joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c1f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6b31
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x1c
mov edx, dword [eax + edx*4]
mov eax, dword [0x10163178]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x1000c333
push 0x10163178
call fcn.100d50bc
add esp, 4
cmp dword [0x10163178], 0xffffffff
jne 0x1000c333
mov dword [ebp - 4], 0
mov eax, 8
mov dword [ebp - 0x1a], 0x67464073
mov dword [ebp - 0x16], 0x5643424e
vpmovsxbd ymm0, qword [ebp - 0x1a]
vpxor ymm0, ymm0, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
vmovq qword [ebp - 0x1a], xmm0
mov dword [ebp - 0x29], 0x637f4b5a
mov dword [ebp - 0x25], 0x75415043
vpmovsxbd ymm0, qword [ebp - 0x29]
vpxor ymm0, ymm0, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov word [ebp - 0x12], 0
mov dword [ebp - 0x21], 0x4c51464a
mov word [ebp - 0x1d], 0x58
mov byte [ebp - 0x1b], 1
vmovq qword [ebp - 0x29], xmm0
nop dword [eax]
lea ecx, [eax + 0x1e]
xor byte [ebp + eax - 0x29], cl
inc eax
cmp eax, 0xd
jb 0x1000c300
lea eax, [ebp - 0x1a]
mov byte [ebp - 0x1b], 0
push eax
lea eax, [ebp - 0x29]
push eax
vzeroupper
call fcn.1000f3e0
push 0x10163178
mov dword [0x101631b8], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x101631b8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + esi]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1000c350
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6b51
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x1c
mov edx, dword [eax + edx*4]
mov eax, dword [0x101631a4]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x1000c479
push 0x101631a4
call fcn.100d50bc
add esp, 4
cmp dword [0x101631a4], 0xffffffff
jne 0x1000c479
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x1d], 0x484c4073
mov dword [ebp - 0x19], 0x51774644
mov dword [ebp - 0x15], 0x4d5347
mov byte [ebp - 0x11], 1
nop
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x1d], al
inc ecx
cmp ecx, 0xb
jb 0x1000c3e0
mov dword [ebp - 0x2c], 0x637f4b5a
mov ecx, 8
mov dword [ebp - 0x28], 0x75415043
vpmovsxbd ymm1, qword [ebp - 0x2c]
vpxor ymm0, ymm1, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x24], 0x4c51464a
mov word [ebp - 0x20], 0x58
mov byte [ebp - 0x1e], 1
vmovq qword [ebp - 0x2c], xmm0
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0xd
jb 0x1000c446
lea eax, [ebp - 0x1d]
mov byte [ebp - 0x1e], 0
push eax
lea eax, [ebp - 0x2c]
push eax
vzeroupper
call fcn.1000f3e0
push 0x101631a4
mov dword [0x1016312c], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x1016312c]
mov ecx, dword [ebp - 0xc]
mov al, byte [eax + esi]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x1000c4a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6b71
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push esi
mov esi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x101631a0]
cmp eax, dword [edx + 4]
jle 0x1000c570
push 0x101631a0
call fcn.100d50bc
add esp, 4
cmp dword [0x101631a0], 0xffffffff
jne 0x1000c570
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x19], 0x44564073
mov dword [ebp - 0x15], 0x4c566c41
mov dword [ebp - 0x11], 0x464e41
mov byte [ebp - 0xd], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 0xb
jb 0x1000c516
mov byte [ebp - 0xd], 0
xor ecx, ecx
mov dword [ebp - 0x26], 0x52415d5d
mov dword [ebp - 0x22], 0x514a6647
mov dword [ebp - 0x1e], 0x51534f
mov byte [ebp - 0x1a], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x26], al
inc ecx
cmp ecx, 0xb
jb 0x1000c542
lea edx, [ebp - 0x19]
mov byte [ebp - 0x1a], 0
lea ecx, [ebp - 0x26]
call fcn.1000bfd0
push 0x101631a0
mov dword [0x10163120], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x10163120]
mov ecx, dword [ebp - 0xc]
add eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c590
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6b91
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push esi
mov esi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x10163168]
cmp eax, dword [edx + 4]
jle 0x1000c65f
push 0x10163168
call fcn.100d50bc
add esp, 4
cmp dword [0x10163168], 0xffffffff
jne 0x1000c65f
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x17], 0x65424073
mov dword [ebp - 0x13], 0x404f4057
mov word [ebp - 0xf], 0x42
mov byte [ebp - 0xd], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 9
jb 0x1000c605
mov byte [ebp - 0xd], 0
xor ecx, ecx
mov dword [ebp - 0x24], 0x52415d5d
mov dword [ebp - 0x20], 0x44487347
mov dword [ebp - 0x1c], 0x5a425f
mov byte [ebp - 0x18], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0xb
jb 0x1000c631
lea edx, [ebp - 0x17]
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x24]
call fcn.1000bfd0
push 0x10163168
mov dword [0x10163128], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x10163128]
mov ecx, dword [ebp - 0xc]
add eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000c680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6bb1
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push esi
mov esi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x1016314c]
cmp eax, dword [edx + 4]
jle 0x1000c74e
push 0x1016314c
call fcn.100d50bc
add esp, 4
cmp dword [0x1016314c], 0xffffffff
jne 0x1000c74e
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x18], 0x65424073
mov dword [ebp - 0x14], 0x4c4f4057
mov dword [ebp - 0x10], 0x1004048
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0xa
jb 0x1000c6f2
mov byte [ebp - 0xd], 0
xor ecx, ecx
mov dword [ebp - 0x25], 0x52415d5d
mov dword [ebp - 0x21], 0x44487347
mov dword [ebp - 0x1d], 0x5a425f
mov byte [ebp - 0x19], 1
nop
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x25], al
inc ecx
cmp ecx, 0xb
jb 0x1000c720
lea edx, [ebp - 0x18]
mov byte [ebp - 0x19], 0
lea ecx, [ebp - 0x25]
call fcn.1000bfd0
push 0x1016314c
mov dword [0x10163124], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x10163124]
mov ecx, dword [ebp - 0xc]
add eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c7b3
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6bd1
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x1c
mov edx, dword [eax + edx*4]
mov eax, dword [0x10163188]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x1000c895
push 0x10163188
call fcn.100d50bc
add esp, 4
cmp dword [0x10163188], 0xffffffff
jne 0x1000c895
mov dword [ebp - 4], 0
mov ecx, 8
mov dword [ebp - 0x2c], 0x68424073
mov dword [ebp - 0x28], 0x4651674c
vpmovsxbd ymm1, qword [ebp - 0x2c]
vpxor ymm0, ymm1, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov dword [ebp - 0x24], 0x445d6d4d
mov word [ebp - 0x20], 0x5a
mov byte [ebp - 0x1e], 1
vmovq qword [ebp - 0x2c], xmm0
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0xd
jb 0x1000c838
mov byte [ebp - 0x1e], 0
xor ecx, ecx
mov dword [ebp - 0x1d], 0x52415d5d
mov dword [ebp - 0x19], 0x44487347
mov dword [ebp - 0x15], 0x5a425f
mov byte [ebp - 0x11], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x1d], al
inc ecx
cmp ecx, 0xb
jb 0x1000c864
mov byte [ebp - 0x11], 0
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x1d]
vzeroupper
call fcn.1000bfd0
push 0x10163188
mov dword [0x10163114], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x10163114]
mov ecx, dword [ebp - 0xc]
add eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x1000c8b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6bf1
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push esi
mov esi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x10163184]
cmp eax, dword [edx + 4]
jle 0x1000c97b
push 0x10163184
call fcn.100d50bc
add esp, 4
cmp dword [0x10163184], 0xffffffff
jne 0x1000c97b
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x27]
mov dword [ebp - 0x27], 0x4d464073
mov dword [ebp - 0x23], 0x4e475666
mov dword [ebp - 0x1f], 0x4c454e52
mov word [ebp - 0x1b], 0x100
call fcn.1000bc50
mov edx, eax
mov dword [ebp - 0x19], 0x52415d5d
mov dword [ebp - 0x15], 0x44487347
xor ecx, ecx
mov dword [ebp - 0x11], 0x5a425f
mov byte [ebp - 0xd], 1
nop dword [eax + eax]
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 0xb
jb 0x1000c950
lea ecx, [ebp - 0x19]
mov byte [ebp - 0xd], 0
call fcn.1000bfd0
push 0x10163184
mov dword [0x101631bc], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x101631bc]
mov ecx, dword [ebp - 0xc]
add eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000ca80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6c31
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push esi
mov esi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x1016319c]
cmp eax, dword [edx + 4]
jle 0x1000cb22
push 0x1016319c
call fcn.100d50bc
add esp, 4
cmp dword [0x1016319c], 0xffffffff
jne 0x1000cb22
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x19], 0x52415d5d
mov dword [ebp - 0x15], 0x44487347
mov dword [ebp - 0x11], 0x5a425f
mov byte [ebp - 0xd], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 0xb
jb 0x1000caf2
mov edx, str.m_vecViewOffset_0_
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x19]
call fcn.1000bfd0
push 0x1016319c
mov dword [0x10163150], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x10163150]
mov ecx, dword [ebp - 0xc]
add eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000cd60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6c91
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push esi
mov esi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x10163110]
cmp eax, dword [edx + 4]
jle 0x1000ce22
push 0x10163110
call fcn.100d50bc
add esp, 4
cmp dword [0x10163110], 0xffffffff
jne 0x1000ce22
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
vmovdqa xmm0, xmmword [0x1014f780]
vmovdqu xmmword [ebp - 0x2c], xmm0
mov word [ebp - 0x1c], 0x57
mov byte [ebp - 0x1a], 1
call fcn.1000c0c0
mov edx, eax
mov dword [ebp - 0x19], 0x52415d5d
mov dword [ebp - 0x15], 0x44487347
xor ecx, ecx
mov dword [ebp - 0x11], 0x5a425f
mov byte [ebp - 0xd], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 0xb
jb 0x1000cdf7
lea ecx, [ebp - 0x19]
mov byte [ebp - 0xd], 0
call fcn.1000bfd0
push 0x10163110
mov dword [0x10163194], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x10163194]
mov ecx, dword [ebp - 0xc]
add eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000d080
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6cf1
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x24
mov edx, dword [eax + edx*4]
mov eax, dword [0x1016311c]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x1000d1d9
push 0x1016311c
call fcn.100d50bc
add esp, 4
cmp dword [0x1016311c], 0xffffffff
jne 0x1000d1d9
mov dword [ebp - 4], 0
mov ecx, 8
vmovdqu ymm1, ymmword [0x1014fce0]
vmovdqu ymm2, ymmword [0x1014fc40]
vmovdqu ymm3, ymmword [0x10150520]
mov dword [ebp - 0x20], 0x4d464073
mov dword [ebp - 0x1c], 0x40404c6f
vpmovsxbd ymm0, qword [ebp - 0x20]
vpxor ymm0, ymm0, ymm1
vpshufb ymm0, ymm0, ymm2
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymm3
vextracti128 xmm0, ymm0, 0
mov dword [ebp - 0x18], 0x484b744a
mov dword [ebp - 0x14], 0x1004e46
vmovq qword [ebp - 0x20], xmm0
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 0xe
jb 0x1000d151
mov dword [ebp - 0x30], 0x52415d5d
mov eax, 8
mov dword [ebp - 0x2c], 0x4c4a6247
vpmovsxbd ymm0, qword [ebp - 0x30]
vpxor ymm0, ymm0, ymm1
vpshufb ymm0, ymm0, ymm2
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymm3
vextracti128 xmm0, ymm0, 0
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x28], 0x405c464b
mov dword [ebp - 0x24], 0x1004c44
vmovq qword [ebp - 0x30], xmm0
lea ecx, [eax + 0x1e]
xor byte [ebp + eax - 0x30], cl
inc eax
cmp eax, 0xe
jb 0x1000d1a8
mov byte [ebp - 0x21], 0
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x30]
vzeroupper
call fcn.1000bfd0
push 0x1016311c
mov dword [0x101631ac], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x101631ac]
mov ecx, dword [ebp - 0xc]
add eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1000d753
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6d51
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x34
mov edx, dword [eax + edx*4]
mov eax, dword [0x1016313c]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x1000d85a
push 0x1016313c
call fcn.100d50bc
add esp, 4
cmp dword [0x1016313c], 0xffffffff
jne 0x1000d85a
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3f]
vmovdqa xmm0, xmmword [0x1014f770]
vmovdqu xmmword [ebp - 0x3f], xmm0
mov dword [ebp - 0x2f], 0x495b47
mov byte [ebp - 0x2b], 1
call fcn.1000bd20
mov edx, eax
mov dword [ebp - 0x1b], 0x40437072
mov dword [ebp - 0x17], 0x5145474e
xor ecx, ecx
mov word [ebp - 0x13], 0x47
mov byte [ebp - 0x11], 1
nop
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 9
jb 0x1000d7c0
mov dword [ebp - 0x2a], 0x637f4b5a
mov ecx, 8
mov dword [ebp - 0x26], 0x75415043
vpmovsxbd ymm1, qword [ebp - 0x2a]
vpxor ymm0, ymm1, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x22], 0x4c51464a
mov word [ebp - 0x1e], 0x58
mov byte [ebp - 0x1c], 1
vmovq qword [ebp - 0x2a], xmm0
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x2a], al
inc ecx
cmp ecx, 0xd
jb 0x1000d826
push edx
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x2a]
push eax
vzeroupper
call fcn.1000f4d0
push 0x1016313c
mov dword [0x10163198], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x10163198]
mov ecx, dword [ebx + 8]
mov dword [eax + esi - 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x10010b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
cmp byte [ebx + 0x13], 0
je 0x10010c16
vmovdqu ymm3, ymmword [0x1014fc40]
vmovdqu ymm4, ymmword [0x10150520]
push esi
xor eax, eax
push edi
nop dword [eax + eax]
vpmovsxbd ymm2, qword [ebx + eax]
lea ecx, [eax + 0x3c]
vmovd xmm0, ecx
lea edx, [eax + 0x3d]
vpinsrd xmm0, xmm0, edx, 1
lea esi, [eax + 0x3e]
vpinsrd xmm0, xmm0, esi, 2
lea edi, [eax + 0x3f]
vpinsrd xmm1, xmm0, edi, 3
lea ebx, [eax + 0x40]
vmovd xmm0, ebx
mov ebx, dword [ebp - 4]
lea ecx, [eax + 0x41]
vpinsrd xmm0, xmm0, ecx, 1
lea ecx, [eax + 0x42]
vpinsrd xmm0, xmm0, ecx, 2
lea ecx, [eax + 0x43]
vpinsrd xmm0, xmm0, ecx, 3
vinsertf128 ymm0, ymm1, xmm0, 1
vpxor ymm0, ymm0, ymm2
vpshufb ymm0, ymm0, ymm3
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymm4
vextracti128 xmm0, ymm0, 0
vmovq qword [ebx + eax], xmm0
add eax, 8
lea ecx, [eax + 0x43]
cmp ecx, 0x53
jb 0x10010b80
pop edi
pop esi
cmp eax, 0x12
jae 0x10010c12
lea edx, [ebx + eax]
lea ecx, [eax + 0x3c]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x10010c04
mov byte [ebx + 0x13], 0
mov eax, ebx
pop ebx
vzeroupper
mov esp, ebp
pop ebp
ret

Function at 0x10010cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
cmp byte [ebx + 0x17], 0
je 0x10010d76
vmovdqu ymm3, ymmword [0x1014fc40]
vmovdqu ymm4, ymmword [0x10150520]
push esi
xor eax, eax
push edi
nop dword [eax + eax]
vpmovsxbd ymm2, qword [ebx + eax]
lea ecx, [eax + 0x3c]
vmovd xmm0, ecx
lea edx, [eax + 0x3d]
vpinsrd xmm0, xmm0, edx, 1
lea esi, [eax + 0x3e]
vpinsrd xmm0, xmm0, esi, 2
lea edi, [eax + 0x3f]
vpinsrd xmm1, xmm0, edi, 3
lea ebx, [eax + 0x40]
vmovd xmm0, ebx
mov ebx, dword [ebp - 4]
lea ecx, [eax + 0x41]
vpinsrd xmm0, xmm0, ecx, 1
lea ecx, [eax + 0x42]
vpinsrd xmm0, xmm0, ecx, 2
lea ecx, [eax + 0x43]
vpinsrd xmm0, xmm0, ecx, 3
vinsertf128 ymm0, ymm1, xmm0, 1
vpxor ymm0, ymm0, ymm2
vpshufb ymm0, ymm0, ymm3
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymm4
vextracti128 xmm0, ymm0, 0
vmovq qword [ebx + eax], xmm0
add eax, 8
lea ecx, [eax + 0x43]
cmp ecx, 0x53
jb 0x10010ce0
pop edi
pop esi
cmp eax, 0x16
jae 0x10010d72
lea edx, [ebx + eax]
lea ecx, [eax + 0x3c]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x10010d64
mov byte [ebx + 0x17], 0
mov eax, ebx
pop ebx
vzeroupper
mov esp, ebp
pop ebp
ret
Function at 0x10010d80
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6f91
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x34
mov edx, dword [eax + edx*4]
mov eax, dword [0x10163254]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x10010eca
push 0x10163254
call fcn.100d50bc
add esp, 4
cmp dword [0x10163254], 0xffffffff
jne 0x10010eca
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3e]
vmovdqa xmm0, xmmword [str.QbHZ]
vmovdqu xmmword [ebp - 0x3e], xmm0
mov dword [ebp - 0x2e], 0x100107c
call fcn.10010b50
mov edx, eax
mov dword [ebp - 0x1b], 0x40437072
mov dword [ebp - 0x17], 0x5145474e
xor ecx, ecx
mov word [ebp - 0x13], 0x47
mov byte [ebp - 0x11], 1
nop dword [eax + eax]
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 9
jb 0x10010e30
mov dword [ebp - 0x2a], 0x637f4b5a
mov ecx, 8
mov dword [ebp - 0x26], 0x75415043
vpmovsxbd ymm1, qword [ebp - 0x2a]
vpxor ymm0, ymm1, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x22], 0x4c51464a
mov word [ebp - 0x1e], 0x58
mov byte [ebp - 0x1c], 1
vmovq qword [ebp - 0x2a], xmm0
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x2a], al
inc ecx
cmp ecx, 0xd
jb 0x10010e96
push edx
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x2a]
push eax
vzeroupper
call fcn.1000f4d0
push 0x10163254
mov dword [0x101631dc], eax
call fcn.100d506b
add esp, 4
mov edx, dword [0x101631dc]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + esi]
mov dword [eax], ecx
mov ecx, dword [edx + esi + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + esi + 8]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4

Function at 0x10010f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6fb1
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push esi
push edi
mov edx, dword [eax + edx*4]
mov edi, ecx
mov eax, dword [0x1016324c]
cmp eax, dword [edx + 4]
jle 0x10010fb1
push 0x1016324c
call fcn.100d50bc
add esp, 4
cmp dword [0x1016324c], 0xffffffff
jne 0x10010fb1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1a]
mov dword [ebp - 0x1a], 0x694e4073
mov dword [ebp - 0x16], 0x4a46574b
mov dword [ebp - 0x12], 0x5d4d745e
mov word [ebp - 0xe], 0x100
call fcn.1000bc50
vmovdqa xmm0, xmmword [0x1014f630]
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x1c], 0x100
mov esi, eax
vmovdqu xmmword [ebp - 0x2c], xmm0
call fcn.1000bb70
push esi
push eax
call fcn.1000f3e0
push 0x1016324c
mov dword [0x10163208], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x10163208]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + edi]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10010ff0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6fd1
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x1c
mov edx, dword [eax + edx*4]
mov eax, dword [0x10163250]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x10011119
push 0x10163250
call fcn.100d50bc
add esp, 4
cmp dword [0x10163250], 0xffffffff
jne 0x10011119
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x1b], 0x69494073
mov dword [ebp - 0x17], 0x51484247
mov word [ebp - 0x13], 0x4e
mov byte [ebp - 0x11], 1
nop dword [eax]
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 9
jb 0x10011080
mov dword [ebp - 0x2a], 0x637f4b5a
mov ecx, 8
mov dword [ebp - 0x26], 0x75415043
vpmovsxbd ymm1, qword [ebp - 0x2a]
vpxor ymm0, ymm1, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x22], 0x4c51464a
mov word [ebp - 0x1e], 0x58
mov byte [ebp - 0x1c], 1
vmovq qword [ebp - 0x2a], xmm0
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x2a], al
inc ecx
cmp ecx, 0xd
jb 0x100110e6
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x2a]
push eax
vzeroupper
call fcn.1000f3e0
push 0x10163250
mov dword [0x1016327c], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x1016327c]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + esi]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret