joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100124a4
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x100789e2
call fcn.10040a5d
mov esi, ecx
test esi, esi
je 0x10012623
xor ebx, ebx
lea edi, [ebp - 0x30]
push 7
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 0x30], vtable.ByteBuffer.0
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push 0x20
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.1000ab9c
mov dword [ebp - 0x30], vtable.Packet.0
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp dword [esi + 4], ebx
jle 0x10012575
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x4c]
push dword [esi + 4]
mov al, byte [eax]
mov byte [ebp - 0x14], al
call fcn.1000ab17
push edi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], vtable.Packet.0
call fcn.1000acc1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
mov al, byte [ebp - 0x48]
mov byte [ebp - 0x2c], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.100129d4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x4c], vtable.ByteBuffer.0
call fcn.1000ac55
mov eax, dword [esi + 4]
test eax, eax
jle 0x10012575
dec eax
lea ecx, [ebp - 0x30]
push eax
mov eax, dword [esi + 8]
inc eax
push eax
call fcn.1000acc1
cmp byte [0x100a6063], 0
jne 0x1001260c
mov eax, dword [ebp - 0x20]
mov ecx, ebx
mov edi, dword [ebp - 0x1c]
movaps xmm0, xmmword [0x10095e00]
sub edi, eax
mov dword [ebp - 0x50], eax
movups xmmword [ebp - 0x64], xmm0
mov byte [ebp - 0x54], bl
mov al, byte [ebp - 0x64]
xor byte [ebp + ecx - 0x63], al
inc ecx
cmp ecx, 0xf
jb 0x1001259d
sub esp, 0x18
mov byte [ebp - 0x54], bl
lea eax, [ebp - 0x63]
mov ecx, esp
push eax
call fcn.10004181
lea ecx, [ebp - 0x48]
call fcn.10034635
add esp, 0x18
test edi, edi
jle 0x10012600
cmp dword [ebp - 0x34], 0x10
lea esi, [ebp - 0x48]
cmovae esi, dword [ebp - 0x48]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100125d8
sub esi, ecx
mov eax, ebx
cmp dword [ebp - 0x34], 0x10
lea ecx, [ebp - 0x48]
cmovae ecx, dword [ebp - 0x48]
xor edx, edx
div esi
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 0x50]
xor byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jl 0x100125ca
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10004036
lea ecx, [ebp - 0x30]
call fcn.100123c1
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], vtable.ByteBuffer.0
call fcn.1000ac55
call fcn.10040a07
ret
Function at 0x100128c1
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x10078a1f
call fcn.10040a5d
cmp byte [0x100a610a], 0
je 0x100129ce
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [0x100a6138]
sbb edx, dword [0x100a613c]
mov dword [ebp - 0x5c], edx
jne 0x100128fc
cmp eax, 0xbb8
jb 0x100129ce
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
movaps xmm0, xmmword [str.I_r____]
xor ecx, ecx
mov dword [0x100a6138], eax
mov dword [0x100a613c], edx
movups xmmword [ebp - 0x58], xmm0
mov al, byte [ebp - 0x58]
xor byte [ebp + ecx - 0x57], al
inc ecx
cmp ecx, 0xe
jb 0x1001291a
sub esp, 0x18
mov byte [ebp - 0x49], 0
lea eax, [ebp - 0x57]
mov ecx, esp
push eax
call fcn.10004181
lea ecx, [ebp - 0x48]
call fcn.10034635
add esp, 0x18
and dword [ebp - 4], 0
lea edi, [ebp - 0x30]
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x14], 0xa1
rep stosd dword es:[edi], eax
push 0x1000
lea ecx, [ebp - 0x30]
call fcn.1000ab17
push 1
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], vtable.Packet.0
call fcn.1000acc1
push 1
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x14], 0xa2
call fcn.1000acc1
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
cmovae eax, dword [ebp - 0x48]
push eax
call fcn.1000aabe
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub edx, ecx
call fcn.1001011d
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], vtable.ByteBuffer.0
call fcn.1000ac55
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10004036
call fcn.10040a07
ret
Function at 0x10012e18
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
mov edi, dword [0x100a6048]
call fcn.10009d5d
mov dword [edi], eax
mov ecx, esi
lea eax, [edi + 8]
push eax
call fcn.10009e0e
lea eax, [edi + 0x20]
xor ebx, ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.10009e0e
mov esi, eax
mov ecx, esi
call fcn.10009ee7
mov ecx, esi
mov byte [edi + 0x38], al
call fcn.10009ee7
mov ecx, esi
mov byte [edi + 0x39], al
call fcn.10009ec1
mov ecx, esi
mov word [edi + 0x3e], ax
call fcn.10009ee7
mov ecx, esi
mov byte [edi + 0x3a], al
call fcn.10009ee7
mov ecx, esi
mov byte [edi + 0x3b], al
call fcn.10009ee7
mov ecx, esi
mov byte [edi + 0x3c], al
call fcn.10009ee7
mov ecx, esi
mov byte [edi + 0x68], al
call fcn.10009ee7
mov ecx, esi
mov byte [edi + 0x69], al
call fcn.10009ee7
mov ecx, esi
mov byte [edi + 0x6a], al
call fcn.10009ee7
mov ecx, esi
mov byte [edi + 0x6b], al
call fcn.10009ee7
mov ecx, esi
mov byte [edi + 0x6c], al
call fcn.10009d5d
mov ecx, esi
mov dword [edi + 0x4c], eax
call fcn.10009d5d
mov ecx, dword [0x100a6050]
mov dword [edi + 0x50], eax
mov byte [0x100a610a], 1
test ecx, ecx
je 0x10012eef
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x10012eef
call fcn.10017f25
mov eax, dword [0x100a604c]
test eax, eax
je 0x10012f1a
cmp byte [eax], bl
jne 0x10012f1a
push ebx
push ebx
push eax
push 0x1001431e
push ebx
push ebx
mov byte [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10012f1a
mov ecx, eax
call fcn.10013fdb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10013c66
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100a107c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str._4_6]
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], 0x121e1453
push esi
mov esi, ecx
mov byte [ebp - 0x20], bl
movups xmmword [ebp - 0x34], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x13
jb 0x10013c93
lea eax, [ebp - 0x33]
mov byte [ebp - 0x20], bl
push eax
mov edx, 0x100a2e30
lea ecx, [ebp - 0x1c]
call fcn.1000d7bd
mov eax, dword [esi + 0x1fc]
pop ecx
test eax, eax
je 0x10013cc6
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push 0x8010
cmovae eax, dword [ebp - 0x1c]
push ebx
push ebx
push 1
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esi + 0x1fc], eax
test eax, eax
je 0x10013d00
mov dword [esi + 0x14], eax
cmp byte [esi + 0x200], bl
je 0x10013d00
push esi
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.10004036
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003fdc5
mov esp, ebp
pop ebp
ret
Function at 0x10013e54
Capabilities:
Allocate or change rwx memory
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x100a107c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x2f4], 0x150d2b79
push esi
mov cl, 0x79
mov dword [ebp - 0x2f0], 0x1d181635
mov dword [ebp - 0x2ec], 0x100b0d2a
mov eax, ebx
mov word [ebp - 0x2e8], 0x1e17
mov byte [ebp - 0x2e6], bl
xor byte [ebp + eax - 0x2f3], cl
inc eax
cmp eax, 0xd
jae 0x10013eb1
mov cl, byte [ebp - 0x2f4]
jmp 0x10013e9c
mov byte [ebp - 0x2e6], bl
mov cl, 0x7d
mov dword [ebp - 0x2e4], 0x1909137d
mov eax, ebx
mov dword [ebp - 0x2e0], 0x19531111
mov word [ebp - 0x2dc], 0x1111
mov byte [ebp - 0x2da], bl
xor byte [ebp + eax - 0x2e3], cl
inc eax
cmp eax, 9
jae 0x10013ef3
mov cl, byte [ebp - 0x2e4]
jmp 0x10013ede
lea eax, [ebp - 0x2f3]
mov byte [ebp - 0x2da], bl
push eax
lea eax, [ebp - 0x2e3]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
jne 0x10013f25
xor eax, eax
jmp 0x10013fcb
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10013f1e
push 0x2cc
lea eax, [ebp - 0x2d8]
push ebx
push eax
call fcn.10042b60
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10013f1e
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10013f1e
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10013f1e
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x10001a61
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x10013f1e
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003fdc5
mov esp, ebp
pop ebp
ret
Function at 0x10013fdb
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], 0x2e3e244a
mov esi, ecx
mov dword [ebp - 8], 0x2e642626
push edi
mov cl, 0x4a
mov word [ebp - 4], 0x2626
mov byte [ebp - 2], bl
mov eax, ebx
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 9
jae 0x10014012
mov cl, byte [ebp - 0xc]
jmp 0x10014003
lea eax, [ebp - 0xb]
mov byte [ebp - 2], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
jne 0x10014029
xor al, al
jmp 0x1001407e
movaps xmm0, xmmword [0x100952d0]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x1a003c06
mov dword [ebp - 0x10], 0xc090d
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x16
jb 0x10014044
lea eax, [ebp - 0x23]
mov byte [ebp - 0xd], bl
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10014025
test esi, esi
jne 0x10014071
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push ebx
push ebx
push 0x11
push esi
call edi
neg eax
sbb al, al
inc al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10014085
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x100140bf
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100140c3
cmp edx, esi
jne 0x100140a8
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x100140e3
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100140e7
cmp edx, esi
jne 0x100140cc
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10014107
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1001410b
cmp edx, esi
jne 0x100140f0
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014197
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100a107c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
call fcn.1000d832
xor ebx, ebx
test eax, eax
je 0x100141df
push esi
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
mov dword [ebp - 8], eax
test eax, eax
je 0x100141e5
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
jmp 0x100141e1
mov eax, ebx
test eax, eax
jne 0x100141ed
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movaps xmm0, xmmword [str._oUsDRTLDuISD_E]
mov ecx, ebx
movups xmmword [ebp - 0x28], xmm0
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0xe
jb 0x100141fa
mov byte [ebp - 0x19], bl
mov cl, 0x35
mov dword [ebp - 0x14], 0x51415b35
mov eax, ebx
mov dword [ebp - 0x10], 0x511b5959
mov word [ebp - 0xc], 0x5959
mov byte [ebp - 0xa], bl
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 9
jae 0x10014234
mov cl, byte [ebp - 0x14]
jmp 0x10014225
lea eax, [ebp - 0x27]
mov byte [ebp - 0xa], bl
push eax
lea eax, [ebp - 0x13]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x116e058
mov dword [ebp - 0x18], eax
call fcn.10010043
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x10014290
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push esi
call dword [ebp - 0x18]
test eax, eax
js 0x100141e5
cmp dword [ebp - 8], 0
ja 0x100141e5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003fdc5
mov esp, ebp
pop ebp
ret

Function at 0x100142a0
Capabilities:
Resume thread

Disassembly:
push 0xc
push 0x1009aad0
call fcn.10041290
mov esi, dword [0x100a6134]
test esi, esi
jne 0x100142bb
or eax, 0xffffffff
jmp 0x10014318
and dword [ebp - 4], 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x100142db
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x10014318
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x100142f2
mov dword [ebp - 4], 0xfffffffe
push 2
pop eax
jmp 0x10014318
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
test eax, eax
jns 0x1001430f
mov dword [ebp - 4], 0xfffffffe
push 3
jmp 0x100142ef
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.100412d6
ret
Function at 0x10014c69
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], 0xe1c1f7d
mov esi, ecx
mov dword [ebp - 0xc], 0x121e2218
mov cl, 0x7d
mov word [ebp - 8], 0xe
mov eax, ebx
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 8
jae 0x10014c9c
mov cl, byte [ebp - 0x10]
jmp 0x10014c8d
sub esp, 0x18
mov byte [ebp - 7], bl
lea eax, [ebp - 0xf]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, dword [esi]
call fcn.1000f474
add esp, 0x18
mov dword [esi + 4], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10014cca
mov dword [esi + 4], ebx
movaps xmm0, xmmword [0x10094f90]
mov ecx, ebx
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x10014cd7
sub esp, 0x18
mov byte [ebp - 5], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, dword [esi + 4]
call fcn.1000f474
add esp, 0x18
mov dword [esi + 8], eax
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10014d13
mov dword [esi + 8], ebx
cmp dword [esi + 8], ebx
je 0x10014d2b
cmp dword [0x100aa42c], ebx
mov ecx, 0x10b78ba
sete dl
call fcn.1000ff8c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100153d1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
mov eax, ecx
mov dword [ebp - 4], 8
push esi
push edi
mov dword [ebp - 8], eax
xor ebx, ebx
lea edi, [eax + 8]
sub esp, 0x18
mov dword [ebp - 0x54], 0xe1c3f7d
mov esi, esp
mov dword [ebp - 0x50], 0x1c2d2218
mov cl, 0x7d
mov dword [ebp - 0x4c], 0x5804090f
mov word [ebp - 0x48], 0x19
xor eax, eax
push ebx
xor byte [ebp + eax - 0x53], cl
inc eax
cmp eax, 0xc
jae 0x1001541f
mov cl, byte [ebp - 0x54]
jmp 0x10015410
sub esp, 0x18
mov byte [ebp - 0x47], 0
lea eax, [ebp - 0x53]
mov ecx, esp
push eax
call fcn.10004181
push esi
call fcn.10003c4b
mov eax, dword [ebp - 8]
add esp, 0x20
mov ecx, dword [eax]
call fcn.1000f474
add esp, 0x18
mov dword [ebp - 0x14], 0x1c0b1879
mov esi, eax
mov word [ebp - 0x10], 0x18
mov cl, 0x79
xor eax, eax
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 4
jae 0x10015469
mov cl, byte [ebp - 0x14]
jmp 0x1001545a
sub esp, 0x18
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, esi
call fcn.1000f474
add esp, 0x18
mov dword [edi - 4], eax
mov cl, 0x4a
mov dword [ebp - 0x20], 0x3a15214a
mov dword [ebp - 0x1c], 0x333e382b
xor eax, eax
mov byte [ebp - 0x18], 0
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 7
jae 0x100154ad
mov cl, byte [ebp - 0x20]
jmp 0x1001549e
sub esp, 0x18
mov byte [ebp - 0x18], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, esi
call fcn.1000f474
add esp, 0x18
mov dword [edi], eax
xor dl, dl
mov ecx, eax
call fcn.1000f6a4
mov cl, 0x68
mov dword [ebp - 0x2c], 0x18370d68
mov dword [ebp - 0x28], 0x111c1a09
xor eax, eax
mov byte [ebp - 0x24], 0
xor byte [ebp + eax - 0x2b], cl
inc eax
cmp eax, 7
jae 0x100154f9
mov cl, byte [ebp - 0x2c]
jmp 0x100154ea
sub esp, 0x18
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x2b]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, esi
call fcn.1000f474
add esp, 0x18
mov dword [edi + 4], eax
xor dl, dl
mov ecx, eax
call fcn.1000f6a4
mov cl, 0x35
mov dword [ebp - 0x44], 0x6a525735
mov dword [ebp - 0x40], 0x58475a5b
xor eax, eax
mov word [ebp - 0x3c], 0x5954
mov byte [ebp - 0x3a], 0
xor byte [ebp + eax - 0x43], cl
inc eax
cmp eax, 9
jae 0x1001554c
mov cl, byte [ebp - 0x44]
jmp 0x1001553d
sub esp, 0x18
mov byte [ebp - 0x3a], 0
lea eax, [ebp - 0x43]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, esi
call fcn.1000f474
add esp, 0x18
mov dword [edi + 8], eax
mov cl, 0x21
mov dword [ebp - 0x38], 0x7e464321
mov dword [ebp - 0x34], 0x4d404c52
xor eax, eax
mov word [ebp - 0x30], 0x4d
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 8
jae 0x10015592
mov cl, byte [ebp - 0x38]
jmp 0x10015583
sub esp, 0x18
mov byte [ebp - 0x2f], 0
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, esi
call fcn.1000f474
add esp, 0x18
mov dword [edi + 0xc], eax
inc ebx
add edi, 0x14
sub dword [ebp - 4], 1
jne 0x100153eb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017f25
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x10078d11
call fcn.10040a5d
mov esi, ecx
mov edx, dword [0x100aa41c]
cmp edx, 0x17
ja 0x10018010
mov ecx, dword [esi + 0x14]
call fcn.1000fe26
mov dword [ebp - 0x18], 0xf
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, ebx
mov eax, dword [0x100aa41c]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
push eax
cmp eax, 0xa
jge 0x10017f93
movaps xmm0, xmmword [str._dcEIA]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x141e4048
mov word [ebp - 0x30], 0x14
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x14
jb 0x10017f81
mov byte [ebp - 0x2f], bl
jmp 0x10017fb8
movaps xmm0, xmmword [0x10095780]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x77777d23
mov byte [ebp - 0x30], bl
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x13
jb 0x10017fa8
mov byte [ebp - 0x30], bl
sub esp, 0x18
lea eax, [ebp - 0x43]
mov ecx, esp
push eax
call fcn.10004181
lea eax, [ebp - 0x60]
push eax
call fcn.10003c4b
add esp, 0x20
lea ecx, [ebp - 0x2c]
push eax
call fcn.10007a5b
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.10004036
mov ecx, dword [esi + 0x1c]
lea edx, [ebp - 0x2c]
call fcn.1000ff04
mov eax, dword [0x100aa41c]
test eax, eax
jle 0x10018001
push ecx
push eax
call fcn.10017edc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
push ebx
push 1
call fcn.10004036
mov edx, dword [0x100aa428]
cmp edx, 0x14
ja 0x10018051
mov ecx, dword [esi + 0x18]
call fcn.1000fe26
mov edx, dword [0x100aa428]
mov ecx, dword [esi + 0x20]
call fcn.1000ff27
movd xmm0, dword [0x100aa428]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x10094ee8]
movss dword [0x100a1a9c], xmm0
call fcn.10017129
call fcn.10040a07
ret
Function at 0x1001810f
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [0x100955f0]
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x180f
push esi
mov esi, ecx
mov byte [ebp - 6], bl
movups xmmword [ebp - 0x18], xmm0
mov edx, ebx
mov al, byte [ebp - 0x18]
xor byte [ebp + edx - 0x17], al
inc edx
cmp edx, 0x11
jb 0x10018131
sub esp, 0x18
mov byte [ebp - 6], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, dword [esi]
call fcn.1000f474
mov dword [esi + 4], eax
add esp, 0x18
mov cl, 0x79
mov dword [ebp - 0x14], 0xb0d0a79
mov dword [ebp - 0x10], 0x1f171026
mov eax, ebx
mov dword [ebp - 0xc], 0x482616
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x10018184
mov cl, byte [ebp - 0x14]
jmp 0x10018175
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, dword [esi + 4]
call fcn.1000f474
mov dword [esi + 8], eax
add esp, 0x18
mov cl, 0x4a
mov dword [ebp - 0x14], 0x383e394a
mov dword [ebp - 0x10], 0x2c242315
mov eax, ebx
mov dword [ebp - 0xc], 0x781525
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x100181cb
mov cl, byte [ebp - 0x14]
jmp 0x100181bc
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, dword [esi + 4]
call fcn.1000f474
mov dword [esi + 0xc], eax
add esp, 0x18
mov cl, 0x68
mov dword [ebp - 0x14], 0x1a1c1b68
mov dword [ebp - 0x10], 0xe060137
mov eax, ebx
mov dword [ebp - 0xc], 0x5b3707
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xa
jae 0x10018212
mov cl, byte [ebp - 0x14]
jmp 0x10018203
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, dword [esi + 4]
call fcn.1000f474
mov dword [esi + 0x10], eax
add esp, 0x18
mov cl, 0x35
mov dword [ebp - 0x14], 0x52585c35
mov dword [ebp - 0x10], 0x5441466a
mov eax, ebx
mov dword [ebp - 0xc], 0x5b5c4147
mov word [ebp - 8], 0x52
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x1001825f
mov cl, byte [ebp - 0x14]
jmp 0x10018250
sub esp, 0x18
mov byte [ebp - 7], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, dword [esi + 4]
call fcn.1000f474
mov dword [esi + 0x18], eax
add esp, 0x18
mov cl, 0x21
mov dword [ebp - 0x14], 0x464c4821
mov dword [ebp - 0x10], 0x5258437e
mov eax, ebx
mov dword [ebp - 0xc], 0x454f4055
mov byte [ebp - 8], bl
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x100182a9
mov cl, byte [ebp - 0x14]
jmp 0x1001829a
sub esp, 0x18
mov byte [ebp - 8], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004181
mov ecx, dword [esi + 4]
call fcn.1000f474
add esp, 0x18
mov dword [esi + 0x1c], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret