joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e128
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x14], 0xb110765
sub esp, 0x18
mov dword [ebp - 0x10], 0xa09063a
lea ecx, [ebp - 0x14]
mov word [ebp - 0xc], 0x16
mov byte [ebp - 0xa], 0
mov esi, esp
mov edi, dword [ebx + 0x20]
call fcn.10001431
push eax
mov ecx, esi
call fcn.10002607
mov ecx, edi
call fcn.1000914c
mov esi, dword [ebx + 0x20]
add esp, 0x18
mov dword [ebx], eax
mov cl, 0x78
mov dword [ebp - 0x14], 0x160c1a78
xor eax, eax
mov dword [ebp - 0x10], 0x190c0b27
mov word [ebp - 0xc], 0xc0a
mov byte [ebp - 0xa], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 9
jae 0x1000e19d
mov cl, byte [ebp - 0x14]
jmp 0x1000e18e
sub esp, 0x18
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
mov edi, dword [ebx + 0x20]
lea ecx, [ebp - 0x14]
mov dword [ebx + 4], eax
mov esi, esp
mov dword [ebp - 0x14], 0x7d677113
mov dword [ebp - 0x10], 0x7c67604c
mov word [ebp - 0xc], 0x63
call fcn.100021bc
push eax
mov ecx, esi
call fcn.10002607
mov ecx, edi
call fcn.1000914c
movaps xmm0, xmmword [0x1003e6b0]
add esp, 0x18
mov esi, dword [ebx + 0x20]
xor ecx, ecx
mov dword [ebx + 8], eax
movups xmmword [ebp - 0x1c], xmm0
mov word [ebp - 0xc], 0x5c5e
mov byte [ebp - 0xa], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x11
jb 0x1000e209
sub esp, 0x18
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
mov edi, dword [ebx + 0x20]
lea ecx, [ebp - 0x18]
mov dword [ebx + 0xc], eax
mov esi, esp
mov dword [ebp - 0x18], 0x617b6d0f
mov dword [ebp - 0x14], 0x607b7c50
mov dword [ebp - 0x10], 0x6650646c
mov word [ebp - 0xc], 0x6161
mov byte [ebp - 0xa], 0
call fcn.100090dc
push eax
mov ecx, esi
call fcn.10002607
mov ecx, edi
call fcn.1000914c
mov esi, dword [ebx + 0x20]
add esp, 0x18
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebp - 0x13], 0x50617b6d
mov dword [ebp - 0xf], 0x63636a7c
push 0xf
pop ecx
mov byte [ebp - 0x14], cl
mov byte [ebp - 0xb], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 8
jae 0x1000e29f
mov cl, byte [ebp - 0x14]
jmp 0x1000e290
sub esp, 0x18
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
movaps xmm0, xmmword [0x1003e100]
add esp, 0x18
mov esi, dword [ebx + 0x20]
xor ecx, ecx
mov dword [ebx + 0x14], eax
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x9130812
mov byte [ebp - 8], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x1000e2d9
sub esp, 0x18
mov byte [ebp - 8], 0
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
add esp, 0x18
mov dword [ebx + 0x18], eax
mov ecx, eax
push 3
pop edx
call fcn.10009702
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000ee4d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x20], 0x111d1165
sub esp, 0x18
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x110c113a
mov word [ebp - 0x18], 9
mov esi, esp
mov edi, dword [ebx]
mov byte [ebp - 0x16], 0
call fcn.10001431
push eax
mov ecx, esi
call fcn.10002607
mov ecx, edi
call fcn.1000914c
mov edi, dword [ebx]
lea ecx, [ebp - 0x20]
push 0xa
mov dword [ebx + 4], eax
pop eax
mov word [ebp - 0x20], 0x1f78
mov esi, esp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x1e], al
mov dword [ebp - 0x1d], 0x27080d17
mov dword [ebp - 0x19], 0x1d0b191a
mov byte [ebp - 0x15], 0
call fcn.1000220d
push eax
mov ecx, esi
call fcn.10002607
mov ecx, edi
call fcn.1000914c
add esp, 0x18
mov dword [ebx + 8], eax
xor eax, eax
lea ecx, [ebx + 0x38]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov ebx, dword [ebx]
lea ecx, [ebp - 0x20]
sub esp, 0x18
mov dword [ebp - 0x20], 0x7c617413
mov edi, esp
mov dword [ebp - 0x1c], 0x364c6366
mov word [ebp - 0x18], 0x77
push eax
sub esp, 0x18
mov esi, esp
call fcn.100021bc
push eax
mov ecx, esi
call fcn.10002607
push edi
call fcn.1000485f
add esp, 0x20
mov ecx, ebx
call fcn.1000914c
mov edi, esp
mov dword [ebp - 0x2c], 0x4d414d39
push dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 0x28], 0x5e4a5466
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x2c]
sub esp, 0x18
mov dword [ebp - 0x24], 0x5d1c66
mov esi, esp
mov dword [eax - 0x28], ebx
call fcn.1000220d
push eax
mov ecx, esi
call fcn.10002607
push edi
call fcn.1000485f
add esp, 0x20
mov ecx, ebx
call fcn.1000914c
mov ecx, dword [ebp - 8]
add esp, 0x18
mov ebx, dword [ebp - 0x10]
mov dword [ecx], eax
add ecx, 4
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 8], ecx
sub dword [ebp - 0xc], 1
mov dword [ebp - 4], eax
jne 0x1000eee1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f9fe
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 0xf
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x1000fa08
pop edi
pop esi
mov byte [ecx + 0x10], 0
ret
Function at 0x10010456
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x100354fd
call fcn.10034356
mov esi, ecx
mov edx, dword [0x10046388]
test edx, edx
js 0x1001055c
cmp edx, 0x17
jg 0x1001055c
mov ecx, dword [esi + 0x14]
call fcn.10009afc
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, ebx
mov eax, dword [0x10046388]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
push eax
cmp eax, 0xa
jge 0x100104d4
movaps xmm0, xmmword [0x1003e710]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x4e441a12
mov word [ebp - 0x30], 0x4e
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x14
jb 0x100104c2
mov byte [ebp - 0x2f], bl
jmp 0x100104f9
movaps xmm0, xmmword [0x1003ea30]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x31313b65
mov byte [ebp - 0x30], bl
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x13
jb 0x100104e9
mov byte [ebp - 0x30], bl
sub esp, 0x18
lea eax, [ebp - 0x43]
mov ecx, esp
push eax
call fcn.10002607
lea eax, [ebp - 0x60]
push eax
call fcn.1000485f
add esp, 0x20
lea ecx, [ebp - 0x2c]
push eax
call fcn.10005394
lea ecx, [ebp - 0x60]
call fcn.10002413
mov ecx, dword [esi + 0x1c]
lea edx, [ebp - 0x2c]
call fcn.10009be1
mov eax, dword [0x10046388]
test eax, eax
jle 0x1001053f
push ecx
push eax
call fcn.1001040d
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, edi
jbe 0x10010553
mov ecx, dword [ebp - 0x2c]
inc edx
call fcn.100023e6
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x2c], bl
mov edx, dword [0x10046394]
cmp edx, 0x14
ja 0x1001059d
mov ecx, dword [esi + 0x18]
call fcn.10009afc
mov edx, dword [0x10046394]
mov ecx, dword [esi + 0x20]
call fcn.10009c04
movd xmm0, dword [0x10046394]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x1003dc08]
movss dword [0x100440a4], xmm0
call fcn.1000f61f
call fcn.10034314
ret
Function at 0x1001064d
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [0x1003de90]
xor edx, edx
push ebx
mov ebx, ecx
mov word [ebp - 8], 0x17
push esi
push edi
movups xmmword [ebp - 0x18], xmm0
mov esi, dword [ebx]
mov ecx, edx
mov byte [ebp - 6], dl
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x11
jb 0x10010672
sub esp, 0x18
mov byte [ebp - 6], dl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
mov edi, eax
mov dword [ebp - 0x14], 0xa0c0b78
lea ecx, [ebp - 0x14]
mov dword [ebx + 4], edi
mov dword [ebp - 0x10], 0x1e161127
mov esi, esp
mov dword [ebp - 0xc], 0x492717
call fcn.1000220d
push eax
mov ecx, esi
call fcn.10002607
mov ecx, edi
call fcn.1000914c
mov esi, dword [ebx + 4]
add esp, 0x18
mov dword [ebx + 8], eax
mov cl, 0x13
mov dword [ebp - 0x14], 0x61676013
xor eax, eax
mov dword [ebp - 0x10], 0x757d7a4c
mov dword [ebp - 0xc], 0x214c7c
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x100106fb
mov cl, byte [ebp - 0x14]
jmp 0x100106ec
sub esp, 0x18
mov byte [ebp - 9], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
mov edi, dword [ebx + 4]
lea ecx, [ebp - 0x14]
mov dword [ebx + 0xc], eax
mov esi, esp
mov dword [ebp - 0x14], 0x4b4d4a39
mov dword [ebp - 0x10], 0x5f575066
mov dword [ebp - 0xc], 0xa6656
call fcn.1000220d
push eax
mov ecx, esi
call fcn.10002607
mov ecx, edi
call fcn.1000914c
mov esi, dword [ebx + 4]
add esp, 0x18
mov dword [ebx + 0x10], eax
mov cl, 0xf
mov dword [ebp - 0x14], 0x6862660f
xor eax, eax
mov dword [ebp - 0x10], 0x6e7b7c50
mov dword [ebp - 0xc], 0x61667b7d
mov word [ebp - 8], 0x68
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x1001077f
mov cl, byte [ebp - 0x14]
jmp 0x10010770
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
mov esi, dword [ebx + 4]
add esp, 0x18
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebp - 0x13], 0x50686266
mov dword [ebp - 0xf], 0x7b7c766d
push 0xf
pop ecx
mov byte [ebp - 0x14], cl
mov dword [ebp - 0xb], 0x6b616e
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x100107cd
mov cl, byte [ebp - 0x14]
jmp 0x100107be
sub esp, 0x18
mov byte [ebp - 8], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
add esp, 0x18
mov dword [ebx + 0x1c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10010c48
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 6
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x10010c52
pop edi
pop esi
mov byte [ecx + 7], 0
ret

Function at 0x10010dfd
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x100355c9
call fcn.10034323
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x10010f26
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esi + 0x20], 1
mov word [esi + 0x28], ax
call fcn.1001119a
movaps xmm0, xmmword [0x1003e7a0]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x6a6a017a
mov dword [ebp - 0x2c], 0x76a6a60
mov byte [ebp - 0x28], bl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x17
jb 0x10010e4d
lea eax, [ebp - 0x3f]
mov byte [ebp - 0x28], bl
push eax
lea ecx, [ebp - 0x24]
call fcn.10002607
mov byte [ebp - 4], 1
lea edx, [ebp - 0x24]
mov ecx, dword [esi + 0xc]
call fcn.10009be1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.10002413
cmp dword [ebp + 0x1c], 0
jne 0x10010ec9
mov cl, 0x32
mov dword [ebp - 0x18], 0x575b6132
mov dword [ebp - 0x14], 0x71125755
mov eax, ebx
mov dword [ebp - 0x10], 0x5c535e
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xa
jae 0x10010eb1
mov cl, byte [ebp - 0x18]
jmp 0x10010ea2
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10002607
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
jmp 0x10010f16
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x1003e2f0]
mov ecx, ebx
cmova eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], bx
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x10010ee6
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10002607
lea eax, [ebp - 0x40]
push eax
call fcn.1000485f
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10009be1
lea ecx, [ebp - 0x40]
call fcn.10002413
lea ecx, [ebp + 0xc]
call fcn.10002413
call fcn.10034300
ret 0x1c
Function at 0x10010f36
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x10035613
call fcn.10034323
mov esi, ecx
mov di, word [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test di, di
je 0x100110cc
cmp word [esi + 0x28], bx
jg 0x100110cc
movaps xmm0, xmmword [0x1003e590]
mov ecx, ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x24], ebx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x565c5c37
mov dword [ebp - 0x14], 0x315c5c
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x16
jb 0x10010f81
lea eax, [ebp - 0x27]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10002607
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, dword [esi + 8]
call fcn.10009be1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.10002413
movaps xmm0, xmmword [0x1003e5c0]
mov ecx, ebx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x45452e55
mov dword [ebp - 0x14], 0x2845454f
mov byte [ebp - 0x10], bl
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x17
jb 0x10010fd5
lea eax, [ebp - 0x27]
mov byte [ebp - 0x10], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10002607
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
mov ecx, dword [esi + 0xc]
call fcn.10009be1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.10002413
cmp dword [ebp + 0x1c], 0
jne 0x10011051
mov cl, 0x47
mov dword [ebp - 0x1c], 0x222e1447
mov dword [ebp - 0x18], 0x4672220
mov eax, ebx
mov dword [ebp - 0x14], 0x29262b
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xa
jae 0x10011039
mov cl, byte [ebp - 0x1c]
jmp 0x1001102a
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10002607
mov byte [ebp - 4], 3
lea edx, [ebp - 0x40]
jmp 0x100110a0
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x1003df30]
mov ecx, ebx
cmova eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x25
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x10011070
sub esp, 0x18
mov byte [ebp - 0x13], bl
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.10002607
lea eax, [ebp - 0x40]
push eax
call fcn.1000485f
add esp, 0x20
mov byte [ebp - 4], 4
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10009be1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.10002413
mov ecx, dword [esi]
push 2
call dword [0x1003cc44]
mov ecx, esi
mov word [esi + 0x28], di
mov byte [esi + 0x21], 1
call fcn.1001119a
lea ecx, [ebp + 0xc]
call fcn.10002413
call fcn.10034300
ret 0x1c
Function at 0x100110dc
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x1003564d
call fcn.10034323
mov esi, ecx
mov ax, word [ebp + 8]
xor edx, edx
mov dword [ebp - 4], edx
mov word [esi + 0x28], ax
cmp dword [ebp + 0x1c], edx
jne 0x1001112b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x78744e1d
mov dword [ebp - 0x18], 0x5e3d787a
mov dword [ebp - 0x14], 0x737c71
call fcn.1000220d
push eax
lea ecx, [ebp - 0x3c]
call fcn.10002607
mov byte [ebp - 4], 1
lea edx, [ebp - 0x3c]
jmp 0x1001117a
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x1003e330]
mov ecx, edx
cmova eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 0x1f
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x1001114a
sub esp, 0x18
mov byte [ebp - 0xf], dl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10002607
lea eax, [ebp - 0x3c]
push eax
call fcn.1000485f
add esp, 0x20
mov byte [ebp - 4], 2
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10009be1
lea ecx, [ebp - 0x3c]
call fcn.10002413
lea ecx, [ebp + 0xc]
call fcn.10002413
call fcn.10034300
ret 0x1c
Function at 0x10011593
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x1003e070]
xor edx, edx
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0xc163a00
push edi
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0xc], 0x11041011
mov ecx, edx
mov edi, dword [esi]
mov dword [ebp - 8], 0xb0a0c
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x1a
jb 0x100115c3
sub esp, 0x18
mov byte [ebp - 5], dl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, edi
call fcn.1000914c
add esp, 0x18
mov dword [esi + 4], eax
pop edi
pop esi
leave
ret
Function at 0x100126a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [0x1003dc80]
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
movups xmmword [ebp - 0x18], xmm0
mov esi, dword [ebx]
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0xe
jb 0x100126ba
sub esp, 0x18
mov byte [ebp - 9], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
mov esi, dword [ebx]
add esp, 0x18
mov dword [ebx + 4], eax
mov cl, 0x78
mov dword [ebp - 0x14], 0x160c3a78
xor eax, eax
mov dword [ebp - 0x10], 0xa0c2b27
mov dword [ebp - 0xc], 0xc1f161d
mov word [ebp - 8], 0x10
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x10012716
mov cl, byte [ebp - 0x14]
jmp 0x10012707
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
mov esi, dword [ebx]
add esp, 0x18
mov dword [ebx + 8], eax
mov cl, 0x13
mov dword [ebp - 0x14], 0x7d675113
xor eax, eax
mov dword [ebp - 0x10], 0x7267404c
mov dword [ebp - 0xc], 0x727d7a7e
mov byte [ebp - 8], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x10012763
mov cl, byte [ebp - 0x14]
jmp 0x10012754
sub esp, 0x18
mov byte [ebp - 8], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
mov esi, dword [ebx]
add esp, 0x18
mov dword [ebx + 0xc], eax
mov cl, 0x39
mov dword [ebp - 0x18], 0x574d7b39
xor eax, eax
mov dword [ebp - 0x14], 0x415c7d66
mov dword [ebp - 0x10], 0x504b5c4d
mov word [ebp - 0xc], 0x404d
mov byte [ebp - 0xa], 0
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xd
jae 0x100127b6
mov cl, byte [ebp - 0x18]
jmp 0x100127a7
sub esp, 0x18
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
movaps xmm0, xmmword [0x1003e830]
lea ecx, [ebp - 0x18]
mov edi, dword [ebx]
mov esi, esp
mov dword [ebx + 0x10], eax
movups xmmword [ebp - 0x18], xmm0
mov byte [ebp - 8], 0
call fcn.1000f9fe
push eax
mov ecx, esi
call fcn.10002607
mov ecx, edi
call fcn.1000914c
movaps xmm0, xmmword [0x1003ea00]
add esp, 0x18
mov esi, dword [ebx]
xor ecx, ecx
mov dword [ebx + 0x14], eax
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0x6a
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x10
jb 0x10012817
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10002607
mov ecx, esi
call fcn.1000914c
add esp, 0x18
mov dword [ebx + 0x18], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10013db2
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 0x10
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x10013dbc
pop edi
pop esi
mov byte [ecx + 0x11], 0
ret
Function at 0x10016232
Capabilities:
Encode data using xor

Disassembly:
push 8
push 0x88
mov eax, 0x10035b70
call fcn.10034451
lea edi, [ecx + 0x130]
mov dword [ebp - 0x24], 3
lea esi, [ecx + 0x44]
mov ecx, dword [esi]
call fcn.10004cd0
test eax, eax
je 0x100162ba
movzx ecx, word [esi + 4]
movups xmm0, xmmword [str.uHSI]
movzx eax, word [edi]
push ecx
push eax
movups xmmword [ebp - 0x38], xmm0
xor ecx, ecx
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0xe
jb 0x10016274
sub esp, 0x18
mov byte [ebp - 0x29], 0
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10002607
lea eax, [ebp - 0x68]
push eax
call fcn.1000485f
add esp, 0x24
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 0xf
jbe 0x100162ab
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10002607
mov byte [ebp - 4], 1
jmp 0x10016335
cmp dword [esi], 1
jne 0x1001636e
cmp byte [esi + 6], 0
je 0x1001636e
movzx ecx, word [esi + 4]
movzx eax, word [edi]
push ecx
push eax
mov cl, 0x34
mov dword [ebp - 0x20], 0x14501134
mov dword [ebp - 0x1c], 0x5011141b
xor eax, eax
mov byte [ebp - 0x18], 0
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 7
jae 0x100162fb
mov cl, byte [ebp - 0x20]
jmp 0x100162ec
sub esp, 0x18
mov byte [ebp - 0x18], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10002607
lea eax, [ebp - 0x68]
push eax
call fcn.1000485f
add esp, 0x24
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 0xf
jbe 0x10016328
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10002607
mov byte [ebp - 4], 3
mov ecx, dword [esi + 0xc]
lea edx, [ebp - 0x50]
call fcn.10009be1
lea ecx, [ebp - 0x50]
call fcn.10002413
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10002413
movzx eax, word [edi]
xorps xmm3, xmm3
mov ecx, dword [esi + 0x10]
xorps xmm2, xmm2
movd xmm1, eax
cvtdq2ps xmm1, xmm1
call fcn.10009a7f
jmp 0x100163d8
movzx eax, word [esi + 4]
push eax
sub esp, 0x18
mov word [ebp - 0x14], 0x35
lea eax, [ebp - 0x13]
mov byte [ebp - 0x13], 0
mov ecx, esp
push eax
call fcn.10002607
lea eax, [ebp - 0x98]
push eax
call fcn.1000485f
add esp, 0x20
mov dword [ebp - 4], 4
cmp dword [eax + 0x14], 0xf
jbe 0x100163a9
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x80]
call fcn.10002607
mov byte [ebp - 4], 5
lea edx, [ebp - 0x80]
mov ecx, dword [esi + 0xc]
call fcn.10009be1
lea ecx, [ebp - 0x80]
call fcn.10002413
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.10002413
mov ax, word [edi]
cmp ax, word [esi + 4]
jb 0x100163ee
mov ecx, dword [esi + 0xc]
mov edx, 0xff80ff00
call fcn.10009c27
add edi, 2
add esi, 0x18
sub dword [ebp - 0x24], 1
jne 0x10016253
call fcn.100343ce
ret
Function at 0x10016404
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x74
mov eax, 0x10035bcf
call fcn.10034323
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
movzx eax, word [esi + 0x136]
mov ecx, eax
mov word [esi + 0x13e], ax
movzx eax, word [esi + 0x140]
push eax
push ecx
cmp byte [esi + 0x13c], bl
je 0x10016481
movaps xmm0, xmmword [0x1003e360]
mov ecx, ebx
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x6e23626f
mov byte [ebp - 0x24], bl
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x13
jb 0x1001644f
sub esp, 0x18
mov byte [ebp - 0x24], bl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10002607
lea eax, [ebp - 0x80]
push eax
call fcn.1000485f
add esp, 0x24
mov dword [ebp - 4], ebx
xor ebx, ebx
inc ebx
jmp 0x100164cf
mov cl, 0x46
mov dword [ebp - 0x20], 0x66226346
mov dword [ebp - 0x1c], 0x63662029
mov eax, ebx
mov word [ebp - 0x18], 0x22
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 8
jae 0x100164a8
mov cl, byte [ebp - 0x20]
jmp 0x10016499
sub esp, 0x18
mov byte [ebp - 0x17], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10002607
lea eax, [ebp - 0x68]
push eax
call fcn.1000485f
add esp, 0x24
push 2
mov dword [ebp - 4], 1
pop ebx
cmp dword [eax + 0x14], 0xf
mov dword [ebp - 0x10], ebx
jbe 0x100164da
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10002607
mov dword [ebp - 4], 2
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0xc]
call fcn.10009be1
lea ecx, [ebp - 0x50]
call fcn.10002413
test bl, 2
je 0x1001650d
lea ecx, [ebp - 0x68]
and ebx, 0xfffffffd
call fcn.10002413
test bl, 1
je 0x1001651a
lea ecx, [ebp - 0x80]
call fcn.10002413
call fcn.10034300
ret