joyce8/EMBER2024-capa huggingface dataset:
Function at 0x207abe30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x19], eax
mov dword [esp + 9], ecx
mov dword [esp + 0x1d], eax
mov dword [esp + 0xd], ecx
mov dword [esp + 0x21], eax
push ebx
mov word [esp + 0x29], ax
push ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x19], ecx
mov byte [esp + 0x2f], al
mov eax, 0x10
mov word [esp + 0x1d], cx
push esi
test ebp, ebp
push edi
mov byte [esp + 0x28], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x18], 0
mov byte [esp + 0x27], cl
jne 0x207abe91
pop edi
pop esi
pop ebp
mov eax, 0x80000065
pop ebx
add esp, 0x28
ret
mov edi, dword [esp + 0x40]
test edi, edi
jne 0x207abea6
pop edi
pop esi
pop ebp
mov eax, 0x80000066
pop ebx
add esp, 0x28
ret
mov esi, dword [esp + 0x44]
test esi, esi
jne 0x207abebb
pop edi
pop esi
pop ebp
mov eax, 0x80000067
pop ebx
add esp, 0x28
ret
mov ebx, dword [esp + 0x48]
test ebx, ebx
jne 0x207abed0
pop edi
pop esi
pop ebp
mov eax, 0x80000068
pop ebx
add esp, 0x28
ret
cmp ebx, eax
jae 0x207abf4c
mov dl, bl
push 1
mov cl, dl
push 2
mov ch, cl
push 1
mov edx, ecx
shl edx, 0x10
mov dx, cx
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
lea edx, [esp + 0x20]
push edx
push ecx
lea edx, [esp + 0x2c]
push eax
push edx
push 0
push 0
push 1
push edi
push ebp
call fcn.20798440
add esp, 0x30
test eax, eax
jne 0x207abfcc
test ebx, ebx
jbe 0x207abfca
lea ecx, [esp + 0x28]
lea eax, [esi + ebx]
sub ecx, esi
mov esi, ebx
mov dl, byte [ecx + eax - 1]
mov bl, byte [eax - 1]
dec eax
xor bl, dl
dec esi
mov byte [eax], bl
jne 0x207abf33
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
lea eax, [ebx - 4]
xor edx, edx
mov ecx, 0xc
div ecx
test edx, edx
mov dword [esp + 0x3c], edx
jbe 0x207abf8b
push 1
push 2
lea edx, [esp + 0x18]
lea eax, [esi + ebx - 0x10]
push 1
push edx
push eax
push 0x10
push eax
push 0
push 0
push 1
push edi
push ebp
call fcn.207984f0
add esp, 0x30
test eax, eax
jne 0x207abfcc
sub ebx, dword [esp + 0x3c]
cmp ebx, 0x10
jb 0x207abfca
lea esi, [esi + ebx - 0x10]
push 1
push 2
lea eax, [esp + 0x18]
push 1
push eax
push esi
push 0x10
push esi
push 0
push 0
push 1
push edi
push ebp
mov dword [esp + 0x40], 0x10
call fcn.207984f0
add esp, 0x30
test eax, eax
jne 0x207abfcc
sub ebx, 0xc
sub esi, 0xc
cmp ebx, 0x10
jae 0x207abf94
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x207adab0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x10
test ecx, ecx
je 0x207adbae
mov eax, dword [esp + 0x18]
test eax, eax
je 0x207adbae
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
jmp 0x207adad9
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebx, 4
lea eax, [edi + ecx]
sub esi, ecx
lea edx, [esp + ebp + 0x10]
add edi, ebx
mov cl, byte [esi + eax]
mov byte [edx], cl
mov byte [eax], cl
add edx, 4
inc eax
dec ebx
jne 0x207adaed
inc ebp
cmp ebp, 4
jl 0x207adad5
cmp edi, 0xb0
jge 0x207adba4
mov ebp, 0x20719178
xor eax, eax
lea ecx, [esp + 0x10]
inc eax
mov edx, eax
and edx, 0x80000003
jns 0x207adb28
dec edx
or edx, 0xfffffffc
inc edx
xor ebx, ebx
add ecx, 4
mov bl, byte [esp + edx*4 + 0x13]
mov dl, byte [ebx + 0x20718b78]
mov bl, byte [ecx - 4]
xor bl, dl
cmp eax, 4
mov byte [ecx - 4], bl
jl 0x207adb18
mov al, byte [ebp]
mov cl, byte [esp + 0x10]
xor cl, al
add ebp, 4
mov byte [esp + 0x10], cl
mov esi, 1
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov dl, byte [eax - 1]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
add eax, 4
dec ecx
jne 0x207adb62
inc esi
cmp esi, 4
jl 0x207adb59
xor esi, esi
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov ebx, dword [esp + 0x24]
mov dl, byte [eax]
add eax, 4
mov byte [edi + ebx], dl
inc edi
dec ecx
jne 0x207adb82
inc esi
cmp esi, 4
jl 0x207adb79
cmp edi, 0xb0
jl 0x207adb12
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, 1
add esp, 0x10
ret
Function at 0x207aea00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x207aeaeb
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x207aeaeb
mov eax, dword [esp + 0x24]
test eax, eax
jl 0x207aeae0
mov ecx, eax
and ecx, 0x8000000f
jns 0x207aea38
dec ecx
or ecx, 0xfffffff0
inc ecx
jne 0x207aeae0
cmp eax, 0x10
jl 0x207aead8
push ebp
push edi
shr eax, 4
lea edi, [esi + 0xb0]
mov dword [esp + 0x28], eax
jmp 0x207aea5c
mov esi, dword [esp + 0x24]
mov edx, ebx
mov eax, dword [edx]
mov dword [esp + 0x10], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x14], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x18], eax
xor eax, eax
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x1c], ecx
mov dl, byte [edi + eax]
mov cl, byte [esp + eax + 0x10]
xor cl, dl
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x10
jl 0x207aea7b
lea eax, [esp + 0x10]
push eax
push esi
call fcn.207adbc0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebp, edi
mov esi, dword [esp + 0x24]
add esp, 8
mov dword [ebp], eax
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], esi
mov ebp, ebx
add ebx, 0x10
mov dword [ebp], eax
mov eax, dword [esp + 0x28]
dec eax
mov dword [ebp + 4], ecx
mov dword [esp + 0x28], eax
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], esi
jne 0x207aea58
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
pop esi
mov eax, 2
pop ebx
add esp, 0x10
ret
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret

Function at 0x207aeb00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
push edi
je 0x207aebe6
mov edi, dword [esp + 0x20]
test edi, edi
je 0x207aebe6
mov eax, dword [esp + 0x24]
test eax, eax
jl 0x207aebdb
mov ecx, eax
and ecx, 0x8000000f
jns 0x207aeb38
dec ecx
or ecx, 0xfffffff0
inc ecx
jne 0x207aebdb
cmp eax, 0x10
jl 0x207aebd3
push ebx
push esi
shr eax, 4
lea esi, [ebp + 0xb0]
mov ebx, eax
mov edx, edi
mov eax, dword [edx]
mov dword [esp + 0x10], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x14], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [edx + 0xc]
lea edx, [esp + 0x10]
push edx
push ebp
mov dword [esp + 0x24], ecx
call fcn.207ae230
add esp, 8
xor eax, eax
mov cl, byte [esi + eax]
mov dl, byte [esp + eax + 0x10]
xor dl, cl
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0x10
jl 0x207aeb81
mov edx, edi
mov eax, esi
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x14]
mov eax, edi
add edi, 0x10
dec ebx
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
jne 0x207aeb54
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x10
ret
pop edi
mov eax, 2
pop ebp
add esp, 0x10
ret
pop edi
mov eax, 1
pop ebp
add esp, 0x10
ret
Function at 0x207aec00
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
cmp edx, esi
jne 0x207aec12
mov eax, 0x80000065
pop esi
ret
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [edx + 0x14]
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
mov dword [edx + 0x54], esi
mov dword [edx + 0x58], esi
rep stosd dword es:[edi], eax
mov eax, esi
pop edi
pop esi
ret

Function at 0x207b0e30
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x207b0e40
mov eax, 1
