joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e18f
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x78
mov eax, 0x100781e8
call fcn.1004602b
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [0x1009e9ac], eax
test edi, edi
jne 0x1002e1b2
xor al, al
jmp 0x1002e39b
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1002e1cd
cmp edi, dword [esi + 4]
jne 0x1002e399
call fcn.1002e77b
jmp 0x1002e399
and eax, 0xf0000
cmp eax, 0x10000
je 0x1002e384
cmp eax, 0x40000
je 0x1002e1fd
cmp eax, 0x80000
jne 0x1002e399
mov ecx, dword [esi]
xor dl, dl
call fcn.1001034a
jmp 0x1002e399
mov ecx, dword [esi]
xor dl, dl
call fcn.1001034a
mov eax, dword [esi + 0x28]
xor ebx, ebx
sub eax, dword [esi + 0x24]
sar eax, 3
test eax, eax
je 0x1002e23e
mov eax, dword [esi + 0x24]
mov eax, dword [eax + ebx*8 + 4]
test eax, eax
je 0x1002e230
mov ecx, dword [eax]
test ecx, ecx
je 0x1002e230
mov edx, 0x110
call fcn.10010397
mov eax, dword [esi + 0x28]
inc ebx
sub eax, dword [esi + 0x24]
sar eax, 3
cmp ebx, eax
jb 0x1002e215
push edi
mov ecx, esi
call fcn.1002e459
mov edi, eax
test edi, edi
je 0x1002e399
mov ecx, dword [edi + 0x50]
test ecx, ecx
je 0x1002e399
cmp dword [edi + 0x54], 0
je 0x1002e399
mov ecx, dword [ecx]
call fcn.100087f9
mov ebx, eax
test ebx, ebx
je 0x1002e399
push edi
mov ecx, esi
call fcn.1002e48c
cmp dword [esi + 0x18], eax
jne 0x1002e399
mov eax, dword [edi + 0x54]
mov edx, 0x4000
mov eax, dword [eax]
add eax, dword [ebx]
mov dword [esi + 0x14], eax
mov ecx, dword [edi]
call fcn.10010397
call fcn.10018729
mov cl, 0x49
mov dword [ebp - 0x18], 0x2a310c49
mov dword [ebp - 0x14], 0x2e272821
xor eax, eax
mov word [ebp - 0x10], 0x2c
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 8
jae 0x1002e2c9
mov cl, byte [ebp - 0x18]
jmp 0x1002e2ba
lea eax, [ebp - 0x17]
mov byte [ebp - 0xf], 0
push eax
lea ecx, [ebp - 0x30]
call fcn.10001f6a
and dword [ebp - 4], 0
lea ecx, [ebp - 0x60]
push 0x64
push 4
push dword [edi + 0x54]
mov edx, ebx
lea esi, [ebp - 0x30]
call fcn.10008c17
pop ecx
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x1002e2fe
mov eax, dword [eax]
movaps xmm0, xmmword [0x1008efa0]
xor ebx, ebx
movups xmmword [ebp - 0x84], xmm0
mov ecx, ebx
mov byte [ebp - 0x64], bl
movaps xmm0, xmmword [0x1008e9a0]
push eax
movups xmmword [ebp - 0x74], xmm0
mov al, byte [ebp - 0x84]
xor byte [ebp + ecx - 0x83], al
inc ecx
cmp ecx, 0x1f
jb 0x1002e31f
sub esp, 0x18
mov byte [ebp - 0x64], bl
lea eax, [ebp - 0x83]
mov ecx, esp
push eax
call fcn.10001f6a
lea eax, [ebp - 0x48]
push eax
call fcn.10007414
add esp, 0x20
mov edx, esi
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.10018621
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.10001e1f
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.10001e1f
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.10001e1f
jmp 0x1002e399
push edi
call fcn.1002e459
test eax, eax
je 0x1002e399
push eax
mov ecx, esi
call fcn.1002e48c
mov dword [esi + 0x18], eax
mov al, 1
call fcn.10045ff4
ret 8
Function at 0x10031f21
Capabilities:
Encode data using xor

Disassembly:
push 0x7c
mov eax, 0x100783bb
call fcn.1004605f
mov esi, ecx
mov eax, dword [esi + 0xa4]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0xa8]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0xac]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0xb0]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0xb4]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xb8]
mov dword [ebp - 0x64], eax
mov eax, dword [esi + 0xbc]
mov dword [ebp - 0x60], eax
mov eax, dword [esi + 0xc0]
mov dword [ebp - 0x5c], eax
mov eax, dword [esi + 0xc4]
mov dword [ebp - 0x58], eax
mov eax, dword [esi + 0xc8]
mov dword [ebp - 0x54], eax
mov eax, dword [esi + 0xcc]
mov dword [ebp - 0x50], eax
mov eax, dword [esi + 0xd0]
mov dword [ebp - 0x4c], eax
mov eax, dword [esi + 0xd4]
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 0xd8]
mov dword [ebp - 0x44], eax
mov eax, dword [esi + 0xdc]
mov dword [ebp - 0x40], eax
mov eax, dword [esi + 0xe0]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0xe4]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0xe8]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0xec]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0xf0]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.10032540
movzx eax, word [esi + 0xfa]
xor ebx, ebx
movaps xmm0, xmmword [0x1008e620]
mov ecx, ebx
push eax
movzx eax, word [esi + 0xf8]
push eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0xc4d47
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x12
jb 0x1003201e
sub esp, 0x18
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.10001f6a
lea eax, [ebp - 0x3c]
push eax
call fcn.10007414
add esp, 0x24
mov dword [ebp - 4], ebx
mov edx, eax
mov ecx, dword [esi + 0x50]
call fcn.10010c45
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
push ebx
push 1
call fcn.10001e1f
mov al, 0x2f
mov byte [ebp - 0x68], 2
xor al, 2
mov byte [ebp - 0x66], bl
mov byte [ebp - 0x67], al
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0x67]
push eax
call fcn.10001f6a
mov dword [ebp - 4], 1
lea edx, [ebp - 0x3c]
mov ecx, dword [esi + 0x54]
call fcn.10010c45
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
push ebx
push 1
call fcn.10001e1f
movsd xmm0, qword [0x1008e188]
mov eax, ebx
push ecx
push ecx
movsd qword [esp], xmm0
mov cl, 0x51
mov dword [ebp - 0x70], 0x637f7451
mov dword [ebp - 0x6c], 0x747437
xor byte [ebp + eax - 0x6f], cl
inc eax
cmp eax, 6
jae 0x100320cf
mov cl, byte [ebp - 0x70]
jmp 0x100320c0
sub esp, 0x18
mov byte [ebp - 0x69], bl
lea eax, [ebp - 0x6f]
mov ecx, esp
push eax
call fcn.10001f6a
lea eax, [ebp - 0x88]
push eax
call fcn.10007414
add esp, 0x24
mov dword [ebp - 4], 2
mov edx, eax
mov ecx, dword [esi + 0x58]
call fcn.10010c45
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
push ebx
push 1
call fcn.10001e1f
mov ecx, esi
mov byte [esi + 0xa0], 1
call fcn.10031ab3
mov ecx, dword [esi]
mov dl, 1
call fcn.10010276
call fcn.10046009
ret
Function at 0x100323ad
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x1007844e
call fcn.1004602b
mov esi, ecx
movzx eax, word [esi + 0xfa]
xor ebx, ebx
movaps xmm0, xmmword [0x1008f000]
mov ecx, ebx
push eax
movzx eax, word [esi + 0xf8]
push eax
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x51101a
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x12
jb 0x100323e1
sub esp, 0x18
mov byte [ebp - 0x21], bl
lea eax, [ebp - 0x33]
mov ecx, esp
push eax
call fcn.10001f6a
lea eax, [ebp - 0x50]
push eax
call fcn.10007414
add esp, 0x24
mov dword [ebp - 4], ebx
mov edx, eax
mov ecx, dword [esi + 0x50]
call fcn.10010c45
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
xor edi, edi
push ebx
inc edi
push edi
call fcn.10001e1f
movzx eax, word [esi + 0xfc]
test ax, ax
jne 0x10032463
mov cl, 0x1d
mov byte [ebp - 0xe], bl
mov al, 0x30
mov byte [ebp - 0x10], cl
xor al, cl
lea ecx, [ebp - 0x38]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0xf]
push eax
call fcn.10001f6a
mov dword [ebp - 4], edi
lea edx, [ebp - 0x38]
mov ecx, dword [esi + 0x54]
call fcn.10010c45
lea ecx, [ebp - 0x38]
jmp 0x100324b2
push eax
mov cl, 0x3c
mov dword [ebp - 0x18], 0x58191f3c
mov byte [ebp - 0x14], bl
mov eax, ebx
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 3
jae 0x10032481
mov cl, byte [ebp - 0x18]
jmp 0x10032472
sub esp, 0x18
mov byte [ebp - 0x14], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10001f6a
lea eax, [ebp - 0x50]
push eax
call fcn.10007414
add esp, 0x20
mov dword [ebp - 4], 2
mov edx, eax
mov ecx, dword [esi + 0x54]
call fcn.10010c45
lea ecx, [ebp - 0x50]
or dword [ebp - 4], 0xffffffff
push ebx
push edi
call fcn.10001e1f
movzx eax, word [esi + 0xf8]
movss xmm1, dword [0x1008e1a8]
push ecx
push ecx
movd xmm0, eax
mov cl, 0x70
cvtdq2ps xmm0, xmm0
mov dword [ebp - 0x20], 0x425e5570
mov eax, ebx
mov dword [ebp - 0x1c], 0x555516
divss xmm1, xmm0
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 6
jae 0x10032502
mov cl, byte [ebp - 0x20]
jmp 0x100324f3
sub esp, 0x18
mov byte [ebp - 0x19], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10001f6a
lea eax, [ebp - 0x68]
push eax
call fcn.10007414
add esp, 0x24
mov dword [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x58]
call fcn.10010c45
push ebx
push edi
lea ecx, [ebp - 0x68]
call fcn.10001e1f
call fcn.10045ff4
ret
Function at 0x10032a77
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x60
mov eax, 0x100784de
call fcn.1004605f
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.1000678f
movzx eax, al
xor ebx, ebx
sub eax, ebx
je 0x10032b4b
sub eax, 1
jne 0x10032c02
mov cl, 0x4a
mov dword [ebp - 0x38], 0x3e25064a
mov dword [ebp - 0x34], 0x33382f3e
mov eax, ebx
mov dword [ebp - 0x30], 0x242f3c0f
mov word [ebp - 0x2c], 0x3e
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xc
jae 0x10032ad1
mov cl, byte [ebp - 0x38]
jmp 0x10032ac2
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], bl
push eax
lea ecx, [ebp - 0x6c]
call fcn.10001f6a
mov dword [ebp - 4], 3
mov ecx, ebx
movaps xmm0, xmmword [0x1008e9e0]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], 0x4a130606
mov dword [ebp - 0x40], 0x4030500
mov dword [ebp - 0x3c], 0x440e0f
mov al, byte [ebp - 0x54]
xor byte [ebp + ecx - 0x53], al
inc ecx
cmp ecx, 0x1a
jb 0x10032b09
lea eax, [ebp - 0x53]
mov byte [ebp - 0x39], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.10001f6a
push ebx
push ebx
lea edx, [ebp - 0x6c]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.10018621
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10001e1f
lea ecx, [ebp - 0x6c]
jmp 0x10032bfa
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.100066dc
cmp dword [ebp - 0x18], 0
je 0x10032bf7
cmp dword [ebp - 0x18], 0xff
ja 0x10032bf7
mov cl, 0x34
mov dword [ebp - 0x38], 0x405b7834
mov dword [ebp - 0x34], 0x4d465140
mov eax, ebx
mov dword [ebp - 0x30], 0x5a514271
mov word [ebp - 0x2c], 0x40
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xc
jae 0x10032ba7
mov cl, byte [ebp - 0x38]
jmp 0x10032b98
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], bl
push eax
lea ecx, [ebp - 0x50]
call fcn.10001f6a
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x6c]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10001f6a
push ebx
push ebx
lea edx, [ebp - 0x50]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6c]
call fcn.10018621
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.10001e1f
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.10001e1f
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.10001e1f
call fcn.10046009
ret 4
Function at 0x10032ee1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
xor ebx, ebx
mov dword [esp + 8], 0x4161577
mov esi, ecx
mov dword [esp + 0xc], 0x2052812
push edi
mov cl, 0x77
mov word [esp + 0x14], 0x1619
mov byte [esp + 0x16], bl
mov eax, ebx
xor byte [esp + eax + 0xd], cl
inc eax
cmp eax, 9
jae 0x10032f20
mov cl, byte [esp + 0xc]
jmp 0x10032f10
lea eax, [esp + 0xd]
mov byte [esp + 0x16], bl
push eax
lea ecx, [esp + 0x24]
call fcn.10001f6a
mov ecx, dword [esi]
lea edx, [esp + 0x20]
call fcn.10010042
xor edi, edi
mov dword [esi + 4], eax
push ebx
inc edi
lea ecx, [esp + 0x24]
push edi
call fcn.10001e1f
movaps xmm0, xmmword [0x1008ecc0]
mov ecx, ebx
movups xmmword [esp + 0xc], xmm0
mov word [esp + 0x1c], 0x5b
mov al, byte [esp + 0xc]
xor byte [esp + ecx + 0xd], al
inc ecx
cmp ecx, 0x10
jb 0x10032f63
lea eax, [esp + 0xd]
mov byte [esp + 0x1d], bl
push eax
lea ecx, [esp + 0x24]
call fcn.10001f6a
mov ecx, dword [esi + 4]
lea edx, [esp + 0x20]
call fcn.10010042
push ebx
push edi
lea ecx, [esp + 0x28]
mov dword [esi + 8], eax
call fcn.10001e1f
movaps xmm0, xmmword [0x1008ecc0]
mov ecx, ebx
movups xmmword [esp + 0xc], xmm0
mov word [esp + 0x1c], 0x58
mov al, byte [esp + 0xc]
xor byte [esp + ecx + 0xd], al
inc ecx
cmp ecx, 0x10
jb 0x10032fb2
lea eax, [esp + 0xd]
mov byte [esp + 0x1d], bl
push eax
lea ecx, [esp + 0x24]
call fcn.10001f6a
mov ecx, dword [esi + 4]
lea edx, [esp + 0x20]
call fcn.10010042
push ebx
push edi
lea ecx, [esp + 0x28]
mov dword [esi + 0xc], eax
call fcn.10001e1f
mov cl, 0x36
mov dword [esp + 0xc], 0x45575436
mov dword [esp + 0x10], 0x5f426953
mov eax, ebx
mov word [esp + 0x14], 0x535b
mov byte [esp + 0x16], bl
xor byte [esp + eax + 0xd], cl
inc eax
cmp eax, 9
jae 0x1003301b
mov cl, byte [esp + 0xc]
jmp 0x1003300b
lea eax, [esp + 0xd]
mov byte [esp + 0x16], bl
push eax
lea ecx, [esp + 0x24]
call fcn.10001f6a
mov ecx, dword [esi + 4]
lea edx, [esp + 0x20]
call fcn.10010042
push ebx
push edi
lea ecx, [esp + 0x28]
mov dword [esi + 0x10], eax
call fcn.10001e1f
mov cl, 0x6d
mov dword [esp + 0xc], 0x1f191e6d
mov dword [esp + 0x10], 0x41932
mov eax, ebx
mov word [esp + 0x14], 8
xor byte [esp + eax + 0xd], cl
inc eax
cmp eax, 8
jae 0x10033072
mov cl, byte [esp + 0xc]
jmp 0x10033062
lea eax, [esp + 0xd]
mov byte [esp + 0x15], bl
push eax
lea ecx, [esp + 0x24]
call fcn.10001f6a
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0x20]
call fcn.10010042
push ebx
push edi
lea ecx, [esp + 0x28]
mov dword [esi + 0x14], eax
call fcn.10001e1f
mov ecx, dword [esi + 0x10]
xor dl, dl
call fcn.10010276
mov ecx, dword [esi]
push 0x14
pop edx
call fcn.10010397
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100361ae
Capabilities:
Encode data using xor

Disassembly:
push 0x40
mov eax, 0x10078726
call fcn.1004602b
mov esi, ecx
cmp byte [ebp + 8], 0
mov eax, dword [esi]
mov dword [0x1009ea74], eax
jne 0x1003625c
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1003625c
call fcn.100107fc
test al, al
je 0x1003625c
push 0x10088750
lea ecx, [ebp - 0x34]
call fcn.10001f6a
xor ebx, ebx
lea edx, [ebp - 0x34]
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0x10]
call fcn.100106e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
xor edi, edi
push ebx
inc edi
push edi
call fcn.10001e1f
movaps xmm0, xmmword [0x1008e3f0]
mov ecx, ebx
movups xmmword [ebp - 0x1c], xmm0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0xe
jb 0x1003621c
lea eax, [ebp - 0x1b]
mov byte [ebp - 0xd], bl
push eax
lea ecx, [ebp - 0x4c]
call fcn.10001f6a
mov dword [ebp - 4], edi
lea edx, [ebp - 0x4c]
mov ecx, dword [esi + 0x10]
call fcn.10010bb4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
push ebx
push edi
call fcn.10001e1f
mov ecx, dword [esi + 0x10]
call fcn.100107dd
call fcn.10045ff4
ret 0xc

Function at 0x10036b54
Capabilities:
Encode data using xor

Disassembly:
push 0x44
mov eax, 0x100787e9
call fcn.1004602b
mov esi, ecx
mov ecx, dword [esi]
xor dl, dl
call fcn.10010276
mov ecx, dword [esi + 0x10]
xor edi, edi
inc edi
test ecx, ecx
je 0x10036bfa
call fcn.100107fc
test al, al
je 0x10036bfa
push 0x10088750
lea ecx, [ebp - 0x38]
call fcn.10001f6a
xor ebx, ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0x10]
call fcn.100106e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
push ebx
push edi
call fcn.10001e1f
movaps xmm0, xmmword [0x1008e450]
mov ecx, ebx
movups xmmword [ebp - 0x20], xmm0
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0xe
jb 0x10036bba
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x50]
call fcn.10001f6a
mov dword [ebp - 4], edi
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0x10]
call fcn.10010bb4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
push ebx
push edi
call fcn.10001e1f
mov ecx, dword [esi + 0x10]
call fcn.100107dd
push edi
push dword [esi + 8]
mov ecx, esi
call fcn.1003639f
call fcn.10045ff4
ret
Function at 0x1003a1a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x44
mov eax, 0x100787e9
call fcn.1004602b
mov esi, ecx
mov ecx, dword [esi]
xor dl, dl
call fcn.10010276
lea eax, [ebp - 0xf]
mov word [ebp - 0x10], 0x68
xor ebx, ebx
lea ecx, [ebp - 0x38]
push eax
mov byte [ebp - 0xf], bl
call fcn.10001f6a
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x38]
mov ecx, dword [esi + 0x88]
call fcn.100106e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
xor edi, edi
push ebx
inc edi
push edi
call fcn.10001e1f
mov cl, 2
mov dword [ebp - 0x20], 0x63675102
mov dword [ebp - 0x1c], 0x226a6170
mov eax, ebx
mov dword [ebp - 0x18], 0x6f67764b
mov byte [ebp - 0x14], bl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xb
jae 0x1003a222
mov cl, byte [ebp - 0x20]
jmp 0x1003a213
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x14], bl
push eax
lea ecx, [ebp - 0x50]
call fcn.10001f6a
mov dword [ebp - 4], edi
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0x88]
call fcn.10010bb4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
push ebx
push edi
call fcn.10001e1f
mov ecx, dword [esi + 0x88]
call fcn.100107dd
call fcn.10018729
mov ecx, esi
call fcn.1003ad57
mov ecx, esi
call fcn.1003aed2
mov ecx, esi
call fcn.1003b5c5
mov ecx, esi
call fcn.1003bd04
call fcn.1003bdf7
call fcn.10045ff4
ret
Function at 0x1003adc9
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x10078b39
call fcn.1004605f
mov esi, ecx
movaps xmm0, xmmword [0x1008e830]
xor ebx, ebx
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x48], 0x81f0e1b
mov ecx, ebx
mov word [ebp - 0x44], 0x54
mov al, byte [ebp - 0x58]
xor byte [ebp + ecx - 0x57], al
inc ecx
cmp ecx, 0x14
jb 0x1003adf3
lea eax, [ebp - 0x57]
mov byte [ebp - 0x43], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10001f6a
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [str.4d_CQF]
movups xmmword [ebp - 0x68], xmm0
mov al, byte [ebp - 0x68]
xor byte [ebp + ecx - 0x67], al
inc ecx
cmp ecx, 0xe
jb 0x1003ae1f
lea eax, [ebp - 0x67]
mov byte [ebp - 0x59], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.10001f6a
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, eax
call fcn.10075640
movss xmm1, dword [esi + 0x1b8]
cvtsd2ss xmm0, xmm0
subss xmm1, xmm0
divss xmm1, dword [0x1008e1b0]
comiss xmm1, dword [0x1008e164]
jbe 0x1003ae7e
push ebx
push ebx
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.10018621
pop ecx
pop ecx
jmp 0x1003aeb6
mov ecx, dword [esi + 0x18]
call fcn.100103ba
test al, al
jne 0x1003aeb6
mov ecx, esi
call fcn.1003aed2
mov ecx, esi
call fcn.1003b5c5
mov ecx, dword [esi + 0x18]
mov dl, 1
call fcn.10010276
mov ecx, dword [esi + 0x24]
call fcn.100107fc
test al, al
jne 0x1003aeb6
mov ecx, dword [esi + 0x24]
call fcn.100107be
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10001e1f
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10001e1f
call fcn.10046009
ret
Function at 0x1003b61f
Capabilities:
Encode data using xor

Disassembly:
push 0xa0
mov eax, 0x10078c67
call fcn.1004602b
mov esi, ecx
call fcn.1003b8ef
xor ebx, ebx
cmp al, 6
jne 0x1003b6cf
movaps xmm0, xmmword [str.Y_t6._t_f_y_n_6_]
mov ecx, ebx
movups xmmword [ebp - 0x48], xmm0
mov al, byte [ebp - 0x48]
xor byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0xe
jb 0x1003b64c
lea eax, [ebp - 0x47]
mov byte [ebp - 0x39], bl
push eax
lea ecx, [ebp - 0x7c]
call fcn.10001f6a
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [0x1008ec60]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x70272a2e
mov word [ebp - 0x10], 0x7f
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x14
jb 0x1003b685
lea eax, [ebp - 0x23]
mov byte [ebp - 0xf], bl
push eax
lea ecx, [ebp - 0x64]
call fcn.10001f6a
push ebx
push ebx
lea edx, [ebp - 0x7c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.10018621
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.10001e1f
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.10001e1f
jmp 0x1003b795
push 6
mov edi, ebx
lea eax, [esi + 0x110]
pop ecx
cmp dword [eax - 4], ebx
jbe 0x1003b6e6
cmp dword [eax], ebx
jbe 0x1003b6e6
add edi, dword [eax + 4]
add eax, 0x18
sub ecx, 1
jne 0x1003b6da
mov ecx, esi
call fcn.1003ad57
mov ecx, esi
call fcn.1003aed2
push 0x2e
mov edx, edi
lea ecx, [ebp - 0xac]
call fcn.1000d6e8
pop ecx
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x1003b71b
mov eax, dword [eax]
movaps xmm0, xmmword [0x1008eca0]
mov ecx, ebx
push eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x7d2b2e
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x12
jb 0x1003b730
sub esp, 0x18
mov byte [ebp - 0x25], bl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10001f6a
lea eax, [ebp - 0x94]
push eax
call fcn.10007414
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x7c]
call fcn.10010c45
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.10001e1f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
push ebx
push 1
call fcn.10001e1f
mov ecx, dword [esi + 0x20]
mov dl, 1
call fcn.10010276
call fcn.10045ff4
ret
Function at 0x10040a09
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1009a078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
xor ecx, ecx
mov dword [ebp - 0xc], esi
push 5
pop eax
add eax, eax
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.10062f1f
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
mov edx, dword [ebp - 0xc]
sub ebx, edx
sub ebx, 5
mov ecx, dword [edx]
mov dword [edi], ecx
mov al, byte [edx + 4]
mov byte [edi + 4], al
add edi, 5
mov eax, edx
sub eax, edi
mov dword [edi + 1], eax
lea eax, [ebp - 8]
push eax
mov byte [edi], 0xe9
push dword [ebp - 8]
mov byte [edx], 0xe9
push 5
push edx
mov dword [edx + 1], ebx
call esi
mov ecx, dword [ebp - 4]
lea eax, [edi - 5]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100454d5
mov esp, ebp
pop ebp
ret

Function at 0x10042800
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100429d0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x100428dd
mov edx, dword [ebp - 4]
cmp edx, dword [0x1009a064]
jb 0x1004284a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1009a068]
ja 0x1004284a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004281a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1005ddd0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1004286f
jmp 0x100428dd
cmp dword [ebp - 0x14], 0x10000
jne 0x100428c3
cmp dword [ebp - 0x18], 0x10000
jb 0x100428c3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100428a6
mov eax, dword [ebp - 8]
jmp 0x100428df
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x100428b6
xor eax, eax
jmp 0x100428df
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100428d8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.100429d0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004281a
xor eax, eax
mov esp, ebp
pop ebp
ret