joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000edc2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x20], 0x2a262a5e
sub esp, 0x18
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x2a372a01
mov word [ebp - 0x18], 0x3b32
mov esi, esp
mov edi, dword [ebx]
mov byte [ebp - 0x16], 0
call fcn.10001431
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009101
mov edi, dword [ebx]
lea ecx, [ebp - 0x20]
mov dword [ebx + 4], eax
mov esi, esp
mov dword [ebp - 0x20], 0x706d781f
mov dword [ebp - 0x1c], 0x7d406f6a
mov dword [ebp - 0x18], 0x7a6c7e
call fcn.1000220a
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009101
add esp, 0x18
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebp - 0xc], 0xa
lea ecx, [ebx + 0x38]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov ebx, dword [ebx]
lea ecx, [ebp - 0x20]
sub esp, 0x18
mov dword [ebp - 0x20], 0x7b667314
mov edi, esp
mov dword [ebp - 0x1c], 0x314b6461
mov word [ebp - 0x18], 0x70
push eax
sub esp, 0x18
mov esi, esp
call fcn.100021b9
push eax
mov ecx, esi
call fcn.10002604
push edi
call fcn.1000485c
add esp, 0x20
mov ecx, ebx
call fcn.10009101
mov edi, esp
mov dword [ebp - 0x2c], 0x717d7105
push dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 0x28], 0x6276685a
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x2c]
sub esp, 0x18
mov dword [ebp - 0x24], 0x61205a
mov esi, esp
mov dword [eax - 0x28], ebx
call fcn.1000220a
push eax
mov ecx, esi
call fcn.10002604
push edi
call fcn.1000485c
add esp, 0x20
mov ecx, ebx
call fcn.10009101
mov ecx, dword [ebp - 8]
add esp, 0x18
mov ebx, dword [ebp - 0x10]
mov dword [ecx], eax
add ecx, 4
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 8], ecx
sub dword [ebp - 0xc], 1
mov dword [ebp - 4], eax
jne 0x1000ee51
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f95f
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 0xf
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x1000f969
pop edi
pop esi
mov byte [ecx + 0x10], 0
ret
Function at 0x100103ae
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x100354cd
call fcn.10034326
mov esi, ecx
mov edx, dword [0x10046388]
test edx, edx
js 0x100104b4
cmp edx, 0x17
jg 0x100104b4
mov ecx, dword [esi + 0x14]
call fcn.10009ab1
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, ebx
mov eax, dword [0x10046388]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
push eax
cmp eax, 0xa
jge 0x1001042c
movaps xmm0, xmmword [0x1003ea50]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x656f3139
mov word [ebp - 0x30], 0x65
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x14
jb 0x1001041a
mov byte [ebp - 0x2f], bl
jmp 0x10010451
movaps xmm0, xmmword [0x1003e8a0]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x3e3e346a
mov byte [ebp - 0x30], bl
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x13
jb 0x10010441
mov byte [ebp - 0x30], bl
sub esp, 0x18
lea eax, [ebp - 0x43]
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x60]
push eax
call fcn.1000485c
add esp, 0x20
lea ecx, [ebp - 0x2c]
push eax
call fcn.10005397
lea ecx, [ebp - 0x60]
call fcn.10002410
mov ecx, dword [esi + 0x1c]
lea edx, [ebp - 0x2c]
call fcn.10009b96
mov eax, dword [0x10046388]
test eax, eax
jle 0x10010497
push ecx
push eax
call fcn.10010365
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, edi
jbe 0x100104ab
mov ecx, dword [ebp - 0x2c]
inc edx
call fcn.100023e3
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x2c], bl
mov edx, dword [0x10046394]
cmp edx, 0x14
ja 0x100104f5
mov ecx, dword [esi + 0x18]
call fcn.10009ab1
mov edx, dword [0x10046394]
mov ecx, dword [esi + 0x20]
call fcn.10009bb9
movd xmm0, dword [0x10046394]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x1003dc08]
movss dword [0x100440a4], xmm0
call fcn.1000f58a
call fcn.100342e4
ret
Function at 0x100105a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [0x1003e500]
xor edx, edx
push ebx
mov ebx, ecx
mov word [ebp - 8], 0x3b2c
push esi
push edi
movups xmmword [ebp - 0x18], xmm0
mov esi, dword [ebx]
mov byte [ebp - 6], 0
mov al, byte [ebp - 0x18]
xor byte [ebp + edx - 0x17], al
inc edx
cmp edx, 0x11
jb 0x100105c9
sub esp, 0x18
mov byte [ebp - 6], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
mov edi, eax
mov dword [ebp - 0x14], 0x6d6b6c1f
lea ecx, [ebp - 0x14]
mov dword [ebx + 4], edi
mov dword [ebp - 0x10], 0x79717640
mov esi, esp
mov dword [ebp - 0xc], 0x2e4070
call fcn.1000220a
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009101
mov esi, dword [ebx + 4]
add esp, 0x18
mov dword [ebx + 8], eax
mov cl, 0x14
mov dword [ebp - 0x14], 0x66606714
xor eax, eax
mov dword [ebp - 0x10], 0x727a7d4b
mov dword [ebp - 0xc], 0x264b7b
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x10010653
mov cl, byte [ebp - 0x14]
jmp 0x10010644
sub esp, 0x18
mov byte [ebp - 9], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
mov edi, dword [ebx + 4]
lea ecx, [ebp - 0x14]
mov dword [ebx + 0xc], eax
mov esi, esp
mov dword [ebp - 0x14], 0x77717605
mov dword [ebp - 0x10], 0x636b6c5a
mov dword [ebp - 0xc], 0x365a6a
call fcn.1000220a
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009101
mov esi, dword [ebx + 4]
add esp, 0x18
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebp - 0x13], 0x221a1014
mov dword [ebp - 0xf], 0xf1c090e
push 0x7d
pop ecx
mov byte [ebp - 0x14], cl
mov dword [ebp - 0xb], 0x1a131409
mov byte [ebp - 7], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x100106d9
mov cl, byte [ebp - 0x14]
jmp 0x100106ca
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
mov esi, dword [ebx + 4]
add esp, 0x18
mov dword [ebx + 0x18], eax
mov cl, 0x46
mov dword [ebp - 0x14], 0x212b2f46
xor eax, eax
mov dword [ebp - 0x10], 0x353f2419
mov dword [ebp - 0xc], 0x22282732
mov byte [ebp - 8], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x10010727
mov cl, byte [ebp - 0x14]
jmp 0x10010718
sub esp, 0x18
mov byte [ebp - 8], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
add esp, 0x18
mov dword [ebx + 0x1c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10010b81
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 6
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x10010b8b
pop edi
pop esi
mov byte [ecx + 7], 0
ret

Function at 0x10010d36
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x10035599
call fcn.100342f3
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x10010e61
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esi + 0x20], 1
mov word [esi + 0x28], ax
call fcn.100110d5
movaps xmm0, xmmword [0x1003e440]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x3d3d562d
mov dword [ebp - 0x2c], 0x503d3d37
mov byte [ebp - 0x28], bl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x17
jb 0x10010d86
lea eax, [ebp - 0x3f]
mov byte [ebp - 0x28], bl
push eax
lea ecx, [ebp - 0x24]
call fcn.10002604
mov byte [ebp - 4], 1
lea edx, [ebp - 0x24]
mov ecx, dword [esi + 0xc]
call fcn.10009b96
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.10002410
cmp dword [ebp + 0x1c], 0
jne 0x10010e02
mov cl, 0x52
mov dword [ebp - 0x18], 0x373b0152
mov dword [ebp - 0x14], 0x11723735
mov eax, ebx
mov dword [ebp - 0x10], 0x3c333e
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xa
jae 0x10010dea
mov cl, byte [ebp - 0x18]
jmp 0x10010ddb
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10002604
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
jmp 0x10010e51
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x1003e7e0]
mov ecx, ebx
cmova eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 0x70
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x10010e21
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x40]
push eax
call fcn.1000485c
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10009b96
lea ecx, [ebp - 0x40]
call fcn.10002410
lea ecx, [ebp + 0xc]
call fcn.10002410
call fcn.100342d0
ret 0x1c
Function at 0x10010e71
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x100355e3
call fcn.100342f3
mov esi, ecx
mov di, word [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test di, di
je 0x10011007
cmp word [esi + 0x28], bx
jg 0x10011007
movaps xmm0, xmmword [0x1003e600]
mov ecx, ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x24], ebx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x53595932
mov dword [ebp - 0x14], 0x345959
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x16
jb 0x10010ebc
lea eax, [ebp - 0x27]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10002604
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, dword [esi + 8]
call fcn.10009b96
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.10002410
movaps xmm0, xmmword [0x1003dfa0]
mov ecx, ebx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x6066d16
mov dword [ebp - 0x14], 0x6b06060c
mov byte [ebp - 0x10], bl
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x17
jb 0x10010f10
lea eax, [ebp - 0x27]
mov byte [ebp - 0x10], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10002604
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
mov ecx, dword [esi + 0xc]
call fcn.10009b96
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.10002410
cmp dword [ebp + 0x1c], 0
jne 0x10010f8c
mov cl, 1
mov dword [ebp - 0x1c], 0x64685201
mov dword [ebp - 0x18], 0x42216466
mov eax, ebx
mov dword [ebp - 0x14], 0x6f606d
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xa
jae 0x10010f74
mov cl, byte [ebp - 0x1c]
jmp 0x10010f65
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10002604
mov byte [ebp - 4], 3
lea edx, [ebp - 0x40]
jmp 0x10010fdb
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x1003e830]
mov ecx, ebx
cmova eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x4e
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x10010fab
sub esp, 0x18
mov byte [ebp - 0x13], bl
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x40]
push eax
call fcn.1000485c
add esp, 0x20
mov byte [ebp - 4], 4
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10009b96
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.10002410
mov ecx, dword [esi]
push 2
call dword [0x1003cc44]
mov ecx, esi
mov word [esi + 0x28], di
mov byte [esi + 0x21], 1
call fcn.100110d5
lea ecx, [ebp + 0xc]
call fcn.10002410
call fcn.100342d0
ret 0x1c
Function at 0x10011017
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x1003561d
call fcn.100342f3
mov esi, ecx
mov ax, word [ebp + 8]
xor edx, edx
mov dword [ebp - 4], edx
mov word [esi + 0x28], ax
cmp dword [ebp + 0x1c], edx
jne 0x10011066
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x6b675d0e
mov dword [ebp - 0x18], 0x4d2e6b69
mov dword [ebp - 0x14], 0x606f62
call fcn.1000220a
push eax
lea ecx, [ebp - 0x3c]
call fcn.10002604
mov byte [ebp - 4], 1
lea edx, [ebp - 0x3c]
jmp 0x100110b5
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x1003eb60]
mov ecx, edx
cmova eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 0x52
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x10011085
sub esp, 0x18
mov byte [ebp - 0xf], dl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x3c]
push eax
call fcn.1000485c
add esp, 0x20
mov byte [ebp - 4], 2
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10009b96
lea ecx, [ebp - 0x3c]
call fcn.10002410
lea ecx, [ebp + 0xc]
call fcn.10002410
call fcn.100342d0
ret 0x1c
Function at 0x100114d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x1003e2f0]
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x372d013b
push edi
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0xc], 0x2a3f2b2a
xor ecx, ecx
mov edi, dword [esi]
mov dword [ebp - 8], 0x303137
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x1a
jb 0x10011502
sub esp, 0x18
mov byte [ebp - 5], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, edi
call fcn.10009101
add esp, 0x18
mov dword [esi + 4], eax
pop edi
pop esi
leave
ret
Function at 0x100125ec
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [str._0]
xor edx, edx
push ebx
mov ebx, ecx
push esi
push edi
movups xmmword [ebp - 0x18], xmm0
mov esi, dword [ebx]
mov al, byte [ebp - 0x18]
xor byte [ebp + edx - 0x17], al
inc edx
cmp edx, 0xe
jb 0x10012606
sub esp, 0x18
mov byte [ebp - 9], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
mov esi, dword [ebx]
add esp, 0x18
mov dword [ebx + 4], eax
mov cl, 0x1f
mov dword [ebp - 0x14], 0x716b5d1f
xor eax, eax
mov dword [ebp - 0x10], 0x6d6b4c40
mov dword [ebp - 0xc], 0x6b78717a
mov word [ebp - 8], 0x77
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x10012662
mov cl, byte [ebp - 0x14]
jmp 0x10012653
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
mov esi, dword [ebx]
add esp, 0x18
mov dword [ebx + 8], eax
mov cl, 0x14
mov dword [ebp - 0x14], 0x7a605614
xor eax, eax
mov dword [ebp - 0x10], 0x7560474b
mov dword [ebp - 0xc], 0x757a7d79
mov byte [ebp - 8], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x100126af
mov cl, byte [ebp - 0x14]
jmp 0x100126a0
sub esp, 0x18
mov byte [ebp - 8], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
mov esi, dword [ebx]
add esp, 0x18
mov dword [ebx + 0xc], eax
mov cl, 5
mov dword [ebp - 0x18], 0x6b714705
xor eax, eax
mov dword [ebp - 0x14], 0x7d60415a
mov dword [ebp - 0x10], 0x6c776071
mov word [ebp - 0xc], 0x7c71
mov byte [ebp - 0xa], 0
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xd
jae 0x10012702
mov cl, byte [ebp - 0x18]
jmp 0x100126f3
sub esp, 0x18
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
movaps xmm0, xmmword [0x1003e030]
lea ecx, [ebp - 0x18]
mov edi, dword [ebx]
mov esi, esp
mov dword [ebx + 0x10], eax
movups xmmword [ebp - 0x18], xmm0
mov byte [ebp - 8], 0
call fcn.1000f95f
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009101
movaps xmm0, xmmword [0x1003e1f0]
add esp, 0x18
mov esi, dword [ebx]
xor ecx, ecx
mov dword [ebx + 0x14], eax
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0x23
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x10
jb 0x10012763
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009101
add esp, 0x18
mov dword [ebx + 0x18], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10013d0e
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 0x10
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x10013d18
pop edi
pop esi
mov byte [ecx + 0x11], 0
ret
Function at 0x100161ad
Capabilities:
Encode data using xor

Disassembly:
push 8
push 0x88
mov eax, 0x10035b40
call fcn.10034421
lea edi, [ecx + 0x130]
mov dword [ebp - 0x24], 3
lea esi, [ecx + 0x44]
mov ecx, dword [esi]
call fcn.10004ccd
test eax, eax
je 0x10016235
movzx ecx, word [esi + 4]
movups xmm0, xmmword [0x1003dd70]
movzx eax, word [edi]
push ecx
push eax
movups xmmword [ebp - 0x38], xmm0
xor ecx, ecx
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0xe
jb 0x100161ef
sub esp, 0x18
mov byte [ebp - 0x29], 0
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x68]
push eax
call fcn.1000485c
add esp, 0x24
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 0xf
jbe 0x10016226
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10002604
mov byte [ebp - 4], 1
jmp 0x100162b0
cmp dword [esi], 1
jne 0x100162e9
cmp byte [esi + 6], 0
je 0x100162e9
movzx ecx, word [esi + 4]
movzx eax, word [edi]
push ecx
push eax
mov cl, 0x1d
mov dword [ebp - 0x20], 0x3d79381d
mov dword [ebp - 0x1c], 0x79383d32
xor eax, eax
mov byte [ebp - 0x18], 0
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 7
jae 0x10016276
mov cl, byte [ebp - 0x20]
jmp 0x10016267
sub esp, 0x18
mov byte [ebp - 0x18], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x68]
push eax
call fcn.1000485c
add esp, 0x24
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 0xf
jbe 0x100162a3
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10002604
mov byte [ebp - 4], 3
mov ecx, dword [esi + 0xc]
lea edx, [ebp - 0x50]
call fcn.10009b96
lea ecx, [ebp - 0x50]
call fcn.10002410
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10002410
movzx eax, word [edi]
xorps xmm3, xmm3
mov ecx, dword [esi + 0x10]
xorps xmm2, xmm2
movd xmm1, eax
cvtdq2ps xmm1, xmm1
call fcn.10009a34
jmp 0x10016353
movzx eax, word [esi + 4]
push eax
sub esp, 0x18
mov word [ebp - 0x14], 0x73
lea eax, [ebp - 0x13]
mov byte [ebp - 0x13], 0
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x98]
push eax
call fcn.1000485c
add esp, 0x20
mov dword [ebp - 4], 4
cmp dword [eax + 0x14], 0xf
jbe 0x10016324
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x80]
call fcn.10002604
mov byte [ebp - 4], 5
lea edx, [ebp - 0x80]
mov ecx, dword [esi + 0xc]
call fcn.10009b96
lea ecx, [ebp - 0x80]
call fcn.10002410
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.10002410
mov ax, word [edi]
cmp ax, word [esi + 4]
jb 0x10016369
mov ecx, dword [esi + 0xc]
mov edx, 0xff80ff00
call fcn.10009bdc
add edi, 2
add esi, 0x18
sub dword [ebp - 0x24], 1
jne 0x100161ce
call fcn.1003439e
ret
Function at 0x1001637f
Capabilities:
Encode data using xor

Disassembly:
push 0x74
mov eax, 0x10035b9f
call fcn.100342f3
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
movzx eax, word [esi + 0x136]
mov ecx, eax
mov word [esi + 0x13e], ax
movzx eax, word [esi + 0x140]
push eax
push ecx
cmp byte [esi + 0x13c], bl
je 0x100163fc
movaps xmm0, xmmword [0x1003e4c0]
mov ecx, ebx
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x602d6c61
mov byte [ebp - 0x24], bl
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x13
jb 0x100163ca
sub esp, 0x18
mov byte [ebp - 0x24], bl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x80]
push eax
call fcn.1000485c
add esp, 0x24
mov dword [ebp - 4], ebx
xor ebx, ebx
inc ebx
jmp 0x1001644a
mov cl, 0x6c
mov dword [ebp - 0x20], 0x4c08496c
mov dword [ebp - 0x1c], 0x494c0a03
mov eax, ebx
mov word [ebp - 0x18], 8
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 8
jae 0x10016423
mov cl, byte [ebp - 0x20]
jmp 0x10016414
sub esp, 0x18
mov byte [ebp - 0x17], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x68]
push eax
call fcn.1000485c
add esp, 0x24
push 2
mov dword [ebp - 4], 1
pop ebx
cmp dword [eax + 0x14], 0xf
mov dword [ebp - 0x10], ebx
jbe 0x10016455
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10002604
mov dword [ebp - 4], 2
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0xc]
call fcn.10009b96
lea ecx, [ebp - 0x50]
call fcn.10002410
test bl, 2
je 0x10016488
lea ecx, [ebp - 0x68]
and ebx, 0xfffffffd
call fcn.10002410
test bl, 1
je 0x10016495
lea ecx, [ebp - 0x80]
call fcn.10002410
call fcn.100342d0
ret
Function at 0x1001649b
Capabilities:
Encode data using xor

Disassembly:
push 0x8c
mov eax, 0x10035bf7
call fcn.100342f3
mov edi, ecx
movzx eax, word [edi + 0x138]
xor ebx, ebx
movzx esi, word [edi + 0x136]
mov ecx, ebx
movaps xmm0, xmmword [str.lI_bL9]
push eax
mov word [edi + 0x13e], si
mov word [edi + 0x140], ax
push esi
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x45084944
mov byte [ebp - 0x1c], bl
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x13
jb 0x100164e3
sub esp, 0x18
mov byte [ebp - 0x1c], bl
lea eax, [ebp - 0x2f]
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x68]
push eax
call fcn.1000485c
add esp, 0x24
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 0xf
jbe 0x10016518
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10002604
mov byte [ebp - 4], 1
lea edx, [ebp - 0x50]
mov ecx, dword [edi + 0xc]
call fcn.10009b96
lea ecx, [ebp - 0x50]
call fcn.10002410
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10002410
lea esi, [edi + 0x50]
mov dword [ebp - 0x34], 3
lea ebx, [edi + 0x12a]
movzx ecx, word [ebx - 6]
mov dword [esi - 0xc], ecx
mov ax, word [ebx]
mov word [esi - 8], ax
mov al, byte [edi + 0x13b]
mov byte [esi - 6], al
call fcn.10004ccd
test eax, eax
je 0x10016603
movzx eax, word [esi - 8]
mov cl, 0x27
push eax
mov dword [ebp - 0x2c], 0x49526f27
xor eax, eax
mov dword [ebp - 0x28], 0x70a0753
mov dword [ebp - 0x24], 0x7080717
mov word [ebp - 0x20], 0x4302
mov byte [ebp - 0x1e], 0
xor byte [ebp + eax - 0x2b], cl
inc eax
cmp eax, 0xd
jae 0x100165af
mov cl, byte [ebp - 0x2c]
jmp 0x100165a0
sub esp, 0x18
mov byte [ebp - 0x1e], 0
lea eax, [ebp - 0x2b]
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x68]
push eax
call fcn.1000485c
add esp, 0x20
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 0xf
jbe 0x100165dc
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10002604
mov byte [ebp - 4], 3
lea edx, [ebp - 0x50]
mov ecx, dword [esi]
call fcn.10009b96
lea ecx, [ebp - 0x50]
call fcn.10002410
lea ecx, [ebp - 0x68]
jmp 0x10016692
cmp dword [esi - 0xc], 1
jne 0x100166b3
cmp byte [esi - 6], 0
je 0x100166b3
movzx eax, word [esi - 8]
mov cl, 0x57
push eax
mov dword [ebp - 0x18], 0x78776757
xor eax, eax
mov dword [ebp - 0x14], 0x337277
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 6
jae 0x1001663d
mov cl, byte [ebp - 0x18]
jmp 0x1001662e
sub esp, 0x18
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x98]
push eax
call fcn.1000485c
add esp, 0x20
mov dword [ebp - 4], 4
cmp dword [eax + 0x14], 0xf
jbe 0x1001666d
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x80]
call fcn.10002604
mov byte [ebp - 4], 5
lea edx, [ebp - 0x80]
mov ecx, dword [esi]
call fcn.10009b96
lea ecx, [ebp - 0x80]
call fcn.10002410
lea ecx, [ebp - 0x98]
or dword [ebp - 4], 0xffffffff
call fcn.10002410
mov ecx, dword [esi]
or edx, 0xffffffff
call fcn.10009bdc
movzx eax, word [esi - 8]
mov ecx, dword [esi + 4]
push eax
call fcn.100099df
pop ecx
add ebx, 2
add esi, 0x18
sub dword [ebp - 0x34], 1
jne 0x10016554
call fcn.100342d0
ret