joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100318a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x60
mov eax, 0x10048b68
call fcn.10044ac9
mov edi, dword [ebp + 8]
mov ecx, edi
mov esi, dword [edi + 8]
push esi
call fcn.10003215
movzx eax, al
lea ecx, [esi + 1]
xor ebx, ebx
mov dword [edi + 8], ecx
sub eax, ebx
je 0x10031981
sub eax, 1
jne 0x10031a3f
mov cl, 0x1b
mov dword [ebp - 0x38], 0x6f74571b
mov dword [ebp - 0x34], 0x62697e6f
mov eax, ebx
mov dword [ebp - 0x30], 0x757e6d5e
mov word [ebp - 0x2c], 0x6f
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xc
jae 0x10031904
mov cl, byte [ebp - 0x38]
jmp 0x100318f5
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], bl
push eax
lea ecx, [ebp - 0x6c]
call fcn.100012e0
movaps xmm0, xmmword [0x10050a20]
mov ecx, ebx
mov dword [ebp - 4], 3
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], 0x247d6868
mov dword [ebp - 0x40], 0x6a6d6b6e
mov dword [ebp - 0x3c], 0x2a6061
mov al, byte [ebp - 0x54]
xor byte [ebp + ecx - 0x53], al
inc ecx
cmp ecx, 0x1a
jb 0x1003193c
lea eax, [ebp - 0x53]
mov byte [ebp - 0x39], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.100012e0
push ebx
push ebx
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1001685b
add esp, 0x10
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.10001cd4
lea ecx, [ebp - 0x6c]
jmp 0x10031a37
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.10003360
cmp dword [ebp - 0x18], 0
je 0x10031a34
cmp dword [ebp - 0x18], 0xff
ja 0x10031a34
mov cl, 0x12
mov dword [ebp - 0x38], 0x667d5e12
mov dword [ebp - 0x34], 0x6b607766
mov eax, ebx
mov dword [ebp - 0x30], 0x7c776457
mov word [ebp - 0x2c], 0x66
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xc
jae 0x100319e1
mov cl, byte [ebp - 0x38]
jmp 0x100319d2
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], bl
push eax
lea ecx, [ebp - 0x50]
call fcn.100012e0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.100012e0
push ebx
push ebx
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.1001685b
add esp, 0x10
lea ecx, [ebp - 0x6c]
push ebx
push 1
call fcn.10001cd4
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.10001cd4
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.10001cd4
call fcn.10044a84
ret 4
Function at 0x100323a0
Capabilities:
Encode data using xor

Disassembly:
push 0x7c
mov eax, 0x10048ba8
call fcn.10044ac9
mov esi, ecx
mov eax, dword [esi + 0xa4]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0xa8]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0xac]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0xb0]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0xb4]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xb8]
mov dword [ebp - 0x64], eax
mov eax, dword [esi + 0xbc]
mov dword [ebp - 0x60], eax
mov eax, dword [esi + 0xc0]
mov dword [ebp - 0x5c], eax
mov eax, dword [esi + 0xc4]
mov dword [ebp - 0x58], eax
mov eax, dword [esi + 0xc8]
mov dword [ebp - 0x54], eax
mov eax, dword [esi + 0xcc]
mov dword [ebp - 0x50], eax
mov eax, dword [esi + 0xd0]
mov dword [ebp - 0x4c], eax
mov eax, dword [esi + 0xd4]
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 0xd8]
mov dword [ebp - 0x44], eax
mov eax, dword [esi + 0xdc]
mov dword [ebp - 0x40], eax
mov eax, dword [esi + 0xe0]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0xe4]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0xe8]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0xec]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0xf0]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.100311bb
movzx eax, word [esi + 0xfa]
xor ebx, ebx
movaps xmm0, xmmword [0x10050a10]
mov ecx, ebx
push eax
movzx eax, word [esi + 0xf8]
push eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x3d7c76
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x12
jb 0x1003249d
sub esp, 0x18
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.100012e0
lea eax, [ebp - 0x3c]
push eax
call fcn.1001b71b
push eax
push dword [esi + 0x50]
mov dword [ebp - 4], ebx
call fcn.1000f1a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
add esp, 0x2c
push ebx
push 1
call fcn.10001cd4
mov cl, 0x15
mov byte [ebp - 0x66], bl
mov al, 0x38
mov byte [ebp - 0x68], cl
xor al, cl
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0x67], al
lea eax, [ebp - 0x67]
push eax
call fcn.100012e0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 1
push eax
push dword [esi + 0x54]
call fcn.1000f1a6
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.10001cd4
movsd xmm0, qword [0x1004dbd0]
mov eax, ebx
push ecx
push ecx
movsd qword [esp], xmm0
mov cl, 0x45
mov dword [ebp - 0x70], 0x776b6045
mov dword [ebp - 0x6c], 0x606023
xor byte [ebp + eax - 0x6f], cl
inc eax
cmp eax, 6
jae 0x10032551
mov cl, byte [ebp - 0x70]
jmp 0x10032542
sub esp, 0x18
mov byte [ebp - 0x69], bl
lea eax, [ebp - 0x6f]
mov ecx, esp
push eax
call fcn.100012e0
lea eax, [ebp - 0x88]
push eax
call fcn.1001b71b
push eax
push dword [esi + 0x58]
mov dword [ebp - 4], 2
call fcn.1000f1a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
add esp, 0x2c
push ebx
push 1
call fcn.10001cd4
mov ecx, esi
mov byte [esi + 0xa0], 1
call fcn.10031eca
push 1
push dword [esi]
call fcn.1000e8b6
pop ecx
pop ecx
call fcn.10044a84
ret
Function at 0x10032e61
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x10048c3b
call fcn.10044a95
mov esi, ecx
movzx eax, word [esi + 0xfa]
xor ebx, ebx
movaps xmm0, xmmword [0x100509f0]
mov ecx, ebx
push eax
movzx eax, word [esi + 0xf8]
push eax
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x125359
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x12
jb 0x10032e95
sub esp, 0x18
mov byte [ebp - 0x21], bl
lea eax, [ebp - 0x33]
mov ecx, esp
push eax
call fcn.100012e0
lea eax, [ebp - 0x50]
push eax
call fcn.1001b71b
push eax
push dword [esi + 0x50]
mov dword [ebp - 4], ebx
call fcn.1000f1a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
add esp, 0x2c
xor edi, edi
inc edi
push ebx
push edi
call fcn.10001cd4
movzx eax, word [esi + 0xfc]
test ax, ax
jne 0x10032f19
mov cl, 0x78
mov byte [ebp - 0xe], bl
mov al, 0x55
mov byte [ebp - 0x10], cl
xor al, cl
lea ecx, [ebp - 0x38]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0xf]
push eax
call fcn.100012e0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], edi
push eax
push dword [esi + 0x54]
call fcn.1000f1a6
pop ecx
pop ecx
lea ecx, [ebp - 0x38]
jmp 0x10032f67
push eax
mov cl, 0x3a
mov dword [ebp - 0x18], 0x5e1f193a
mov byte [ebp - 0x14], bl
mov eax, ebx
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 3
jae 0x10032f37
mov cl, byte [ebp - 0x18]
jmp 0x10032f28
sub esp, 0x18
mov byte [ebp - 0x14], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.100012e0
lea eax, [ebp - 0x50]
push eax
call fcn.1001b71b
push eax
push dword [esi + 0x54]
mov dword [ebp - 4], 2
call fcn.1000f1a6
add esp, 0x28
lea ecx, [ebp - 0x50]
or dword [ebp - 4], 0xffffffff
push ebx
push edi
call fcn.10001cd4
movzx eax, word [esi + 0xf8]
movss xmm1, dword [0x100509c0]
push ecx
push ecx
movd xmm0, eax
mov cl, 0x6d
cvtdq2ps xmm0, xmm0
mov dword [ebp - 0x20], 0x5f43486d
mov eax, ebx
mov dword [ebp - 0x1c], 0x48480b
divss xmm1, xmm0
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 6
jae 0x10032fb7
mov cl, byte [ebp - 0x20]
jmp 0x10032fa8
sub esp, 0x18
mov byte [ebp - 0x19], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.100012e0
lea eax, [ebp - 0x68]
push eax
call fcn.1001b71b
push eax
push dword [esi + 0x58]
mov dword [ebp - 4], 3
call fcn.1000f1a6
add esp, 0x2c
lea ecx, [ebp - 0x68]
push ebx
push edi
call fcn.10001cd4
call fcn.10044a6f
ret
Function at 0x100331f4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x50
mov eax, 0x10048c7e
call fcn.10044a95
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x28], 0x7f6d6e0c
mov cl, 0xc
mov dword [ebp - 0x24], 0x797e5369
mov word [ebp - 0x20], 0x6d62
mov eax, ebx
mov byte [ebp - 0x1e], bl
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 9
jae 0x1003322e
mov cl, byte [ebp - 0x28]
jmp 0x1003321f
lea eax, [ebp - 0x27]
mov byte [ebp - 0x1e], bl
push eax
lea ecx, [ebp - 0x44]
call fcn.100012e0
lea eax, [ebp - 0x44]
mov dword [ebp - 4], ebx
push eax
push dword [esi]
call fcn.1000e2fb
or dword [ebp - 4], 0xffffffff
xor edi, edi
pop ecx
pop ecx
push ebx
inc edi
mov dword [esi + 4], eax
push edi
lea ecx, [ebp - 0x44]
call fcn.10001cd4
movaps xmm0, xmmword [0x10050a40]
mov ecx, ebx
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 0x1c], 0x5c
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x10
jb 0x10033274
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x1b], bl
push eax
lea ecx, [ebp - 0x44]
call fcn.100012e0
lea eax, [ebp - 0x44]
mov dword [ebp - 4], edi
push eax
push dword [esi + 4]
call fcn.1000e2fb
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x44]
mov dword [esi + 8], eax
call fcn.10001cd4
movaps xmm0, xmmword [0x10050a30]
mov ecx, ebx
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 0x1c], 0x6e
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x10
jb 0x100332c5
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x1b], bl
push eax
lea ecx, [ebp - 0x44]
call fcn.100012e0
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 2
push eax
push dword [esi + 4]
call fcn.1000e2fb
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x44]
mov dword [esi + 0xc], eax
call fcn.10001cd4
mov cl, 0x4d
mov dword [ebp - 0x28], 0x3e2c2f4d
mov dword [ebp - 0x24], 0x24391228
mov eax, ebx
mov word [ebp - 0x20], 0x2820
mov byte [ebp - 0x1e], bl
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 9
jae 0x10033331
mov cl, byte [ebp - 0x28]
jmp 0x10033322
lea eax, [ebp - 0x27]
mov byte [ebp - 0x1e], bl
push eax
lea ecx, [ebp - 0x44]
call fcn.100012e0
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 3
push eax
push dword [esi + 4]
call fcn.1000e2fb
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x44]
mov dword [esi + 0x10], eax
call fcn.10001cd4
mov cl, 0x3b
mov dword [ebp - 0x18], 0x494f483b
mov dword [ebp - 0x14], 0x56524f64
mov eax, ebx
mov word [ebp - 0x10], 0x5e
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 8
jae 0x1003338d
mov cl, byte [ebp - 0x18]
jmp 0x1003337e
lea eax, [ebp - 0x17]
mov byte [ebp - 0xf], bl
push eax
lea ecx, [ebp - 0x5c]
call fcn.100012e0
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 4
push eax
push dword [esi + 0x10]
call fcn.1000e2fb
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x5c]
mov dword [esi + 0x14], eax
call fcn.10001cd4
push ebx
push dword [esi + 0x10]
call fcn.1000e8b6
push 0x14
push dword [esi]
call fcn.1000e85d
add esp, 0x10
call fcn.10044a6f
ret
Function at 0x100363f0
Capabilities:
Encode data using xor

Disassembly:
push 0x44
mov eax, 0x10049329
call fcn.10044a95
mov esi, ecx
xor ebx, ebx
push ebx
push dword [esi]
call fcn.1000e8b6
xor edi, edi
pop ecx
inc edi
pop ecx
cmp dword [esi + 0x10], ebx
je 0x100364ac
push dword [esi + 0x10]
call fcn.1000ea7c
pop ecx
test al, al
je 0x100364ac
lea eax, [ebp - 0xf]
mov word [ebp - 0x10], 0x77
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 0xf], bl
call fcn.100012e0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], ebx
push eax
push dword [esi + 0x10]
call fcn.1000ec14
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x38]
call fcn.10001cd4
movaps xmm0, xmmword [0x10050a90]
mov ecx, ebx
movups xmmword [ebp - 0x20], xmm0
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0xe
jb 0x10036468
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x50]
call fcn.100012e0
lea eax, [ebp - 0x50]
mov dword [ebp - 4], edi
push eax
push dword [esi + 0x10]
call fcn.1000f039
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x50]
call fcn.10001cd4
push dword [esi + 0x10]
call fcn.1000eaad
pop ecx
push edi
push dword [esi + 8]
mov ecx, esi
call fcn.10036f34
call fcn.10044a6f
ret
Function at 0x100372f5
Capabilities:
Encode data using xor

Disassembly:
push 0x40
mov eax, 0x100490bc
call fcn.10044a95
mov esi, ecx
cmp byte [ebp + 8], 0
mov eax, dword [esi]
mov dword [0x1005b5d0], eax
jne 0x100373b9
cmp dword [esi + 0x10], 0
je 0x100373b9
push dword [esi + 0x10]
call fcn.1000ea7c
pop ecx
test al, al
je 0x100373b9
lea eax, [ebp + 9]
mov word [ebp + 8], 0x3d
xor ebx, ebx
lea ecx, [ebp - 0x34]
push eax
mov byte [ebp + 9], bl
call fcn.100012e0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], ebx
push eax
push dword [esi + 0x10]
call fcn.1000ec14
or dword [ebp - 4], 0xffffffff
xor edi, edi
pop ecx
pop ecx
push ebx
inc edi
lea ecx, [ebp - 0x34]
push edi
call fcn.10001cd4
movaps xmm0, xmmword [str.euoi_Vty_Uzv]
mov ecx, ebx
movups xmmword [ebp - 0x1c], xmm0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0xe
jb 0x10037375
lea eax, [ebp - 0x1b]
mov byte [ebp - 0xd], bl
push eax
lea ecx, [ebp - 0x4c]
call fcn.100012e0
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], edi
push eax
push dword [esi + 0x10]
call fcn.1000f039
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x4c]
call fcn.10001cd4
push dword [esi + 0x10]
call fcn.1000eaad
pop ecx
call fcn.10044a6f
ret 0xc
Function at 0x10038f16
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x44
mov eax, 0x10049329
call fcn.10044a95
mov esi, ecx
xor ebx, ebx
push ebx
push dword [esi]
call fcn.1000e8b6
pop ecx
pop ecx
lea eax, [ebp - 0xf]
mov word [ebp - 0x10], 0x59
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 0xf], bl
call fcn.100012e0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], ebx
push eax
push dword [esi + 0x88]
call fcn.1000ec14
or dword [ebp - 4], 0xffffffff
xor edi, edi
pop ecx
pop ecx
push ebx
inc edi
lea ecx, [ebp - 0x38]
push edi
call fcn.10001cd4
mov cl, 0x15
mov dword [ebp - 0x20], 0x74704615
mov dword [ebp - 0x1c], 0x357d7667
mov eax, ebx
mov dword [ebp - 0x18], 0x7870615c
mov byte [ebp - 0x14], bl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xb
jae 0x10038f95
mov cl, byte [ebp - 0x20]
jmp 0x10038f86
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x14], bl
push eax
lea ecx, [ebp - 0x50]
call fcn.100012e0
lea eax, [ebp - 0x50]
mov dword [ebp - 4], edi
push eax
push dword [esi + 0x88]
call fcn.1000f039
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x50]
call fcn.10001cd4
push dword [esi + 0x88]
call fcn.1000eaad
push 0xffffffffffffffff
call fcn.10016833
pop ecx
pop ecx
mov ecx, esi
call fcn.1003c953
mov ecx, esi
call fcn.1003c9cb
mov ecx, esi
call fcn.1003cb78
mov ecx, esi
call fcn.1003c858
mov ecx, esi
call fcn.1003cbd7
call fcn.10044a6f
ret
Function at 0x1003ae1e
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x100495ad
call fcn.10044ac9
mov esi, ecx
movaps xmm0, xmmword [0x10050cc0]
xor ebx, ebx
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x48], 0x35223326
mov ecx, ebx
mov word [ebp - 0x44], 0x69
mov al, byte [ebp - 0x58]
xor byte [ebp + ecx - 0x57], al
inc ecx
cmp ecx, 0x14
jb 0x1003ae48
lea eax, [ebp - 0x57]
mov byte [ebp - 0x43], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.100012e0
movaps xmm0, xmmword [0x10050ba0]
mov ecx, ebx
mov dword [ebp - 4], ebx
movups xmmword [ebp - 0x68], xmm0
mov al, byte [ebp - 0x68]
xor byte [ebp + ecx - 0x67], al
inc ecx
cmp ecx, 0xe
jb 0x1003ae74
lea eax, [ebp - 0x67]
mov byte [ebp - 0x59], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.100012e0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, eax
call fcn.10044ee0
movss xmm1, dword [esi + 0x1ac]
cvtsd2ss xmm0, xmm0
subss xmm1, xmm0
divss xmm1, dword [0x1004a524]
comiss xmm1, dword [0x1004a5dc]
jbe 0x1003aed6
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.1001685b
add esp, 0x10
jmp 0x1003af13
push dword [esi + 0x18]
call fcn.1000e5a6
pop ecx
test al, al
jne 0x1003af13
mov ecx, esi
call fcn.1003c9cb
mov ecx, esi
call fcn.1003cb78
push 1
push dword [esi + 0x18]
call fcn.1000e8b6
push dword [esi + 0x24]
call fcn.1000ea7c
add esp, 0xc
test al, al
jne 0x1003af13
push dword [esi + 0x24]
call fcn.1000ebca
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10001cd4
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10001cd4
call fcn.10044a84
ret
Function at 0x1003b4bb
Capabilities:
Encode data using xor

Disassembly:
push 0xa0
mov eax, 0x10049698
call fcn.10044a95
mov esi, ecx
call fcn.10039003
xor ebx, ebx
cmp al, 6
jne 0x1003b56e
movaps xmm0, xmmword [str.5eZBPG]
mov ecx, ebx
movups xmmword [ebp - 0x48], xmm0
mov al, byte [ebp - 0x48]
xor byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0xe
jb 0x1003b4e8
lea eax, [ebp - 0x47]
mov byte [ebp - 0x39], bl
push eax
lea ecx, [ebp - 0x7c]
call fcn.100012e0
movaps xmm0, xmmword [0x10050dc0]
mov ecx, ebx
mov dword [ebp - 4], ebx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x2a7d7074
mov word [ebp - 0x10], 0x25
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x14
jb 0x1003b521
lea eax, [ebp - 0x23]
mov byte [ebp - 0xf], bl
push eax
lea ecx, [ebp - 0x64]
call fcn.100012e0
push ebx
push ebx
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.1001685b
add esp, 0x10
lea ecx, [ebp - 0x64]
push ebx
push 1
call fcn.10001cd4
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.10001cd4
jmp 0x1003b637
push 6
mov edi, ebx
lea eax, [esi + 0x104]
pop ecx
cmp dword [eax - 4], ebx
jbe 0x1003b585
cmp dword [eax], ebx
jbe 0x1003b585
add edi, dword [eax + 4]
add eax, 0x18
sub ecx, 1
jne 0x1003b579
mov ecx, esi
call fcn.1003c953
mov ecx, esi
call fcn.1003c9cb
push 0x2e
lea eax, [ebp - 0xac]
push edi
push eax
call fcn.1000b16c
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 2
jb 0x1003b5bc
mov eax, dword [eax]
movaps xmm0, xmmword [0x10050d30]
mov ecx, ebx
push eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x5653
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x12
jb 0x1003b5d1
sub esp, 0x18
mov byte [ebp - 0x25], bl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.100012e0
lea eax, [ebp - 0x94]
push eax
call fcn.1001b71b
push eax
push dword [esi + 0x7c]
mov byte [ebp - 4], 3
call fcn.1000f1a6
add esp, 0x28
lea ecx, [ebp - 0x94]
push ebx
push 1
call fcn.10001cd4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
push ebx
push 1
call fcn.10001cd4
push 1
push dword [esi + 0x20]
call fcn.1000e8b6
pop ecx
pop ecx
call fcn.10044a6f
ret
Function at 0x1003d51d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x44
mov eax, 0x10049329
call fcn.10044a95
mov esi, ecx
mov eax, dword [esi]
mov dword [0x1005b610], eax
push dword [esi]
call fcn.1000e5a6
pop ecx
test al, al
je 0x1003d61b
xor ebx, ebx
push ebx
push dword [esi]
call fcn.1000e8b6
pop ecx
pop ecx
lea eax, [ebp - 0xf]
mov word [ebp - 0x10], 0x4e
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 0xf], bl
call fcn.100012e0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], ebx
push eax
push dword [esi + 0x88]
call fcn.1000ec14
or dword [ebp - 4], 0xffffffff
xor edi, edi
pop ecx
pop ecx
push ebx
inc edi
lea ecx, [ebp - 0x38]
push edi
call fcn.10001cd4
mov cl, 0x3a
mov dword [ebp - 0x20], 0x5b5f693a
mov dword [ebp - 0x1c], 0x1a525948
mov eax, ebx
mov dword [ebp - 0x18], 0x575f4e73
mov byte [ebp - 0x14], bl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xb
jae 0x1003d5b3
mov cl, byte [ebp - 0x20]
jmp 0x1003d5a4
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x14], bl
push eax
lea ecx, [ebp - 0x50]
call fcn.100012e0
lea eax, [ebp - 0x50]
mov dword [ebp - 4], edi
push eax
push dword [esi + 0x88]
call fcn.1000f039
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x50]
call fcn.10001cd4
push dword [esi + 0x88]
call fcn.1000eaad
push 0xffffffffffffffff
call fcn.10016833
pop ecx
pop ecx
mov ecx, esi
call fcn.1003c953
mov ecx, esi
call fcn.1003c9cb
mov ecx, esi
call fcn.1003cb78
mov ecx, esi
call fcn.1003c858
mov ecx, esi
call fcn.1003cbd7
call fcn.10044a6f
ret 0xc
Function at 0x1003e150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x50
mov eax, 0x10048c7e
call fcn.10044a95
mov esi, ecx
push 0x6d
pop ebx
mov cl, 0xc
mov dword [ebp - 0x1c], 0x6568690c
mov word [ebp - 0x18], 0x5378
xor eax, eax
mov byte [ebp - 0x16], 0x78
mov byte [ebp - 0x15], bl
mov word [ebp - 0x14], 0x6b
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 8
jae 0x1003e18e
mov cl, byte [ebp - 0x1c]
jmp 0x1003e17f
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x13], 0
push eax
lea ecx, [ebp - 0x44]
call fcn.100012e0
and dword [ebp - 4], 0
lea eax, [ebp - 0x44]
push eax
push dword [esi]
call fcn.1000e2fb
or dword [ebp - 4], 0xffffffff
xor edi, edi
pop ecx
pop ecx
push 0
inc edi
mov dword [esi + 4], eax
push edi
lea ecx, [ebp - 0x44]
call fcn.10001cd4
mov byte [ebp - 0x1c], bl
xor eax, eax
mov dword [ebp - 0x1b], 0x3203190f
mov dword [ebp - 0x17], 0xb03020e
mov dword [ebp - 0x13], 0x1f04
xor byte [ebp + eax - 0x1b], bl
inc eax
cmp eax, 0xb
jae 0x1003e1ed
mov bl, byte [ebp - 0x1c]
jmp 0x1003e1de
lea eax, [ebp - 0x1b]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x10], bl
call fcn.100012e0
lea eax, [ebp - 0x44]
mov dword [ebp - 4], edi
push eax
push dword [esi]
call fcn.1000e2fb
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x44]
mov dword [esi + 8], eax
call fcn.10001cd4
mov cl, 0x5c
mov dword [ebp - 0x1c], 0x32283e5c
mov dword [ebp - 0x18], 0x30393803
mov eax, ebx
mov dword [ebp - 0x14], 0x392839
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xa
jae 0x1003e247
mov cl, byte [ebp - 0x1c]
jmp 0x1003e238
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x44]
call fcn.100012e0
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 2
push eax
push dword [esi]
call fcn.1000e2fb
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x44]
mov dword [esi + 0xc], eax
call fcn.10001cd4
mov cl, 0x4d
mov dword [ebp - 0x1c], 0x23392f4d
mov dword [ebp - 0x18], 0x232c2e12
mov eax, ebx
mov dword [ebp - 0x14], 0x21282e
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xa
jae 0x1003e2a3
mov cl, byte [ebp - 0x1c]
jmp 0x1003e294
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x44]
call fcn.100012e0
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 3
push eax
push dword [esi]
call fcn.1000e2fb
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x44]
mov dword [esi + 0x10], eax
call fcn.10001cd4
mov cl, 0x3b
mov dword [ebp - 0x2c], 0x5c56523b
mov dword [ebp - 0x28], 0x575a4b64
mov eax, ebx
mov dword [ebp - 0x24], 0x5e4f4f5e
mov byte [ebp - 0x20], bl
xor byte [ebp + eax - 0x2b], cl
inc eax
cmp eax, 0xb
jae 0x1003e302
mov cl, byte [ebp - 0x2c]
jmp 0x1003e2f3
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x20], bl
push eax
lea ecx, [ebp - 0x5c]
call fcn.100012e0
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 4
push eax
push dword [esi]
call fcn.1000e2fb
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x5c]
mov dword [esi + 0x14], eax
call fcn.10001cd4
call fcn.10044a6f
ret