joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4170d0
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444dc6
mov eax, dword fs:[0]
push eax
mov eax, 0x1444
call fcn.0041fc00
mov eax, dword [0x455100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4570f0
mov dword [ebp - 0xa40], 0x4570f0
mov byte [ebp - 0xa3c], 0
call fcn.0041f21f
add esp, 4
test eax, eax
jne 0x417283
cmp dword [0x45711c], 0x7fffffff
je 0x41728a
mov byte [ebp - 0xa3c], 1
mov dword [ebp - 0xa38], 0x4570d0
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4570d0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.00411e60
mov eax, dword [eax + 4]
test eax, eax
je 0x41725b
cmp eax, dword [0x4570d4]
je 0x41725b
lea eax, [ebp + 8]
mov ecx, 0x4570d0
push eax
call fcn.00419730
mov dword [ebp - 0x1450], 0
lea esi, [ebp + 0xc]
mov ecx, 0x282
mov dword [ebp - 0xa28], eax
lea edi, [ebp - 0x1448]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x284
lea esi, [ebp - 0x1450]
lea edi, [ebp - 0xa20]
rep movsd dword es:[edi], dword [esi]
push 0xa18
call fcn.0041f75c
add esp, 4
test eax, eax
je 0x41720e
mov ecx, 0x286
lea esi, [ebp - 0xa28]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x417210
xor eax, eax
mov dword [ebp - 0xa34], eax
lea ecx, [ebp - 0xa2c]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x412200
push 0
push 0
call fcn.0042e4d5
add esp, 0x18
mov dword [ebp - 0xa30], eax
test eax, eax
je 0x4172a2
mov ecx, dword [ebp - 0xa2c]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x41729b
push ecx
push eax
call fcn.0041cf9f
add esp, 8
test eax, eax
jne 0x41729b
push 0x4570f0
call fcn.0041f230
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fbeb
mov esp, ebp
pop ebp
ret
push 5
call fcn.0041d272
push 6
mov dword [0x45711c], 0x7ffffffe
call fcn.0041d272
push 1
call fcn.0041d272
push 6
mov dword [ebp - 0xa2c], 0
call fcn.0041d272
int3
Function at 0x417400
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444e3d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x455100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4570f0
mov dword [ebp - 0x2c], 0x4570f0
mov byte [ebp - 0x28], 0
call fcn.0041f21f
add esp, 4
test eax, eax
jne 0x41756a
cmp dword [0x45711c], 0x7fffffff
je 0x417571
mov byte [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x4570d0
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4570d0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00411e60
mov eax, dword [eax + 4]
test eax, eax
je 0x41754e
cmp eax, dword [0x4570d4]
je 0x41754e
lea eax, [ebp + 8]
mov ecx, 0x4570d0
push eax
call fcn.00419730
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
movups xmm0, xmmword [ebp - 0x20]
push 0x18
mov dword [ebp - 0x44], eax
movups xmmword [ebp - 0x3c], xmm0
call fcn.0041f75c
add esp, 4
test eax, eax
je 0x41750d
movups xmm0, xmmword [ebp - 0x44]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x34]
movq qword [eax + 0x10], xmm0
jmp 0x41750f
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x412110
push 0
push 0
call fcn.0042e4d5
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x417589
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x417582
push ecx
push eax
call fcn.0041cf9f
add esp, 8
test eax, eax
jne 0x417582
push 0x4570f0
call fcn.0041f230
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 5
call fcn.0041d272
push 6
mov dword [0x45711c], 0x7ffffffe
call fcn.0041d272
push 1
call fcn.0041d272
push 6
mov dword [ebp - 0x14], 0
call fcn.0041d272
int3
Function at 0x403e57
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp byte [edi], 0x25
jne 0x403ed4
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
call fcn.00403093
lea eax, [ebp + eax - 0x105]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x25
jne 0x403ebc
and byte [eax], 0
push dword [ebp + 0x1c]
lea eax, [ebp - 0x104]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push eax
push 0x4016ec
call esi
pop edi
pop esi
leave
ret 0x18

Function at 0x4041d7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0xc]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40422c
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
lea eax, [ebp + 8]
push esi
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x404223
cmp dword [ebp + 8], esi
jne 0x404223
cmp dword [ebp - 4], esi
jne 0x404223
push 1
pop esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 8

Function at 0x438cc2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
add esi, 0x67dc198e
call fcn.00438cf3
add edx, edx
add edx, edx
xor dword [ebx], eax
mov esi, esi
sub esi, 0xae65bf2
add ebx, 1
and edx, esi
sub esi, esi
add edx, esi
cmp ebx, ecx
jne fcn.00438cc2
dec edx
ret
Function at 0x10049060
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011859b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x10135364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x10155e58]
test al, 1
jne 0x100491ab
or eax, 1
mov dword [0x10155e58], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x10128ed0]
xorps xmm0, xmmword [0x10128940]
mov dword [ebp - 0x20], 0x1f001f
mov dword [ebp - 0x1c], 0x66006218
mov word [ebp - 0x18], 0x2011
movups xmmword [ebp - 0x30], xmm0
xor byte [ebp + eax - 0x30], 0x20
inc eax
cmp eax, 0x1a
jb 0x100490e3
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10049110
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.10050420
mov byte [ebp - 4], 1
mov edx, dword [0x101fd964]
test edx, edx
je 0x10049139
mov edx, dword [edx + 0x50]
jmp 0x1004913b
xor edx, edx
mov eax, dword [0x101fd95c]
test eax, eax
je 0x10049149
mov eax, dword [eax + 0x18]
jmp 0x1004914b
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.10048b50
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
mov dword [0x10155e5c], eax
cmp ecx, 0x10
jb 0x100491a2
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10049193
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10049193
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10116adb
mov eax, dword [0x10155e5c]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x100491b0
mov eax, dword [0x10155e5c]
test eax, eax
je 0x100491b8
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10051020
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10118a6f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10135364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edx]
xorps xmm0, xmm0
mov dword [edi + 0xc], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov byte [edi + 0x84], 0
mov dword [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov byte [edi + 0x3d9], 0
mov dword [edi + 0x3dc], 0
mov byte [edi + 0x3e0], 0
mov dword [edi + 0x3e4], 0
mov dword [edi + 0x3e8], 0
mov dword [edi + 0x3ec], 0
mov dword [edi + 0x3f0], 0
mov dword [edi + 0x3f4], 0
mov dword [edi + 0x3f8], 0
mov word [edi + 0x40c], 0
mov byte [edi + 0x40e], 0
movups xmmword [edi + 0x418], xmm0
mov dword [edi + 0x428], 0
mov dword [edi + 0x42c], 0xf
mov dword [ebp - 0x10], edi
mov byte [edi + 0x418], 0
mov dword [ebp - 4], 0
mov word [edi + 0x431], 0
mov byte [edi + 0x433], 0
mov dword [edi + 0x430], 0
movups xmmword [edi + 0x438], xmm0
mov dword [edi + 0x448], 0
mov dword [edi + 0x44c], 0xf
mov byte [edi + 0x438], 0
movups xmmword [edi + 0x450], xmm0
mov dword [edi + 0x460], 0
mov dword [edi + 0x464], 0xf
mov byte [edi + 0x450], 0
push fcn.1004fae0
push fcn.1004fb70
push 0x40
push 0x18
lea eax, [edi + 0x468]
mov byte [ebp - 4], 2
push eax
call fcn.10116b0c
push fcn.1004fae0
push fcn.1004fb70
push 0x40
push 0x18
lea eax, [edi + 0xa68]
mov byte [ebp - 4], 3
push eax
call fcn.10116b0c
push esi
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.10049350
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10058f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10135364]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10058fdc
cmp byte [esi + 0x3d], 0
je 0x10058fdc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10058fca
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10058f91
sub eax, 1
je 0x10058f95
sub eax, 2
jne 0x10058fca
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10116660
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10058fb3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10058fca
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10116660
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10116660
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10116660
mov esp, ebp
pop ebp
ret
Function at 0x1005dd90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10119506
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x10135364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x10203a94]
test al, 1
jne 0x1005ded1
or eax, 1
mov dword [0x10203a94], eax
mov byte [ebp - 4], 1
mov eax, 0x10
movaps xmm0, xmmword [0x10128ed0]
xorps xmm0, xmmword [0x10128dc0]
mov dword [ebp - 0x44], 0x19660062
mov dword [ebp - 0x40], 0x666600
mov word [ebp - 0x3c], 0x1511
mov byte [ebp - 0x3a], 0x20
movups xmmword [ebp - 0x54], xmm0
nop dword [eax + eax]
xor byte [ebp + eax - 0x54], 0x20
inc eax
cmp eax, 0x1b
jb 0x1005de20
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x24], 0
movups xmmword [ebp - 0x38], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005de46
sub ecx, edx
lea eax, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.10050420
mov byte [ebp - 4], 2
mov edx, dword [0x101fd970]
test edx, edx
je 0x1005de6f
mov edx, dword [edx + 0x50]
jmp 0x1005de71
xor edx, edx
mov eax, dword [0x101fd968]
test eax, eax
je 0x1005de7f
mov eax, dword [eax + 0x18]
jmp 0x1005de81
xor eax, eax
lea ecx, [ebp - 0x38]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.10048b50
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
mov dword [0x10203a9c], eax
cmp ecx, 0x10
jb 0x1005decd
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1005dec3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005df1f
push ecx
push edx
call fcn.10116adb
add esp, 8
mov byte [ebp - 4], 0
cmp dword [ebx + 0x1c], 0x10
lea ecx, [ebx + 8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x6874616d
cmovae ecx, dword [ebx + 8]
mov dword [ebp - 0x1c], 0x63616d65
mov word [ebp - 0x18], 0x79
call dword [0x10203a9c]
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0x10
jb 0x1005df2f
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1005df25
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1005df25
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10116adb
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
Function at 0x1005df50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x10135364]
xor eax, esp
mov dword [esp + 0x30], eax
cmp byte [0x101540d0], 0
push ebx
push esi
push edi
je 0x1005e151
mov eax, dword [0x10203a90]
test al, 1
jne 0x1005dfd8
or eax, 1
mov dword [0x10203a90], eax
mov eax, dword [0x101fd9e4]
mov ebx, dword [eax + 0x30]
jmp 0x1005dfcc
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + edi], 0
jne 0x1005dfa0
xor edx, edx
test ecx, ecx
je 0x1005dfc9
nop dword [eax]
movsx eax, byte [edx + edi]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x1005dfb0
cmp esi, 0x1b1db0e9
je 0x1005dfd0
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x1005df90
mov dword [0x10203aa0], ebx
jmp 0x1005dfde
mov ebx, dword [0x10203aa0]
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x34]
call eax
mov eax, dword [0x101fda48]
movss xmm1, dword [0x101284c0]
movss xmm0, dword [0x101285c8]
divss xmm1, dword [eax + 0x14]
comiss xmm0, xmm1
movss dword [esp + 0x1c], xmm1
jbe 0x1005e151
cvtps2pd xmm0, xmm1
sub esp, 8
movsd qword [esp], xmm0
push 0x10126ec0
call fcn.1005abc0
add esp, 0xc
lea ecx, [esp + 0x24]
mov esi, eax
push 0
push esi
call fcn.10060440
movss xmm1, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
cmp dword [esp + 0x38], 0x10
lea eax, [esi + 1]
cvtps2pd xmm0, xmm1
cmovae ecx, dword [esp + 0x24]
sub esp, 8
movsd qword [esp], xmm0
push 0x10126ec0
push eax
push ecx
call fcn.1005ab80
movaps xmm0, xmmword [0x10128ed0]
add esp, 0x14
xorps xmm0, xmmword [0x10128ec0]
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
movups xmmword [esp + 0xc], xmm0
push 0xfffffffffffffff5
call ebx
lea ecx, [esp + 0xc]
mov edx, eax
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005e090
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleA]
lea eax, [esp + 0x1c]
push 0
push eax
sub ecx, esi
lea eax, [esp + 0x14]
push ecx
push eax
push edx
call edi
cmp dword [esp + 0x38], 0x10
lea esi, [esp + 0x24]
push 0xfffffffffffffff5
cmovae esi, dword [esp + 0x28]
call ebx
mov edx, esi
lea ecx, [edx + 1]
mov dword [esp + 0x1c], ecx
nop word [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1005e0d0
sub edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push 0
push ecx
push edx
push esi
push eax
call edi
push 0xfffffffffffffff5
mov word [esp + 0x20], 0xa
call ebx
lea ecx, [esp + 0x1c]
mov edx, eax
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005e100
push 0
lea eax, [esp + 0x24]
sub ecx, esi
push eax
push ecx
lea eax, [esp + 0x28]
push eax
push edx
call edi
mov ecx, dword [esp + 0x38]
cmp ecx, 0x10
jb 0x1005e151
mov edx, dword [esp + 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1005e147
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1005e147
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10116adb
add esp, 8
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10116660
mov esp, ebp
pop ebp
ret
Function at 0x1005e170
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10153d88], 0
push ebx
push esi
push edi
je 0x1005e2fe
mov ecx, dword [0x101fd9e8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1005e2fe
mov ecx, dword [0x101fda70]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1005e2fe
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x1005e1d0
xor edx, edx
test ecx, ecx
je 0x1005e1f9
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1005e1e0
cmp edi, 0x5ff56dc5
je 0x1005e208
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1005e2fe
mov ecx, dword [ebp - 4]
jmp 0x1005e1b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1005e2fe
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1005e2fe
movss xmm1, dword [0x101284d8]
xor ebx, ebx
cmp edx, 4
jl 0x1005e2cb
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1005e26c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1005e287
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1005e2a2
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1005e2b5
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x1005e251
cmp ebx, edx
jl 0x1005e2cf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1005e2fe
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1005e2f3
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x1005e2e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005f9a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10119578
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2c
mov eax, dword [0x10135364]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
cmp dword [ebx + 0x1c], 0
je 0x1005fb07
cmp dword [ebx + 0x20], 0x10
lea ecx, [ebx + 0x24]
lea eax, [ebx + 0xc]
cmovae eax, dword [ebx + 0xc]
xor edx, edx
push ecx
push eax
xor ecx, ecx
call fcn.1005ab40
mov ecx, dword [ebp - 0x1c]
mov esi, eax
add esp, 8
cmp esi, ecx
ja 0x1005fa44
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
cmovae ecx, dword [ebp - 0x2c]
mov byte [ecx + esi], 0
jmp 0x1005fa51
sub eax, ecx
lea ecx, [ebp - 0x2c]
push 0
push eax
call fcn.10060880
cmp dword [ebx + 0x20], 0x10
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x24]
cmovae eax, dword [ebx + 0xc]
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
push edx
cmovae ecx, dword [ebp - 0x2c]
lea edx, [esi + 1]
push eax
call fcn.1005ab40
add esp, 8
mov dword [ebp - 0x3c], 0x54414d7b
mov dword [ebp - 0x38], 0x414d4548
xor eax, eax
mov dword [ebp - 0x34], 0x7d5943
mov byte [ebp - 0x30], 0x20
xor byte [ebp + eax - 0x3c], 0x20
inc eax
cmp eax, 0xd
jb 0x1005fa92
mov eax, dword [0x101fd9e4]
lea edx, [ebp - 0x3c]
push edx
push 0x101fdebc
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x64]
call eax
mov eax, dword [0x101fd9e4]
lea edx, [ebp - 0x2c]
add esp, 0xc
cmp dword [ebp - 0x18], 0x10
cmovae edx, dword [ebp - 0x2c]
mov ecx, dword [eax]
push edx
push 0x10142738
push eax
mov eax, dword [ecx + 0x64]
call eax
mov ecx, dword [ebp - 0x18]
add esp, 0xc
cmp ecx, 0x10
jb 0x1005fb07
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1005fafd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005fb3f
push ecx
push edx
call fcn.10116adb
add esp, 8
mov ecx, dword [ebx + 0x20]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x1005fb4f
mov edx, dword [ebx + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1005fb45
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1005fb45
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10116adb
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10116660
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret