joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8342d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [ecx]
xor edi, edi
mov eax, dword [ebx + 0x10]
mov ebp, dword [eax + 0x14]
test ebp, ebp
je 0x83448f
cmp byte [ebx + 0x4f], 0
mov esi, ecx
je 0x8342fd
mov ecx, ebp
call fcn.00787ca0
test eax, eax
je 0x834477
mov edx, fcn.007c1060
xor eax, eax
movzx edi, byte [0xbbadb3]
and edx, 1
inc edx
mov ecx, edx
xor ecx, fcn.007c1060
sete al
mov ecx, eax
xor ecx, 1
lea eax, [ecx + eax*2]
or al, 4
movzx eax, al
bt edi, eax
jb 0x834462
mov al, byte [0xbbadb3]
mov edi, edx
xor ecx, ecx
mov ah, 1
xor edi, fcn.007c1060
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ebx + ecx*2]
or cl, 4
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbadb3], ah
jne 0x834335
mov ecx, fcn.007c1060
xor edx, edx
movzx eax, al
and ecx, 1
inc ecx
mov edi, ecx
xor edi, fcn.007c1060
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [ebx + edx*2]
or dl, 4
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x8343ba
mov edx, ecx
xor eax, eax
movzx edi, byte [0xbbadb3]
xor edx, fcn.007c1060
sete al
mov edx, eax
xor edx, 1
lea eax, [edx + eax*2]
or al, 4
movzx eax, al
bt edi, eax
jae 0x83438f
jmp 0x834462
xor eax, eax
xor ecx, fcn.007c1060
movzx edi, byte [0xbbadb3]
sete al
mov ecx, eax
xor ecx, 0x34a042b1
lea edx, [ecx + eax*2 + 0xa84]
mov eax, edx
and al, 7
movzx eax, al
bt edi, eax
jb 0x834437
mov edi, 0xbbad70
xor eax, eax
mov ebx, dword [edi]
mov ecx, eax
mov ebp, edx
inc eax
shl ebp, cl
xor cl, 0x1f
xor ebx, edx
shr edx, cl
mov dword [edi], ebx
or edx, ebp
not ebx
add edi, 4
imul edx, ebx
cmp eax, 0x10
jne 0x8343ee
mov eax, fcn.007c1060
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.007c1060
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [eax + ecx*2]
mov al, 1
or cl, 4
shl al, cl
or byte [0xbbadb3], al
mov eax, fcn.007c1060
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.007c1060
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [eax + ecx*2]
mov al, 0xfe
or cl, 4
xor cl, 7
rol al, cl
and byte [0xbbadb3], al
push 0xbbad70
push esi
call fcn.0078de60
add esp, 8
mov edi, 1
jmp 0x83448f
mov ecx, ebp
call fcn.007aec30
mov eax, dword [ebx + 0x10]
mov ecx, ebx
mov dword [eax + 0x14], 0
call fcn.00788280
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x834be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
add cl, 0xf9
cmp cl, 3
ja 0x834d12
mov eax, sub.KERNEL32.dll_MapViewOfFile
mov dword [esp + 8], ecx
mov ecx, sub.KERNEL32.dll_MapViewOfFile
xor edx, edx
xor eax, 2
or ecx, 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
xor ebx, ebx
mov ebp, dword [edx*4 + 0xb576e4]
mov edi, dword [edx*4 + 0xb576f4]
mov dword [esp + 0x1c], edx
add eax, dword [esp + 0x10]
mov eax, 1
sete bl
xor ebx, 0xed5570f9
add ebx, 0xa08
xor ebx, dword [edx*4 + 0xb57704]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [ebp + edi - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x834cf3
mov dword [esp + 4], eax
mov al, byte [ebp + edi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [ebp + edi - 1], cl
jne 0x834c78
mov ecx, dword [esp + 4]
movzx eax, al
test edx, eax
je 0x834c9a
movzx eax, byte [ebp + edi - 1]
test ecx, eax
je 0x834c8f
jmp 0x834cf3
mov dword [esp + 0xc], edx
movzx eax, byte [ebp + edi - 1]
test ecx, eax
jne 0x834ce9
lea ecx, [edi - 4]
shr ecx, 2
je 0x834ce1
xor eax, eax
mov edx, ebp
mov dword [esp + 0x18], ecx
mov esi, dword [edx]
mov ecx, eax
mov dword [esp], ebx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, ebx
shr ebx, cl
mov ecx, dword [esp + 0x18]
or ebx, dword [esp]
mov dword [edx], esi
not esi
add edx, 4
imul ebx, esi
cmp eax, ecx
jne 0x834cb7
mov eax, dword [esp + 4]
or byte [ebp + edi - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [ebp + edi - 1], al
mov edx, dword [esp + 0x1c]
inc edx
cmp edx, 4
jne 0x834c11
movsx eax, byte [esp + 8]
mov eax, dword [eax*4 + 0xb50d80]
jmp 0x834e4a
mov edx, fcn.0082a6d0
movzx ecx, byte [0xbbae83]
and edx, 1
inc edx
mov eax, edx
xor eax, fcn.0082a6d0
sete al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x834e45
mov al, byte [0xbbae83]
mov ecx, edx
mov ah, 1
xor ecx, fcn.0082a6d0
sete cl
or cl, 4
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbae83], ah
jne 0x834d3f
mov ecx, fcn.0082a6d0
movzx eax, al
and ecx, 1
inc ecx
mov edx, ecx
xor edx, fcn.0082a6d0
sete dl
or dl, 4
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x834da5
mov eax, ecx
movzx edx, byte [0xbbae83]
xor eax, fcn.0082a6d0
sete al
or al, 4
movzx eax, al
bt edx, eax
jae 0x834d85
jmp 0x834e45
xor ecx, fcn.0082a6d0
movzx ecx, byte [0xbbae83]
sete al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x834e24
mov eax, fcn.0082a6d0
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.0082a6d0
mov eax, dword [0xbbae74]
sete cl
or ecx, 0xe536486c
add ecx, 0xa20
xor eax, ecx
mov edx, ecx
mov dword [0xbbae74], eax
shr edx, 0x1f
not eax
mov edi, dword [str._Wj_]
or edx, ecx
and cl, 7
imul edx, eax
lea esi, [edx + edx]
xor edi, edx
shr edx, 0x1e
mov dword [str._Wj_], edi
or esi, edx
not edi
mov dl, 1
imul edi, esi
shl dl, cl
xor dword [0xbbae7c], edi
or byte [0xbbae83], dl
mov eax, fcn.0082a6d0
and eax, 1
inc eax
xor eax, fcn.0082a6d0
mov al, 0xfe
sete cl
or cl, 4
xor cl, 7
rol al, cl
and byte [0xbbae83], al
mov eax, 0xbbae74
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x834e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, fcn.007cfb80
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov dword [esp + 8], edx
imul eax, eax
and eax, 3
mov dword [esp + 0x10], eax
xor ebx, ebx
cmp dword [esp + 0x10], 1
mov ebp, dword [ecx*4 + 0xb57714]
mov esi, dword [ecx*4 + 0xb57724]
mov dword [esp + 0x18], ecx
mov eax, 1
seta bl
or ebx, 0xe8c0033a
add ebx, 0x900
xor ebx, dword [ecx*4 + 0xb57734]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [ebp + esi - 1]
mov edi, dword [esp]
bt ecx, edi
jb 0x834f61
mov dword [esp + 4], eax
mov al, byte [ebp + esi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [ebp + esi - 1], cl
jne 0x834ee4
mov ecx, dword [esp + 4]
movzx eax, al
test edx, eax
je 0x834f06
movzx eax, byte [ebp + esi - 1]
test ecx, eax
je 0x834efb
jmp 0x834f61
movzx eax, byte [ebp + esi - 1]
test ecx, eax
jne 0x834f5b
lea ecx, [esi - 4]
shr ecx, 2
je 0x834f53
xor eax, eax
mov edi, ebp
mov dword [esp + 0x14], ecx
mov ecx, edi
mov dword [esp + 0x1c], edi
mov edi, dword [edi]
mov dword [esp], ebx
xor edi, ebx
mov dword [ecx], edi
mov ecx, eax
not edi
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
shr ebx, cl
mov ecx, dword [esp + 0x14]
or ebx, dword [esp]
imul ebx, edi
mov edi, dword [esp + 0x1c]
add edi, 4
cmp eax, ecx
jne 0x834f1f
mov eax, dword [esp + 4]
or byte [ebp + esi - 1], al
not dl
and byte [ebp + esi - 1], dl
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 4
jne 0x834e80
xor eax, eax
cmp dword [esp + 8], 0
mov ebx, dword [esp + 0xc]
mov ecx, 0xb4bd14
mov edi, 0xb507a0
mov edx, 0xbbae84
setne al
cmove edi, ecx
mov ecx, ebx
lea esi, [eax*8 + 4]
push 0
push 0
push 0
push 0
push 0
push 0x8352f0
push edi
push 1
push 2
call fcn.007949a0
add esp, 0x24
mov ecx, ebx
mov edx, 0xbbae90
push 0
push 0
push 0
push 0
push 0
push 0x8352f0
push edi
push 1
push 3
call fcn.007949a0
add esp, 0x24
mov ecx, ebx
mov edx, 0xbbae9c
push 0
push 1
push 2
call fcn.00794d80
add esp, 0xc
or dword [eax + 4], esi
mov ecx, ebx
mov edx, 0xbbaea8
push 0
push 1
push 3
call fcn.00794d80
add esp, 0xc
or dword [eax + 4], esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x835090
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
movsx eax, byte [ecx]
mov esi, ecx
mov ecx, eax
add cl, 0xd0
cmp cl, 2
ja 0x8350a9
add eax, 0xffffffd0
jmp 0x8352e3
mov edx, fcn.007c4cf0
mov edi, fcn.007c4cf0
xor eax, eax
or edx, 2
xor edi, 2
mov ecx, edx
add ecx, edi
movzx ecx, byte [0xbbad5f]
setne al
bt ecx, eax
jb 0x8351b3
mov al, byte [0xbbad5f]
mov ecx, edx
mov ah, 1
add ecx, edi
setne cl
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbad5f], ah
jne 0x8350d7
mov ecx, fcn.007c4cf0
mov edx, fcn.007c4cf0
or ecx, 2
xor edx, 2
mov edi, ecx
add edi, edx
setne ah
xor ah, 7
movzx edi, ah
movzx eax, al
bt eax, edi
jae 0x835130
mov edi, ecx
xor eax, eax
add edi, edx
movzx edi, byte [0xbbad5f]
setne al
bt edi, eax
jae 0x835116
jmp 0x8351b3
xor eax, eax
add ecx, edx
movzx ecx, byte [0xbbad5f]
setne al
bt ecx, eax
jb 0x835191
mov eax, fcn.007c4cf0
mov edx, fcn.007c4cf0
xor ecx, ecx
xor edx, 2
or eax, 2
add eax, edx
mov eax, dword [0xbbad54]
sete cl
xor ecx, 0x43b30091
add ecx, 0xe58
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbbad54], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
xor dword [0xbbad58], edx
mov dl, 1
shl dl, cl
or byte [0xbbad5f], dl
mov eax, fcn.007c4cf0
mov ecx, fcn.007c4cf0
xor ecx, 2
or eax, 2
add eax, ecx
mov al, 0xfe
setne cl
xor cl, 7
rol al, cl
and byte [0xbbad5f], al
mov ecx, esi
mov edx, 0xbbad54
call fcn.00783720
test eax, eax
jne 0x8351cd
mov eax, 1
jmp 0x8352e3
mov edx, fcn.0078aac0
movzx ecx, byte [0xbbad6b]
imul edx, edx
and edx, 3
cmp edx, 1
seta al
or al, 2
movzx eax, al
bt ecx, eax
jb 0x8352cc
mov al, byte [0xbbad6b]
cmp edx, 1
mov ah, 1
seta cl
or cl, 2
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbad6b], ah
jne 0x8351f8
mov ecx, fcn.0078aac0
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 1
seta dl
or dl, 2
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x83524f
cmp ecx, 1
movzx edx, byte [0xbbad6b]
seta al
or al, 2
movzx eax, al
bt edx, eax
jae 0x835236
jmp 0x8352cc
cmp ecx, 1
movzx edx, byte [0xbbad6b]
seta al
or al, 2
movzx eax, al
bt edx, eax
jb 0x8352ab
mov eax, fcn.0078aac0
xor ecx, ecx
mov edi, dword [0xbbad60]
mov dl, 1
imul eax, eax
and eax, 3
cmp eax, 1
seta cl
or ecx, 0xf8905d2
add ecx, 0x418
xor edi, ecx
mov dword [0xbbad60], edi
not edi
imul edi, ecx
and cl, 7
shl dl, cl
xor dword [0xbbad64], edi
or byte [0xbbad6b], dl
mov eax, fcn.0078aac0
imul eax, eax
and eax, 3
cmp eax, 1
mov al, 0xfe
seta cl
or cl, 2
xor cl, 7
rol al, cl
and byte [0xbbad6b], al
mov ecx, esi
mov edx, 0xbbad60
call fcn.00783720
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
add eax, eax
pop esi
pop edi
ret
Function at 0x836a50
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [esp + 8], edx
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
mov eax, dword [0xbd33e0]
xor eax, esp
mov dword [esp + 0x30], eax
mov ebx, dword [ecx]
cmp dword [ecx + 0x24], 0
jne 0x836bc3
mov edi, ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
mov edx, ebp
call fcn.008383c0
test eax, eax
jne 0x836bc3
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.008383c0
test eax, eax
jne 0x836bc3
mov edx, dword [esp + 0x58]
lea ecx, [esp + 0x10]
call fcn.008383c0
test eax, eax
jne 0x836bc3
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x836b20
xor eax, eax
cmp byte [ecx], 0x73
jne 0x836b05
mov eax, dword [ecx + 8]
mov edx, dword [esp + 8]
mov ecx, edi
push 0
push 0
push eax
call fcn.008002d0
add esp, 0xc
test eax, eax
jne 0x836bc3
mov ecx, edi
call fcn.007f7590
mov ecx, edi
mov edx, 4
mov dword [esp + 4], eax
call fcn.007fa700
mov dword [esp], eax
mov ecx, edi
mov edx, ebp
push eax
call fcn.007f7750
add esp, 4
mov eax, dword [esp]
mov ecx, edi
mov edx, esi
inc eax
push eax
call fcn.007f7750
add esp, 4
mov eax, dword [esp]
mov edx, dword [esp + 0x58]
mov ecx, edi
lea eax, [eax + 2]
push eax
call fcn.007f7750
add esp, 4
cmp dword [esp + 4], 0
je 0x836bc3
mov eax, dword [esp + 0x48]
movsx edx, byte [eax]
mov eax, dword [esp]
add eax, 3
mov dword [esp + 0xc], edx
mov ecx, eax
sub ecx, edx
xor edx, edx
mov dword [esp], ecx
mov ecx, edi
push 0
push dword [esp + 0x4c]
push dword [esp + 0x14]
push eax
push dword [esp + 0x10]
call fcn.007fa980
add esp, 0x14
xor eax, eax
cmp dword [esp + 8], 0x18
mov ecx, dword [esp + 4]
mov edx, 0x9e
sete al
push eax
call fcn.007f9600
add esp, 4
mov ecx, ebx
mov edx, ebp
call fcn.007cb9e0
mov ecx, ebx
mov edx, esi
call fcn.007cb9e0
mov edx, dword [esp + 0x58]
mov ecx, ebx
call fcn.007cb9e0
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00989fe9
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x838b90
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ecx]
mov edi, ecx
mov ecx, edx
mov ebx, edx
xor edx, edx
shl ecx, 4
mov eax, dword [eax + 0x10]
mov esi, dword [eax + ecx + 0xc]
mov ecx, edi
push ebx
call fcn.00800f40
add esp, 4
mov ebp, dword [edi + 0x28]
mov dword [esp], edi
mov ecx, edi
mov dword [esp + 4], ebx
mov edx, ebx
lea eax, [ebp + 3]
mov dword [edi + 0x28], eax
push 0
push 0
mov edi, ebp
push ebp
call fcn.00838f50
add esp, 0xc
mov ebp, dword [esi + 0x10]
test ebp, ebp
je 0x838c04
mov eax, dword [esp]
mov ebx, dword [eax + 0x2c]
mov esi, dword [eax + 0x28]
inc ebx
mov edx, dword [ebp + 8]
mov ecx, dword [esp]
push esi
push ebx
push edi
push 0
call fcn.00839ab0
add esp, 0x10
mov ebp, dword [ebp]
test ebp, ebp
jne 0x838bea
mov ecx, dword [esp]
mov edx, dword [esp + 4]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp 0x83a670
push esi
mov esi, edx
call fcn.007f7590
test eax, eax
je 0x83a68c
mov ecx, eax
mov edx, 0x8e
push esi
call fcn.007f9600
add esp, 4
pop esi
ret
Function at 0x83a690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, fcn.00816aa0
xor eax, eax
mov esi, edx
movzx edx, byte [0xbbb64b]
mov ebp, ecx
mov edi, dword [esp + 0x14]
imul ebx, ebx
and ebx, 3
cmp ebx, 1
seta al
mov ecx, eax
xor ecx, 5
lea eax, [ecx + eax*2]
bt edx, eax
jb 0x83a7e2
mov al, byte [0xbbb64b]
xor edx, edx
cmp ebx, 1
seta dl
mov ecx, edx
xor ecx, 5
lea ecx, [ecx + edx*2]
mov dl, 1
xor cl, 7
shl dl, cl
or dl, al
lock cmpxchg byte [0xbbb64b], dl
jne 0x83a6cc
mov ecx, fcn.00816aa0
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 1
seta dl
mov ebx, edx
xor ebx, 5
lea edx, [ebx + edx*2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x83a739
xor eax, eax
cmp ecx, 1
movzx ebx, byte [0xbbb64b]
seta al
mov edx, eax
xor edx, 5
lea eax, [edx + eax*2]
bt ebx, eax
jae 0x83a718
jmp 0x83a7e2
xor eax, eax
cmp ecx, 1
movzx edx, byte [0xbbb64b]
seta al
mov ecx, eax
xor ecx, 5
lea eax, [ecx + eax*2]
bt edx, eax
jb 0x83a7ba
mov eax, fcn.00816aa0
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 1
seta cl
mov eax, ecx
xor eax, 0x63cdf6dd
lea ecx, [eax + ecx*2 + 0x1200]
mov eax, dword [0xbbb63c]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbbb63c], eax
not eax
imul edx, eax
mov eax, dword [0xbbb640]
lea ebx, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbbb640], eax
or ebx, edx
not eax
mov dl, 1
imul eax, ebx
shl dl, cl
xor dword [0xbbb644], eax
or byte [0xbbb64b], dl
mov eax, fcn.00816aa0
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 1
seta cl
mov eax, ecx
xor eax, 5
lea ecx, [eax + ecx*2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbbb64b], al
mov ecx, ebp
xor edx, edx
push 0
push 0xb50884
push 1
push edi
push esi
call fcn.007fa980
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x83ebd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ecx, fcn.00797f30
mov eax, fcn.00797f30
xor ebx, ebx
and ecx, 1
xor ecx, eax
mov dword [esp + 0xc], ecx
xor eax, eax
cmp dword [esp + 0xc], 0xffffffff
mov edi, dword [ebx*4 + 0xb57810]
mov esi, dword [ebx*4 + 0xb57840]
mov dword [esp + 0x14], ebx
sete al
mov ecx, eax
not ecx
and ecx, 0x51d
lea edx, [eax + ecx*2 - 0x3aa1df20]
mov eax, 1
xor edx, dword [ebx*4 + 0xb57870]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + esi - 1]
mov ebp, dword [esp]
bt ecx, ebp
jb 0x83ecd0
mov dword [esp + 4], eax
mov al, byte [edi + esi - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + esi - 1], cl
jne 0x83ec55
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x83ec77
movzx eax, byte [edi + esi - 1]
test ecx, eax
je 0x83ec6c
jmp 0x83ecd0
mov dword [esp + 8], ebx
movzx eax, byte [edi + esi - 1]
test ecx, eax
jne 0x83ecc6
lea ecx, [esi - 4]
shr ecx, 2
je 0x83ecbe
xor eax, eax
mov ebx, edi
mov dword [esp + 0x10], ecx
mov ebp, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor ebp, edx
shr edx, cl
mov ecx, dword [esp + 0x10]
or edx, dword [esp]
mov dword [ebx], ebp
not ebp
add ebx, 4
imul edx, ebp
cmp eax, ecx
jne 0x83ec94
mov eax, dword [esp + 4]
or byte [edi + esi - 1], al
mov eax, dword [esp + 8]
not al
and byte [edi + esi - 1], al
mov ebx, dword [esp + 0x14]
inc ebx
cmp ebx, 0xb
jne 0x83ebec
mov ecx, 0xbbd28c
mov edx, 0xf
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
jmp 0x83ee20
Function at 0x83ed00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ecx, fcn.007cfb80
mov eax, fcn.007cfb80
xor ebx, ebx
and ecx, 1
xor ecx, eax
mov dword [esp + 0xc], ecx
xor edx, edx
cmp dword [esp + 0xc], 0xffffffff
mov edi, dword [ebx*4 + 0xb578a0]
mov esi, dword [ebx*4 + 0xb578c0]
mov dword [esp + 0x14], ebx
mov eax, 1
sete dl
xor edx, 0x6155d4d7
add edx, 0x1040
xor edx, dword [ebx*4 + 0xb578e0]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + esi - 1]
mov ebp, dword [esp]
bt ecx, ebp
jb 0x83edfb
mov dword [esp + 4], eax
mov al, byte [edi + esi - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + esi - 1], cl
jne 0x83ed80
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x83eda2
movzx eax, byte [edi + esi - 1]
test ecx, eax
je 0x83ed97
jmp 0x83edfb
mov dword [esp + 8], ebx
movzx eax, byte [edi + esi - 1]
test ecx, eax
jne 0x83edf1
lea ecx, [esi - 4]
shr ecx, 2
je 0x83ede9
xor eax, eax
mov ebx, edi
mov dword [esp + 0x10], ecx
mov ebp, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor ebp, edx
shr edx, cl
mov ecx, dword [esp + 0x10]
or edx, dword [esp]
mov dword [ebx], ebp
not ebp
add ebx, 4
imul edx, ebp
cmp eax, ecx
jne 0x83edbf
mov eax, dword [esp + 4]
or byte [edi + esi - 1], al
mov eax, dword [esp + 8]
not al
and byte [edi + esi - 1], al
mov ebx, dword [esp + 0x14]
inc ebx
cmp ebx, 8
jne 0x83ed1c
mov ecx, 0xbbd580
mov edx, 8
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
jmp 0x83ee20
Function at 0x841200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov ecx, dword [0xbd33e0]
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, esp
xor ecx, ebp
mov dword [esp + 0x98], ecx
mov ecx, esi
push edi
push eax
call fcn.008429e0
add esp, 8
test eax, eax
jne 0x8413e9
mov edx, fcn.008465e0
xor eax, eax
movzx edi, byte [0xbbd923]
imul edx, edx
and edx, 3
cmp edx, 3
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2]
and al, 3
movzx eax, al
bt edi, eax
jb 0x8413b4
mov al, byte [0xbbd923]
xor ecx, ecx
cmp edx, 3
mov ah, 1
sete cl
mov ebx, ecx
not ebx
lea ecx, [ecx + ebx*2]
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbd923], ah
jne 0x841271
mov ecx, fcn.008465e0
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete dl
mov ebx, edx
not ebx
lea edx, [edx + ebx*2]
and dl, 3
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x8412e6
xor eax, eax
cmp ecx, 3
movzx edi, byte [0xbbd923]
sete al
mov edx, eax
not edx
lea eax, [eax + edx*2]
and al, 3
movzx eax, al
bt edi, eax
jae 0x8412c1
jmp 0x8413b4
xor eax, eax
cmp ecx, 3
movzx edx, byte [0xbbd923]
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2]
and al, 3
movzx eax, al
bt edx, eax
jb 0x84138a
mov ecx, fcn.008465e0
xor eax, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete al
mov ecx, eax
not ecx
and ecx, 0xc5
lea ecx, [eax + ecx*2 + 0x2745cd18]
mov eax, dword [0xbbd910]
xor eax, ecx
mov dword [0xbbd910], eax
not eax
mov edx, dword [0xbbd914]
imul eax, ecx
and cl, 7
lea edi, [eax + eax]
xor edx, eax
shr eax, 0x1e
mov dword [0xbbd914], edx
or edi, eax
not edx
mov eax, dword [0xbbd918]
imul edx, edi
lea edi, [edx*4]
xor eax, edx
shr edx, 0x1d
mov dword [0xbbd918], eax
or edi, edx
not eax
mov dl, 1
imul eax, edi
shl dl, cl
xor dword [0xbbd91c], eax
or byte [0xbbd923], dl
mov eax, fcn.008465e0
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 3
sete cl
mov eax, ecx
not eax
lea ecx, [ecx + eax*2]
mov al, 0xfe
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbbd923], al
mov ecx, esp
call fcn.00845740
lea edi, [esp + 0x34]
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0xbbd910
push edi
push 0x64
call fcn.00783420
add esp, 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push esi
call fcn.00789a60
add esp, 0x10
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.00989fe9
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x841400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov ecx, dword [0xbd33e0]
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
lea edi, [esp + 8]
xor ecx, ebp
mov dword [esp + 0xa0], ecx
mov ecx, esi
push edi
push eax
call fcn.008429e0
add esp, 8
test eax, eax
jne 0x841625
mov edx, fcn.007c76e0
xor eax, eax
movzx edi, byte [0xbbd943]
imul edx, edx
and edx, 3
cmp edx, 3
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edi, eax
jb 0x8415c9
mov al, byte [0xbbd943]
xor ecx, ecx
cmp edx, 3
mov ah, 1
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 6]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbbd943], ah
jne 0x841475
mov ecx, fcn.007c76e0
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 6]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x8414f0
xor eax, eax
cmp ecx, 3
movzx edi, byte [0xbbd943]
sete al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 6]
and al, 7
movzx eax, al
bt edi, eax
jae 0x8414c9
jmp 0x8415c9
xor eax, eax
cmp ecx, 3
movzx edx, byte [0xbbd943]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edx, eax
jb 0x84159d
mov ecx, fcn.007c76e0
xor eax, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete al
mov ecx, eax
not ecx
and ecx, 0x601
lea ecx, [eax + ecx*2 - 0x6645cf82]
mov eax, dword [0xbbd930]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbbd930], eax
not eax
imul edx, eax
mov eax, dword [0xbbd934]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbbd934], eax
or edi, edx
not eax
mov edx, dword [0xbbd938]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbbd938], edx
or edi, eax
not edx
mov al, 1
imul edx, edi
shl al, cl
xor dword [0xbbd93c], edx
or byte [0xbbd943], al
mov eax, fcn.007c76e0
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 3
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 6]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbbd943], al
lea ecx, [esp + 8]
call fcn.00845950
fld qword [esp + 0x28]
fnstcw word [esp + 2]
lea edi, [esp + 0x3c]
movzx eax, word [esp + 2]
mov word [esp + 2], 0xc7f
fldcw word [esp + 2]
mov word [esp + 2], ax
fistp dword [esp + 4]
fldcw word [esp + 2]
push dword [esp + 4]
push dword [esp + 0x24]
push dword [esp + 0x24]
push 0xbbd930
push edi
push 0x64
call fcn.00783420
add esp, 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push esi
call fcn.00789a60
add esp, 0x10
mov ecx, dword [esp + 0xa0]
xor ecx, ebp
call fcn.00989fe9
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret