joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100541e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a461
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10077008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 2
mov eax, 0x3f
mov dword [esi + 4], 0x3f800000
mov word [esi + 0x3c], ax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x3f800000
call fcn.10054350
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10056000
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x10077008]
xor eax, esp
mov dword [esp + 0x24], eax
cmp dword [0x10078a50], 0
push esi
push edi
jne 0x1005602d
cmp dword [0x10078a48], 0
je 0x1005602d
call fcn.10055e40
mov edi, dword [0x10077088]
lea eax, [esp + 0x1c]
push eax
push dword [0x10078a40]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
movd xmm1, eax
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x10]
cvtdq2ps xmm0, xmm0
push eax
movss dword [edi + 4], xmm1
movss dword [edi + 8], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x10]
sub ecx, dword [0x10078a38]
mov edx, dword [esp + 0x14]
sbb edx, dword [0x10078a3c]
call fcn.10068930
mov edx, dword [0x10078a34]
mov ecx, dword [0x10078a30]
cvtsd2ss xmm0, xmm0
movss dword [esp + 8], xmm0
call fcn.10068930
movss xmm1, dword [esp + 8]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0xc], xmm1
mov eax, dword [esp + 0x14]
mov dword [0x10078a38], eax
mov eax, dword [esp + 0x18]
mov dword [0x10078a3c], eax
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xe1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xe2], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xe4], 0
cmp byte [edi + 0x30b], 0
mov byte [edi + 0xe3], al
je 0x1005614a
cvttss2si eax, dword [edi + 0xcc]
mov dword [esp + 8], eax
cvttss2si eax, dword [edi + 0xd0]
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push dword [0x10078a40]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp byte [edi + 0xe0], 0
je 0x1005615b
push 0
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.10032d80
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.100671ce
mov esp, ebp
pop ebp
ret
Function at 0x10056910
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, edx
push edi
mov dword [ebp - 4], ebx
call fcn.100658b0
mov edi, eax
test edi, edi
je 0x100569ee
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x100569ee
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
jne 0x100569ee
mov eax, dword [eax + edi + 0x50]
xor esi, esi
add eax, edi
mov edx, ebx
mov dword [ebp - 8], eax
cmp edi, eax
jae 0x100569ee
mov eax, 0x3f3f
mov bl, byte [edx]
cmp bl, 0x3f
je 0x100569b9
mov al, bl
movzx ecx, bl
sub al, 0x30
cmp al, 9
ja 0x1005697c
sub ecx, 0x30
jmp 0x10056982
and ecx, 0xffffffdf
sub ecx, 0x37
mov ah, byte [edx + 1]
mov al, ah
sub al, 0x30
cmp al, 9
movzx eax, ah
ja 0x10056995
sub eax, 0x30
jmp 0x1005699b
and eax, 0xffffffdf
sub eax, 0x37
shl ecx, 4
or ecx, eax
movzx eax, byte [edi]
cmp eax, ecx
je 0x100569b4
test esi, esi
je 0x100569df
mov edx, dword [ebp - 4]
mov edi, esi
xor esi, esi
jmp 0x100569df
mov eax, 0x3f3f
test esi, esi
cmove esi, edi
cmp byte [edx + 2], 0
je 0x100569f7
cmp word [edx], ax
je 0x100569d3
mov eax, 2
cmp bl, 0x3f
je 0x100569d8
mov eax, 3
add edx, eax
cmp byte [edx], 0
je 0x100569f7
inc edi
mov eax, 0x3f3f
cmp edi, dword [ebp - 8]
jb 0x10056965
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005f150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006abfc
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10077008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x1007885c]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1007c8f8]
cmp eax, dword [edx + 4]
jle 0x1005f23e
push 0x1007c8f8
call fcn.10067831
add esp, 4
cmp dword [0x1007c8f8], 0xffffffff
jne 0x1005f23e
