joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c7d50
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6730f0
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x5c7ef7
mov ecx, dword [0xc877b0]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x5c7e4c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.005c6a70
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.0065cffc
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.0065cec3
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xc76d6c
call fcn.0065cf31
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.005c6e30
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.0065cffc
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.0065cec3
lea ecx, [esp + 0xc]
call fcn.0065d3d7
mov ecx, dword [esp + 0xc]
push 0xc777ac
push ecx
call fcn.0063b464
add esp, 8
test eax, eax
je 0x5c7e74
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x5c7dad
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.0065cec3
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0065cec3
jmp 0x5c7efb
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.005c7af0
test eax, eax
push 0
je 0x5c7edf
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.005c6190
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x5c7ec5
cmp eax, 0x64
jg 0x5c7eb3
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [0x67643c]
mov esi, eax
jmp 0x5c7e50
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [0x67643c]
mov esi, eax
jmp 0x5c7e50
cmp eax, 0x64
jge 0x5c7e4c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [0x67643c]
mov esi, eax
jmp 0x5c7e50
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.005c6190
mov esi, eax
jmp 0x5c7e50
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x5c7f05
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x5d8f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x673800
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.005d8ab0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.005d8b30
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.005d8b30
lea ecx, [esi + 0xc]
call fcn.0065ce4e
lea ecx, [esi + 0x10]
call fcn.0065ce4e
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.005da0c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.005da0c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.005da0c0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0065cec3
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0065cec3
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5dc870
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x674050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
lea eax, [esi + 0x28]
mov dword [ebp - 4], ebx
push eax
push 0x13
call fcn.005dca90
lea ecx, [esi + 0x30]
push ecx
push 5
mov ecx, esi
call fcn.005dcb20
lea edx, [esi + 0x20]
mov ecx, esi
push edx
push 0x21
call fcn.005dc9e0
lea eax, [esi + 0x14]
mov ecx, esi
push eax
push 0x16
call fcn.005dc9e0
lea ecx, [esi + 0x18]
push ecx
push 1
mov ecx, esi
call fcn.005dc9e0
mov eax, dword [esi + 8]
mov edi, dword [0x6767d4]
lea edx, [ebp - 0x14]
push ebx
push edx
push ebx
push 0x1d
push eax
mov dword [esi + 0x24], ebx
mov dword [ebp - 0x14], ebx
call edi
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jbe 0x5dc94d
push eax
call fcn.0065cc04
mov edx, dword [esi + 8]
add esp, 4
lea ecx, [ebp - 0x14]
mov ebx, eax
push 0
push ecx
push ebx
push 0x1d
push edx
call edi
push 0xc7f04c
push ebx
call dword [0x676244]
test eax, eax
jne 0x5dc92b
mov dword [esi + 0x24], 1
jmp 0x5dc942
push 0xc7f044
push ebx
call dword [0x676244]
test eax, eax
jne 0x5dc942
mov dword [esi + 0x24], 2
push ebx
call fcn.0065cc2d
add esp, 4
xor ebx, ebx
lea ecx, [esi + 0x1c]
push 0xc8d3c4
call fcn.0065d04c
mov dword [ebp - 0x18], ebx
mov edx, dword [esi + 8]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push ecx
push ebx
push 0x2b
push edx
mov dword [ebp - 0x14], ebx
call edi
mov eax, dword [ebp - 0x14]
cmp eax, 1
jb 0x5dc9c4
push eax
call fcn.0065cc04
mov edx, dword [esi + 8]
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push ecx
push ebx
push 0x2b
push edx
call edi
cmp dword [ebp - 0x18], 1
jbe 0x5dc9a8
push 0xc6a414
lea ecx, [esi + 0x1c]
call fcn.0065d29f
push ebx
lea ecx, [esi + 0x1c]
call fcn.0065d29f
push ebx
call fcn.0065cc2d
add esp, 4
xor ebx, ebx
jmp 0x5dc95d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5dd860
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x5dd86b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x5dd96e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0xb736a8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0xb736a8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0xb736a8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0xb736a8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0xb736a8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0xb736a8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0xb736a8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0xb736a8]
xor eax, edx
inc ecx
dec edi
jne 0x5dd886
pop edi
test esi, esi
je 0x5dd990
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0xb736a8]
xor eax, edx
inc ecx
dec esi
jne 0x5dd972
pop esi
pop ebx
not eax
ret
Function at 0x5e9810
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x5e9843
push esi
call fcn.005ee750
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x5e983c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x5e98c9
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x5e98b2
mov eax, dword [esi + 8]
test eax, eax
je 0x5e9867
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x5e98ae
cmp eax, 2
je 0x5e98b2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5e985a
cmp eax, 3
je 0x5e988d
cmp eax, 1
jne 0x5e985a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x5e985a
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x5e985a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.005e9900
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x5e98e9
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.005e9900
add esp, 4
pop esi
ret
Function at 0x401335
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414914], al
inc ecx
cmp byte [ecx + 0x414913], 0
jne 0x401356
mov eax, 0x414914
leave
ret

Function at 0x401373
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x411460]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414c30], al
inc ecx
cmp byte [ecx + 0x414c2f], 0
jne 0x40138a
mov eax, 0x414c30
leave
ret

Function at 0x4013d1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x4149e4], al
inc ecx
cmp byte [ecx + 0x4149e3], 0
jne 0x4013f2
mov eax, 0x4149e4
leave
ret

Function at 0x40140f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x31343a19
xor ecx, ecx
mov dword [ebp - 0xc], 0x27373c19
mov dword [ebp - 8], 0x142c2734
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b54], al
inc ecx
cmp byte [ecx + 0x414b53], 0
jne 0x401430
mov eax, 0x414b54
leave
ret

Function at 0x401477
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414a9c], al
inc ecx
cmp byte [ecx + 0x414a9b], 0
jne 0x401498
mov eax, 0x414a9c
leave
ret

Function at 0x4014b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x5213012
xor ecx, ecx
mov dword [ebp - 0xc], 0x14363a27
mov dword [ebp - 8], 0x30273131
mov word [ebp - 4], 0x2626
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x4149f4], al
inc ecx
cmp byte [ecx + 0x4149f3], 0
jne 0x4014dc
mov eax, 0x4149f4
leave
ret

Function at 0x401523
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c0c], al
inc ecx
cmp byte [ecx + 0x414c0b], 0
jne 0x401544
mov eax, 0x414c0c
leave
ret
Function at 0x401561
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x411480]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x5526
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414950], al
inc ecx
cmp byte [ecx + 0x41494f], 0
jne 0x40157a
mov eax, 0x414950
leave
ret

Function at 0x4015c1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c44], al
inc ecx
cmp byte [ecx + 0x414c43], 0
jne 0x4015e2
mov eax, 0x414c44
leave
ret

Function at 0x4015ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x411480]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 4], 0x55311c26
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414ad0], al
inc ecx
cmp byte [ecx + 0x414acf], 0
jne 0x401619
mov eax, 0x414ad0
leave
ret

Function at 0x401660
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414a20], al
inc ecx
cmp byte [ecx + 0x414a1f], 0
jne 0x401681
mov eax, 0x414a20
leave
ret

Function at 0x40169e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x213c2d10
xor ecx, ecx
mov dword [ebp - 8], 0x363a2705
mov dword [ebp - 4], 0x55262630
mov al, byte [ebp + ecx - 0xc]
xor al, 0x55
mov byte [ecx + 0x414930], al
inc ecx
cmp byte [ecx + 0x41492f], 0
jne 0x4016bb
mov eax, 0x414930
leave
ret

Function at 0x401702
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b34], al
inc ecx
cmp byte [ecx + 0x414b33], 0
jne 0x401723
mov eax, 0x414b34
leave
ret

Function at 0x401740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x4114c0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x5521
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x4149b0], al
inc ecx
cmp byte [ecx + 0x4149af], 0
jne 0x401759
mov eax, 0x4149b0
leave
ret
Function at 0x4017a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b24], al
inc ecx
cmp byte [ecx + 0x414b23], 0
jne 0x4017c1
mov eax, 0x414b24
leave
ret

Function at 0x4017de
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x21273c03
xor ecx, ecx
mov dword [ebp - 0xc], 0x14393420
mov dword [ebp - 8], 0x363a3939
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b94], al
inc ecx
cmp byte [ecx + 0x414b93], 0
jne 0x4017ff
mov eax, 0x414b94
leave
ret

Function at 0x401846
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x41493c], al
inc ecx
cmp byte [ecx + 0x41493b], 0
jne 0x401867
mov eax, 0x41493c
leave
ret

Function at 0x401884
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x21273c03
xor ecx, ecx
mov dword [ebp - 0xc], 0x14393420
mov dword [ebp - 8], 0x363a3939
mov word [ebp - 4], 0x2d10
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b44], al
inc ecx
cmp byte [ecx + 0x414b43], 0
jne 0x4018ab
mov eax, 0x414b44
leave
ret

Function at 0x4018f2
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414990], al
inc ecx
cmp byte [ecx + 0x41498f], 0
jne 0x401913
mov eax, 0x414990
leave
ret

Function at 0x401930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x21273c03
xor ecx, ecx
mov dword [ebp - 8], 0x13393420
mov dword [ebp - 4], 0x55303027
mov al, byte [ebp + ecx - 0xc]
xor al, 0x55
mov byte [ecx + 0x414bb4], al
inc ecx
cmp byte [ecx + 0x414bb3], 0
jne 0x40194d
mov eax, 0x414bb4
leave
ret

Function at 0x401994
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x4149a0], al
inc ecx
cmp byte [ecx + 0x41499f], 0
jne 0x4019b5
mov eax, 0x4149a0
leave
ret
Function at 0x4019d2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x21273c03
xor ecx, ecx
mov dword [ebp - 0xc], 0x5393420
mov dword [ebp - 8], 0x30213a27
mov word [ebp - 4], 0x2136
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414a04], al
inc ecx
cmp byte [ecx + 0x414a03], 0
jne 0x4019f9
mov eax, 0x414a04
leave
ret

Function at 0x401a40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b64], al
inc ecx
cmp byte [ecx + 0x414b63], 0
jne 0x401a61
mov eax, 0x414b64
leave
ret

Function at 0x401a7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x411490]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x4148f0], al
inc ecx
cmp byte [ecx + 0x4148ef], 0
jne 0x401a95
mov eax, 0x4148f0
leave
ret

Function at 0x401adc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b14], al
inc ecx
cmp byte [ecx + 0x414b13], 0
jne 0x401afd
mov eax, 0x414b14
leave
ret

Function at 0x401b1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x4114b0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x2c27
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414b00], al
inc ecx
cmp byte [ecx + 0x414aff], 0
jne 0x401b37
mov eax, 0x414b00
leave
ret

Function at 0x401b7e
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414904], al
inc ecx
cmp byte [ecx + 0x414903], 0
jne 0x401b9f
mov eax, 0x414904
leave
ret

Function at 0x401bbc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [0x4114d0]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x3d363416
mov word [ebp - 4], 0x5530
mov al, byte [ebp + ecx - 0x18]
xor al, 0x55
mov byte [ecx + 0x414ab0], al
inc ecx
cmp byte [ecx + 0x414aaf], 0
jne 0x401bdc
mov eax, 0x414ab0
leave
ret
Function at 0x401c23
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414ba4], al
inc ecx
cmp byte [ecx + 0x414ba3], 0
jne 0x401c44
mov eax, 0x414ba4
leave
ret

Function at 0x401c61
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x411470]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x3b3a3c21
mov dword [ebp - 8], 0x313b341d
mov dword [ebp - 4], 0x55273039
mov al, byte [ebp + ecx - 0x1c]
xor al, 0x55
mov byte [ecx + 0x414c70], al
inc ecx
cmp byte [ecx + 0x414c6f], 0
jne 0x401c89
mov eax, 0x414c70
leave
ret

Function at 0x401cd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b84], al
inc ecx
cmp byte [ecx + 0x414b83], 0
jne 0x401cf1
mov eax, 0x414b84
leave
ret

Function at 0x401d0e
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x4114a0]
xor ecx, ecx
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x21253036
mov dword [ebp - 0xc], 0x1d3b3a3c
mov dword [ebp - 8], 0x39313b34
mov word [ebp - 4], 0x2730
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x20]
xor al, 0x55
mov byte [ecx + 0x414970], al
inc ecx
cmp byte [ecx + 0x41496f], 0
jne 0x401d40
mov eax, 0x414970
leave
ret

Function at 0x401d87
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414ae4], al
inc ecx
cmp byte [ecx + 0x414ae3], 0
jne 0x401da8
mov eax, 0x414ae4
leave
ret

Function at 0x401dc5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x4114e0]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x25343b06
mov dword [ebp - 8], 0x213a3d26
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x1c]
xor al, 0x55
mov byte [ecx + 0x414bc0], al
inc ecx
cmp byte [ecx + 0x414bbf], 0
jne 0x401dea
mov eax, 0x414bc0
leave
ret

Function at 0x401e31
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414bdc], al
inc ecx
cmp byte [ecx + 0x414bdb], 0
jne 0x401e52
mov eax, 0x414bdc
leave
ret