joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100485c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bdee5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10122c00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.10037760
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100486e6
cmp dword [esi + 8], 0xfffffff
je 0x100486fd
lea eax, [esi + 4]
mov dword [ebp - 0x20], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.100ba448
mov dword [ebp - 0x1c], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [edi]
mov dword [ebp - 0x18], ecx
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov eax, dword [esi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9780]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9780]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x100486d7
mov ecx, esi
call fcn.1003b350
push ebx
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.10037760
mov ecx, dword [eax]
jmp 0x100486da
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x1c]
push ecx
push ebx
mov ecx, esi
call fcn.1003b2f0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3

Function at 0x100487e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10122c00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword fs:[0x30]
push esi
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
jne 0x10048814
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba7ae
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebx + 0xc]
add ebx, 0x14
mov esi, dword [ebx]
cmp esi, ebx
je 0x10048881
mov ecx, 0x5a4d
lea edx, [esi - 8]
test edx, edx
je 0x1004887b
mov eax, dword [edx + 0x18]
test eax, eax
je 0x1004887b
cmp word [eax], cx
jne 0x1004887b
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x10048876
cmp dword [ecx], 0x4550
jne 0x10048876
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
cmp eax, dword [edi + 8]
je 0x1004886a
movq xmm0, qword [ebp - 0x10]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [edi + 4], 0xc
jmp 0x10048876
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, edi
call fcn.10047e30
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, ebx
jne 0x10048825
mov eax, dword [edi]
cmp eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.100ba7ae
mov esp, ebp
pop ebp
ret
Function at 0x100526a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf175
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10122c00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.10037760
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1005272a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x10052877
cmp dword [ebx + 8], 0xaaaaaaa
je 0x1005288d
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
push 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
call fcn.100ba448
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9780]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100c9780]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1005282a
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100ba870
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1005280c
cmp eax, 0x200
jae 0x1005280a
shl eax, 3
cmp eax, ecx
jae 0x1005280c
mov eax, ecx
push eax
mov ecx, ebx
call fcn.1003ae20
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10037760
mov edx, dword [eax]
jmp 0x1005282d
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x10052858
mov dword [ecx + eax*8], esi
jmp 0x1005286a
cmp ebx, edx
jne 0x10052861
mov dword [ecx + eax*8], esi
jmp 0x1005286e
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1005286e
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x100b1aa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c5a23
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10122c00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], edi
mov dword [edi], 0
push 0x10
mov dword [ebp - 0x20], ebx
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.100ba448
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [edi + 0x18], 7
mov dword [edi + 0x1c], 8
mov dword [edi], 0x3f800000
push dword [edi + 4]
mov byte [ebp - 4], 1
push 0x10
call fcn.1003ad50
mov dword [ebp - 4], 2
cmp esi, ebx
je 0x100b1c64
nop
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
push eax
call fcn.10037760
cmp dword [ebp - 0x14], 0
jne 0x100b1c58
cmp dword [edi + 8], 0xfffffff
je 0x100b1c7a
lea eax, [edi + 4]
mov dword [ebp - 0x28], eax
push 0x10
mov byte [ebp - 4], 3
mov dword [ebp - 0x24], 0
call fcn.100ba448
mov ecx, dword [esi + 4]
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
lea edx, [eax + 8]
mov eax, dword [esi]
mov dword [ebp - 0x1c], edx
mov dword [edx], eax
mov dword [edx + 4], ecx
mov eax, dword [edi + 8]
inc eax
mov byte [ebp - 4], 4
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9780]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9780]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x100b1c3e
mov ecx, edi
call fcn.1003b350
push ebx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.10037760
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jmp 0x100b1c41
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x10]
mov dword [ebp - 0x24], 0
push ecx
push ebx
mov ecx, edi
call fcn.1003b2f0
mov byte [ebp - 4], 2
add esi, 8
cmp esi, dword [ebp - 0x20]
jne 0x100b1b50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x1114058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.011141a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x111407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x111406a
add dl, dl
jne 0x1114089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11140dc
xor eax, eax
add dl, dl
jne 0x1114096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x111417d
add dl, dl
jne 0x11140a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11140b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11140bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11140c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11140d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1114075
mov eax, 1
add dl, dl
jne 0x11140ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11140f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11140e1
sub eax, ebx
mov ebx, 1
jne 0x1114128
mov ecx, 1
add dl, dl
jne 0x111410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1114119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1114105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1114075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x111413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x111414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1114136
cmp eax, 0x7d00
jae 0x111416d
cmp eax, 0x500
jb 0x1114168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1114075
cmp eax, 0x7f
ja 0x1114170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1114075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x111419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1114075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x35c50
Capabilities:
Encode data using xor

Disassembly:
add byte [eax + 0x52f52424], cl
cmp al, 9
pushfd
lea esp, [esp + 0x10]
ja 0x37611
bt di, cx
bt bx, 3
jmp 0x3612d
clc
call fcn.000393c3
test byte [ebx + ebp*2 - 0x6f4fbb43], dh
stosb byte es:[edi], al
movsb byte es:[edi], byte [esi]
insd dword es:[edi], dx
jns 0x35c69
or ah, byte [ebp - 0x3e]
jmp 0x35c23
xchg byte [edi + 0x4f], al
sbb byte [edx - 0x427aae19], dh
lodsb al, byte [esi]
stc
xor eax, 0x90b04462
pop ebp
add eax, 0x7a5b8f7e
cmpsb byte [esi], byte es:[edi]
invalid
cmc
imul edx, edx, 0xa
cmc
test cl, bl
add edx, eax
pushfd
mov word [esp], cx
pushal
mov word [esp + 0xc], dx
lea esp, [esp + 0x24]
jmp fcn.000389b1
call fcn.00039251

Function at 0x37806
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [edx + 0x18]
lea esp, [esp + 0x24]
lea esp, [esp + 0x24]
jae 0x393b7
push ecx
push dword [esp]
push 0x93a584bc
pushal
lea esp, [esp + 0x2c]
jmp fcn.00037630
lea esp, [esp + 0x48]
jbe 0x38c6c
sub di, bx
cmc
push ebx
btr cx, bx
mov edi, dword [edx + 0x24]
jmp 0x394cb
pushal
push 0xb8f44887
jmp 0x38355
lea esp, [esp + 0x48]
je 0x393b7
shr si, 0xb
mov esi, dword [eax + 0x3c]
btr dx, 0xe
add esi, eax
test ch, 8
sar dh, 7
bt edx, edx
lea edx, [eax + 0x3b9ba810]
mov edx, dword [esi + 0x78]
cmp esi, 0xaa51d746
test edx, edx
pushfd
pushal
lea esp, [esp + 0x24]
je 0x393b7
cmc
bswap cx
add edx, eax
sal ch, 7
shl cx, cl
shl ecx, 0x1f
mov ecx, dword [esi + 0x7c]
clc
test eax, eax
pushal
bt ecx, edi
add ecx, edx
jmp 0x5930b
pushfd
pushal
bt ax, sp
sub ecx, dword [edx + 0x10]
mov word [esp], 0x441a
cmp ecx, dword [edx + 0x14]
jmp 0x3678f
cmc
add edi, eax
neg cx
rcr cl, cl
neg bh
mov ebx, dword [edx + 0x20]
or cx, sp
pushal
btc ecx, 0x1e
add ebx, eax
xor cl, ch
rcr cl, 3
cmp si, 0xba0d
btr cx, 0xc
mov dword [ebp - 8], 0
bswap cx
jmp 0x353ba
pushal
mov dword [ebp - 0x10], ecx
cmc
cmc
mov ecx, dword [ebp + 0xc]
mov dword [esp], 0xc1e1721d
push ebp
pushfd
clc
cmp ecx, 0xffff
mov byte [esp + 8], 0xb7
jmp 0x377c8

Function at 0x5bf58
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
lea esp, [esp + 0x30]
je 0x3799a
cmp dl, 0x41
add edx, 0x11c
push edi
lea esp, [esp + 4]
jmp 0x355eb
Function at 0x40135f
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414a34], al
inc ecx
cmp byte [ecx + 0x414a33], 0
jne 0x401380
mov eax, 0x414a34
leave
ret

Function at 0x40139d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x411690]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414d50], al
inc ecx
cmp byte [ecx + 0x414d4f], 0
jne 0x4013b4
mov eax, 0x414d50
leave
ret

Function at 0x4013fb
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b04], al
inc ecx
cmp byte [ecx + 0x414b03], 0
jne 0x40141c
mov eax, 0x414b04
leave
ret

Function at 0x401439
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x31343a19
xor ecx, ecx
mov dword [ebp - 0xc], 0x27373c19
mov dword [ebp - 8], 0x142c2734
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c74], al
inc ecx
cmp byte [ecx + 0x414c73], 0
jne 0x40145a
mov eax, 0x414c74
leave
ret

Function at 0x4014a1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414bbc], al
inc ecx
cmp byte [ecx + 0x414bbb], 0
jne 0x4014c2
mov eax, 0x414bbc
leave
ret

Function at 0x4014df
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x5213012
xor ecx, ecx
mov dword [ebp - 0xc], 0x14363a27
mov dword [ebp - 8], 0x30273131
mov word [ebp - 4], 0x2626
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b14], al
inc ecx
cmp byte [ecx + 0x414b13], 0
jne 0x401506
mov eax, 0x414b14
leave
ret

Function at 0x40154d
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414d2c], al
inc ecx
cmp byte [ecx + 0x414d2b], 0
jne 0x40156e
mov eax, 0x414d2c
leave
ret
Function at 0x40158b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x4116b0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x5526
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414a70], al
inc ecx
cmp byte [ecx + 0x414a6f], 0
jne 0x4015a4
mov eax, 0x414a70
leave
ret

Function at 0x4015eb
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414d64], al
inc ecx
cmp byte [ecx + 0x414d63], 0
jne 0x40160c
mov eax, 0x414d64
leave
ret

Function at 0x401629
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x4116b0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 4], 0x55311c26
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414bf0], al
inc ecx
cmp byte [ecx + 0x414bef], 0
jne 0x401643
mov eax, 0x414bf0
leave
ret

Function at 0x40168a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b40], al
inc ecx
cmp byte [ecx + 0x414b3f], 0
jne 0x4016ab
mov eax, 0x414b40
leave
ret

Function at 0x4016c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x213c2d10
xor ecx, ecx
mov dword [ebp - 8], 0x363a2705
mov dword [ebp - 4], 0x55262630
mov al, byte [ebp + ecx - 0xc]
xor al, 0x55
mov byte [ecx + 0x414a50], al
inc ecx
cmp byte [ecx + 0x414a4f], 0
jne 0x4016e5
mov eax, 0x414a50
leave
ret

Function at 0x40172c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c54], al
inc ecx
cmp byte [ecx + 0x414c53], 0
jne 0x40174d
mov eax, 0x414c54
leave
ret

Function at 0x40176a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x4116f0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x5521
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414ad0], al
inc ecx
cmp byte [ecx + 0x414acf], 0
jne 0x401783
mov eax, 0x414ad0
leave
ret
Function at 0x4019fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x21273c03
xor ecx, ecx
mov dword [ebp - 0xc], 0x5393420
mov dword [ebp - 8], 0x30213a27
mov word [ebp - 4], 0x2136
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b24], al
inc ecx
cmp byte [ecx + 0x414b23], 0
jne 0x401a23
mov eax, 0x414b24
leave
ret

Function at 0x401a6a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c84], al
inc ecx
cmp byte [ecx + 0x414c83], 0
jne 0x401a8b
mov eax, 0x414c84
leave
ret

Function at 0x401aa8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x4116c0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414a10], al
inc ecx
cmp byte [ecx + 0x414a0f], 0
jne 0x401abf
mov eax, 0x414a10
leave
ret

Function at 0x401b06
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c34], al
inc ecx
cmp byte [ecx + 0x414c33], 0
jne 0x401b27
mov eax, 0x414c34
leave
ret

Function at 0x401b44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x4116e0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x2c27
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x14]
xor al, 0x55
mov byte [ecx + 0x414c20], al
inc ecx
cmp byte [ecx + 0x414c1f], 0
jne 0x401b61
mov eax, 0x414c20
leave
ret

Function at 0x401ba8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414a24], al
inc ecx
cmp byte [ecx + 0x414a23], 0
jne 0x401bc9
mov eax, 0x414a24
leave
ret

Function at 0x401be6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [0x411700]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x3d363416
mov word [ebp - 4], 0x5530
mov al, byte [ebp + ecx - 0x18]
xor al, 0x55
mov byte [ecx + 0x414bd0], al
inc ecx
cmp byte [ecx + 0x414bcf], 0
jne 0x401c06
mov eax, 0x414bd0
leave
ret