joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010e27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], 0x60706a04
mov esi, ecx
mov dword [ebp - 8], 0x602a6868
push edi
mov cl, 4
mov word [ebp - 4], 0x6868
mov byte [ebp - 2], bl
mov eax, ebx
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 9
jae 0x10010e5e
mov cl, byte [ebp - 0xc]
jmp 0x10010e4f
lea eax, [ebp - 0xb]
mov byte [ebp - 2], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
je 0x10010ec8
movaps xmm0, xmmword [0x1004c460]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x49536f55
mov dword [ebp - 0x10], 0x5f5a5e
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x16
jb 0x10010e8c
lea eax, [ebp - 0x23]
mov byte [ebp - 0xd], bl
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10010ec8
test esi, esi
jne 0x10010eb9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push ebx
push ebx
push 0x11
push esi
call edi
neg eax
sbb al, al
inc al
jmp 0x10010eca
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10010ecf
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x10010f09
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10010f0d
cmp edx, esi
jne 0x10010ef2
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10010f2d
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10010f31
cmp edx, esi
jne 0x10010f16
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10010f51
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10010f55
cmp edx, esi
jne 0x10010f3a
popfd
popal
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10010fdf
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10053040]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.1000aaf3
test eax, eax
jne 0x10011000
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movaps xmm0, xmmword [0x1004b7d0]
push ebx
push esi
xor ebx, ebx
push edi
movups xmmword [ebp - 0x24], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xe
jb 0x10011012
mov byte [ebp - 0x15], bl
mov cl, 0x3f
mov dword [ebp - 0x14], 0x5b4b513f
mov eax, ebx
mov dword [ebp - 0x10], 0x5b115353
mov word [ebp - 0xc], 0x5353
mov byte [ebp - 0xa], bl
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 9
jae 0x1001104c
mov cl, byte [ebp - 0x14]
jmp 0x1001103d
lea eax, [ebp - 0x23]
mov byte [ebp - 0xa], bl
push eax
lea eax, [ebp - 0x13]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x116e058
mov edi, eax
call fcn.1000d217
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x100110a5
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push esi
call edi
test eax, eax
js 0x10010ff8
cmp dword [ebp - 8], ebx
ja 0x10010ff8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bff4
leave
ret

Function at 0x100110b4
Capabilities:
Resume thread

Disassembly:
push 0xc
push 0x1004edc8
call fcn.1003cf40
mov esi, dword [0x10056934]
test esi, esi
jne 0x100110cf
or eax, 0xffffffff
jmp 0x1001112c
and dword [ebp - 4], 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x100110ef
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x1001112c
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x10011106
mov dword [ebp - 4], 0xfffffffe
push 2
pop eax
jmp 0x1001112c
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
test eax, eax
jns 0x10011123
mov dword [ebp - 4], 0xfffffffe
push 3
jmp 0x10011103
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001136e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], 0x2f322740
push edi
mov esi, ecx
mov word [ebp - 8], 0x3035
mov dl, 0x40
mov byte [ebp - 6], bl
mov eax, ebx
xor byte [ebp + eax - 0xb], dl
inc eax
cmp eax, 5
jae 0x1001139e
mov dl, byte [ebp - 0xc]
jmp 0x1001138f
sub esp, 0x18
mov byte [ebp - 6], bl
lea eax, [ebp - 0xb]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi]
call fcn.1000c655
mov edi, eax
mov dword [ebp - 0x1c], 0x5f455331
add esp, 0x18
mov dword [ebp - 0x18], 0x505d526e
mov cl, 0x31
mov dword [ebp - 0x14], 0x50536e5f
mov word [ebp - 0x10], 0x5a5f
mov eax, ebx
mov byte [ebp - 0xe], bl
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xd
jae 0x100113ec
mov cl, byte [ebp - 0x1c]
jmp 0x100113dd
sub esp, 0x18
mov byte [ebp - 0xe], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, edi
call fcn.1000c655
add esp, 0x18
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10011a34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], 0x33212240
mov esi, ecx
mov dword [ebp - 0xc], 0x2f231f25
mov cl, 0x40
mov word [ebp - 8], 0x33
mov eax, ebx
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 8
jae 0x10011a67
mov cl, byte [ebp - 0x10]
jmp 0x10011a58
sub esp, 0x18
mov byte [ebp - 7], bl
lea eax, [ebp - 0xf]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi]
call fcn.1000c655
add esp, 0x18
mov dword [esi + 4], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10011a95
mov dword [esi + 4], ebx
movaps xmm0, xmmword [str.1SE_naPEYBgXTF]
mov ecx, ebx
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x10011aa2
sub esp, 0x18
mov byte [ebp - 5], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi + 4]
call fcn.1000c655
add esp, 0x18
mov dword [esi + 8], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10011ade
mov dword [esi + 8], ebx
cmp dword [esi + 8], ebx
je 0x10011af6
cmp dword [0x10056bd8], ebx
mov ecx, 0x10b78ba
sete dl
call fcn.1000d168
pop esi
pop ebx
leave
ret
Function at 0x1001217d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
mov eax, ecx
mov dword [ebp - 4], 8
push esi
push edi
mov dword [ebp - 8], eax
xor ebx, ebx
lea edi, [eax + 8]
sub esp, 0x18
mov dword [ebp - 0x54], 0x33210240
mov esi, esp
mov dword [ebp - 0x50], 0x21101f25
mov cl, 0x40
mov dword [ebp - 0x4c], 0x65393432
mov word [ebp - 0x48], 0x24
xor eax, eax
push ebx
xor byte [ebp + eax - 0x53], cl
inc eax
cmp eax, 0xc
jae 0x100121cb
mov cl, byte [ebp - 0x54]
jmp 0x100121bc
sub esp, 0x18
mov byte [ebp - 0x47], 0
lea eax, [ebp - 0x53]
mov ecx, esp
push eax
call fcn.10003da0
push esi
call fcn.100039e5
mov eax, dword [ebp - 8]
add esp, 0x20
mov ecx, dword [eax]
call fcn.1000c655
add esp, 0x18
mov dword [ebp - 0x14], 0x54435031
mov esi, eax
mov word [ebp - 0x10], 0x50
mov cl, 0x31
xor eax, eax
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 4
jae 0x10012215
mov cl, byte [ebp - 0x14]
jmp 0x10012206
sub esp, 0x18
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, esi
call fcn.1000c655
add esp, 0x18
mov dword [edi - 4], eax
mov cl, 4
mov dword [ebp - 0x20], 0x745b6f04
mov dword [ebp - 0x1c], 0x7d707665
xor eax, eax
mov byte [ebp - 0x18], 0
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 7
jae 0x10012259
mov cl, byte [ebp - 0x20]
jmp 0x1001224a
sub esp, 0x18
mov byte [ebp - 0x18], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, esi
call fcn.1000c655
add esp, 0x18
mov dword [edi], eax
xor dl, dl
mov ecx, eax
call fcn.1000c87f
mov cl, 0x3b
mov dword [ebp - 0x2c], 0x4b645e3b
mov dword [ebp - 0x28], 0x424f495a
xor eax, eax
mov byte [ebp - 0x24], 0
xor byte [ebp + eax - 0x2b], cl
inc eax
cmp eax, 7
jae 0x100122a5
mov cl, byte [ebp - 0x2c]
jmp 0x10012296
sub esp, 0x18
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x2b]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, esi
call fcn.1000c655
add esp, 0x18
mov dword [edi + 4], eax
xor dl, dl
mov ecx, eax
call fcn.1000c87f
mov cl, 0x3f
mov dword [ebp - 0x44], 0x60585d3f
mov dword [ebp - 0x40], 0x524d5051
xor eax, eax
mov word [ebp - 0x3c], 0x535e
mov byte [ebp - 0x3a], 0
xor byte [ebp + eax - 0x43], cl
inc eax
cmp eax, 9
jae 0x100122f8
mov cl, byte [ebp - 0x44]
jmp 0x100122e9
sub esp, 0x18
mov byte [ebp - 0x3a], 0
lea eax, [ebp - 0x43]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, esi
call fcn.1000c655
add esp, 0x18
mov dword [edi + 8], eax
xor edx, edx
mov dword [ebp - 0x38], 0x330b0e6c
mov cl, 0x6c
mov dword [ebp - 0x34], 0xd011f
mov word [ebp - 0x30], dx
mov eax, edx
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 8
jae 0x1001233e
mov cl, byte [ebp - 0x38]
jmp 0x1001232f
sub esp, 0x18
mov byte [ebp - 0x2f], dl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, esi
call fcn.1000c655
add esp, 0x18
mov dword [edi + 0xc], eax
inc ebx
add edi, 0x14
sub dword [ebp - 4], 1
jne 0x10012197
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10014c95
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x1003ea7e
call fcn.1003d3d1
mov esi, ecx
mov edx, dword [0x10056bc8]
test edx, edx
js 0x10014d9b
cmp edx, 0x17
jg 0x10014d9b
mov ecx, dword [esi + 0x14]
call fcn.1000cffb
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, ebx
mov eax, dword [0x10056bc8]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
push eax
cmp eax, 0xa
jge 0x10014d13
movaps xmm0, xmmword [0x1004c3a0]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x5f550b03
mov word [ebp - 0x30], 0x5f
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x14
jb 0x10014d01
mov byte [ebp - 0x2f], bl
jmp 0x10014d38
movaps xmm0, xmmword [0x1004c6c0]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x3838326c
mov byte [ebp - 0x30], bl
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x13
jb 0x10014d28
mov byte [ebp - 0x30], bl
sub esp, 0x18
lea eax, [ebp - 0x43]
mov ecx, esp
push eax
call fcn.10003da0
lea eax, [ebp - 0x60]
push eax
call fcn.100039e5
add esp, 0x20
lea ecx, [ebp - 0x2c]
push eax
call fcn.10008af4
lea ecx, [ebp - 0x60]
call fcn.10003b9e
mov ecx, dword [esi + 0x1c]
lea edx, [ebp - 0x2c]
call fcn.1000d0e0
mov eax, dword [0x10056bc8]
test eax, eax
jle 0x10014d7e
push ecx
push eax
call fcn.10014c4c
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, edi
jbe 0x10014d92
mov ecx, dword [ebp - 0x2c]
inc edx
call fcn.10003b71
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x2c], bl
mov edx, dword [0x10056bd4]
cmp edx, 0x14
ja 0x10014ddc
mov ecx, dword [esi + 0x18]
call fcn.1000cffb
mov edx, dword [0x10056bd4]
mov ecx, dword [esi + 0x20]
call fcn.1000d103
movd xmm0, dword [0x10056bd4]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x1004b76c]
movss dword [0x100530dc], xmm0
call fcn.10013e7d
call fcn.1003d38f
ret
Function at 0x10014e8c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [str.___3_]
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x2532
push esi
mov esi, ecx
mov byte [ebp - 6], bl
movups xmmword [ebp - 0x18], xmm0
mov edx, ebx
mov al, byte [ebp - 0x18]
xor byte [ebp + edx - 0x17], al
inc edx
cmp edx, 0x11
jb 0x10014eae
sub esp, 0x18
mov byte [ebp - 6], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi]
call fcn.1000c655
mov dword [esi + 4], eax
add esp, 0x18
mov cl, 0x31
mov dword [ebp - 0x14], 0x43454231
mov dword [ebp - 0x10], 0x575f586e
mov eax, ebx
mov dword [ebp - 0xc], 0x6e5e
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x10014f01
mov cl, byte [ebp - 0x14]
jmp 0x10014ef2
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi + 4]
call fcn.1000c655
mov dword [esi + 8], eax
add esp, 0x18
mov cl, 4
mov dword [ebp - 0x14], 0x76707704
mov dword [ebp - 0x10], 0x626a6d5b
mov eax, ebx
mov dword [ebp - 0xc], 0x365b6b
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x10014f48
mov cl, byte [ebp - 0x14]
jmp 0x10014f39
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi + 4]
call fcn.1000c655
mov dword [esi + 0xc], eax
add esp, 0x18
mov cl, 0x3b
mov dword [ebp - 0x14], 0x494f483b
mov dword [ebp - 0x10], 0x5d555264
mov eax, ebx
mov dword [ebp - 0xc], 0x86454
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x10014f8f
mov cl, byte [ebp - 0x14]
jmp 0x10014f80
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi + 4]
call fcn.1000c655
mov dword [esi + 0x10], eax
add esp, 0x18
mov cl, 0x3f
mov dword [ebp - 0x14], 0x5852563f
mov dword [ebp - 0x10], 0x5e4b4c60
mov eax, ebx
mov dword [ebp - 0xc], 0x51564b4d
mov word [ebp - 8], 0x58
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x10014fdc
mov cl, byte [ebp - 0x14]
jmp 0x10014fcd
sub esp, 0x18
mov byte [ebp - 7], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi + 4]
call fcn.1000c655
mov dword [esi + 0x18], eax
add esp, 0x18
mov cl, 0x6c
mov dword [ebp - 0x14], 0xb01056c
mov dword [ebp - 0x10], 0x1f150e33
mov eax, ebx
mov dword [ebp - 0xc], 0x8020d18
mov byte [ebp - 8], bl
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x10015026
mov cl, byte [ebp - 0x14]
jmp 0x10015017
sub esp, 0x18
mov byte [ebp - 8], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi + 4]
call fcn.1000c655
add esp, 0x18
mov dword [esi + 0x1c], eax
pop esi
pop ebx
leave
ret
Function at 0x10015623
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x1003eb4a
call fcn.1003d39e
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x1001574e
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esi + 0x20], 1
mov word [esi + 0x28], ax
call fcn.100159d3
movaps xmm0, xmmword [0x1004bc30]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x6b10
mov dword [ebp - 0x2c], 0x6d00000a
mov byte [ebp - 0x28], bl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x17
jb 0x10015673
lea eax, [ebp - 0x3f]
mov byte [ebp - 0x28], bl
push eax
lea ecx, [ebp - 0x24]
call fcn.10003da0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x24]
mov ecx, dword [esi + 0xc]
call fcn.1000d0e0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.10003b9e
cmp dword [ebp + 0x1c], 0
jne 0x100156ef
mov cl, 0x4a
mov dword [ebp - 0x18], 0x2f23194a
mov dword [ebp - 0x14], 0x96a2f2d
mov eax, ebx
mov dword [ebp - 0x10], 0x242b26
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xa
jae 0x100156d7
mov cl, byte [ebp - 0x18]
jmp 0x100156c8
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10003da0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
jmp 0x1001573e
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x1004c020]
mov ecx, ebx
cmova eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 4
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x1001570e
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003da0
lea eax, [ebp - 0x40]
push eax
call fcn.100039e5
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.1000d0e0
lea ecx, [ebp - 0x40]
call fcn.10003b9e
lea ecx, [ebp + 0xc]
call fcn.10003b9e
call fcn.1003d37b
ret 0x1c
Function at 0x1001575e
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x1003eb94
call fcn.1003d39e
mov esi, ecx
mov di, word [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test di, di
je 0x100158f4
cmp word [esi + 0x28], bx
jg 0x100158f4
movaps xmm0, xmmword [0x1004c800]
mov ecx, ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x24], ebx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x747e7e15
mov dword [ebp - 0x14], 0x137e7e
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x16
jb 0x100157a9
lea eax, [ebp - 0x27]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10003da0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, dword [esi + 8]
call fcn.1000d0e0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.10003b9e
movaps xmm0, xmmword [str._LDH_G_GN_t_DL]
mov ecx, ebx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x19197209
mov dword [ebp - 0x14], 0x74191913
mov byte [ebp - 0x10], bl
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x17
jb 0x100157fd
lea eax, [ebp - 0x27]
mov byte [ebp - 0x10], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10003da0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
mov ecx, dword [esi + 0xc]
call fcn.1000d0e0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.10003b9e
cmp dword [ebp + 0x1c], 0
jne 0x10015879
mov cl, 2
mov dword [ebp - 0x1c], 0x676b5102
mov dword [ebp - 0x18], 0x41226765
mov eax, ebx
mov dword [ebp - 0x14], 0x6c636e
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xa
jae 0x10015861
mov cl, byte [ebp - 0x1c]
jmp 0x10015852
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10003da0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x40]
jmp 0x100158c8
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x1004bfa0]
mov ecx, ebx
cmova eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 6
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x10015898
sub esp, 0x18
mov byte [ebp - 0x13], bl
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.10003da0
lea eax, [ebp - 0x40]
push eax
call fcn.100039e5
add esp, 0x20
mov byte [ebp - 4], 4
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.1000d0e0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.10003b9e
mov ecx, dword [esi]
push 2
call dword [0x1004a374]
mov ecx, esi
mov word [esi + 0x28], di
mov byte [esi + 0x21], 1
call fcn.100159d3
lea ecx, [ebp + 0xc]
call fcn.10003b9e
call fcn.1003d37b
ret 0x1c
Function at 0x10015904
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x1003ebce
call fcn.1003d39e
mov esi, ecx
mov ax, word [ebp + 8]
xor edx, edx
mov dword [ebp - 4], edx
mov word [esi + 0x28], ax
cmp dword [ebp + 0x1c], edx
jne 0x10015964
mov cl, 0x6c
mov dword [ebp - 0x1c], 0x9053f6c
mov dword [ebp - 0x18], 0x2f4c090b
mov eax, edx
mov dword [ebp - 0x14], 0x20d00
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xa
jae 0x1001594c
mov cl, byte [ebp - 0x1c]
jmp 0x1001593d
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], dl
push eax
lea ecx, [ebp - 0x3c]
call fcn.10003da0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x3c]
jmp 0x100159b3
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x1004bf90]
mov ecx, edx
cmova eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 9
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x10015983
sub esp, 0x18
mov byte [ebp - 0xf], dl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003da0
lea eax, [ebp - 0x3c]
push eax
call fcn.100039e5
add esp, 0x20
mov byte [ebp - 4], 2
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.1000d0e0
lea ecx, [ebp - 0x3c]
call fcn.10003b9e
lea ecx, [ebp + 0xc]
call fcn.10003b9e
call fcn.1003d37b
ret 0x1c
Function at 0x10015dd1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x1004c110]
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x29331f25
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0xc], 0x34213534
xor ecx, ecx
mov dword [ebp - 8], 0x2e2f29
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x1a
jb 0x10015dfc
sub esp, 0x18
mov byte [ebp - 5], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi]
call fcn.1000c655
add esp, 0x18
mov dword [esi + 4], eax
pop esi
leave
ret
Function at 0x10016f15
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [str.__4.]
push ebx
push esi
xor ebx, ebx
mov esi, ecx
movups xmmword [ebp - 0x18], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0xe
jb 0x10016f2e
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi]
call fcn.1000c655
mov dword [esi + 4], eax
add esp, 0x18
mov cl, 0x31
mov dword [ebp - 0x14], 0x5f457331
mov dword [ebp - 0x10], 0x4345626e
mov eax, ebx
mov dword [ebp - 0xc], 0x45565f54
mov word [ebp - 8], 0x59
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x10016f87
mov cl, byte [ebp - 0x14]
jmp 0x10016f78
sub esp, 0x18
mov byte [ebp - 7], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi]
call fcn.1000c655
mov dword [esi + 8], eax
add esp, 0x18
mov cl, 4
mov dword [ebp - 0x14], 0x6a704604
mov dword [ebp - 0x10], 0x6570575b
mov eax, ebx
mov dword [ebp - 0xc], 0x656a6d69
mov byte [ebp - 8], bl
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x10016fd0
mov cl, byte [ebp - 0x14]
jmp 0x10016fc1
sub esp, 0x18
mov byte [ebp - 8], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi]
call fcn.1000c655
mov dword [esi + 0xc], eax
add esp, 0x18
mov cl, 0x3b
mov dword [ebp - 0x18], 0x554f793b
mov dword [ebp - 0x14], 0x435e7f64
mov eax, ebx
mov dword [ebp - 0x10], 0x52495e4f
mov word [ebp - 0xc], 0x424f
mov byte [ebp - 0xa], bl
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xd
jae 0x1001701f
mov cl, byte [ebp - 0x18]
jmp 0x10017010
sub esp, 0x18
mov byte [ebp - 0xa], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi]
call fcn.1000c655
movaps xmm0, xmmword [0x1004c470]
add esp, 0x18
mov dword [esi + 0x10], eax
mov ecx, ebx
movups xmmword [ebp - 0x18], xmm0
mov byte [ebp - 8], bl
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0xf
jb 0x1001704d
sub esp, 0x18
mov byte [ebp - 8], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi]
call fcn.1000c655
movaps xmm0, xmmword [0x1004bcd0]
add esp, 0x18
mov dword [esi + 0x14], eax
mov ecx, ebx
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 9
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x10
jb 0x1001708b
sub esp, 0x18
mov byte [ebp - 7], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi]
call fcn.1000c655
add esp, 0x18
mov dword [esi + 0x18], eax
pop esi
pop ebx
leave
ret