mov dword [ebp - 4], 0
mov cl, 0x41
mov dword [ebp - 0x20], 0x2f1e2c41
xor eax, eax
mov dword [ebp - 0x1c], 0x23352809
mov dword [ebp - 0x18], 0x2412392e
mov word [ebp - 0x14], 0x35
nop dword [eax + eax]
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x1005f1ef
mov cl, byte [ebp - 0x20]
jmp 0x1005f1e0
movaps xmm0, xmmword [0x100716d0]
xor ecx, ecx
mov byte [ebp - 0x13], 0
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x24], 0x42
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x10
jb 0x1005f206
mov ecx, dword [0x1007c134]
lea eax, [ebp - 0x1f]
push 0
push eax
lea eax, [ebp - 0x33]
mov byte [ebp - 0x23], 0
push eax
call fcn.1005ee80
push 0x1007c8f8
mov dword [0x1007c8dc], eax
call fcn.100677f2
add esp, 4
mov eax, dword [0x1007c8dc]
add eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100671ce
mov esp, ebp
pop ebp
ret

Function at 0x1005f260
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ac3c
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10077008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x1007885c]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1007c89c]
cmp eax, dword [edx + 4]
jle 0x1005f34e
push 0x1007c89c
call fcn.10067831
add esp, 4
cmp dword [0x1007c89c], 0xffffffff
jne 0x1005f34e
mov dword [ebp - 4], 0
xor ecx, ecx
movaps xmm0, xmmword [0x10071670]
movups xmmword [ebp - 0x34], xmm0
mov byte [ebp - 0x24], 0
nop dword [eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0xf
jb 0x1005f2e0
mov byte [ebp - 0x24], 0
mov cl, 0x10
mov dword [ebp - 0x20], 0x4f445410
xor eax, eax
mov dword [ebp - 0x1c], 0x75637152
mov dword [ebp - 0x18], 0x69717c40
mov word [ebp - 0x14], 0x6275
mov byte [ebp - 0x12], 0
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xd
jae 0x1005f323
mov cl, byte [ebp - 0x20]
jmp 0x1005f314
mov ecx, dword [0x1007c134]
lea eax, [ebp - 0x33]
push 0
push eax
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x12], 0
push eax
call fcn.1005ee80
push 0x1007c89c
mov dword [0x1007c8a4], eax
call fcn.100677f2
add esp, 4
mov eax, dword [0x1007c8a4]
add eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100671ce
mov esp, ebp
pop ebp
ret
Function at 0x1005f370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ac7c
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10077008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x1007885c]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1007c914]
cmp eax, dword [edx + 4]
jle 0x1005f45e
push 0x1007c914
call fcn.10067831
add esp, 4
cmp dword [0x1007c914], 0xffffffff
jne 0x1005f45e
mov dword [ebp - 4], 0
xor ecx, ecx
movaps xmm0, xmmword [0x100716c0]
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x24], 0x27
nop
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x10
jb 0x1005f3f0
mov byte [ebp - 0x23], 0
mov cl, 0x4b
mov dword [ebp - 0x20], 0x141f0f4b
xor eax, eax
mov dword [ebp - 0x1c], 0x2e382a09
mov dword [ebp - 0x18], 0x322a271b
mov word [ebp - 0x14], 0x392e
mov byte [ebp - 0x12], 0
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xd
jae 0x1005f433
mov cl, byte [ebp - 0x20]
jmp 0x1005f424
mov ecx, dword [0x1007c134]
lea eax, [ebp - 0x33]
push 0
push eax
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x12], 0
push eax
call fcn.1005ee80
push 0x1007c914
mov dword [0x1007c91c], eax
call fcn.100677f2
add esp, 4
mov eax, dword [0x1007c91c]
add eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100671ce
mov esp, ebp
pop ebp
ret

Function at 0x1005f480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006acbc
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10077008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x1007885c]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1007c8b0]
cmp eax, dword [edx + 4]
jle 0x1005f571
push 0x1007c8b0
call fcn.10067831
add esp, 4
cmp dword [0x1007c8b0], 0xffffffff
jne 0x1005f571
mov dword [ebp - 4], 0
xor ecx, ecx
movaps xmm0, xmmword [0x100710f0]
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x24], 0x171a
mov byte [ebp - 0x22], 0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x11
jb 0x1005f503
mov byte [ebp - 0x22], 0
mov cl, 0x70
mov dword [ebp - 0x20], 0x2f243470
xor eax, eax
mov dword [ebp - 0x1c], 0x15031132
mov dword [ebp - 0x18], 0x9111c20
mov word [ebp - 0x14], 0x215
mov byte [ebp - 0x12], 0
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xd
jae 0x1005f546
mov cl, byte [ebp - 0x20]
jmp 0x1005f537
mov ecx, dword [0x1007c134]
lea eax, [ebp - 0x33]
push 0
push eax
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x12], 0
push eax
call fcn.1005ee80
push 0x1007c8b0
mov dword [0x1007c8fc], eax
call fcn.100677f2
add esp, 4
mov eax, dword [0x1007c8fc]
add eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100671ce
mov esp, ebp
pop ebp
ret
Function at 0x1005f5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006acfc
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10077008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x1007885c]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1007c8cc]
cmp eax, dword [edx + 4]
jle 0x1005f6a0
push 0x1007c8cc
call fcn.10067831
add esp, 4
cmp dword [0x1007c8cc], 0xffffffff
jne 0x1005f6a0
mov dword [ebp - 4], 0
mov cl, 0x38
mov dword [ebp - 0x20], 0x54675538
xor eax, eax
mov dword [ebp - 0x1c], 0x6b5d5e51
mov dword [ebp - 0x18], 0x5d4c594c
mov byte [ebp - 0x14], 0
nop dword [eax]
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xb
jae 0x1005f63f
mov cl, byte [ebp - 0x20]
jmp 0x1005f630
mov byte [ebp - 0x14], 0
mov cl, 0x3c
mov dword [ebp - 0x30], 0x6368783c
xor eax, eax
mov dword [ebp - 0x2c], 0x594f5d7e
mov dword [ebp - 0x28], 0x455d506c
mov word [ebp - 0x24], 0x4e59
mov byte [ebp - 0x22], 0
xor byte [ebp + eax - 0x2f], cl
inc eax
cmp eax, 0xd
jae 0x1005f675
mov cl, byte [ebp - 0x30]
jmp 0x1005f666
mov ecx, dword [0x1007c134]
lea eax, [ebp - 0x1f]
push 0
push eax
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x22], 0
push eax
call fcn.1005ee80
push 0x1007c8cc
mov dword [0x1007c8d8], eax
call fcn.100677f2
add esp, 4
mov eax, dword [0x1007c8d8]
add eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100671ce
mov esp, ebp
pop ebp
ret
Function at 0x1005f6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ad3c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10077008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x1007885c]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1007c920]
cmp eax, dword [edx + 4]
jle 0x1005f7d0
push 0x1007c920
call fcn.10067831
add esp, 4
cmp dword [0x1007c920], 0xffffffff
jne 0x1005f7d0
mov dword [ebp - 4], 0
mov cl, 0x30
mov dword [ebp - 0x20], 0x5e6f5d30
xor eax, eax
mov dword [ebp - 0x1c], 0x5b535964
mov dword [ebp - 0x18], 0x55435172
mov byte [ebp - 0x14], 0
nop dword [eax]
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xb
jae 0x1005f76f
mov cl, byte [ebp - 0x20]
jmp 0x1005f760
mov byte [ebp - 0x14], 0
mov cl, 0x5a
mov dword [ebp - 0x30], 0x50e1e5a
xor eax, eax
mov dword [ebp - 0x2c], 0x3f293b18
mov dword [ebp - 0x28], 0x233b360a
mov word [ebp - 0x24], 0x283f
mov byte [ebp - 0x22], 0
xor byte [ebp + eax - 0x2f], cl
inc eax
cmp eax, 0xd
jae 0x1005f7a5
mov cl, byte [ebp - 0x30]
jmp 0x1005f796
mov ecx, dword [0x1007c134]
lea eax, [ebp - 0x1f]
push 0
push eax
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x22], 0
push eax
call fcn.1005ee80
push 0x1007c920
mov dword [0x1007c918], eax
call fcn.100677f2
add esp, 4
mov eax, dword [0x1007c918]
add eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100671ce
mov esp, ebp
pop ebp
ret
