joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b8d3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
mov edi, dword [0x1007cfc0]
call fcn.10003b72
mov dword [edi], eax
lea eax, [edi + 8]
push eax
call fcn.10003de1
lea eax, [edi + 0x20]
xor ebx, ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.10003de1
mov ecx, eax
call fcn.10003e8e
mov byte [edi + 0x38], al
call fcn.10003e8e
mov byte [edi + 0x39], al
call fcn.10003e6c
mov word [edi + 0x3e], ax
call fcn.10003e8e
mov byte [edi + 0x3a], al
call fcn.10003e8e
mov byte [edi + 0x3b], al
call fcn.10003e8e
mov byte [edi + 0x3c], al
call fcn.10003e8e
mov byte [edi + 0x68], al
call fcn.10003e8e
mov byte [edi + 0x69], al
call fcn.10003e8e
mov byte [edi + 0x6a], al
call fcn.10003e8e
mov byte [edi + 0x6b], al
call fcn.10003e8e
mov byte [edi + 0x6c], al
call fcn.10003b72
mov dword [edi + 0x4c], eax
call fcn.10003b72
mov ecx, dword [0x1007cfc8]
mov dword [edi + 0x50], eax
mov byte [0x1007cfcc], 1
test ecx, ecx
je 0x1000b98e
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x1000b98e
call fcn.1001065c
mov eax, dword [0x1007cfc4]
test eax, eax
je 0x1000b9b9
cmp byte [eax], bl
jne 0x1000b9b9
push ebx
push ebx
push eax
push 0x1000cafe
push ebx
push ebx
mov byte [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000b9b9
mov ecx, eax
call fcn.1000c7de
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1000c4b3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10044040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1003e420]
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], 0x4a464c0b
push esi
mov esi, ecx
mov byte [ebp - 0x20], bl
movups xmmword [ebp - 0x34], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x13
jb 0x1000c4e0
lea eax, [ebp - 0x33]
mov byte [ebp - 0x20], bl
push eax
mov edx, 0x10045480
lea ecx, [ebp - 0x1c]
call fcn.10008de0
mov eax, dword [esi + 0x1fc]
pop ecx
test eax, eax
je 0x1000c513
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
push 0x8010
cmova eax, dword [ebp - 0x1c]
push ebx
push ebx
push 1
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esi + 0x1fc], eax
test eax, eax
je 0x1000c54d
mov dword [esi + 0x14], eax
cmp byte [esi + 0x200], bl
je 0x1000c54d
push esi
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
lea ecx, [ebp - 0x1c]
call fcn.10002410
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100334f4
leave
ret
Function at 0x1000c68a
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x10044040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x2f4], 0x41c3a68
push esi
lea ecx, [ebp - 0x2f4]
mov dword [ebp - 0x2f0], 0xc090724
mov dword [ebp - 0x2ec], 0x11a1c3b
mov word [ebp - 0x2e8], 0xf06
mov byte [ebp - 0x2e6], bl
call fcn.10009324
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x2e4], 0x41514b25
mov esi, eax
mov dword [ebp - 0x2e0], 0x410b4949
mov word [ebp - 0x2dc], 0x4949
mov byte [ebp - 0x2da], bl
call fcn.10001431
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
je 0x1000c7ce
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000c7ce
push 0x2c8
lea eax, [ebp - 0x2d4]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1000c7ce
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1000c7ce
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1000c7ce
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x1000183f
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1000c7ce
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
jmp 0x1000c7d0
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100334f4
leave
ret

Function at 0x1000c7de
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], 0x6878620c
mov esi, ecx
mov dword [ebp - 8], 0x68226060
push edi
mov cl, 0xc
mov word [ebp - 4], 0x6060
mov byte [ebp - 2], bl
mov eax, ebx
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 9
jae 0x1000c815
mov cl, byte [ebp - 0xc]
jmp 0x1000c806
lea eax, [ebp - 0xb]
mov byte [ebp - 2], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
je 0x1000c87f
movaps xmm0, xmmword [0x1003df60]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x110b370d
mov dword [ebp - 0x10], 0x70206
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x16
jb 0x1000c843
lea eax, [ebp - 0x23]
mov byte [ebp - 0xd], bl
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000c87f
test esi, esi
jne 0x1000c870
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push ebx
push ebx
push 0x11
push esi
call edi
neg eax
sbb al, al
inc al
jmp 0x1000c881
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000c886
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1000c8c0
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000c8c4
cmp edx, esi
jne 0x1000c8a9
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x1000c8e4
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000c8e8
cmp edx, esi
jne 0x1000c8cd
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x1000c908
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000c90c
cmp edx, esi
jne 0x1000c8f1
popfd
popal
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000c996
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10044040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.10007519
test eax, eax
je 0x1000ca6d
push esi
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x1000ca6d
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
movaps xmm0, xmmword [0x1003de50]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xe
jb 0x1000c9e5
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x14], 0x7f6f751b
mov dword [ebp - 0x10], 0x7f357777
mov word [ebp - 0xc], 0x7777
mov byte [ebp - 0xa], bl
call fcn.10001431
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x23]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x116e058
mov ebx, eax
call fcn.10009f60
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1000ca5e
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push edi
call ebx
test eax, eax
js 0x1000ca6d
cmp dword [ebp - 8], 0
ja 0x1000ca6d
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100334f4
leave
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000ca76
Capabilities:
Resume thread

Disassembly:
push 0xc
push 0x10040118
call fcn.100342a0
mov esi, dword [0x1007d008]
test esi, esi
jne 0x1000ca91
or eax, 0xffffffff
jmp 0x1000caee
and dword [ebp - 4], 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1000cab1
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x1000caee
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x1000cac8
mov dword [ebp - 4], 0xfffffffe
push 2
pop eax
jmp 0x1000caee
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
test eax, eax
jns 0x1000cae5
mov dword [ebp - 4], 0xfffffffe
push 3
jmp 0x1000cac5
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000d43c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x56444725
push edi
mov cl, 0x25
mov dword [ebp - 0xc], 0x4a467a40
mov word [ebp - 8], 0x56
xor eax, eax
mov edi, dword [esi]
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 8
jae 0x1000d46f
mov cl, byte [ebp - 0x10]
jmp 0x1000d460
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0xf]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, edi
call fcn.10009394
add esp, 0x18
mov dword [esi + 4], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1000d49f
and dword [esi + 4], 0
movaps xmm0, xmmword [0x1003dce0]
xor ecx, ecx
mov edi, dword [esi + 4]
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x1000d4af
sub esp, 0x18
mov byte [ebp - 5], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, edi
call fcn.10009394
add esp, 0x18
mov dword [esi + 8], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1000d4ec
and dword [esi + 8], 0
cmp dword [esi + 8], 0
je 0x1000d506
cmp dword [0x100463a4], 0
mov ecx, 0x10b78ba
sete dl
call fcn.10009eb1
pop edi
pop esi
leave
ret
Function at 0x1000db8a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xc], ecx
push edi
mov dword [ebp - 4], eax
lea edi, [ecx + 8]
mov dword [ebp - 8], 8
mov esi, dword [ecx]
sub esp, 0x18
mov ebx, esp
mov dword [ebp - 0x58], 0x56446725
mov cl, 0x25
mov dword [ebp - 0x54], 0x44757a40
mov dword [ebp - 0x50], 0x5c5157
push eax
mov word [ebp - 0x4c], 0x41
xor eax, eax
xor byte [ebp + eax - 0x57], cl
inc eax
cmp eax, 0xc
jae 0x1000dbdb
mov cl, byte [ebp - 0x58]
jmp 0x1000dbcc
sub esp, 0x18
mov byte [ebp - 0x4b], 0
lea eax, [ebp - 0x57]
mov ecx, esp
push eax
call fcn.10002604
push ebx
call fcn.10004864
add esp, 0x20
mov ecx, esi
call fcn.10009394
add esp, 0x18
mov dword [ebp - 0x18], 0xd1a0968
mov ebx, eax
mov word [ebp - 0x14], 9
mov cl, 0x68
xor eax, eax
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 4
jae 0x1000dc22
mov cl, byte [ebp - 0x18]
jmp 0x1000dc13
sub esp, 0x18
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, ebx
call fcn.10009394
add esp, 0x18
mov dword [edi - 4], eax
mov cl, 0xc
mov dword [ebp - 0x24], 0x7c53670c
mov dword [ebp - 0x20], 0x75787e6d
xor eax, eax
mov byte [ebp - 0x1c], 0
xor byte [ebp + eax - 0x23], cl
inc eax
cmp eax, 7
jae 0x1000dc66
mov cl, byte [ebp - 0x24]
jmp 0x1000dc57
sub esp, 0x18
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, ebx
call fcn.10009394
add esp, 0x18
mov dword [edi], eax
xor dl, dl
mov ecx, eax
call fcn.100095bf
mov cl, 0x63
mov dword [ebp - 0x30], 0x133c0663
mov dword [ebp - 0x2c], 0x1a171102
xor eax, eax
mov byte [ebp - 0x28], 0
xor byte [ebp + eax - 0x2f], cl
inc eax
cmp eax, 7
jae 0x1000dcb2
mov cl, byte [ebp - 0x30]
jmp 0x1000dca3
sub esp, 0x18
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x2f]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, ebx
call fcn.10009394
xor dl, dl
mov dword [edi + 4], eax
mov ecx, eax
call fcn.100095bf
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0x447c791b
mov dword [ebp - 0x44], 0x76697475
mov esi, esp
mov word [ebp - 0x40], 0x777a
mov byte [ebp - 0x3e], 0
call fcn.10001431
push eax
mov ecx, esi
call fcn.10002604
mov ecx, ebx
call fcn.10009394
add esp, 0x18
mov dword [edi + 8], eax
mov cl, 0x15
mov dword [ebp - 0x3c], 0x4a727715
mov dword [ebp - 0x38], 0x79747866
xor eax, eax
mov word [ebp - 0x34], 0x79
xor byte [ebp + eax - 0x3b], cl
inc eax
cmp eax, 8
jae 0x1000dd35
mov cl, byte [ebp - 0x3c]
jmp 0x1000dd26
sub esp, 0x18
mov byte [ebp - 0x33], 0
lea eax, [ebp - 0x3b]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, ebx
call fcn.10009394
mov ecx, dword [ebp - 0xc]
add esp, 0x18
mov dword [edi + 0xc], eax
add edi, 0x14
mov eax, dword [ebp - 4]
inc eax
sub dword [ebp - 8], 1
mov dword [ebp - 4], eax
jne 0x1000dba5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e373
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x14], 0x4b514725
sub esp, 0x18
mov dword [ebp - 0x10], 0x4a49467a
lea ecx, [ebp - 0x14]
mov word [ebp - 0xc], 0x4056
mov byte [ebp - 0xa], 0
mov esi, esp
mov edi, dword [ebx + 0x20]
call fcn.10001431
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009394
mov esi, dword [ebx + 0x20]
add esp, 0x18
mov dword [ebx], eax
mov cl, 0x68
mov dword [ebp - 0x14], 0x61c0a68
xor eax, eax
mov dword [ebp - 0x10], 0x91c1b37
mov word [ebp - 0xc], 0x1c1a
mov byte [ebp - 0xa], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 9
jae 0x1000e3e8
mov cl, byte [ebp - 0x14]
jmp 0x1000e3d9
sub esp, 0x18
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009394
mov edi, dword [ebx + 0x20]
lea ecx, [ebp - 0x14]
mov dword [ebx + 4], eax
mov esi, esp
mov dword [ebp - 0x14], 0x62786e0c
mov dword [ebp - 0x10], 0x63787f53
mov word [ebp - 0xc], 0x7c
call fcn.100021b9
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009394
movaps xmm0, xmmword [0x1003dfc0]
add esp, 0x18
mov esi, dword [ebx + 0x20]
xor ecx, ecx
mov dword [ebx + 8], eax
movups xmmword [ebp - 0x1c], xmm0
mov word [ebp - 0xc], 0x604
mov byte [ebp - 0xa], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x11
jb 0x1000e454
sub esp, 0x18
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009394
mov edi, dword [ebx + 0x20]
lea ecx, [ebp - 0x18]
mov dword [ebx + 0xc], eax
mov esi, esp
mov dword [ebp - 0x18], 0x756f791b
mov dword [ebp - 0x14], 0x746f6844
mov dword [ebp - 0x10], 0x72447078
mov word [ebp - 0xc], 0x7575
mov byte [ebp - 0xa], 0
call fcn.10009324
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009394
mov esi, dword [ebx + 0x20]
add esp, 0x18
mov dword [ebx + 0x10], eax
mov cl, 0x15
mov dword [ebp - 0x14], 0x7b617715
xor eax, eax
mov dword [ebp - 0x10], 0x7970664a
mov word [ebp - 0xc], 0x79
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 8
jae 0x1000e4e8
mov cl, byte [ebp - 0x14]
jmp 0x1000e4d9
sub esp, 0x18
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009394
movaps xmm0, xmmword [0x1003e7d0]
add esp, 0x18
mov esi, dword [ebx + 0x20]
xor ecx, ecx
mov dword [ebx + 0x14], eax
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x48524953
mov byte [ebp - 8], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x1000e522
sub esp, 0x18
mov byte [ebp - 8], 0
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009394
add esp, 0x18
mov dword [ebx + 0x18], eax
mov ecx, eax
push 3
pop edx
call fcn.1000994a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f057
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x20], 0x515d5125
sub esp, 0x18
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x514c517a
mov word [ebp - 0x18], 0x4049
mov esi, esp
mov edi, dword [ebx]
mov byte [ebp - 0x16], 0
call fcn.10001431
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009394
mov edi, dword [ebx]
lea ecx, [ebp - 0x20]
push 0xa
mov dword [ebx + 4], eax
pop eax
mov dword [ebp - 0x20], 0x71a0f68
mov esi, esp
mov word [ebp - 0x1c], 0x181d
mov byte [ebp - 0x1a], 0x37
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x19], al
mov dword [ebp - 0x18], 0xd1b09
call fcn.1000220a
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009394
add esp, 0x18
mov dword [ebx + 8], eax
xor eax, eax
lea ecx, [ebx + 0x38]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov ebx, dword [ebx]
lea ecx, [ebp - 0x20]
sub esp, 0x18
mov dword [ebp - 0x20], 0x637e6b0c
mov edi, esp
mov dword [ebp - 0x1c], 0x29537c79
mov word [ebp - 0x18], 0x68
push eax
sub esp, 0x18
mov esi, esp
call fcn.100021b9
push eax
mov ecx, esi
call fcn.10002604
push edi
call fcn.10004864
add esp, 0x20
mov ecx, ebx
call fcn.10009394
mov edi, esp
mov dword [ebp - 0x2c], 0x171b1763
push dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 0x28], 0x4100e3c
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x2c]
sub esp, 0x18
mov dword [ebp - 0x24], 0x7463c
mov esi, esp
mov dword [eax - 0x28], ebx
call fcn.1000220a
push eax
mov ecx, esi
call fcn.10002604
push edi
call fcn.10004864
add esp, 0x20
mov ecx, ebx
call fcn.10009394
mov ecx, dword [ebp - 8]
add esp, 0x18
mov ebx, dword [ebp - 0x10]
mov dword [ecx], eax
add ecx, 4
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 8], ecx
sub dword [ebp - 0xc], 1
mov dword [ebp - 4], eax
jne 0x1000f0eb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000fbfc
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 1]
push 0xf
mov esi, eax
pop edi
mov dl, byte [ecx]
xor byte [esi], dl
inc esi
sub edi, 1
jne 0x1000fc06
pop edi
pop esi
mov byte [ecx + 0x10], 0
ret
Function at 0x1001065c
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x1003579d
call fcn.10034586
mov esi, ecx
mov edx, dword [0x10046394]
test edx, edx
js 0x10010762
cmp edx, 0x17
jg 0x10010762
mov ecx, dword [esi + 0x14]
call fcn.10009d44
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, ebx
mov eax, dword [0x10046394]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
push eax
cmp eax, 0xa
jge 0x100106da
movaps xmm0, xmmword [0x1003e4e0]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x5258060e
mov word [ebp - 0x30], 0x52
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x14
jb 0x100106c8
mov byte [ebp - 0x2f], bl
jmp 0x100106ff
movaps xmm0, xmmword [0x1003e0a0]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x4949431d
mov byte [ebp - 0x30], bl
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x13
jb 0x100106ef
mov byte [ebp - 0x30], bl
sub esp, 0x18
lea eax, [ebp - 0x43]
mov ecx, esp
push eax
call fcn.10002604
lea eax, [ebp - 0x60]
push eax
call fcn.10004864
add esp, 0x20
lea ecx, [ebp - 0x2c]
push eax
call fcn.1000539f
lea ecx, [ebp - 0x60]
call fcn.10002410
mov ecx, dword [esi + 0x1c]
lea edx, [ebp - 0x2c]
call fcn.10009e29
mov eax, dword [0x10046394]
test eax, eax
jle 0x10010745
push ecx
push eax
call fcn.10010613
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, edi
jbe 0x10010759
mov ecx, dword [ebp - 0x2c]
inc edx
call fcn.100023e3
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x2c], bl
mov edx, dword [0x100463a0]
cmp edx, 0x14
ja 0x100107a3
mov ecx, dword [esi + 0x18]
call fcn.10009d44
mov edx, dword [0x100463a0]
mov ecx, dword [esi + 0x20]
call fcn.10009e4c
movd xmm0, dword [0x100463a0]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x1003dc18]
movss dword [0x100440a4], xmm0
call fcn.1000f827
call fcn.10034544
ret
Function at 0x10010853
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [0x1003e490]
xor edx, edx
push ebx
mov ebx, ecx
mov word [ebp - 8], 0x4057
push esi
push edi
movups xmmword [ebp - 0x18], xmm0
mov esi, dword [ebx]
mov byte [ebp - 6], 0
mov al, byte [ebp - 0x18]
xor byte [ebp + edx - 0x17], al
inc edx
cmp edx, 0x11
jb 0x10010877
sub esp, 0x18
mov byte [ebp - 6], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009394
mov edi, eax
mov dword [ebp - 0x14], 0x1a1c1b68
lea ecx, [ebp - 0x14]
mov dword [ebx + 4], edi
mov dword [ebp - 0x10], 0xe060137
mov esi, esp
mov dword [ebp - 0xc], 0x593707
call fcn.1000220a
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009394
mov esi, dword [ebx + 4]
add esp, 0x18
mov dword [ebx + 8], eax
mov cl, 0xc
mov dword [ebp - 0x14], 0x7e787f0c
xor eax, eax
mov dword [ebp - 0x10], 0x6a626553
mov dword [ebp - 0xc], 0x3e5363
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x10010901
mov cl, byte [ebp - 0x14]
jmp 0x100108f2
sub esp, 0x18
mov byte [ebp - 9], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009394
mov edi, dword [ebx + 4]
lea ecx, [ebp - 0x14]
mov dword [ebx + 0xc], eax
mov esi, esp
mov dword [ebp - 0x14], 0x11171063
mov dword [ebp - 0x10], 0x50d0a3c
mov dword [ebp - 0xc], 0x503c0c
call fcn.1000220a
push eax
mov ecx, esi
call fcn.10002604
mov ecx, edi
call fcn.10009394
mov esi, dword [ebx + 4]
add esp, 0x18
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebp - 0x13], 0x447c7672
mov dword [ebp - 0xf], 0x697a6f68
push 0x1b
pop ecx
mov byte [ebp - 0x14], cl
mov dword [ebp - 0xb], 0x7c75726f
mov byte [ebp - 7], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x10010987
mov cl, byte [ebp - 0x14]
jmp 0x10010978
sub esp, 0x18
mov byte [ebp - 7], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009394
mov esi, dword [ebx + 4]
add esp, 0x18
mov dword [ebx + 0x18], eax
mov cl, 0x15
mov dword [ebp - 0x14], 0x72787c15
xor eax, eax
mov dword [ebp - 0x10], 0x666c774a
mov dword [ebp - 0xc], 0x717b7461
mov byte [ebp - 8], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x100109d5
mov cl, byte [ebp - 0x14]
jmp 0x100109c6
sub esp, 0x18
mov byte [ebp - 8], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10002604
mov ecx, esi
call fcn.10009394
add esp, 0x18
mov dword [ebx + 0x1c], eax
pop edi
pop esi
pop ebx
leave
ret