joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a7bf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.00671ef0
mov esi, eax
add esp, 8
test esi, esi
jne 0x6a7c20
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x831384], 0
mov edi, dword [ebp + 8]
je 0x6a7c6b
mov eax, dword [0x831480]
test eax, eax
je 0x6a7c43
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x6a7c6b
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x675180
push 0
push 0
mov dword [esi + 0xc], edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x6a7c78
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x6a7c91
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6b6820
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 0x10]
mov edi, edx
mov ebx, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov byte [ebx + 0x10], 1
push edi
push edi
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push ebx
call fcn.006bc810
add esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x6b6861
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push ebx
call fcn.006bc810
add esp, 0x14
pop edi
pop ebx
pop ebp
ret
Function at 0x712b40
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
test edx, edx
push ebx
mov ecx, 0x367cd507
mov dword [ebp - 0xc], 0xc1059ed8
mov dword [eax], 0
mov ebx, 0xa54ff53a
mov dword [eax + 4], 0
mov edx, 0x510e527f
mov eax, 0xbb67ae85
cmovne eax, ecx
mov ecx, 0x3070dd17
mov dword [ebp - 0x10], eax
mov eax, 0x3c6ef372
cmovne eax, ecx
mov ecx, 0x5be0cd19
mov dword [ebp - 0x14], eax
mov eax, 0xf70e5939
cmovne ebx, eax
mov eax, 0x64f98fa7
push esi
push edi
mov edi, 0x1f83d9ab
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
cmovne edi, eax
mov eax, 0x68581511
mov esi, 0x9b05688c
cmovne esi, eax
test ebx, ebx
mov ebx, dword [ebp - 4]
mov eax, 0xffc00b31
cmovne edx, eax
mov eax, 0xbefa4fa4
cmovne ecx, eax
mov eax, 0x6a09e667
cmovne eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], esi
mov dword [eax + 0x20], edi
pop edi
mov dword [eax + 0x24], ecx
mov ecx, dword [ebp - 8]
pop esi
mov dword [eax + 0xe8], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x718540
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Encode data using xor
Get local ipv4 addresses
Get socket information
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7bacc2
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1d0], edi
mov dword [ebp - 0x1cc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebp - 0x1b4]
mov dword [ebp - 4], 0
push eax
push 0x202
mov dword [ebp - 0x1cc], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [ebp - 0x1c0], 7
xorps xmm0, xmm0
mov dword [ebp - 0x1c8], esi
mov eax, 2
mov dword [ebp - 0x1bc], 0x82938491
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x24], ax
xor ecx, ecx
mov dword [ebp - 0x1b8], 0xb0978095
nop word [eax + eax]
lea eax, [ecx - 0x57]
xor byte [ebp + ecx - 0x1bc], al
inc ecx
mov eax, dword [ebp - 0x1c0]
cmp ecx, eax
jb 0x718600
mov byte [ebp + eax - 0x1bc], 0
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x35
mov dword [ebp - 0x20], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
mov esi, dword [ebp - 0x1c8]
jne 0x7186aa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x10
push eax
lea eax, [ebp - 0x1c4]
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x1c4], xmm0
call dword [sym.imp.WS2_32.dll_getsockname]
push dword [ebp - 0x1c0]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, eax
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x1c8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x718694
sub ecx, dword [ebp - 0x1c8]
push ecx
push edx
mov ecx, edi
call fcn.00407ab0
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret
Function at 0x71a2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7baff8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [0x831184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x10], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
movzx esi, word [eax + 4]
xor ebx, ebx
test esi, esi
je 0x71a3a1
movzx eax, word [edx + 0x12]
lea ecx, [edx + 6]
cmp eax, dword [ebp + 0x10]
lea edx, [edx + 0xe]
cmovne ecx, ebx
mov ebx, ecx
sub esi, 1
jne 0x71a310
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x71a3a1
mov esi, dword [ebp + 0xc]
lea ebx, [esi + 0x26]
push ebx
call fcn.007906ca
mov edi, eax
xor eax, eax
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x10]
push esi
push dword [ebp + 8]
mov cx, word [eax + 2]
mov eax, 1
mov word [ebp - 0x2e], cx
mov ecx, dword [ebp - 0x30]
mov dword [edi], ecx
mov ecx, dword [ebp - 0x14]
mov word [edi + 4], ax
mov eax, dword [ecx]
mov dword [edi + 6], eax
mov eax, dword [ecx + 4]
mov dword [edi + 0xa], eax
lea eax, [edi + 0x16]
mov dword [edi + 0xe], esi
push eax
mov dword [edi + 0x12], 0x16
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x18]
add esp, 0x10
mov dword [eax], edi
mov dword [eax + 4], ebx
mov byte [eax + 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x7c], 0x21
xor eax, eax
mov dword [ebp - 0x78], 0xc500ed
mov dword [ebp - 0x74], 0x8b00c5
mov dword [ebp - 0x70], 0x8e00d9
mov dword [ebp - 0x6c], 0xdf00c9
mov dword [ebp - 0x68], 0xdc00c4
mov dword [ebp - 0x64], 0x9400d7
mov dword [ebp - 0x60], 0xc400f2
mov dword [ebp - 0x5c], 0xf100c7
mov dword [ebp - 0x58], 0xd500da
mov dword [ebp - 0x54], 0xf800d5
mov dword [ebp - 0x50], 0xcc00d4
mov dword [ebp - 0x4c], 0xae00fa
mov dword [ebp - 0x48], 0xb000b5
mov dword [ebp - 0x44], 0xe400ba
mov dword [ebp - 0x40], 0xbf00a7
mov dword [ebp - 0x3c], 0xa100e7
mov dword [ebp - 0x38], 0xca00ad
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x78], cx
inc eax
mov ecx, dword [ebp - 0x7c]
cmp eax, ecx
jb 0x71a421
xor eax, eax
mov dword [ebp - 0x20], 7
mov word [ebp + ecx*2 - 0x78], ax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x24], eax
lea edx, [ecx + 2]
mov word [ebp - 0x34], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x71a450
sub ecx, edx
lea eax, [ebp - 0x78]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.004044f0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00404120
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x34]
mov dword [edi + 0x18], eax
mov byte [edi + 0x1c], 1
call fcn.00404490
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x71b6a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ecx]
movaps xmm0, xmmword [0x7e6040]
movzx ecx, byte [eax + 0x14]
movzx edx, byte [eax + 0x17]
movzx ebx, byte [eax + 0x15]
mov dword [ebp - 0x40], ecx
movzx ecx, byte [eax + 0x13]
mov dword [ebp - 0x44], ecx
movzx ecx, byte [eax + 0x12]
mov dword [ebp - 0x48], ecx
movzx ecx, byte [eax + 0x11]
mov dword [ebp - 0x4c], ecx
movzx ecx, byte [eax + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x50], ecx
movzx ecx, byte [eax + 0xe]
mov dword [ebp - 0x54], ecx
movzx ecx, byte [eax + 0xf]
mov dword [ebp - 0x58], ecx
movzx ecx, byte [eax + 0xc]
mov dword [ebp - 0x5c], ecx
movzx ecx, byte [eax + 0xd]
mov dword [ebp - 0x60], ecx
movzx ecx, byte [eax + 8]
mov dword [ebp - 0x64], ecx
movzx ecx, byte [eax + 9]
mov dword [ebp - 0x68], ecx
movzx ecx, byte [eax + 0xa]
movzx edi, byte [eax + 0x16]
movzx eax, byte [eax + 0xb]
movups xmmword [ebp - 0xb4], xmm0
mov dword [ebp - 0x3c], esi
movaps xmm0, xmmword [0x7e6150]
movups xmmword [ebp - 0xa4], xmm0
mov dword [ebp - 0x6c], ecx
xor ecx, ecx
movaps xmm0, xmmword [0x7e57b0]
mov dword [ebp - 0x3c], eax
mov eax, 0x44
movups xmmword [ebp - 0x94], xmm0
mov dword [ebp - 0xb8], eax
movaps xmm0, xmmword [0x7e5a20]
movups xmmword [ebp - 0x84], xmm0
mov dword [ebp - 0x74], 0xb4d9dacc
mov byte [ebp - 0x70], 0xed
mov word [ebp - 0x6f], cx
mov byte [ebp - 0x6d], cl
nop dword [eax]
lea eax, [ecx - 0x57]
xor byte [ebp + ecx - 0xb4], al
inc ecx
mov eax, dword [ebp - 0xb8]
cmp ecx, eax
jb 0x71b780
push edx
push edi
push ebx
push dword [ebp - 0x40]
mov byte [ebp + eax - 0xb4], 0
lea eax, [ebp - 0xb4]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push dword [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0071d980
lea ecx, [ebp - 0x38]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
add esp, 0x48
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x71b7f1
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, esi
call fcn.00407ab0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 4
Function at 0x727440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.00725160
Function at 0x72a100
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7bc408
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x831184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ecx, edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x20], edi
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0
call fcn.00404120
add edi, 0x18
mov dword [ebp - 4], 1
add esi, 0x18
mov dword [ebp - 0x1c], edi
push esi
mov ecx, edi
call fcn.00472e40
lea eax, [esi + 0xc]
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
push eax
call fcn.00404120
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov byte [ebp - 4], 3
lea eax, [esi + 0x3c]
lea ecx, [edi + 0x3c]
push eax
call fcn.00404120
lea eax, [esi + 0x54]
mov byte [ebp - 4], 4
lea ecx, [edi + 0x54]
push eax
call fcn.00404120
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x6c], eax
movups xmm0, xmmword [esi + 0x70]
mov byte [ebp - 4], 5
movups xmmword [edi + 0x70], xmm0
movzx eax, byte [esi + 0x80]
mov byte [edi + 0x80], al
movzx eax, byte [esi + 0x81]
mov byte [edi + 0x81], al
movzx eax, byte [esi + 0x82]
mov byte [edi + 0x82], al
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov eax, dword [esi + 0x88]
add esi, 0x8c
mov dword [edi + 0x88], eax
add edi, 0x8c
push esi
mov ecx, edi
mov dword [ebp - 0x1c], edi
call fcn.00404120
lea eax, [esi + 0x18]
mov byte [ebp - 4], 6
lea ecx, [edi + 0x18]
push eax
call fcn.00404120
lea eax, [esi + 0x30]
mov byte [ebp - 4], 7
lea ecx, [edi + 0x30]
push eax
call fcn.00404120
lea eax, [esi + 0x48]
mov byte [ebp - 4], 8
lea ecx, [edi + 0x48]
push eax
call fcn.00404120
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
mov edi, dword [ebp - 0x10]
cmp dword [edi + 0xb4], 0
jne 0x72a2d1
lea eax, [ebp - 0x38]
push eax
call fcn.006610b0
mov esi, eax
add edi, 0xa4
add esp, 4
cmp edi, esi
je 0x72a292
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x24]
cmp edx, 8
jb 0x72a2ce
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x72a2c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x72a2c4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0076e8f3
add esp, 8
mov edi, dword [ebp - 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7391f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
push esi
cmp eax, 1
je 0x739386
cmp eax, 2
je 0x739386
cmp eax, 3
jne 0x73926b
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0xb
mov dword [ebp - 0xc], 0xcfc4c6cb
mov dword [ebp - 8], 0xd6c0f1c6
mov dword [ebp - 4], 0xb4c1d7d7
call fcn.004131e0
mov esi, dword [ebp + 8]
mov edx, eax
mov ecx, edx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edi, [ecx + 1]
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x739251
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00407ab0
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 4
jne 0x7392a2
movaps xmm0, xmmword [0x7caeb0]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x13
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 4], 0xbcd5d5d0
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 7
jne 0x7392bc
mov ecx, dword [ebp + 8]
push 0x83e510
call fcn.00406bb0
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 8
jne 0x7392d6
mov ecx, dword [ebp + 8]
push 0x83e528
call fcn.00406bb0
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 9
jne 0x7392ff
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xf]
call fcn.00736c20
mov ecx, eax
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x739328
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xf]
call fcn.00736bf0
mov ecx, eax
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x739351
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xf]
call fcn.00736cd0
mov ecx, eax
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 9
mov dword [ebp - 0xc], 0xc9cfc4dc
mov dword [ebp - 8], 0xd5c1c7cb
mov dword [ebp - 4], 0xb2d5
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x7caee0]
mov eax, 0x11
mov dword [ebp - 0x18], eax
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 4], 0xbad7
lea eax, [ecx - 0x57]
xor byte [ebp + ecx - 0x14], al
inc ecx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
jb 0x7393a2
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp + eax - 0x14], 0
lea edx, [ecx + 1]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x7393d0
sub ecx, edx
lea eax, [ebp - 0x14]
push ecx
push eax
mov ecx, esi
call fcn.00407ab0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7393f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x1c
push esi
cmp eax, 2
jne 0x73945e
movaps xmm0, xmmword [0x7cae60]
mov eax, 0xc
mov dword [ebp - 0x14], eax
xor ecx, ecx
movups xmmword [ebp - 0x10], xmm0
lea eax, [ecx - 0x57]
xor byte [ebp + ecx - 0x10], al
inc ecx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
jb 0x739414
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov byte [ebp + eax - 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x739442
sub ecx, edx
lea eax, [ebp - 0x10]
push ecx
push eax
mov ecx, esi
call fcn.00407ab0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x7394d0
movaps xmm0, xmmword [0x7caed0]
mov eax, 0x15
mov dword [ebp - 0x1c], eax
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0xd9d0e5d7
mov dword [ebp - 4], 0xbec4
lea eax, [ecx - 0x57]
xor byte [ebp + ecx - 0x18], al
inc ecx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
jb 0x739486
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov byte [ebp + eax - 0x18], 0
lea edx, [ecx + 1]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x7394b4
sub ecx, edx
lea eax, [ebp - 0x18]
push ecx
push eax
mov ecx, esi
call fcn.00407ab0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x73952a
push edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 5
mov dword [ebp - 8], 0xdfc4c6ca
mov dword [ebp - 4], 0xaec8
call fcn.004131e0
mov esi, dword [ebp + 8]
mov edx, eax
mov ecx, edx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edi, [ecx + 1]
mov byte [esi], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x739510
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00407ab0
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x739561
movaps xmm0, xmmword [0x7caef0]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x13
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 4], 0xbcc2d6d5
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x73958a
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xf]
call fcn.00736ca0
mov ecx, eax
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], 9
lea ecx, [ebp - 0x10]
cmp eax, 4
jne 0x7395b0
mov dword [ebp - 0xc], 0xf3d2d8dd
mov dword [ebp - 8], 0xd1c6dcd9
mov dword [ebp - 4], 0xb2dd
jmp 0x7395c5
mov dword [ebp - 0xc], 0xc9cfc4dc
mov dword [ebp - 8], 0xd5c1c7cb
mov dword [ebp - 4], 0xb2d5
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x73adb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7be11f
mov eax, dword fs:[0]
push eax
sub esp, 0xac
push esi
mov eax, dword [0x831184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0
mov byte [ebp - 0xa8], 0
call fcn.004353e0
mov ecx, 5
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0x14], 0xc2dec5ca
mov dword [ebp - 0x10], 0xaed9
lea ecx, [eax - 0x57]
xor byte [ebp + eax - 0x14], cl
inc eax
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x73ae15
lea eax, [ebp - 0x14]
mov byte [ebp + ecx - 0x14], 0
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x98]
lea eax, [ebp - 0x38]
push eax
call fcn.00435c30
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x98]
mov dword [ebp - 0x88], eax
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
mov byte [ebp - 0x84], 1
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
sar eax, 2
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x80]
mov byte [ebp - 0x80], 6
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 1
push 2
push 1
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x98]
push eax
push ecx
lea ecx, [ebp - 0x68]
call fcn.00434bb0
lea eax, [ebp - 0x68]
mov byte [ebp - 0x54], 1
mov dword [ebp - 0x58], eax
push 0x433f80
push 2
push 0x18
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 4
push eax
call fcn.0076e7c5
push 2
push 1
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x68]
push eax
push ecx
lea ecx, [ebp - 0xb8]
call fcn.00434bb0
movaps xmm0, xmmword [0x7cb040]
xor ecx, ecx
mov byte [ebp - 4], 6
mov dword [ebp - 0x34], 0x17
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0xddd5dfe6
mov dword [ebp - 0x1c], 0xc0dad2df
nop dword [eax + eax]
lea eax, [ecx - 0x57]
xor byte [ebp + ecx - 0x30], al
inc ecx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
jb 0x73af00
mov byte [ebp + eax - 0x30], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x40], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x73af30
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.00407ab0
mov ecx, dword [esi]
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.004340e0
mov edx, dword [ebp - 0x3c]
mov byte [ebp - 4], 6
cmp edx, 0x10
jb 0x73af9d
mov ecx, dword [ebp - 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x73af93
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x73af93
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0076e8f3
add esp, 8
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
call fcn.00434940
push 0x433f80
push 1
push 0x18
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 1
push eax
call fcn.0076e7c5
lea ecx, [ebp - 0xa8]
call fcn.00434940
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8