Function at 0x1005f800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ad7c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10077008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x1007885c]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1007c8c8]
cmp eax, dword [edx + 4]
jle 0x1005f91f
push 0x1007c8c8
call fcn.10067831
add esp, 4
cmp dword [0x1007c8c8], 0xffffffff
jne 0x1005f91f
mov dword [ebp - 4], 0
mov al, 0x15
mov byte [ebp - 0x1c], 0x78
mov ah, 0x1d
xor al, byte [ebp - 0x1c]
mov cl, 0x27
mov byte [ebp - 0x1b], al
mov dl, 0x11
mov al, byte [ebp - 0x1c]
mov bl, 0x30
xor cl, al
mov byte [ebp - 0x2d], 0x10
xor dl, al
mov byte [ebp - 0x12], 0
xor bl, al
mov byte [ebp - 0x1a], cl
xor ah, al
mov byte [ebp - 0x19], dl
mov ch, 0x19
mov byte [ebp - 0x17], ah
xor ch, al
mov byte [ebp - 0x18], bl
mov dh, 0x14
mov byte [ebp - 0x16], ch
xor dh, al
mov byte [ebp - 0x12], 0
mov bh, 0xc
mov byte [ebp - 0x15], dh
xor bh, al
mov dword [ebp - 0x2c], 0x676c7c38
mov al, byte [ebp - 0x2d]
mov cl, 0x38
xor al, byte [ebp - 0x1c]
mov byte [ebp - 0x13], al
xor eax, eax
mov byte [ebp - 0x14], bh
mov dword [ebp - 0x28], 0x5d4b597a
mov dword [ebp - 0x24], 0x41595468
mov word [ebp - 0x20], 0x4a5d
mov byte [ebp - 0x1e], 0
xor byte [ebp + eax - 0x2b], cl
inc eax
cmp eax, 0xd
jae 0x1005f8f4
mov cl, byte [ebp - 0x2c]
jmp 0x1005f8e5
mov ecx, dword [0x1007c134]
lea eax, [ebp - 0x1b]
push 0
push eax
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x1e], 0
push eax
call fcn.1005ee80
push 0x1007c8c8
mov dword [0x1007c8d4], eax
call fcn.100677f2
add esp, 4
mov eax, dword [0x1007c8d4]
add eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100671ce
mov esp, ebp
pop ebp
ret
Function at 0x1005f950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006adbc
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10077008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x1007885c]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1007c8ac]
cmp eax, dword [edx + 4]
jle 0x1005fa62
push 0x1007c8ac
call fcn.10067831
add esp, 4
cmp dword [0x1007c8ac], 0xffffffff
jne 0x1005fa62
mov dword [ebp - 4], 0
mov al, 0x56
mov byte [ebp - 0x1c], 0x3b
mov ah, 0x57
xor al, byte [ebp - 0x1c]
mov cl, 0x64
mov byte [ebp - 0x1b], al
mov dl, 0x5d
mov al, byte [ebp - 0x1c]
mov bl, 0x7d
xor cl, al
mov byte [ebp - 0x13], 0
mov ch, 0x5a
mov byte [ebp - 0x1a], cl
mov dh, 0x5c
mov byte [ebp - 0x13], 0
mov bh, 0x48
mov dword [ebp - 0x2c], 0x606b7b3f
xor ah, al
mov dword [ebp - 0x28], 0x5a4c5e7d
xor dl, al
mov byte [ebp - 0x17], ah
xor bl, al
mov byte [ebp - 0x19], dl
xor ch, al
mov byte [ebp - 0x18], bl
xor dh, al
mov byte [ebp - 0x16], ch
xor bh, al
mov byte [ebp - 0x15], dh
mov byte [ebp - 0x14], bh
mov cl, 0x3f
mov dword [ebp - 0x24], 0x465e536f
xor eax, eax
mov word [ebp - 0x20], 0x4d5a
mov byte [ebp - 0x1e], 0
xor byte [ebp + eax - 0x2b], cl
inc eax
cmp eax, 0xd
jae 0x1005fa37
mov cl, byte [ebp - 0x2c]
jmp 0x1005fa28
mov ecx, dword [0x1007c134]
lea eax, [ebp - 0x1b]
push 0
push eax
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x1e], 0
push eax
call fcn.1005ee80
push 0x1007c8ac
mov dword [0x1007c8f4], eax
call fcn.100677f2
add esp, 4
mov eax, dword [0x1007c8f4]
add eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100671ce
mov esp, ebp
pop ebp
ret
Function at 0x1005fe00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006aebc
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10077008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x1007885c]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1007c8f0]
cmp eax, dword [edx + 4]
jle 0x1005feeb
push 0x1007c8f0
call fcn.10067831
add esp, 4
cmp dword [0x1007c8f0], 0xffffffff
jne 0x1005feeb
mov dword [ebp - 4], 0
xor ecx, ecx
movaps xmm0, xmmword [0x10071040]
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x24], 0x1118
mov byte [ebp - 0x22], 0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x11
jb 0x1005fe83
mov byte [ebp - 0x22], 0
mov cl, 0x3d
mov dword [ebp - 0x20], 0x6269793d
xor eax, eax
mov dword [ebp - 0x1c], 0x516d6e7e
mov dword [ebp - 0x18], 0x4f58445c
mov byte [ebp - 0x14], 0
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xb
jae 0x1005fec0
mov cl, byte [ebp - 0x20]
jmp 0x1005feb1
mov ecx, dword [0x1007c134]
lea eax, [ebp - 0x33]
push 0
push eax
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x14], 0
push eax
call fcn.1005ee80
push 0x1007c8f0
mov dword [0x1007c908], eax
call fcn.100677f2
add esp, 4
mov eax, dword [0x1007c908]
add eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100671ce
mov esp, ebp
pop ebp
ret

Function at 0x1005ff10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006aefc
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x10077008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x1007885c]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1007c8e4]
cmp eax, dword [edx + 4]
jle 0x1005ffff
push 0x1007c8e4
call fcn.10067831
add esp, 4
cmp dword [0x1007c8e4], 0xffffffff
jne 0x1005ffff
mov dword [ebp - 4], 0
xor ecx, ecx
movaps xmm0, xmmword [0x10071820]
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 0x2c], 0
nop dword [eax]
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0xf
jb 0x1005ff90
movaps xmm0, xmmword [0x10071850]
xor ecx, ecx
mov byte [ebp - 0x2c], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x61637063
mov dword [ebp - 0x14], 0x706776
nop dword [eax]
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x16
jb 0x1005ffc0
mov ecx, dword [0x1007c134]
lea eax, [ebp - 0x3b]
push 0
push eax
lea eax, [ebp - 0x27]
mov byte [ebp - 0x11], 0
push eax
call fcn.1005ee80
push 0x1007c8e4
mov dword [0x1007c8e8], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100677f2
add esp, 4
mov eax, dword [0x1007c8e8]
mov ecx, dword [0x10078aa0]
mov edx, dword [eax + esi]
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100671ce
mov esp, ebp
pop ebp
ret
Function at 0x10060030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006af3c
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10077008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1007885c]
mov ebx, dword [ebp + 8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1007c910]
cmp eax, dword [ecx + 4]
jle 0x10060131
push 0x1007c910
call fcn.10067831
add esp, 4
cmp dword [0x1007c910], 0xffffffff
jne 0x10060131
mov dword [ebp - 4], 0
xor ecx, ecx
movaps xmm0, xmmword [0x10071870]
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x452843
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x12
jb 0x100600b5
mov byte [ebp - 0x21], 0
mov cl, 0x77
mov dword [ebp - 0x20], 0x28233377
xor eax, eax
mov dword [ebp - 0x1c], 0x12041635
mov dword [ebp - 0x18], 0xe161b27
mov word [ebp - 0x14], 0x512
mov byte [ebp - 0x12], 0
nop dword [eax]
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xd
jae 0x100600ff
mov cl, byte [ebp - 0x20]
jmp 0x100600f0
mov ecx, dword [0x1007c134]
lea eax, [ebp - 0x33]
push 0
push eax
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x12], 0
push eax
call fcn.1005ee80
push 0x1007c910
mov dword [0x1007c8a8], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100677f2
add esp, 4
mov esi, dword [0x1007c8a8]
mov ecx, edi
call fcn.10029870
movss xmm0, dword [esi + edi]
movss xmm2, dword [eax + 4]
movss xmm1, dword [eax + 8]
addss xmm0, dword [eax]
addss xmm2, dword [esi + edi + 4]
addss xmm1, dword [esi + edi + 8]
mov eax, ebx
movss dword [ebx], xmm0
movss dword [ebx + 4], xmm2
movss dword [ebx + 8], xmm1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100671ce
mov esp, ebp
pop ebp
ret 4