joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016088
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x10074568
call fcn.1003d3a0
mov esi, ecx
mov edx, dword [0x100a3044]
cmp edx, 0x17
ja 0x10016173
mov ecx, dword [esi + 0x14]
call fcn.1000dd72
mov dword [ebp - 0x18], 0xf
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edx, ebx
mov eax, dword [0x100a3044]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
push eax
cmp eax, 0xa
jge 0x100160f6
movaps xmm0, xmmword [0x100905c0]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x656f3139
mov word [ebp - 0x30], 0x65
mov cl, byte [ebp - 0x44]
xor byte [ebp + edx - 0x43], cl
inc edx
cmp edx, 0x14
jb 0x100160e4
mov byte [ebp - 0x2f], bl
jmp 0x1001611b
movaps xmm0, xmmword [0x1008fc00]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x7b7b712f
mov byte [ebp - 0x30], bl
mov cl, byte [ebp - 0x44]
xor byte [ebp + edx - 0x43], cl
inc edx
cmp edx, 0x13
jb 0x1001610b
mov byte [ebp - 0x30], bl
sub esp, 0x18
lea eax, [ebp - 0x43]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x60]
push eax
call fcn.10003c43
add esp, 0x20
lea ecx, [ebp - 0x2c]
push eax
call fcn.10005f9d
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.1000402e
mov ecx, dword [esi + 0x1c]
lea edx, [ebp - 0x2c]
call fcn.1000de50
mov eax, dword [0x100a3044]
test eax, eax
jle 0x10016164
push ecx
push eax
call fcn.1001603f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
push ebx
push 1
call fcn.1000402e
mov edx, dword [0x100a3050]
cmp edx, 0x14
ja 0x100161b4
mov ecx, dword [esi + 0x18]
call fcn.1000dd72
mov edx, dword [0x100a3050]
mov ecx, dword [esi + 0x20]
call fcn.1000de73
movd xmm0, dword [0x100a3050]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x1008f590]
movss dword [0x1009aaac], xmm0
call fcn.10015287
call fcn.1003d34a
ret
Function at 0x10016272
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [0x1008fdc0]
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x3225
push esi
mov esi, ecx
mov byte [ebp - 6], bl
movups xmmword [ebp - 0x18], xmm0
mov edx, ebx
mov cl, byte [ebp - 0x18]
xor byte [ebp + edx - 0x17], cl
inc edx
cmp edx, 0x11
jb 0x10016294
sub esp, 0x18
mov byte [ebp - 6], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 4], eax
mov dl, 0x5e
mov dword [ebp - 0x14], 0x2c2a2d5e
mov dword [ebp - 0x10], 0x38303701
mov ecx, ebx
mov dword [ebp - 0xc], 0x6f0131
xor dl, byte [ebp + ecx - 0x13]
mov byte [ebp + ecx - 0x13], dl
inc ecx
cmp ecx, 0xa
jae 0x100162eb
mov dl, byte [ebp - 0x14]
jmp 0x100162d8
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi + 4]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 8], eax
mov dl, 0x23
mov dword [ebp - 0x14], 0x51575023
mov dword [ebp - 0x10], 0x454d4a7c
mov ecx, ebx
mov dword [ebp - 0xc], 0x117c4c
xor dl, byte [ebp + ecx - 0x13]
mov byte [ebp + ecx - 0x13], dl
inc ecx
cmp ecx, 0xa
jae 0x10016336
mov dl, byte [ebp - 0x14]
jmp 0x10016323
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi + 4]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 0xc], eax
mov cl, 0x3c
mov dword [ebp - 0x14], 0x4e484f3c
mov dword [ebp - 0x10], 0x5a525563
mov edx, ebx
mov dword [ebp - 0xc], 0xf6353
xor cl, byte [ebp + edx - 0x13]
mov byte [ebp + edx - 0x13], cl
inc edx
cmp edx, 0xa
jae 0x10016381
mov cl, byte [ebp - 0x14]
jmp 0x1001636e
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi + 4]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 0x10], eax
mov dl, 0x36
mov dword [ebp - 0x14], 0x515b5f36
mov dword [ebp - 0x10], 0x57424569
mov ecx, ebx
mov dword [ebp - 0xc], 0x585f4244
mov word [ebp - 8], 0x51
xor dl, byte [ebp + ecx - 0x13]
mov byte [ebp + ecx - 0x13], dl
inc ecx
cmp ecx, 0xc
jae 0x100163d2
mov dl, byte [ebp - 0x14]
jmp 0x100163bf
sub esp, 0x18
mov byte [ebp - 7], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi + 4]
call fcn.1000d3c0
mov dword [esi + 0x18], eax
add esp, 0x18
mov cl, 4
mov dword [ebp - 0x14], 0x63696d04
mov dword [ebp - 0x10], 0x777d665b
mov eax, ebx
mov dword [ebp - 0xc], 0x606a6570
mov byte [ebp - 8], bl
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x1001641c
mov cl, byte [ebp - 0x14]
jmp 0x1001640d
sub esp, 0x18
mov byte [ebp - 8], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi + 4]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 0x1c], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016a3c
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x1007461f
call fcn.1003d36c
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x10016b6f
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esi + 0x20], 1
mov word [esi + 0x28], ax
call fcn.10016e27
movaps xmm0, xmmword [0x10090490]
mov edx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x62620972
mov dword [ebp - 0x2c], 0xf626268
mov byte [ebp - 0x28], bl
mov cl, byte [ebp - 0x40]
xor byte [ebp + edx - 0x3f], cl
inc edx
cmp edx, 0x17
jb 0x10016a8c
lea eax, [ebp - 0x3f]
mov byte [ebp - 0x28], bl
push eax
lea ecx, [ebp - 0x24]
call fcn.10004179
mov byte [ebp - 4], 1
lea edx, [ebp - 0x24]
mov ecx, dword [esi + 0xc]
call fcn.1000de50
push ebx
push 1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.1000402e
cmp dword [ebp + 0x1c], 0
mov edx, ebx
jne 0x10016b0f
mov cl, 0x63
mov dword [ebp - 0x18], 0x60a3063
mov dword [ebp - 0x14], 0x20430604
mov dword [ebp - 0x10], 0xd020f
xor cl, byte [ebp + edx - 0x17]
mov byte [ebp + edx - 0x17], cl
inc edx
cmp edx, 0xa
jae 0x10016af7
mov cl, byte [ebp - 0x18]
jmp 0x10016ae4
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10004179
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
jmp 0x10016b5c
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x10090640]
cmovae eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 0x5a
mov cl, byte [ebp - 0x20]
xor byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 0x10
jb 0x10016b2c
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x40]
push eax
call fcn.10003c43
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.1000de50
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.1000402e
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.1000402e
call fcn.1003d335
ret 0x1c
Function at 0x10016b82
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x10074662
call fcn.1003d36c
mov esi, ecx
mov di, word [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test di, di
je 0x10016d3d
movzx eax, word [esi + 0x28]
test ax, ax
jg 0x10016d3d
movaps xmm0, xmmword [0x1008f9c0]
mov edx, ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x24], ebx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x111b1b70
mov dword [ebp - 0x14], 0x761b1b
mov cl, byte [ebp - 0x28]
xor byte [ebp + edx - 0x27], cl
inc edx
cmp edx, 0x16
jb 0x10016bd0
lea eax, [ebp - 0x27]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.10004179
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, dword [esi + 8]
call fcn.1000de50
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.1000402e
movaps xmm0, xmmword [str._mZRVQVQX]
xor edx, edx
push 0x62
pop ebx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0xf0f641f
mov word [ebp - 0x14], 0xf05
mov byte [ebp - 0x12], 0xf
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x10], 0
mov cl, byte [ebp - 0x28]
xor byte [ebp + edx - 0x27], cl
inc edx
cmp edx, 0x17
jb 0x10016c31
lea eax, [ebp - 0x27]
mov byte [ebp - 0x10], 0
push eax
lea ecx, [ebp - 0x40]
call fcn.10004179
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
mov ecx, dword [esi + 0xc]
call fcn.1000de50
push 0
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.1000402e
cmp dword [ebp + 0x1c], 0
jne 0x10016cbd
mov byte [ebp - 0x1c], bl
xor ecx, ecx
mov dword [ebp - 0x1b], 0x5070b31
mov dword [ebp - 0x17], 0xe214207
mov word [ebp - 0x13], 0xc03
mov byte [ebp - 0x11], 0
xor bl, byte [ebp + ecx - 0x1b]
mov byte [ebp + ecx - 0x1b], bl
inc ecx
cmp ecx, 0xa
jae 0x10016ca3
mov bl, byte [ebp - 0x1c]
jmp 0x10016c90
lea eax, [ebp - 0x1b]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x11], bl
call fcn.10004179
mov byte [ebp - 4], 3
lea edx, [ebp - 0x40]
jmp 0x10016d0e
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x100905e0]
cmovae eax, dword [ebp + 0xc]
xor ebx, ebx
push eax
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x5f
mov edx, ebx
mov cl, byte [ebp - 0x24]
xor byte [ebp + edx - 0x23], cl
inc edx
cmp edx, 0x10
jb 0x10016cde
sub esp, 0x18
mov byte [ebp - 0x13], bl
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x40]
push eax
call fcn.10003c43
add esp, 0x20
mov byte [ebp - 4], 4
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.1000de50
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.1000402e
mov ecx, dword [esi]
push 2
call dword [0x1008e4a0]
mov ecx, esi
mov word [esi + 0x28], di
mov byte [esi + 0x21], 1
call fcn.10016e27
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.1000402e
call fcn.1003d335
ret 0x1c
Function at 0x10016d50
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x10074695
call fcn.1003d36c
mov esi, ecx
mov ax, word [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edx, ebx
mov word [esi + 0x28], ax
cmp dword [ebp + 0x1c], ebx
jne 0x10016db4
mov cl, 0x6d
mov dword [ebp - 0x1c], 0x8043e6d
mov dword [ebp - 0x18], 0x2e4d080a
mov dword [ebp - 0x14], 0x30c01
xor cl, byte [ebp + edx - 0x1b]
mov byte [ebp + edx - 0x1b], cl
inc edx
cmp edx, 0xa
jae 0x10016d9c
mov cl, byte [ebp - 0x1c]
jmp 0x10016d89
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], bl
push eax
lea ecx, [ebp - 0x3c]
call fcn.10004179
mov byte [ebp - 4], 1
lea edx, [ebp - 0x3c]
jmp 0x10016e01
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x10090730]
cmovae eax, dword [ebp + 0xc]
push eax
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 0x53
mov cl, byte [ebp - 0x20]
xor byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 0x10
jb 0x10016dd1
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x3c]
push eax
call fcn.10003c43
add esp, 0x20
mov byte [ebp - 4], 2
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.1000de50
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000402e
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.1000402e
call fcn.1003d335
ret 0x1c
Function at 0x10017230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x1008fbd0]
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x3e240832
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0xc], 0x23362223
xor ecx, ecx
mov dword [ebp - 8], 0x39383e
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x1a
jb 0x1001725b
sub esp, 0x18
mov byte [ebp - 5], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 4], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001822b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x1009ee2c], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov ebx, ecx
push edi
jne 0x10018263
mov ecx, dword [ebx]
call fcn.1000d78d
mov edi, eax
test edi, edi
je 0x10018263
mov ecx, dword [edi]
push 4
push ecx
mov dword [0x1009ee2c], ecx
call esi
test eax, eax
jne 0x10018263
mov dword [edi], 0x10017eaf
cmp dword [0x1009ee24], 0
jne 0x10018290
mov ecx, dword [ebx]
call fcn.1000d7bc
mov edi, eax
test edi, edi
je 0x10018290
mov ecx, dword [edi]
push 4
push ecx
mov dword [0x1009ee24], ecx
call esi
test eax, eax
jne 0x10018290
mov dword [edi], 0x1001815c
call fcn.1003b3e0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call fcn.1003b8b0
mov ebx, 0x1001819a
push ebx
push 0x1009ee20
call fcn.1003b0f0
call fcn.1003b440
push 4
push 0x83abd0
call esi
test eax, eax
jne 0x100182ec
mov dword [0x1009ee20], 0x83abd0
call fcn.1003b3e0
call edi
push eax
call fcn.1003b8b0
push ebx
push 0x1009ee20
call fcn.1003ac60
call fcn.1003b440
push 4
mov edi, 0x83cc97
push edi
call esi
test eax, eax
jne 0x10018309
mov ecx, edi
mov edx, 0x100181f3
pop edi
pop esi
pop ebx
jmp fcn.10010594
pop edi
pop esi
pop ebx
ret
Function at 0x100183db
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movaps xmm0, xmmword [str.W59_b_6_b_2_2]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov edx, ebx
movups xmmword [ebp - 0x18], xmm0
mov cl, byte [ebp - 0x18]
xor byte [ebp + edx - 0x17], cl
inc edx
cmp edx, 0xe
jb 0x100183f4
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 4], eax
mov dl, 0x5e
mov dword [ebp - 0x14], 0x302a1c5e
mov dword [ebp - 0x10], 0x2c2a0d01
mov ecx, ebx
mov dword [ebp - 0xc], 0x2a39303b
mov word [ebp - 8], 0x36
xor dl, byte [ebp + ecx - 0x13]
mov byte [ebp + ecx - 0x13], dl
inc ecx
cmp ecx, 0xc
jae 0x10018451
mov dl, byte [ebp - 0x14]
jmp 0x1001843e
sub esp, 0x18
mov byte [ebp - 7], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 8], eax
mov dl, 0x23
mov dword [ebp - 0x14], 0x4d576123
mov dword [ebp - 0x10], 0x4257707c
mov ecx, ebx
mov dword [ebp - 0xc], 0x424d4a4e
mov byte [ebp - 8], bl
xor dl, byte [ebp + ecx - 0x13]
mov byte [ebp + ecx - 0x13], dl
inc ecx
cmp ecx, 0xb
jae 0x1001849e
mov dl, byte [ebp - 0x14]
jmp 0x1001848b
sub esp, 0x18
mov byte [ebp - 8], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 0xc], eax
mov dl, 0x3c
mov dword [ebp - 0x18], 0x52487e3c
mov dword [ebp - 0x14], 0x44597863
mov ecx, ebx
mov dword [ebp - 0x10], 0x554e5948
mov word [ebp - 0xc], 0x4548
mov byte [ebp - 0xa], bl
xor dl, byte [ebp + ecx - 0x17]
mov byte [ebp + ecx - 0x17], dl
inc ecx
cmp ecx, 0xd
jae 0x100184f1
mov dl, byte [ebp - 0x18]
jmp 0x100184de
sub esp, 0x18
mov byte [ebp - 0xa], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
movaps xmm0, xmmword [0x10090310]
add esp, 0x18
mov dword [esi + 0x10], eax
mov edx, ebx
movups xmmword [ebp - 0x18], xmm0
mov byte [ebp - 8], bl
mov cl, byte [ebp - 0x18]
xor byte [ebp + edx - 0x17], cl
inc edx
cmp edx, 0xf
jb 0x1001851f
sub esp, 0x18
mov byte [ebp - 8], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
movaps xmm0, xmmword [0x10090480]
add esp, 0x18
mov dword [esi + 0x14], eax
mov ecx, ebx
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0x61
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x10
jb 0x1001855d
sub esp, 0x18
mov byte [ebp - 7], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 0x18], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c07d
Capabilities:
Encode data using xor

Disassembly:
push 0x84
mov eax, 0x10074bf7
call fcn.1003d36c
push 3
lea edi, [ecx + 0x130]
lea esi, [ecx + 0x44]
pop ebx
mov ecx, dword [esi]
call fcn.10008ecc
test eax, eax
je 0x1001c0ff
movzx eax, word [esi + 4]
xor edx, edx
movaps xmm0, xmmword [str.eSnuo_6__]
push eax
movzx eax, word [edi]
push eax
movups xmmword [ebp - 0x30], xmm0
mov cl, byte [ebp - 0x30]
xor byte [ebp + edx - 0x2f], cl
inc edx
cmp edx, 0xe
jb 0x1001c0b9
sub esp, 0x18
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x2f]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x60]
push eax
call fcn.10003c43
add esp, 0x24
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x1001c0f0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x48]
call fcn.10004179
mov byte [ebp - 4], 1
jmp 0x1001c17e
cmp dword [esi], 1
jne 0x1001c1bf
cmp byte [esi + 6], 0
je 0x1001c1bf
movzx eax, word [esi + 4]
mov cl, 0x5a
push eax
movzx eax, word [edi]
xor edx, edx
push eax
mov dword [ebp - 0x1c], 0x7a3e7f5a
mov dword [ebp - 0x18], 0x3e7f7a75
mov byte [ebp - 0x14], 0
xor cl, byte [ebp + edx - 0x1b]
mov byte [ebp + edx - 0x1b], cl
inc edx
cmp edx, 7
jae 0x1001c144
mov cl, byte [ebp - 0x1c]
jmp 0x1001c131
sub esp, 0x18
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x60]
push eax
call fcn.10003c43
add esp, 0x24
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x1001c171
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x48]
call fcn.10004179
mov byte [ebp - 4], 3
mov ecx, dword [esi + 0xc]
lea edx, [ebp - 0x48]
call fcn.1000de50
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.1000402e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
push 0
push 1
call fcn.1000402e
movzx eax, word [edi]
xorps xmm3, xmm3
mov ecx, dword [esi + 0x10]
xorps xmm2, xmm2
movd xmm1, eax
cvtdq2ps xmm1, xmm1
call fcn.1000dcf3
jmp 0x1001c231
movzx eax, word [esi + 4]
push eax
sub esp, 0x18
mov word [ebp - 0x10], 0x6d
lea eax, [ebp - 0xf]
mov byte [ebp - 0xf], 0
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x90]
push eax
call fcn.10003c43
add esp, 0x20
mov dword [ebp - 4], 4
cmp dword [eax + 0x14], 0x10
jb 0x1001c1fa
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x78]
call fcn.10004179
mov byte [ebp - 4], 5
lea edx, [ebp - 0x78]
mov ecx, dword [esi + 0xc]
call fcn.1000de50
push 0
push 1
lea ecx, [ebp - 0x78]
call fcn.1000402e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
push 0
push 1
call fcn.1000402e
mov ax, word [edi]
cmp ax, word [esi + 4]
jb 0x1001c247
mov ecx, dword [esi + 0xc]
mov edx, 0xff80ff00
call fcn.1000de96
add edi, 2
add esi, 0x18
sub ebx, 1
jne 0x1001c098
call fcn.1003d335
ret
Function at 0x1001c25c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x74
mov eax, 0x10074c4f
call fcn.1003d36c
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edx, ebx
movzx eax, word [esi + 0x140]
movzx ecx, word [esi + 0x136]
push eax
mov word [esi + 0x13e], cx
push ecx
cmp byte [esi + 0x13c], bl
je 0x1001c2d7
movaps xmm0, xmmword [0x10090080]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x115c1d10
mov byte [ebp - 0x24], bl
mov cl, byte [ebp - 0x38]
xor byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0x13
jb 0x1001c2a5
sub esp, 0x18
mov byte [ebp - 0x24], bl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x80]
push eax
call fcn.10003c43
add esp, 0x24
mov dword [ebp - 4], ebx
xor ebx, ebx
inc ebx
jmp 0x1001c327
mov cl, 0x5b
mov dword [ebp - 0x20], 0x7b3f7e5b
mov dword [ebp - 0x1c], 0x7e7b3d34
mov word [ebp - 0x18], 0x3f
xor cl, byte [ebp + edx - 0x1f]
mov byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 8
jae 0x1001c300
mov cl, byte [ebp - 0x20]
jmp 0x1001c2ed
sub esp, 0x18
mov byte [ebp - 0x17], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x68]
push eax
call fcn.10003c43
add esp, 0x24
push 2
mov dword [ebp - 4], 1
pop ebx
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x10], ebx
jb 0x1001c332
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10004179
mov dword [ebp - 4], 2
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0xc]
call fcn.1000de50
xor esi, esi
lea ecx, [ebp - 0x50]
push esi
push 1
call fcn.1000402e
test bl, 2
je 0x1001c36d
push esi
push 1
lea ecx, [ebp - 0x68]
and ebx, 0xfffffffd
call fcn.1000402e
test bl, 1
je 0x1001c37d
push esi
push 1
lea ecx, [ebp - 0x80]
call fcn.1000402e
call fcn.1003d335
ret
Function at 0x10020382
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x10074f39
call fcn.1003d36c
mov edi, ecx
mov dword [ebp - 0x18], edi
or dword [edi + 0x140], 0xffffffff
xor ebx, ebx
movaps xmm0, xmmword [0x1008ffe0]
mov edx, ebx
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x405f5a52
mov byte [ebp - 0x1c], bl
mov cl, byte [ebp - 0x30]
xor byte [ebp + edx - 0x2f], cl
inc edx
cmp edx, 0x13
jb 0x100203b3
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x1c], bl
push eax
lea ecx, [ebp - 0x48]
call fcn.10004179
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x48]
mov ecx, dword [edi + 0x7c]
call fcn.1000de50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
push ebx
push 1
call fcn.1000402e
mov ecx, dword [edi + 0x7c]
or edx, 0xffffffff
call fcn.1000de96
push 4
lea esi, [edi + 0xb8]
lea ebx, [edi + 0x84]
pop edi
mov ecx, dword [ebx]
xor dl, dl
call fcn.1000d5f0
lea eax, [ebp - 0xf]
mov word [ebp - 0x10], 0x41
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 0xf], 0
call fcn.10004179
mov dword [ebp - 4], 1
lea edx, [ebp - 0x48]
mov ecx, dword [esi - 8]
call fcn.1000de50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
push 0
push 1
call fcn.1000402e
lea eax, [ebp - 0x13]
mov word [ebp - 0x14], 0x34
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x13], 0
call fcn.10004179
mov dword [ebp - 4], 2
lea edx, [ebp - 0x48]
mov ecx, dword [esi - 4]
call fcn.1000de50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
push 0
push 1
call fcn.1000402e
mov ecx, dword [esi]
push 0
call fcn.1000dc9e
pop ecx
mov ecx, dword [esi]
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
call fcn.1000dcf3
lea ebx, [ebx + 4]
lea esi, [esi + 0x14]
sub edi, 1
jne 0x10020406
mov edi, dword [ebp - 0x18]
push 5
pop ebx
lea esi, [edi + 0xf8]
add edi, 0x94
mov ecx, dword [edi]
xor dl, dl
call fcn.1000d5f0
xor ecx, ecx
cmp dword [esi], ecx
je 0x10020518
mov word [ebp - 0x14], 0x5f
lea eax, [ebp - 0x13]
mov byte [ebp - 0x13], cl
lea ecx, [ebp - 0x48]
push eax
call fcn.10004179
mov dword [ebp - 4], 3
lea edx, [ebp - 0x48]
mov ecx, dword [esi]
add ecx, 4
call fcn.1000b24e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
push 0
push 1
call fcn.1000402e
mov eax, dword [esi]
xor ecx, ecx
mov dword [eax + 0x60], ecx
mov eax, dword [esi]
mov dword [eax + 0x64], ecx
mov eax, dword [esi]
mov dword [eax + 0x68], ecx
mov eax, dword [esi]
mov dword [eax + 0x6c], ecx
mov word [ebp - 0x18], 0x48
lea eax, [ebp - 0x17]
mov byte [ebp - 0x17], cl
lea ecx, [ebp - 0x60]
push eax
call fcn.10004179
mov dword [ebp - 4], 4
lea edx, [ebp - 0x60]
mov ecx, dword [esi + 8]
call fcn.1000dacb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
push 0
push 1
call fcn.1000402e
add edi, 4
add esi, 0xc
sub ebx, 1
jne 0x100204ba
call fcn.1003d335
ret