joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40655a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movups xmm0, xmmword [str.GdtLoeumeIaodme_]
movups xmmword [ecx], xmm0
mov byte [ecx + 0x10], 0
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0x10
jne 0x4065fd
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40666e
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movsd xmm0, qword [str.LnaeLhbs]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x40797361
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0xc
jne 0x40671a
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40678a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movsd xmm0, qword [str.Vhruu_l_]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x626f6d6c
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0xc
jne 0x406836
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4068a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movaps xmm0, xmmword [str.FeuCnmlaodMioe_]
movups xmmword [ecx], xmm0
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor al, byte [esi + ebx]
xor al, 1
mov byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0xf
jne 0x406945
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4069ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movaps xmm0, xmmword [str.FeuCnmlaodMioeV]
movups xmmword [ecx], xmm0
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor al, byte [esi + ebx]
xor al, 1
mov byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0xf
jne 0x406a59
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406ace
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movsd xmm0, qword [str._wfeum_]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x73616f69
mov word [ecx + 0xc], 0x7267
mov byte [ecx + 0xe], 0
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0xe
jne 0x406b80
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movsd xmm0, qword [str._feum_i]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x6773616f
mov word [ecx + 0xc], 0x72
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor al, byte [esi + ebx]
xor al, 1
mov byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0xd
jne 0x406c9e
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406d14
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movsd xmm0, qword [0x43bcb0]
movsd qword [ecx], xmm0
mov word [ecx + 8], 0x7767
mov byte [ecx + 0xa], 0
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0xa
jne 0x406dbf
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movsd xmm0, qword [str._q__va]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x776773
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor al, byte [esi + ebx]
xor al, 1
mov byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0xb
jne 0x406ed8
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406f4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movsd xmm0, qword [str._p_as]
movsd qword [ecx], xmm0
mov word [ecx + 8], 0x6267
mov byte [ecx + 0xa], 0
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0xa
jne 0x406ff9
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40706a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov dword [ecx], 0x75697965
mov byte [ecx + 4], 0
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 4
jne 0x407109
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40717a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov dword [ecx], 0x6979455e
mov word [ecx + 4], 0x75
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor al, byte [esi + ebx]
xor al, 1
mov byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 5
jne 0x40721b
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407290
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov dword [ecx], 0x6979655e
mov word [ecx + 4], 0x75
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor al, byte [esi + ebx]
xor al, 1
mov byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 5
jne 0x407331
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4073a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movsd xmm0, qword [str.qtibkey]
movsd qword [ecx], xmm0
mov word [ecx + 8], 0x7569
mov byte [ecx + 0xa], 0
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0xa
jne 0x407451
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4074c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movsd xmm0, qword [str.DxhtQrnc]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x727364
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor al, byte [esi + ebx]
xor al, 1
mov byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0xb
jne 0x40756a
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4075e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movsd xmm0, qword [str.otelm.el]
movsd qword [ecx], xmm0
mov word [ecx + 8], 0x6d
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor al, byte [esi + ebx]
xor al, 1
mov byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 9
jne 0x407687
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret