joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41304a
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x414c30
push 1
xor ebx, ebx
push ebx
push 0x414ce0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x41311b
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x414cd0
push eax
call dword [ecx]
test eax, eax
jl 0x413112
cmp byte [ebp + 8], bl
je 0x41309d
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x4130ba
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x4130cc
push 0x41437c
jmp 0x4130cf
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x4130e4
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x4130f5
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x413109
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x413135
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x78427c48
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x39795924
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x100053c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b37a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100d8054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10046de1
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1004649a
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
mov dword [ebp - 0x14], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea esi, [eax + 0x24]
mov byte [ebx + 0x48], 0
add eax, 0x28
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x14]
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [ecx], 0
mov ecx, dword [0x101e3ef8]
mov dword [eax], 0
mov eax, dword [0x101e3ef4]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008660
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100086ac
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1000868f
cmp edi, 2
jb 0x1000868f
cmp byte [esi], cl
jne 0x1000868f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100ca9b8]
test edi, edi
jne 0x10008675
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100086db
cmp cl, 0x23
jne 0x100086c2
cmp byte [esi], cl
jne 0x100086c2
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100ca9b8]
test cl, cl
jne 0x100086b3
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x100087c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100087d3
mov dword [ebx], 0
mov edx, 0x100ced34
call fcn.100086f0
mov esi, eax
test esi, esi
je 0x100088b0
push esi
call fcn.1008cf7e
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x100088a7
push 2
push 0
push esi
call fcn.1008d8de
add esp, 0xc
test eax, eax
jne 0x100088a7
push esi
call fcn.1008cf7e
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x100088a7
push 0
push dword [ebp + 8]
push esi
call fcn.1008d8de
add esp, 0xc
test eax, eax
jne 0x100088a7
mov eax, dword [0x101dbe34]
test eax, eax
je 0x10008846
inc dword [eax + 0xb0]
push edi
call fcn.100905d9
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x100088a7
push esi
push edi
push 1
push eax
call fcn.1009049e
add esp, 0x10
push esi
cmp eax, edi
je 0x10008891
call fcn.1008d599
mov eax, dword [0x101dbe34]
add esp, 4
test eax, eax
je 0x1000887f
dec dword [eax + 0xb0]
push dword [ebp + 8]
call fcn.1009029d
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.1008d599
add esp, 4
test ebx, ebx
je 0x1000889f
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.1008d599
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x1000aab0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x14]
mov edi, 0x10
movss xmm1, dword [edx + 0xfc]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x100]
subss xmm0, xmm1
mov ecx, dword [edx + 0xe0]
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xe8]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 8], xmm0
not edx
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100ca9b8]
sub edi, 1
jne 0x1000ab20
not edx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000e240
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x1000e27d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1000e263
cmp byte [esi], bl
jne 0x1000e263
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x100ca9b8]
test bl, bl
jne 0x1000e254
pop edi
pop esi
not ecx
pop ebx
jmp fcn.1000e1d0
Function at 0x1001a720
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x101dbe34]
test bl, bl
je 0x1001a766
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1001a747
cmp byte [esi], bl
jne 0x1001a747
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x100ca9b8]
test bl, bl
jne 0x1001a738
mov edi, dword [0x101dbe34]
mov esi, dword [edi + 0x5a1c]
xor ecx, ecx
not eax
test esi, esi
jle 0x1001a78c
mov edi, dword [edi + 0x5a24]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x1001a792
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x1001a780
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x1001c1d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3a65
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100d8054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
mov al, byte [0x101e3ef0]
test al, al
jne 0x1001c278
mov edx, dword [ebx]
lea ecx, [ebp - 0x48]
call fcn.100396b0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x1001c221
mov eax, dword [eax]
push ecx
mov edx, esi
mov ecx, eax
call fcn.1002f900
mov edx, dword [ebp - 0x34]
add esp, 4
mov bl, al
cmp edx, 0x10
jb 0x1001c264
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001c25a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001c38a
push edx
push ecx
call fcn.10046e16
add esp, 8
test bl, bl
je 0x1001c36c
mov byte [0x101e3ef0], 1
jmp 0x1001c36c
cmp al, 1
jne 0x1001c36c
mov al, 0x6c
mov byte [ebp - 0x14], 0
mov ah, 0x42
mov dword [ebp - 0x30], 0
mov cl, al
mov byte [ebp - 0x18], ah
mov dl, al
mov byte [ebp - 0x14], 0
xor cl, ah
mov dword [ebp - 0x20], 0
xor al, ah
mov byte [ebp - 0x16], cl
xor dl, ah
mov byte [ebp - 0x17], al
lea ecx, [ebp - 0x17]
mov byte [ebp - 0x15], dl
mov dword [ebp - 0x1c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x30], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001c2c1
sub ecx, edx
lea eax, [ebp - 0x17]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.100012d0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x30]
cmp dword [ebp - 0x1c], 0x10
mov edx, esi
cmovae ecx, dword [ebp - 0x30]
push ecx
call fcn.1002f900
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 4
mov esi, 1
nop
push esi
call edi
inc esi
cmp esi, 0xe7
jle 0x1001c300
mov esi, 1
push esi
call edi
inc esi
cmp esi, 0xe7
jle 0x1001c311
mov esi, 1
push esi
call edi
test ax, ax
je 0x1001c333
mov dword [ebx], esi
mov byte [0x101e3ef0], 0
inc esi
cmp esi, 0xe7
jle 0x1001c322
mov edx, dword [ebp - 0x1c]
cmp edx, 0x10
jb 0x1001c36c
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001c362
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001c38f
push edx
push ecx
call fcn.10046e16
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10046dd3
mov esp, ebp
pop ebp
ret
call fcn.1008c84f
call fcn.1008c84f
int3
Function at 0x10023c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10023ca6
mov eax, dword [0x101dbe34]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x10023c96
dec dword [eax + 0xb0]
push ecx
call fcn.1009029d
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10023cda
mov eax, dword [0x101dbe34]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x10023cca
dec dword [eax + 0xb0]
push ecx
call fcn.1009029d
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10023d0e
mov eax, dword [0x101dbe34]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x10023cfe
dec dword [eax + 0xb0]
push ecx
call fcn.1009029d
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10023d5e
mov eax, dword [0x101dbe34]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x10023d4e
dec dword [eax + 0xb0]
push ecx
call fcn.1009029d
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10023d92
mov eax, dword [0x101dbe34]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x10023d82
dec dword [eax + 0xb0]
push ecx
call fcn.1009029d
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x10023dc6
mov eax, dword [0x101dbe34]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x10023db6
dec dword [eax + 0xb0]
push ecx
call fcn.1009029d
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100266e0
Function at 0x100345c0
Capabilities:
Hash data with crc32

Disassembly:
push ecx
test dword [ecx + 0xc], 0x100000
push ebx
push esi
push edi
mov edi, edx
je 0x10034632
mov cl, byte [edi]
lea esi, [edi + 1]
or eax, 0xffffffff
test cl, cl
je 0x10034608
or edi, 0xffffffff
nop
cmp cl, 0x23
jne 0x100345ef
cmp byte [esi], cl
jne 0x100345ef
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100ca9b8]
test cl, cl
jne 0x100345e0
mov ecx, dword [0x101dbe34]
not eax
cmp dword [ecx + 0x3e84], eax
jne 0x1003461e
mov dword [ecx + 0x3e88], eax
cmp dword [ecx + 0x3eac], eax
jne 0x10034677
mov byte [ecx + 0x3eb0], 1
pop edi
pop esi
pop ebx
pop ecx
ret
mov esi, dword [0x101dbe34]
xor edx, edx
mov eax, dword [esi + 0x3e38]
mov ecx, dword [eax + 0xe0]
mov eax, dword [eax + 0xe8]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.10008660
mov ebx, eax
add esp, 4
cmp dword [esi + 0x3e6c], ebx
jne 0x10034675
push ecx
push edi
mov edx, 0xb
mov ecx, ebx
call fcn.1001b5e0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1003b840
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1003b877
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x1003b130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x101dbe40], eax
mov eax, 1
pop ebp
ret 0xc
test eax, eax
jne 0x1003b888
push eax
push dword [0x101dbe40]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x1003bb20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100d8054]
xor eax, ebp
mov dword [ebp - 4], eax
mov dl, 0x11
mov byte [ebp - 0x10], 0x7d
mov byte [ebp - 0x39], dl
mov al, 0x1e
xor al, byte [ebp - 0x10]
mov ah, 0x18
mov byte [ebp - 0x3a], dl
mov dh, 0x13
xor dl, byte [ebp - 0x10]
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x39]
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0x10]
xor al, dl
mov byte [ebp - 5], 0
push ebx
mov byte [ebp - 7], al
xor ah, dl
mov al, byte [ebp - 0x3a]
mov bl, 0x14
push esi
mov esi, ecx
mov byte [ebp - 0xc], ah
xor al, dl
mov byte [ebp - 5], 0
mov cl, 0x53
mov byte [ebp - 6], al
mov ch, 0x19
lea eax, [ebp - 0xf]
mov bh, 9
xor bl, dl
xor dh, dl
mov byte [ebp - 0xd], bl
xor bh, dl
mov byte [ebp - 0xb], dh
xor cl, dl
mov byte [ebp - 0xa], bh
xor ch, dl
mov byte [ebp - 9], cl
push eax
mov byte [ebp - 8], ch
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1003bc73
movaps xmm0, xmmword [0x100d0d50]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x4f4f
mov byte [ebp - 0x12], 0
nop dword [eax]
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x11
jb 0x1003bbc0
movaps xmm0, xmmword [0x100d0e60]
xor eax, eax
mov byte [ebp - 0x12], 0
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0x28], 0x1b63
mov byte [ebp - 0x26], 0
mov cl, byte [ebp - 0x38]
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0x11
jb 0x1003bbe8
mov cl, 0x12
mov byte [ebp - 0x10], 0x7e
mov byte [ebp - 0x3a], cl
mov al, 0x1d
xor al, byte [ebp - 0x10]
mov ah, 0x10
mov byte [ebp - 0xf], al
mov dl, 0x17
mov al, byte [ebp - 0x3a]
mov ch, 0xa
mov byte [ebp - 0x39], cl
mov dh, 0x50
xor cl, byte [ebp - 0x10]
mov bl, 0x1b
mov byte [ebp - 0xe], cl
mov bh, 0x1a
mov cl, byte [ebp - 0x10]
xor al, cl
mov byte [ebp - 5], 0
mov byte [ebp - 7], al
xor ah, cl
mov al, byte [ebp - 0x39]
xor dl, cl
xor al, cl
mov byte [ebp - 0xb], ah
mov byte [ebp - 6], al
xor bl, cl
lea eax, [ebp - 0x23]
mov byte [ebp - 0x26], 0
push eax
lea eax, [ebp - 0x37]
mov byte [ebp - 0xd], dl
push eax
lea eax, [ebp - 0xf]
mov byte [ebp - 0xc], bl
xor ch, cl
mov byte [ebp - 5], 0
xor dh, cl
mov byte [ebp - 0xa], ch
xor bh, cl
mov byte [ebp - 9], dh
push eax
mov byte [ebp - 8], bh
call fcn.1003b060
test eax, eax
je 0x1003bc73
push esi
call eax
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10046dd3
mov esp, ebp
pop ebp
ret
Function at 0x1003bdf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100d8054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101dfe78]
push esi
mov esi, ecx
push edi
mov edi, edx
test eax, eax
jne 0x1003beef
mov dl, 0x39
mov dword [ebp - 0x20], 0x41414139
mov dword [ebp - 0x1c], 0x41414141
mov dword [ebp - 0x18], 0x41414141
mov word [ebp - 0x14], 0x41
xor byte [ebp + eax - 0x1f], dl
inc eax
cmp eax, 0xc
jae 0x1003be3f
mov dl, byte [ebp - 0x20]
jmp 0x1003be30
mov byte [ebp - 0x13], 0
mov cl, 0x5f
mov dword [ebp - 0x30], 0xb3d40a5f
xor eax, eax
mov dword [ebp - 0x2c], 0xa05712d4
mov dword [ebp - 0x28], 0x5ed4532a
mov word [ebp - 0x24], 0xa0
xor byte [ebp + eax - 0x2f], cl
inc eax
cmp eax, 0xc
jae 0x1003be71
mov cl, byte [ebp - 0x30]
jmp 0x1003be62
mov cl, 9
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0x31], cl
mov al, 6
xor al, byte [ebp - 0x10]
mov ah, 0xb
mov byte [ebp - 0xf], al
mov dl, 0xc
mov al, byte [ebp - 0x31]
mov ch, 0x11
mov byte [ebp - 0x32], cl
mov dh, 0x4b
xor cl, byte [ebp - 0x10]
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0x10]
xor al, cl
mov byte [ebp - 0x23], 0
mov byte [ebp - 7], al
xor ah, cl
mov al, byte [ebp - 0x32]
xor dl, cl
push ebx
xor al, cl
mov byte [ebp - 0xb], ah
mov byte [ebp - 6], al
xor bl, bl
lea eax, [ebp - 0x1f]
mov byte [ebp - 5], bl
push eax
lea eax, [ebp - 0x2f]
mov byte [ebp - 0xd], dl
push eax
mov bh, 1
mov byte [ebp - 5], 0
lea eax, [ebp - 0xf]
xor bl, cl
xor ch, cl
mov byte [ebp - 0xc], bl
xor dh, cl
mov byte [ebp - 0xa], ch
xor bh, cl
mov byte [ebp - 9], dh
push eax
mov byte [ebp - 8], bh
call fcn.1003b060
mov dword [0x101dfe78], eax
pop ebx
test eax, eax
je 0x1003bef6
push edi
push esi
call eax
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10046dd3
mov esp, ebp
pop ebp
ret
Function at 0x1003c0e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x100d8054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101dfe5c]
push esi
mov esi, ecx
push edi
mov edi, edx
test eax, eax
jne 0x1003c20f
movaps xmm0, xmmword [0x100d0900]
xor ecx, ecx
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x18], 0x76767676
movaps xmm0, xmmword [0x100d0910]
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0x14], 0x76
movaps xmm0, xmmword [0x100d0df0]
movups xmmword [ebp - 0x28], xmm0
mov al, byte [ebp - 0x48]
xor byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0x34
jb 0x1003c136
movaps xmm0, xmmword [0x100d0740]
xor eax, eax
movups xmmword [ebp - 0x80], xmm0
mov byte [ebp - 0x13], 0
movaps xmm0, xmmword [0x100d0750]
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x50], 0xed8a54cd
movaps xmm0, xmmword [0x100d0e70]
movups xmmword [ebp - 0x60], xmm0
mov word [ebp - 0x4c], 0x52
mov cl, byte [ebp - 0x80]
xor byte [ebp + eax - 0x7f], cl
inc eax
cmp eax, 0x34
jb 0x1003c177
mov cl, 0x1e
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0x81], cl
mov al, 0x11
xor al, byte [ebp - 0x10]
mov ah, 0x1c
mov byte [ebp - 0xf], al
mov dl, 0x1b
mov al, byte [ebp - 0x81]
mov ch, 6
mov byte [ebp - 0x82], cl
mov dh, 0x5c
xor cl, byte [ebp - 0x10]
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0x10]
xor al, cl
mov byte [ebp - 5], 0
mov byte [ebp - 7], al
xor ah, cl
mov al, byte [ebp - 0x82]
xor dl, cl
push ebx
xor al, cl
mov byte [ebp - 0xb], ah
mov byte [ebp - 6], al
mov bl, 0x17
lea eax, [ebp - 0x47]
mov byte [ebp - 0x4b], 0
push eax
lea eax, [ebp - 0x7f]
mov byte [ebp - 0xd], dl
push eax
mov bh, 0x16
mov byte [ebp - 5], 0
lea eax, [ebp - 0xf]
xor bl, cl
xor ch, cl
mov byte [ebp - 0xc], bl
xor dh, cl
mov byte [ebp - 0xa], ch
xor bh, cl
mov byte [ebp - 9], dh
push eax
mov byte [ebp - 8], bh
call fcn.1003b060
mov dword [0x101dfe5c], eax
pop ebx
test eax, eax
je 0x1003c216
push edi
push esi
call eax
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10046dd3
mov esp, ebp
pop ebp
ret
Function at 0x1003c500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x100d8054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101dfe4c]
push esi
mov esi, ecx
push edi
mov edi, edx
test eax, eax
jne 0x1003c60c
movaps xmm0, xmmword [0x100d0780]
xor ecx, ecx
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x18], 0x9090909
movaps xmm0, xmmword [str._t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tq_t_t_t_t_t_t_tNNNN_t_t_t_th___RH__t]
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x14], 9
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x24
jb 0x1003c548
movaps xmm0, xmmword [0x100d0e50]
xor eax, eax
movups xmmword [ebp - 0x60], xmm0
mov byte [ebp - 0x13], 0
movaps xmm0, xmmword [0x100d0e80]
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x40], 0xc1a678e1
mov word [ebp - 0x3c], 0x7b
nop
mov cl, byte [ebp - 0x60]
xor byte [ebp + eax - 0x5f], cl
inc eax
cmp eax, 0x24
jb 0x1003c580
mov cl, 0x4f
mov byte [ebp - 0x10], 0x23
mov byte [ebp - 0x61], cl
mov al, 0x40
xor al, byte [ebp - 0x10]
mov ah, 0x4d
mov byte [ebp - 0xf], al
mov dl, 0x4a
mov al, byte [ebp - 0x61]
mov ch, 0x57
mov byte [ebp - 0x62], cl
mov dh, 0xd
xor cl, byte [ebp - 0x10]
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0x10]
xor al, cl
mov byte [ebp - 5], 0
mov byte [ebp - 7], al
xor ah, cl
mov al, byte [ebp - 0x62]
xor dl, cl
push ebx
xor al, cl
mov byte [ebp - 0xb], ah
mov byte [ebp - 6], al
mov bl, 0x46
lea eax, [ebp - 0x37]
mov byte [ebp - 0x3b], 0
push eax
lea eax, [ebp - 0x5f]
mov byte [ebp - 0xd], dl
push eax
mov bh, 0x47
mov byte [ebp - 5], 0
lea eax, [ebp - 0xf]
xor bl, cl
xor ch, cl
mov byte [ebp - 0xc], bl
xor dh, cl
mov byte [ebp - 0xa], ch
xor bh, cl
mov byte [ebp - 9], dh
push eax
mov byte [ebp - 8], bh
call fcn.1003b060
mov dword [0x101dfe4c], eax
pop ebx
test eax, eax
je 0x1003c613
push edi
push esi
call eax
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10046dd3
mov esp, ebp
pop ebp
ret