joyce8/EMBER2024-capa huggingface dataset:
Function at 0x612708
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [reloc.imm32.dll_ImmSetConversionStatus], 0
je 0x612849
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0xa8f188]
mov edx, dword [edx]
xor al, byte [edx + 0xc0]
je 0x612849
mov eax, dword [reloc.imm32.dll_ImmGetConversionStatus]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [reloc.imm32.dll_ImmSetConversionStatus]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x612818
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [reloc.imm32.dll_ImmSetConversionStatus]
call fcn.004b38b8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x612810
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1fd], 0
je 0x612810
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x68]
test al, al
je 0x612810
mov eax, dword [ebp - 0x14]
call fcn.0061e3c8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x612810
push ebp
call fcn.006126c4
pop ecx
test al, al
jne 0x612810
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00408964
test al, al
je 0x612810
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00408964
cmp byte [ebp - 1], 0
je 0x612810
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0041108c
test al, al
je 0x612810
mov edx, dword [ebp - 0x14]
mov eax, dword [reloc.imm32.dll_ImmGetConversionStatus]
call fcn.00611e28
inc edi
dec ebx
jne 0x61276d
mov eax, dword [reloc.imm32.dll_ImmGetConversionStatus]
cmp dword [eax + 8], 0
jle 0x612830
mov eax, dword [reloc.imm32.dll_ImmGetConversionStatus]
call fcn.00611edc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x612849
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0061252c
pop ecx
test al, al
jne 0x612849
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61ae24
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0041157c
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00614cc4
test ebx, ebx
jne 0x61ae77
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0061aca0
mov ebx, eax
test ebx, ebx
je 0x61af6d
cmp esi, ebx
je 0x61aea0
mov eax, dword [esp]
sub eax, dword [ebx + 0x48]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x4c]
mov dword [esp + 0x118], eax
jmp 0x61aeb5
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x61aeed
add eax, 0xffffff5f
sub eax, 2
jb 0x61af05
dec eax
sub eax, 2
jb 0x61af19
dec eax
sub eax, 2
jb 0x61af0f
jmp 0x61af23
add eax, 0xfffffdff
sub eax, 2
jb 0x61af05
dec eax
sub eax, 2
jb 0x61af19
dec eax
sub eax, 2
jb 0x61af0f
jmp 0x61af23
mov byte [esp + 0x120], 0
jmp 0x61af2b
mov byte [esp + 0x120], 2
jmp 0x61af2b
mov byte [esp + 0x120], 1
jmp 0x61af2b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.005e066c
mov esi, eax
call fcn.006117b8
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.006166c4
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x61af6f
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x62c5a4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x62c5f5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x62c5dc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x62c5cc
jmp 0x62c5f5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x62c5dd
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63b7bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov edx, 0x63b12c
mov eax, dword [ebx + 0xc]
call fcn.004b3eb4
cmp byte [ebx + 0x314], 0
je 0x63b7e2
mov edi, 0xff
jmp 0x63b7e7
mov edi, pe_nt_image_headers32
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 8]
mov dword [ebx + 0x310], eax
dec eax
test eax, eax
jl 0x63b821
inc eax
mov dword [esp + 8], eax
xor esi, esi
cmp edi, esi
jle 0x63b812
mov edx, esi
mov eax, dword [ebx + 0xc]
call fcn.004b38b8
cmp dword [eax], 0
jne 0x63b81a
mov dword [ebx + 0x310], esi
jmp 0x63b821
inc esi
dec dword [esp + 8]
jne 0x63b7ff
mov eax, dword [ebx + 0x310]
dec eax
test eax, eax
jl 0x63b864
inc eax
mov dword [esp + 8], eax
xor esi, esi
mov edx, esi
mov eax, dword [ebx + 0xc]
call fcn.004b38b8
mov dword [eax + 8], esi
mov edx, esi
mov eax, dword [ebx + 0xc]
call fcn.004b38b8
lea edx, [esi + esi*2]
mov cx, word [eax + 0xc]
mov word [ebx + edx + 0x10], cx
mov cl, byte [eax + 0xe]
mov byte [ebx + edx + 0x12], cl
inc esi
dec dword [esp + 8]
jne 0x63b833
mov esi, dword [ebx + 0x310]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 8]
dec eax
sub eax, esi
jl 0x63b937
inc eax
mov dword [esp + 8], eax
mov edx, esi
mov eax, dword [ebx + 0xc]
call fcn.004b38b8
mov edi, eax
cmp dword [edi], 0
jne 0x63b89d
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 8]
mov dword [edi + 8], eax
jmp 0x63b92c
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], 0x2fd
mov eax, dword [ebx + 0x310]
dec eax
test eax, eax
jl 0x63b91a
inc eax
mov dword [esp + 0xc], eax
xor ebp, ebp
mov edx, ebp
mov eax, dword [ebx + 0xc]
call fcn.004b38b8
movzx eax, byte [eax + 0xc]
movzx edx, byte [edi + 0xc]
sub eax, edx
push eax
mov edx, ebp
mov eax, dword [ebx + 0xc]
call fcn.004b38b8
movzx eax, byte [eax + 0xd]
movzx edx, byte [edi + 0xd]
sub eax, edx
pop edx
add edx, eax
push edx
mov edx, ebp
mov eax, dword [ebx + 0xc]
call fcn.004b38b8
movzx eax, byte [eax + 0xe]
movzx edx, byte [edi + 0xe]
sub eax, edx
mov edx, eax
pop eax
add eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [esp]
jge 0x63b913
mov dword [esp], eax
mov dword [esp + 4], ebp
inc ebp
dec dword [esp + 0xc]
jne 0x63b8bc
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0xc]
call fcn.004b38b8
mov eax, dword [eax + 8]
mov dword [edi + 8], eax
inc esi
dec dword [esp + 8]
jne 0x63b87e
cmp byte [ebx + 0x314], 0
je 0x63b97d
movzx eax, byte [ebx + 0x310]
mov byte [ebx + 0x315], al
mov eax, dword [ebx + 0x310]
lea eax, [eax + eax*2]
mov byte [ebx + eax + 0x10], 0
mov eax, dword [ebx + 0x310]
lea eax, [eax + eax*2]
mov byte [ebx + eax + 0x11], 0
mov eax, dword [ebx + 0x310]
lea eax, [eax + eax*2]
mov byte [ebx + eax + 0x12], 0
inc dword [ebx + 0x310]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x63eabc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
dec esi
test si, si
jb 0x63eae2
inc esi
xor edx, edx
movzx edi, dx
mov ecx, dword [eax]
movzx ecx, byte [ecx + edi]
xor cl, dl
push ecx
mov ecx, dword [eax]
pop ebx
mov byte [ecx + edi], bl
inc edx
dec si
jne 0x63eaca
pop edi
pop esi
pop ebx
ret
Function at 0x63ebe4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx ebx, byte [eax - 1]
mov edi, edx
dec edi
test di, di
jb 0x63ec6a
inc edi
xor esi, esi
movzx eax, si
mov edx, dword [ebp - 4]
mov edx, dword [edx]
movzx eax, byte [edx + eax]
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
xor al, bl
mov byte [ebp - 6], al
movzx edx, byte [ebp - 6]
movzx eax, byte [ebp - 5]
call fcn.0063ea68
mov edx, eax
mov eax, dword [ebp + 8]
movzx ecx, byte [eax - 8]
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
mov eax, dword [ebp + 8]
inc dword [eax - 8]
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0xf000
jl 0x63ec55
mov bl, 0x80
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 8], edx
movzx eax, si
mov edx, dword [ebp - 4]
mov edx, dword [edx]
movzx ecx, byte [ebp - 6]
mov byte [edx + eax], cl
inc esi
dec di
jne 0x63ec02
mov eax, dword [ebp + 8]
mov byte [eax - 1], bl
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x63f750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
movzx eax, byte [ebp - 0x12]
mov byte [esi], al
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x63f79c
cmp dword [ebp - 4], 0
jle 0x63f805
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004bbfb4
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004b8028
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63f810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, pe_nt_image_headers32
call fcn.004069d8
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 4], eax
mov bl, 0x80
movzx eax, byte [ebp - 0x13]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
movzx eax, byte [esi]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x10]
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x63f87a
cmp dword [ebp - 4], 0
jle 0x63f8e3
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004b8028
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004bbfb4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x63f900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], eax
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0xd]
xor al, bl
mov byte [ebp - 0xe], al
movzx edx, byte [ebp - 0xe]
movzx eax, byte [ebp - 0xd]
call fcn.0063ea68
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0xd]
xor al, bl
mov byte [ebp - 0xe], al
movzx edx, byte [ebp - 0xe]
movzx eax, byte [ebp - 0xd]
call fcn.0063ea68
mov edx, eax
movzx ecx, byte [ebp - 0xc]
inc ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
movzx eax, byte [ebp - 0xe]
mov byte [esi], al
inc dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 4
jne 0x63f949
cmp dword [ebp - 4], 0
jle 0x63f9b7
mov eax, dword [ebp - 8]
call fcn.004b8008
push edx
push eax
mov eax, dword [ebp - 4]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.004b8028
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63f9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
movzx eax, byte [ebp - 0x12]
mov byte [esi], al
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x63fa0c
lea edx, [ebp - 4]
mov ecx, 4
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [ebp - 4], 0
jle 0x63fa79
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004bbfb4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x63fa84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea edx, [ebp - 4]
mov ecx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, pe_nt_image_headers32
call fcn.004069d8
mov bl, 0x80
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
movzx eax, byte [esi]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x10]
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x63faed
cmp dword [ebp - 4], 0
jle 0x63fb4a
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004bbfb4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63fb54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
movzx eax, byte [ebp - 0x12]
mov byte [esi], al
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x63fba0
cmp dword [ebp - 4], 0
jle 0x63fc0b
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov ecx, ebx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0063ec78
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004b8028
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x63fc18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004b8028
mov eax, pe_nt_image_headers32
call fcn.004069d8
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 4], eax
mov bl, 0x80
movzx eax, byte [ebp - 0x13]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
movzx eax, byte [esi]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x10]
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x63fc8e
cmp dword [ebp - 4], 0
jle 0x63fcf9
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004b8028
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov ecx, ebx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0063ec78
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63fd04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
movzx eax, byte [ebp - 0x12]
mov byte [esi], al
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x63fd50
cmp dword [ebp - 4], 0
jle 0x63fdfc
call fcn.0043496c
push eax
push 1
xor ecx, ecx
mov dl, 1
mov eax, dword [0x498e98]
call fcn.004bd0c4
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x63fdf5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call fcn.004bbfb4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.004bd354
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63fe04
mov eax, dword [ebp - 0x18]
call fcn.00408618
ret
mov eax, dword [ebp - 0xc]
call fcn.0040a2d8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63fe0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.0040a3bc
xor eax, eax
push ebp
push 0x63ff22
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, pe_nt_image_headers32
call fcn.004069d8
mov byte [ebp - 0x13], al
call fcn.0043496c
mov edx, dword [ebp - 8]
call fcn.00433a20
mov dword [ebp - 4], eax
mov bl, 0x80
movzx eax, byte [ebp - 0x13]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 4]
movzx eax, byte [esi]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor al, bl
mov byte [ebp - 0x12], al
movzx edx, byte [ebp - 0x12]
movzx eax, byte [ebp - 0x11]
call fcn.0063ea68
mov edx, eax
movzx ecx, byte [ebp - 0x10]
inc ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x10]
inc dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 4
jne 0x63fe97
call fcn.0043496c
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00433f48
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004b82f8
mov ebx, dword [ebp - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63ff29
lea eax, [ebp - 0x18]
mov edx, dword [0x41fe80]
call fcn.0040cb80
lea eax, [ebp - 8]
call fcn.0040a2d8
ret

Function at 0x63ff88
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], eax
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bl, 0x80
movzx eax, byte [ebp - 0xd]
xor al, bl
mov byte [ebp - 0xe], al
movzx edx, byte [ebp - 0xe]
movzx eax, byte [ebp - 0xd]
call fcn.0063ea68
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea esi, [ebp - 4]
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [ebp - 0xd]
xor al, bl
mov byte [ebp - 0xe], al
movzx edx, byte [ebp - 0xe]
movzx eax, byte [ebp - 0xd]
call fcn.0063ea68
mov edx, eax
movzx ecx, byte [ebp - 0xc]
inc ecx
mov eax, ebx
call fcn.0063ea7c
mov ebx, eax
movzx eax, byte [ebp - 0xe]
mov byte [esi], al
inc dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 4
jne 0x63ffd1
cmp dword [ebp - 4], 0
jle 0x64003f
mov eax, dword [ebp - 8]
call fcn.004b8008
push edx
push eax
mov eax, dword [ebp - 4]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.004b8028
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret