joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1430cc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x1430ce2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x1430cd0
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret
Function at 0x1431c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movaps xmm0, xmmword [0xe857a0]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x21], 0xc7c8d6cc
mov dword [ebp - 0x1d], 0xc4c6c1d3
mov word [ebp - 0x19], 0x100
nop word [eax + eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x18
jb 0x1431c30
mov byte [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x17], 0xfaf1e0fd
mov dword [ebp - 0x13], 0xf6fdb6fb
mov word [ebp - 0xf], 0xf7
mov byte [ebp - 0xd], 1
nop dword [eax + eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 9
jb 0x1431c60
push ebx
push esi
push edi
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], 0
push eax
call fcn.01773d3f

Function at 0x1431d50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x1431d72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x1431d60
mov byte [esi + 0xa], 0
mov eax, esi
pop esi
ret

Function at 0x1431d80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x19], 0
je 0x1431da2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x18
jb 0x1431d90
mov byte [esi + 0x19], 0
mov eax, esi
pop esi
ret

Function at 0x1431ef0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x1431f12
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x1431f00
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret

Function at 0x1432320
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x1432342
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x1432330
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
ret

Function at 0x1433030
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x1433052
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x1433040
mov byte [esi + 5], 0
mov eax, esi
pop esi
ret
Function at 0x1433090
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe634d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x18], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x100f6e1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x14330f4
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push edi
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0150a5d0
mov edi, eax
add esp, 8
test edi, edi
je 0x143318d
push 2
push 0
push edi
call fcn.0150e3a6
push edi
call fcn.0150a15b
push 0
push 0
push edi
mov dword [ebp - 0x14], eax
call fcn.0150e3a6
mov ecx, dword [esi + 0x10]
add esp, 0x1c
mov eax, dword [ebp - 0x14]
cmp eax, ecx
ja 0x1433161
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x1433158
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov byte [ecx + eax], 0
jmp 0x1433170
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0148fe10
mov eax, dword [ebp - 0x14]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x143317a
mov ecx, dword [esi]
push edi
push eax
push 1
push ecx
call fcn.01512e4f
push edi
call fcn.0150de58
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop edi
cmp ecx, 0x10
jb 0x14331be
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x14331b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x14331cf
push ecx
push edx
call fcn.01504783
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.01509a20
int3
Function at 0x14331fb
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe63516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
call fcn.01491530
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x100f6e1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x1433224
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0150a5d0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x14332ba
push edi
push 2
push 0
push ebx
call fcn.0150e3a6
push ebx
call fcn.0150a15b
push 0
push 0
push ebx
mov edi, eax
call fcn.0150e3a6
mov ecx, dword [esi]
add esp, 0x1c
mov edx, dword [ecx + 0x10]
lea eax, [ecx + 0x10]
cmp edi, edx
ja 0x1433290
cmp dword [ecx + 0x14], 0x10
jb 0x1433288
mov ecx, dword [ecx]
mov dword [eax], edi
mov byte [ecx + edi], 0
jmp 0x143329c
mov eax, edi
push 0
sub eax, edx
push eax
call fcn.0148fe10
mov eax, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x14332a6
mov eax, dword [eax]
push ebx
push edi
push 1
push eax
call fcn.01512e4f
push ebx
call fcn.0150de58
add esp, 0x14
pop edi
mov ecx, dword [ebp + 0x1c]
pop ebx
cmp ecx, 0x10
jb 0x14332eb
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x14332e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x14332fc
push ecx
push edx
call fcn.01504783
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.01509a20
int3
Function at 0x1433310
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe63516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push edi
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
call fcn.01491530
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x100f6e1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x1433354
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0150a5d0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x14333f4
push esi
push 2
push 0
push ebx
call fcn.0150e3a6
push ebx
call fcn.0150a15b
push 0
push 0
push ebx
mov esi, eax
call fcn.0150e3a6
mov ecx, dword [edi]
mov eax, 0x1e8481
mov edx, dword [ecx + 0x10]
add esp, 0x1c
cmp esi, eax
cmova esi, eax
lea eax, [ecx + 0x10]
cmp esi, edx
ja 0x14333ca
cmp dword [ecx + 0x14], 0x10
jb 0x14333c2
mov ecx, dword [ecx]
mov dword [eax], esi
mov byte [ecx + esi], 0
jmp 0x14333d6
mov eax, esi
push 0
sub eax, edx
push eax
call fcn.0148fe10
mov eax, dword [edi]
cmp dword [eax + 0x14], 0x10
jb 0x14333e0
mov eax, dword [eax]
push ebx
push esi
push 1
push eax
call fcn.01512e4f
push ebx
call fcn.0150de58
add esp, 0x14
pop esi
mov ecx, dword [ebp + 0x1c]
pop ebx
cmp ecx, 0x10
jb 0x1433425
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x143341b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1433436
push ecx
push edx
call fcn.01504783
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.01509a20
int3

Function at 0x1433440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], 0x100f6e1
xor ecx, ecx
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x1433450
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push esi
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0150a5d0
mov esi, eax
add esp, 8
test esi, esi
je 0x143349b
push 2
push 0
push esi
call fcn.0150e3a6
push esi
call fcn.0150a15b
push esi
mov edi, eax
call fcn.0150de58
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop esi
cmp ecx, 0x10
jb 0x14334cc
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x14334c2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x14334d3
push ecx
push edx
call fcn.01504783
add esp, 8
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
call fcn.01509a20
int3
Function at 0x1433520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0x1a], 0xd1f9e0c1
xor ecx, ecx
mov dword [ebp - 0x16], 0xffcfecf2
mov dword [ebp - 0x12], 0xf1f4efe9
mov word [ebp - 0xe], 0xf1
mov byte [ebp - 0xc], 1
nop word [eax + eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 0xd
jb 0x1433550
mov byte [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0xb], 0xfaf1e0dd
mov dword [ebp - 7], 0xf6fdb6fb
mov word [ebp - 3], 0xf7
mov byte [ebp - 1], 1
nop dword [eax + eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x1433580
lea eax, [ebp - 0xb]
mov byte [ebp - 1], 0
push eax
call fcn.0177f30f
iretd

Function at 0x14336b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x100f6e1
xor ecx, ecx
nop dword [eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x14336c0
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0150a5d0
add esp, 8
test eax, eax
je 0x14336fb
push eax
call fcn.0150de58
add esp, 4
mov bl, 1
jmp 0x14336fd
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x143372d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1433723
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1433734
push ecx
push edx
call fcn.01504783
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.01509a20
int3
Function at 0x14365c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x14365e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x14365d0
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret

Function at 0x14366e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x1436702
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x14366f0
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret

Function at 0x1436710
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x1436732
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x1436720
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
ret

Function at 0x1436740
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x1436762
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x1436750
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret

Function at 0x1436770
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x1436792
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x1436780
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
ret

Function at 0x14367a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x14367c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x14367b0
mov byte [esi + 0x22], 0
mov eax, esi
pop esi
ret

Function at 0x14367d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x14367f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x14367e0
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret
Function at 0x143b810
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x143b832
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x143b820
mov byte [esi + 0x1d], 0
mov eax, esi
pop esi
ret
Function at 0x143c450
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call fcn.016d8c4f
sub al, 0x85
ror byte [edi], 0xb6
retf

Function at 0x143c5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x10]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x10], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov ebx, dword [ebp - 8]
shr ebx, 0x1f
and bl, 1
mov dword [ebp - 0xe], 0xf8e7f1f8
mov dword [ebp - 0xa], 0xa8aaf4f2
xor eax, eax
mov dword [ebp - 6], 0xf2f1f8b5
mov word [ebp - 2], 0x100
lea ecx, [eax - 0x6d]
xor byte [ebp + eax - 0xe], cl
inc eax
cmp eax, 0xc
jb 0x143c621
lea eax, [ebp - 0xe]
mov byte [ebp - 1], 0
push eax
call fcn.016996dc
mov cl, 0x85
ror byte [edi], 0xb6
retf

Function at 0x143c890
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x29], 0
je 0x143c8b2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x28
jb 0x143c8a0
mov byte [esi + 0x29], 0
mov eax, esi
pop esi
ret

Function at 0x143d870
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x143d892
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x2a
jb 0x143d880
mov byte [esi + 0x2b], 0
mov eax, esi
pop esi
ret

Function at 0x143d8a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x143d8c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x143d8b0
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
ret
Function at 0x143f9e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2e], 0
je 0x143fa02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x2d
jb 0x143f9f0
mov byte [esi + 0x2e], 0
mov eax, esi
pop esi
ret
Function at 0x1445270
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x1445292
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x1445280
mov byte [esi + 0x17], 0
mov eax, esi
pop esi
ret

Function at 0x14452a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x23], 0
je 0x14452c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x22
jb 0x14452b0
mov byte [esi + 0x23], 0
mov eax, esi
pop esi
ret
Function at 0x14468e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe64888
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x24
push esi
push 0xe96080
mov dword [ebp - 4], 0
call fcn.01503a84
add esp, 4
test eax, eax
jne 0x1446a86
mov dword [ebp - 0x1c], 0xeac5d5de
xor ecx, ecx
mov word [ebp - 0x18], 0xcb
mov byte [ebp - 0x16], 1
nop
mov al, cl
sub al, 0x6d
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 5
jb 0x1446940
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x16], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1446958
sub ecx, edx
mov eax, 0x7fffffff
mov edx, dword [ebx + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x1446a8c
cmp dword [ebx + 0x1c], 0x10
lea eax, [ebx + 8]
push edx
cmovae eax, dword [ebx + 8]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
push ecx
push dword [ebp - 0x19]
lea ecx, [ebp - 0x34]
call fcn.01494f90
mov byte [ebp - 4], 1
mov eax, dword [0xe96178]
cmp eax, dword [0xe9617c]
je 0x14469c5
movups xmm0, xmmword [ebp - 0x34]
mov ecx, 0xf
mov byte [ebp - 0x34], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [eax + 0x10], xmm0
add dword [0xe96178], 0x18
jmp 0x14469d7
lea ecx, [ebp - 0x34]
push ecx
push eax
mov ecx, 0xe96174
call fcn.0149a140
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 4], 0
cmp ecx, 0x10
jb 0x1446a0c
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1446a02
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1446a91
push ecx
push edx
call fcn.01504783
add esp, 8
push 0xe96080
call fcn.01503a95
mov esi, dword [0xe93aac]
lea eax, [ebx + 8]
sub esp, 0x14
mov ecx, esp
push eax
call fcn.0148d550
mov edx, 0x2714
mov ecx, esi
call fcn.01445860
mov ecx, dword [ebx + 0x1c]
add esp, 0x18
test al, al
setne al
mov byte [ebp - 0x11], al
cmp ecx, 0x10
jb 0x1446a74
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1446a67
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1446a91
push ecx
push edx
call fcn.01504783
mov al, byte [ebp - 0x11]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push eax
call fcn.0150372b
call fcn.01429840
call fcn.01509a20
int3
Function at 0x144be80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x144bea2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x20
jb 0x144be90
mov byte [esi + 0x21], 0
mov eax, esi
pop esi
ret
Function at 0x144fc90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x86], 0
je 0x144fcb7
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x85
jb 0x144fca0
mov byte [esi + 0x86], 0
mov eax, esi
pop esi
ret

Function at 0x144fcc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x57], 0
je 0x144fce2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x56
jb 0x144fcd0
mov byte [esi + 0x57], 0
mov eax, esi
pop esi
ret

Function at 0x1451eb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x66], 0
je 0x1451ed2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x65
jb 0x1451ec0
mov byte [esi + 0x66], 0
mov eax, esi
pop esi
ret
Function at 0x145dce0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4b], 0
je 0x145dd02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x4a
jb 0x145dcf0
mov byte [esi + 0x4b], 0
mov eax, esi
pop esi
ret
Function at 0x14603d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2a], 0
je 0x14603f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x29
jb 0x14603e0
mov byte [esi + 0x2a], 0
mov eax, esi
pop esi
ret
Function at 0x14664e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe670ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x58
push esi
push edi
push 0xff
call fcn.0151319c
push 0xff
mov edi, eax
push 0
push edi
call fcn.01506760
push 0xff
call fcn.0151319c
push 0xff
push 0
push eax
mov dword [ebp - 0x18], eax
call fcn.01506760
movaps xmm0, xmmword [0xe860c0]
add esp, 0x20
movups xmmword [ebp - 0x64], xmm0
xor ecx, ecx
mov dword [ebp - 0x44], 0xeadbd1c3
movaps xmm0, xmmword [0xe86790]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x40], 0xd7d4d7d4
mov dword [ebp - 0x3c], 0xd9d2da
mov byte [ebp - 0x38], 1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x64], al
inc ecx
cmp ecx, 0x2b
jb 0x1466578
lea eax, [ebp - 0x14]
mov byte [ebp - 0x38], 0
push eax
push 1
push 0
lea eax, [ebp - 0x64]
push eax
push 0x80000002
call fcn.01746099
aam 0x85
ror byte [edi], 0x85
cmp byte [ecx], al
add byte [eax], al
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xff
push eax
push edi
push 0
push 0
push 0
push dword [ebp - 0x14]
call dword [0xe6c014]
push dword [ebp - 0x14]
mov esi, eax
push ecx
call fcn.016981d9
test esi, esi
jne 0x14666e0
mov ecx, edi
mov dword [ebp - 0x24], esi
xorps xmm0, xmm0
mov dword [ebp - 0x20], esi
movups xmmword [ebp - 0x34], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x14665e8
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x34]
call fcn.0142a030
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
movups xmmword [ebp - 0x50], xmm0
cmp eax, 1
jb 0x14666f5
lea ecx, [eax - 5]
dec eax
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push ecx
inc eax
lea ecx, [ebp - 0x50]
push eax
call fcn.0142a030
cmp dword [ebp - 0x3c], 0x10
lea ecx, [ebp - 0x50]
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
cmovae ecx, esi
add eax, 0xffffffef
push eax
push ecx
push dword [ebp - 0x18]
call fcn.015061e0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
cmp eax, 0x10
jb 0x1466691
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x1466687
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x14666fa
push ecx
push esi
call fcn.01504783
add esp, 8
push edi
call fcn.01512a46
mov ecx, dword [ebp - 0x20]
add esp, 4
cmp ecx, 0x10
jb 0x14666ca
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x14666c0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x14666ff
push ecx
push edx
call fcn.01504783
add esp, 8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.01490b10
call fcn.01509a20
call fcn.01509a20
int3