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x24], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
xor eax, eax
ret
Function at 0x207b7c70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
push esi
push edi
xor edx, edx
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], dl
mov dword [esp + 0xc], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x48]
mov byte [esp + 0x10], dl
cmp edi, edx
mov word [esp + 0x11], dx
mov byte [esp + 0xb], dl
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0x20
je 0x207b7d79
mov esi, dword [esp + 0x44]
cmp esi, edx
je 0x207b7d79
lea eax, [esp + 0x18]
push 1
push eax
call fcn.207981e0
add esp, 8
test eax, eax
jne 0x207b7d0f
push edi
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.207982b0
add esp, 0xc
test eax, eax
jne 0x207b7d0f
lea edx, [esp + 0x14]
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.20798340
add esp, 0xc
test eax, eax
jne 0x207b7d0f
mov dl, byte [esp + 0x20]
mov byte [esp + 0xb], dl
jmp 0x207b7d34
mov cl, byte [esi]
mov eax, 1
cmp edi, eax
mov byte [esp + 0xb], cl
mov dword [esp + 0xc], eax
jbe 0x207b7d34
mov dl, byte [eax + esi]
xor cl, dl
inc eax
cmp eax, edi
mov byte [esp + 0xb], cl
mov dword [esp + 0xc], eax
jb 0x207b7d22
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x13]
push 1
push edx
mov dword [esp + 0x1c], 3
call fcn.207df9e0
mov edx, dword [esp + 0x20]
neg eax
sbb al, al
not al
and eax, edx
mov byte [esp + 0x1b], al
lea eax, [esp + 0x28]
push eax
call fcn.20798410
mov al, byte [esp + 0x1f]
add esp, 0x14
pop edi
pop esi
add esp, 0x38
ret
pop edi
xor al, al
pop esi
add esp, 0x38
ret
Function at 0x207c04b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ecx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x20]
push edi
mov eax, dword [esi + 0x40]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x50]
cmp eax, ecx
je 0x207c04e3
test eax, eax
jne 0x207c04d6
cmp byte [esi], 0
je 0x207c04ec
pop edi
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0x10
ret
cmp byte [esi], 0
jne 0x207c0692
test eax, eax
jne 0x207c0503
test ecx, ecx
je 0x207c0503
mov dword [esi + 0x50], ecx
mov ecx, dword [ecx + 0x48]
push ecx
call fcn.207e3890
add esp, 4
mov ecx, dword [esi + 0x44]
xor edx, edx
mov dl, byte [esi + 6]
xor eax, eax
mov edi, edx
mov bl, 4
mov al, byte [ecx + edi]
mov ebp, eax
mov edx, ebp
and ebp, 0xfffffff7
sar edx, 3
mov byte [esi + 4], dl
mov al, dl
shl dl, 2
sub bl, dl
mov edx, dword [esi + 0x40]
cmp ebp, 5
mov byte [esi + 7], bl
jne 0x207c0548
mov byte [esi + 3], 1
mov byte [esi + 5], al
mov bx, word [edx + 0x20]
mov word [esi + 8], bx
mov dx, word [edx + 0x24]
jmp 0x207c0565
cmp ebp, 2
jne 0x207c0682
mov byte [esi + 3], 0
mov byte [esi + 5], 0
mov bx, word [edx + 0x18]
mov word [esi + 8], bx
mov dx, word [edx + 0x1c]
mov ebx, dword [esp + 0x24]
mov word [esi + 0xa], dx
and eax, 0xff
mov dx, word [ebx + 0x14]
mov byte [esi + 2], 0
dec dx
mov byte [esi + 1], 0
mov word [esi + 0x14], dx
xor edx, edx
mov dx, word [ebx + 0x16]
xor ebx, ebx
mov dword [esp + 0x10], edx
mov edx, 3
sub edx, eax
lea eax, [edi + edx*4]
mov dword [esp + 0x18], eax
mov word [esi + 0xc], ax
movzx dx, byte [ecx + edi + 4]
mov bh, byte [ecx + edi + 3]
xor eax, eax
mov ah, byte [ecx + edi + 5]
or ebx, edx
mov al, byte [ecx + edi + 6]
xor edx, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
mov word [esi + 0x12], bx
mov ebp, ebx
mov dx, word [eax + 0x14]
mov eax, 0x2aaaaaab
sub edx, 8
and ebp, 0xffff
imul edx
mov eax, edx
mov dword [esp + 0x14], ebp
shr eax, 0x1f
add edx, eax
cmp ebp, edx
jle 0x207c05f8
pop edi
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0x10
ret
test bx, bx
jne 0x207c0618
mov eax, dword [esp + 0x28]
test eax, eax
je 0x207c0618
cmp dword [eax + 0x4c], 1
je 0x207c0618
pop edi
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0x10
ret
xor edx, edx
mov ebx, dword [esp + 0x18]
mov dl, byte [ecx + edi + 7]
xor eax, eax
mov ah, byte [ecx + edi + 1]
mov ebp, edx
mov edx, dword [esp + 0x14]
mov al, byte [ecx + edi + 2]
mov edi, dword [esp + 0x1c]
add edx, edx
sub ebp, edx
sub ebp, ebx
add ebp, edi
test eax, eax
jle 0x207c0676
mov edx, dword [esp + 0x10]
lea ebx, [edx - 4]
cmp eax, ebx
jg 0x207c0682
xor edx, edx
mov dh, byte [eax + ecx]
mov dl, byte [eax + ecx + 1]
mov edi, edx
xor edx, edx
mov dh, byte [eax + ecx + 2]
mov dl, byte [eax + ecx + 3]
test edi, edi
jle 0x207c066e
lea eax, [edx + eax + 3]
cmp edi, eax
jle 0x207c0682
add ebp, edx
mov eax, edi
test edi, edi
jg 0x207c0649
mov eax, dword [esp + 0x10]
mov word [esi + 0x10], bp
cmp ebp, eax
jl 0x207c068f
pop edi
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0x10
ret
mov byte [esi], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x207c28a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push esi
call fcn.207c2660
xor ebx, ebx
add esp, 4
cmp eax, ebx
jne 0x207c2a08
cmp byte [esi + 0x43], bl
jne 0x207c28cb
mov ecx, dword [esp + 0x10]
pop esi
pop ebx
mov dword [ecx], 1
ret
mov edx, dword [esp + 0x10]
push ebp
push edi
mov dword [edx], ebx
xor eax, eax
mov edi, dword [esi + 0x18]
cmp byte [edi + 4], bl
jne 0x207c29aa
mov ecx, dword [edi + 0x44]
xor eax, eax
mov al, byte [edi + 6]
lea edx, [eax + ecx + 8]
push edx
call fcn.2082c4f0
mov ebp, dword [esi + 0x18]
xor ecx, ecx
mov cx, word [edi + 0x12]
add esp, 4
mov dword [esi + 0x1c], ecx
mov ecx, dword [esi + 4]
cmp eax, ebx
jne 0x207c2910
mov ecx, 0xb
jmp 0x207c2964
lea edx, [esp + 0x18]
push ebx
push edx
push eax
push ecx
call fcn.207c06a0
mov edi, eax
add esp, 0x10
cmp edi, ebx
jne 0x207c295a
mov eax, dword [esp + 0x18]
cmp byte [eax], bl
jne 0x207c295e
push ebp
push eax
call fcn.207c04b0
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x207c295a
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x207c2952
mov eax, dword [eax + 0x48]
push eax
call fcn.207e5b30
add esp, 4
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x207c295e
mov eax, dword [esp + 0x18]
cmp edi, ebx
mov ecx, edi
je 0x207c296f
cmp ecx, ebx
mov eax, ecx
jne 0x207c29bf
jmp 0x207c28d5
mov cx, word [esi + 0x1c]
mov word [eax + 0xe], cx
mov eax, dword [esi + 0x18]
cmp eax, ebx
mov byte [eax + 1], bl
je 0x207c298d
mov edx, dword [eax + 0x48]
push edx
call fcn.207e5b30
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], eax
mov word [esi + 0x3e], bx
mov byte [esi + 0x42], bl
cmp word [eax + 0x12], 1
jb 0x207c29bf
jmp 0x207c28d3
cmp eax, ebx
jne 0x207c29bf
xor eax, eax
mov ax, word [edi + 0x12]
mov word [esi + 0x3e], bx
dec eax
mov byte [esi + 0x42], bl
mov dword [esi + 0x1c], eax
xor ebp, ebp
cmp word [esi + 0x3e], bx
jne 0x207c2a00
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
xor edi, edi
mov ecx, dword [eax + 0x44]
mov di, word [eax + 0xc]
mov ebx, ecx
add ebx, edi
lea edi, [ebx + edx*2]
lea edx, [esi + 0x20]
push edx
xor edx, edx
mov dl, byte [edi + 1]
mov dh, byte [edi]
xor edi, edi
mov di, word [eax + 0x14]
and edx, edi
add edx, ecx
push edx
push eax
call fcn.207c0330
add esp, 0xc
mov byte [esi + 0x42], 1
mov eax, ebp
pop edi
mov byte [esi + 0x41], 1
pop ebp
pop esi
pop ebx
ret
Function at 0x207c4800
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x18]
mov al, byte [ebx + 2]
push edi
test al, al
jne 0x207c490e
xor ecx, ecx
lea eax, [esi + 2]
mov cx, word [ebx + 0x10]
cmp eax, ecx
jg 0x207c490e
mov edx, dword [ebx + 0x48]
push edx
call fcn.207e5e90
add esp, 4
test eax, eax
jne 0x207c4966
mov ax, word [ebx + 0xc]
xor edx, edx
mov dx, word [ebx + 0x12]
xor ecx, ecx
mov cl, byte [ebx + 6]
push ebp
mov ebp, dword [ebx + 0x44]
lea edi, [eax + edx*2 + 2]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], edi
lea eax, [eax + edx*2]
xor edx, edx
mov dh, byte [ecx + ebp + 5]
mov dword [esp + 0x18], eax
mov dl, byte [ecx + ebp + 6]
sub edx, esi
cmp edi, edx
jle 0x207c487e
push ebx
call fcn.207c4970
add esp, 4
push esi
push ebx
call fcn.207c4ab0
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
add word [ebx + 0x10], 0xfffe
and edi, 0xff
mov ecx, esi
add esp, 8
inc word [ebx + 0x12]
sub ecx, edi
lea esi, [edi + edx]
add edi, eax
mov edx, ecx
add edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add ecx, 0xfffffffe
cmp ecx, esi
lea edx, [ecx + ebp]
jle 0x207c48e3
sub ecx, esi
inc ecx
shr ecx, 1
mov edi, ecx
mov cl, byte [edx - 2]
mov byte [edx], cl
mov cl, byte [edx - 1]
mov byte [edx + 1], cl
add edx, 0xfffffffe
dec edi
jne 0x207c48d2
mov edx, eax
xor ecx, ecx
sar edx, 8
mov byte [esi + ebp], dl
mov byte [esi + ebp + 1], al
mov eax, dword [esp + 0x20]
mov cl, byte [ebx + 0x13]
mov byte [eax + ebp + 3], cl
mov dl, byte [ebx + 0x12]
mov byte [eax + ebp + 4], dl
pop ebp
pop edi
mov byte [ebx + 1], 1
pop esi
xor eax, eax
pop ebx
ret
mov edx, dword [esp + 0x20]
test edx, edx
je 0x207c493c
mov eax, dword [esp + 0x24]
mov ecx, esi
mov esi, dword [esp + 0x18]
and eax, 0xff
sub ecx, eax
add esi, eax
lea edi, [eax + edx]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x207c4940
mov edx, dword [esp + 0x18]
mov al, byte [ebx + 2]
mov ecx, eax
and ecx, 0xff
inc al
mov byte [ebx + 2], al
xor eax, eax
mov dword [ebx + ecx*8 + 0x18], edx
mov dx, word [esp + 0x14]
mov word [ebx + ecx*8 + 0x1c], dx
mov word [ebx + 0x10], 0
pop edi
pop esi
pop ebx
ret
Function at 0x207c4970
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, dword [esp + 0x54]
push edi
mov eax, dword [esi + 0x40]
mov ecx, dword [eax]
push ecx
call fcn.207e3160
xor ecx, ecx
mov edx, dword [esi + 0x44]
mov cl, byte [esi + 6]
xor ebx, ebx
mov ebp, ecx
xor ecx, ecx
mov cx, word [esi + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov cx, word [esi + 0x12]
lea edi, [edx + ebp + 6]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 0x40]
lea esi, [edx + ebp + 5]
mov dword [esp + 0x30], edi
mov bx, word [ecx + 0x16]
xor ecx, ecx
mov ch, byte [esi]
mov dword [esp + 0x2c], esi
mov cl, byte [edi]
add esp, 4
mov edi, ecx
mov ecx, ebx
sub ecx, edi
mov dword [esp + 0x14], edx
lea esi, [edi + edx]
add edi, eax
mov eax, ecx
mov dword [esp + 0x24], ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
test esi, esi
jle 0x207c4a67
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], esi
lea ebp, [ecx + edx]
mov eax, dword [esp + 0x20]
xor edx, edx
mov dh, byte [ebp]
lea ecx, [esp + 0x30]
mov dl, byte [ebp + 1]
push ecx
mov esi, edx
mov edx, dword [esp + 0x5c]
add esi, eax
push esi
push edx
call fcn.207c0330
mov ecx, dword [esp + 0x5a]
mov eax, dword [esp + 0x20]
and ecx, 0xffff
add esp, 0xc
sub ebx, ecx
mov edx, ecx
shr ecx, 2
lea edi, [ebx + eax]
mov eax, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add ebp, 2
and ecx, 3
sar eax, 8
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 2], al
mov eax, dword [esp + 0x10]
mov byte [ebp - 1], bl
dec eax
mov dword [esp + 0x10], eax
jne 0x207c49fe
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, ebx
sar ecx, 8
mov byte [eax], cl
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov byte [ecx], bl
mov ecx, ebx
lea esi, [eax + esi*2]
mov byte [edx + ebp + 1], 0
mov byte [edx + ebp + 2], 0
sub ecx, esi
mov byte [edx + ebp + 7], 0
lea edi, [esi + edx]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x207d0650
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x34
mov eax, dword [0x2072f804]
mov ecx, dword [0x2072f7f8]
push ebx
mov edx, dword [0x2072f7fc]
push ebp
push esi
push edi
push 0x20718260
push 0x20716418
push 4
push 0xa2
push eax
mov eax, dword [0x2072f800]
push ecx
push edx
push eax
push 1
mov dword [esp + 0x34], 0x14
call fcn.207921f0
mov ebp, dword [esp + 0x6c]
add esp, 0x24
test ebp, ebp
jne 0x207d06ad
mov esi, 0x80000065
mov ecx, 0xa9
mov eax, esi
jmp 0x207d07fe
mov edi, dword [esp + 0x4c]
test edi, edi
jne 0x207d06c6
mov esi, 0x80000066
mov ecx, 0xb0
mov eax, esi
jmp 0x207d07fe
mov ebx, dword [esp + 0x50]
test ebx, ebx
je 0x207d07f2
mov ecx, dword [ebx]
lea edx, [ecx - 1]
and edx, 0xfffffffe
cmp edx, 0x28
ja 0x207d07f2
cmp ecx, 0x12
jb 0x207d07f2
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
rep stosb byte es:[edi], al
call fcn.207d0870
add esp, 4
test eax, eax
je 0x207d0710
mov esi, eax
jmp 0x207d0829
mov edi, dword [ebp + 8]
mov al, 0xb0
dec edi
xor esi, esi
mov ecx, 0x20721d04
mov dl, byte [ecx]
xor al, 0xef
add al, 0x72
add ecx, 2
xor dl, al
mov byte [esp + esi + 0x1c], dl
inc esi
cmp ecx, 0x20721d2c
jl 0x207d071d
lea eax, [esp + 0x14]
push 1
push eax
call fcn.207981e0
lea ecx, [esp + 0x24]
push 0x14
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.207982b0
xor eax, eax
add esp, 0x14
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
test edi, edi
mov dword [esp + 0x2c], eax
jle 0x207d0797
xor esi, esi
mov ecx, dword [ebp + 0x14]
mov eax, esi
add eax, ecx
mov ecx, dword [eax + 0x18]
test ecx, ecx
jbe 0x207d0791
push ecx
mov ecx, dword [eax + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.207982b0
add esp, 0xc
add esi, 0x1c
dec edi
jne 0x207d0771
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, ecx
lea edi, [esp + 0x30]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea edx, [esp + 0x14]
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x10]
lea ecx, [esp + 0x30]
push eax
push ecx
push edx
call fcn.20798340
mov eax, dword [esp + 0x58]
push ebx
mov byte [eax], 0x76
mov edx, dword [ebx]
dec edx
inc eax
push eax
lea eax, [esp + 0x44]
push 8
push eax
mov dword [ebx], edx
call fcn.20797a00
add esp, 0x1c
test eax, eax
je 0x207d07e9
mov esi, eax
jmp 0x207d0829
mov eax, dword [ebx]
inc eax
xor esi, esi
mov dword [ebx], eax
jmp 0x207d0829
mov esi, 0x80000067
mov ecx, 0xb8
mov eax, esi
mov edx, dword [0x2072f7f8]
push 0x66
push ecx
mov ecx, dword [0x2072f804]
push ecx
mov ecx, dword [0x2072f7fc]
push edx
mov edx, dword [0x2072f800]
push ecx
push edx
push eax
push esi
push 3
call fcn.2078d820
add esp, 0x24
mov eax, dword [0x2072f804]
mov ecx, dword [0x2072f7f8]
mov edx, dword [0x2072f7fc]
push esi
push 0x20718250
push 0x20718240
push 4
push 0xf2
push eax
mov eax, dword [0x2072f800]
push ecx
push edx
push eax
push 1
call fcn.207921f0
add esp, 0x28
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret