011b10
cmp dword [0x10057bf8], 0
mov ecx, 0x10b78ba
sete dl
call fcn.1000d19c
pop edi
pop esi
leave
ret
Function at 0x100121a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xc], ecx
push edi
mov dword [ebp - 4], eax
lea ebx, [ecx + 8]
mov dword [ebp - 8], 8
mov esi, dword [ecx]
sub esp, 0x18
mov edi, esp
mov dword [ebp - 0x58], 0x5e4c6f2d
mov cl, 0x2d
mov dword [ebp - 0x54], 0x4c7d7248
mov dword [ebp - 0x50], 0x854595f
push eax
mov word [ebp - 0x4c], 0x49
xor eax, eax
xor byte [ebp + eax - 0x57], cl
inc eax
cmp eax, 0xc
jae 0x100121f1
mov cl, byte [ebp - 0x58]
jmp 0x100121e2
sub esp, 0x18
mov byte [ebp - 0x4b], 0
lea eax, [ebp - 0x57]
mov ecx, esp
push eax
call fcn.10003d99
push edi
call fcn.100039e2
add esp, 0x20
mov ecx, esi
call fcn.1000c67f
add esp, 0x18
mov dword [ebp - 0x18], 0x6a7d6e0f
mov esi, eax
mov word [ebp - 0x14], 0x6e
mov cl, 0xf
xor eax, eax
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 4
jae 0x10012238
mov cl, byte [ebp - 0x18]
jmp 0x10012229
sub esp, 0x18
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, esi
call fcn.1000c67f
add esp, 0x18
mov dword [ebx - 4], eax
mov cl, 0x66
mov dword [ebp - 0x24], 0x16390d66
mov dword [ebp - 0x20], 0x1f121407
xor eax, eax
mov byte [ebp - 0x1c], 0
xor byte [ebp + eax - 0x23], cl
inc eax
cmp eax, 7
jae 0x1001227c
mov cl, byte [ebp - 0x24]
jmp 0x1001226d
sub esp, 0x18
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, esi
call fcn.1000c67f
add esp, 0x18
mov dword [ebx], eax
xor dl, dl
mov ecx, eax
call fcn.1000c8aa
mov cl, 0x3d
mov dword [ebp - 0x30], 0x4d62583d
mov dword [ebp - 0x2c], 0x44494f5c
xor eax, eax
mov byte [ebp - 0x28], 0
xor byte [ebp + eax - 0x2f], cl
inc eax
cmp eax, 7
jae 0x100122c8
mov cl, byte [ebp - 0x30]
jmp 0x100122b9
sub esp, 0x18
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x2f]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, esi
call fcn.1000c67f
add esp, 0x18
mov dword [ebx + 4], eax
xor dl, dl
mov ecx, eax
call fcn.1000c8aa
mov cl, 0x73
mov dword [ebp - 0x48], 0x2c141173
mov dword [ebp - 0x44], 0x1e011c1d
xor eax, eax
mov word [ebp - 0x40], 0x1f12
mov byte [ebp - 0x3e], 0
xor byte [ebp + eax - 0x47], cl
inc eax
cmp eax, 9
jae 0x1001231b
mov cl, byte [ebp - 0x48]
jmp 0x1001230c
sub esp, 0x18
mov byte [ebp - 0x3e], 0
lea eax, [ebp - 0x47]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, esi
call fcn.1000c67f
add esp, 0x18
mov dword [ebx + 8], eax
mov cl, 1
mov dword [ebp - 0x3c], 0x5e666301
mov dword [ebp - 0x38], 0x6d606c72
xor eax, eax
mov word [ebp - 0x34], 0x6d
xor byte [ebp + eax - 0x3b], cl
inc eax
cmp eax, 8
jae 0x10012361
mov cl, byte [ebp - 0x3c]
jmp 0x10012352
sub esp, 0x18
mov byte [ebp - 0x33], 0
lea eax, [ebp - 0x3b]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, esi
call fcn.1000c67f
mov ecx, dword [ebp - 0xc]
add esp, 0x18
mov dword [ebx + 0xc], eax
add ebx, 0x14
mov eax, dword [ebp - 4]
inc eax
sub dword [ebp - 8], 1
mov dword [ebp - 4], eax
jne 0x100121bb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100136b5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x1c], 0x5955592d
xor ebx, ebx
mov dword [ebp - 0x18], 0x59445972
push edi
mov dl, 0x2d
mov word [ebp - 0x14], 0x4841
mov edi, dword [esi]
mov eax, ebx
mov byte [ebp - 0x12], bl
xor byte [ebp + eax - 0x1b], dl
inc eax
cmp eax, 9
jae 0x100136ee
mov dl, byte [ebp - 0x1c]
jmp 0x100136df
sub esp, 0x18
mov byte [ebp - 0x12], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, dword [esi]
add esp, 0x18
mov dword [esi + 4], eax
mov cl, 0xf
mov dword [ebp - 0x1c], 0x607d680f
mov eax, ebx
mov dword [ebp - 0x18], 0x6d507f7a
mov dword [ebp - 0x14], 0x6a7c6e
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xa
jae 0x10013736
mov cl, byte [ebp - 0x1c]
jmp 0x10013727
sub esp, 0x18
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, ebx
mov dword [esi + 8], eax
add esp, 0x18
mov dword [ebp - 4], 0xa
lea ebx, [esi + 0x38]
mov eax, dword [esi]
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov cl, 0x66
mov dword [ebp - 8], esp
xor eax, eax
mov dword [ebp - 0x1c], 0x9140166
push edi
mov dword [ebp - 0x18], 0x43391613
mov word [ebp - 0x14], 2
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 8
jae 0x10013793
mov cl, byte [ebp - 0x1c]
jmp 0x10013784
sub esp, 0x18
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10003d99
push dword [ebp - 8]
call fcn.100039e2
mov ecx, dword [ebp - 0xc]
add esp, 0x20
call fcn.1000c67f
mov dword [ebp - 8], eax
mov cl, 0x3d
mov dword [ebx - 0x28], eax
xor eax, eax
mov dword [ebp - 0xc], esp
push edi
mov dword [ebp - 0x28], 0x4945493d
mov dword [ebp - 0x24], 0x5a4e5062
mov dword [ebp - 0x20], 0x591862
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xa
jae 0x100137ea
mov cl, byte [ebp - 0x28]
jmp 0x100137db
sub esp, 0x18
mov byte [ebp - 0x1d], 0
lea eax, [ebp - 0x27]
mov ecx, esp
push eax
call fcn.10003d99
push dword [ebp - 0xc]
call fcn.100039e2
mov ecx, dword [ebp - 8]
add esp, 0x20
call fcn.1000c67f
add esp, 0x18
mov dword [ebx], eax
inc edi
add ebx, 4
sub dword [ebp - 4], 1
jne 0x10013760
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10014d0a
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x1003ee2b
call fcn.1003d7b1
mov esi, ecx
mov edx, dword [0x10057be8]
test edx, edx
js 0x10014e10
cmp edx, 0x17
jg 0x10014e10
mov ecx, dword [esi + 0x14]
call fcn.1000d02f
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, ebx
mov eax, dword [0x10057be8]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
push eax
cmp eax, 0xa
jge 0x10014d88
movaps xmm0, xmmword [str.g_FJB_asNJB_a]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x171d434b
mov word [ebp - 0x30], 0x17
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x14
jb 0x10014d76
mov byte [ebp - 0x2f], bl
jmp 0x10014dad
movaps xmm0, xmmword [0x1004d830]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x24242e70
mov byte [ebp - 0x30], bl
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x13
jb 0x10014d9d
mov byte [ebp - 0x30], bl
sub esp, 0x18
lea eax, [ebp - 0x43]
mov ecx, esp
push eax
call fcn.10003d99
lea eax, [ebp - 0x60]
push eax
call fcn.100039e2
add esp, 0x20
lea ecx, [ebp - 0x2c]
push eax
call fcn.10008b15
lea ecx, [ebp - 0x60]
call fcn.10003b97
mov ecx, dword [esi + 0x1c]
lea edx, [ebp - 0x2c]
call fcn.1000d114
mov eax, dword [0x10057be8]
test eax, eax
jle 0x10014df3
push ecx
push eax
call fcn.10014cc1
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, edi
jbe 0x10014e07
mov ecx, dword [ebp - 0x2c]
inc edx
call fcn.10003b6a
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x2c], bl
mov edx, dword [0x10057bf4]
cmp edx, 0x14
ja 0x10014e51
mov ecx, dword [esi + 0x18]
call fcn.1000d02f
mov edx, dword [0x10057bf4]
mov ecx, dword [esi + 0x20]
call fcn.1000d137
movd xmm0, dword [0x10057bf4]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x1004c744]
movss dword [0x100540dc], xmm0
call fcn.10013ed0
call fcn.1003d76f
ret
Function at 0x10014f01
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [0x1004d2d0]
push ebx
push esi
mov esi, ecx
mov word [ebp - 8], 0x485f
xor ebx, ebx
push edi
movups xmmword [ebp - 0x18], xmm0
mov edi, dword [esi]
mov edx, ebx
mov byte [ebp - 6], bl
mov al, byte [ebp - 0x18]
xor byte [ebp + edx - 0x17], al
inc edx
cmp edx, 0x11
jb 0x10014f26
sub esp, 0x18
mov byte [ebp - 6], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, eax
mov dword [ebp - 0x14], 0x7d7b7c0f
add esp, 0x18
mov dword [esi + 4], edi
mov cl, 0xf
mov dword [ebp - 0x10], 0x69616650
mov dword [ebp - 0xc], 0x3e5060
mov eax, ebx
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x10014f7b
mov cl, byte [ebp - 0x14]
jmp 0x10014f6c
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, dword [esi + 4]
add esp, 0x18
mov dword [esi + 8], eax
mov cl, 0x66
mov dword [ebp - 0x14], 0x14121566
mov eax, ebx
mov dword [ebp - 0x10], 0x80f39
mov dword [ebp - 0xc], 0x543909
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x10014fc4
mov cl, byte [ebp - 0x14]
jmp 0x10014fb5
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, dword [esi + 4]
add esp, 0x18
mov dword [esi + 0xc], eax
mov cl, 0x3d
mov dword [ebp - 0x14], 0x4f494e3d
mov eax, ebx
mov dword [ebp - 0x10], 0x5b535462
mov dword [ebp - 0xc], 0xe6252
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x1001500d
mov cl, byte [ebp - 0x14]
jmp 0x10014ffe
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, dword [esi + 4]
xor ebx, ebx
inc ebx
mov dword [esi + 0x10], eax
add esp, 0x18
mov dword [ebp - 0x14], 0x141e1a73
mov cl, 0x73
mov dword [ebp - 0x10], 0x1207002c
mov byte [ebp - 0xc], bl
xor eax, eax
mov dword [ebp - 0xb], 0x141d1a07
mov byte [ebp - 7], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x10015060
mov cl, byte [ebp - 0x14]
jmp 0x10015051
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, dword [esi + 4]
add esp, 0x18
mov dword [esi + 0x18], eax
xor eax, eax
mov byte [ebp - 0x14], bl
mov dword [ebp - 0x13], 0x5e666c68
mov dword [ebp - 0xf], 0x75727863
mov dword [ebp - 0xb], 0x656f60
xor byte [ebp + eax - 0x13], bl
inc eax
cmp eax, 0xb
jae 0x100150ab
mov bl, byte [ebp - 0x14]
jmp 0x1001509c
sub esp, 0x18
mov byte [ebp - 8], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
add esp, 0x18
mov dword [esi + 0x1c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10015694
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x1003eef7
call fcn.1003d77e
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x100157bf
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esi + 0x20], 1
mov word [esi + 0x28], ax
call fcn.10015a44
movaps xmm0, xmmword [0x1004d650]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x60600b70
mov dword [ebp - 0x2c], 0xd60606a
mov byte [ebp - 0x28], bl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x17
jb 0x100156e4
lea eax, [ebp - 0x3f]
mov byte [ebp - 0x28], bl
push eax
lea ecx, [ebp - 0x24]
call fcn.10003d99
mov byte [ebp - 4], 1
lea edx, [ebp - 0x24]
mov ecx, dword [esi + 0xc]
call fcn.1000d114
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.10003b97
cmp dword [ebp + 0x1c], 0
jne 0x10015760
mov cl, 0x73
mov dword [ebp - 0x18], 0x161a2073
mov dword [ebp - 0x14], 0x30531614
mov eax, ebx
mov dword [ebp - 0x10], 0x1d121f
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xa
jae 0x10015748
mov cl, byte [ebp - 0x18]
jmp 0x10015739
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10003d99
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
jmp 0x100157af
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x1004cf00]
mov ecx, ebx
cmova eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 4
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x1001577f
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003d99
lea eax, [ebp - 0x40]
push eax
call fcn.100039e2
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.1000d114
lea ecx, [ebp - 0x40]
call fcn.10003b97
lea ecx, [ebp + 0xc]
call fcn.10003b97
call fcn.1003d75b
ret 0x1c