joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c0
mov ebp, edx
mov ebx, ecx
mov edi, dword [esp + 0x1d8]
mov eax, dword [ecx + 8]
mov dword [esp], eax
lea esi, [esp + 0x5c]
push 0x100
push 0xeb236c
push esi
call fcn.007de188
add esp, 0xc
mov dword [esp + 4], ebp
push ebp
push ebx
call fcn.0042b2d0
add esp, 8
mov dword [esp + 8], eax
call fcn.0060b520
mov ebp, eax
and eax, 0xff800000
cmp eax, 0xa000000
jne 0x47a808
mov eax, ebp
and eax, 0x7fffff
cmp eax, 0x414
jg 0x47a7ab
cmp eax, 0x86
je 0x47a7bd
cmp eax, 0xcf
jne 0x47a808
mov eax, dword [esp]
or byte [eax + 0x2d8], 8
mov esi, 0xeb24ac
jmp 0x47a957
cmp eax, 0x45c
je 0x47a90d
cmp eax, 0x415
jne 0x47a808
mov eax, dword [esp]
push dword [eax + 0x10c]
call fcn.0055c9b0
add esp, 4
mov edi, 0x3c
test eax, eax
je 0x47a952
mov ecx, dword [esp + 8]
mov dword [ecx + 0x48], eax
push eax
call fcn.00686890
add esp, 4
lea esi, [esp + 0x5c]
push eax
push 0xeb246c
push 0x100
push esi
call fcn.0040ad30
add esp, 0x10
jmp 0x47a957
mov byte [esp + 0x5c], 0
push 0x100
push esi
push ebp
call fcn.0060bd40
add esp, 0xc
cmp byte [esp + 0x5c], 0
je 0x47a831
mov eax, edi
xor eax, 0x23
or eax, ebp
je 0x47a85b
jmp 0x47a957
test ebp, ebp
mov eax, 0xeb250d
mov ecx, 0xeb24ff
cmove ecx, eax
lea eax, [esp + 0x5c]
push ecx
push eax
call fcn.007ddf70
add esp, 8
mov eax, edi
xor eax, 0x23
or eax, ebp
jne 0x47a957
mov ebp, dword [esp + 0x1d4]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
movups xmmword [esp + 0x2c], xmm0
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0xc], xmm0
call dword [0x100ad04]
mov esi, eax
lea edi, [esp + 0x15c]
push edi
push 0
push 0
push dword [esp + 0x10]
push dword [ebx + 4]
call fcn.00438870
add esp, 0x14
test esi, esi
sete al
cmp ebp, 5
setne cl
or cl, al
jne 0x47a8d2
lea ebx, [esp + 0xc]
push 0x50
push ebx
push esi
call fcn.0041b460
add esp, 0xc
cmp byte [esp + 0xc], 0
mov eax, 0xeb2577
cmovne eax, ebx
mov ecx, dword [esp]
jmp 0x47a8e6
mov eax, 0xeb25fa
cmp ebp, 0xa
mov ecx, dword [esp]
ja 0x47a8e6
mov eax, dword [ebp*4 + 0xeb2e04]
push edi
push dword [esp + 0x1bc]
push dword [ecx + 0xf4]
push eax
push 0xeb24cf
push dword [esp + 0x18]
call fcn.00443310
add esp, 0x18
mov edi, 0x23
jmp 0x47a969
mov byte [esp + 0x5c], 0
lea esi, [esp + 0x5c]
push 0x100
push esi
push ebp
call fcn.0060bd40
add esp, 0xc
mov edi, 0x62
cmp byte [esp + 0x5c], 0
jne 0x47a957
mov word [esp + 0x68], 0x72
mov dword [esp + 0x64], 0x6f727265
mov dword [esp + 0x60], 0x206e776f
mov dword [esp + 0x5c], 0x6e6b6e55
jmp 0x47a957
mov esi, 0xeb2488
push esi
push 0xeb24fc
push dword [esp + 0xc]
call fcn.00443310
add esp, 0xc
mov eax, edi
add esp, 0x1c0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48ec30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [esp + 0x70]
mov eax, dword [esp + 0x68]
mov ebp, dword [esp + 0x74]
mov edx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], eax
mov edi, dword [esp + 0x78]
mov dword [esp + 0x2c], ebp
test edx, edx
je 0x48ec8e
mov dword [esp + 0x20], esi
mov ebp, edx
mov esi, edx
jmp 0x48ec77
mov esi, dword [esi + 0xc]
test esi, esi
je 0x48ec88
mov eax, dword [esi + 0x10]
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [eax + 0x18]
test eax, eax
je 0x48ec70
mov esi, dword [esp + 0x20]
mov edx, ebp
mov eax, dword [edx + 0xc]
mov dword [esp + 0x34], edx
test eax, eax
je 0x48ed08
mov dword [esp + 0x38], eax
mov eax, dword [eax + 0xc]
mov ebp, 2
test eax, eax
je 0x48ecb2
mov dword [esp + 0x3c], eax
mov ebp, 3
mov eax, edi
mov edi, esi
mov esi, ebp
mov ebp, eax
sub esi, 1
mov edx, dword [esp + 0x28]
mov eax, dword [esp + esi*4 + 0x34]
mov ecx, dword [eax + 0x10]
mov dword [esp], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
call dword [eax + 0xc]
test esi, esi
jne 0x48ecba
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edx + 0x10]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x78], edi
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x6c], esi
mov dword [esp + 0x74], ebp
mov dword [esp + 0x70], edi
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x60], edx
mov eax, dword [eax + 0xc]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
jmp eax
Function at 0x4cb700
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp + 8], 0
mov edx, dword [esp + 0x28]
test ecx, ecx
jne 0x4cb65f
jmp 0x4cb6df
mov dword [esp], 1
add edi, 1
xor esi, esi
mov byte [esp + 7], 0
mov byte [esp + 0xc], 0
mov ecx, dword [esp + 8]
add ecx, 4
mov dword [esp + 0x10], ecx
cmp ecx, dword [esp + 0x2c]
jge 0x4cb6d0
mov ecx, eax
shl eax, 4
shr cl, 2
and eax, 0x30
movzx ebp, cl
movzx ecx, byte [ebx + ebp]
mov byte [edx], cl
movzx ecx, byte [esp + 7]
shr cl, 4
movzx ebp, cl
or eax, ebp
cmp dword [esp], 1
movzx eax, byte [ebx + eax]
mov byte [edx + 1], al
je 0x4cb698
movzx eax, byte [esp + 7]
movzx ecx, byte [esp + 0xc]
lea eax, [eax*4]
shr cl, 6
and eax, 0x3c
movzx ebp, cl
or eax, ebp
cmp dword [esp], 3
movzx eax, byte [ebx + eax]
mov byte [edx + 2], al
jne 0x4cb69c
mov eax, dword [esp + 0xc]
add edx, 4
and eax, 0x3f
movzx eax, byte [ebx + eax]
mov byte [edx - 1], al
test esi, esi
je 0x4cb6ab
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
movzx eax, byte [edi]
cmp esi, 1
je 0x4cb5c0
movzx ecx, byte [edi + 1]
mov byte [esp + 7], cl
cmp esi, 2
je 0x4cb6e8
movzx ecx, byte [edi + 2]
mov dword [esp], 3
sub esi, 3
add edi, 3
mov byte [esp + 0xc], cl
jmp 0x4cb5d6
mov byte [edx + 2], 0x3d
mov eax, 0x3d
add edx, 4
mov byte [edx - 1], al
test esi, esi
jne 0x4cb657
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0x10]
add eax, 5
cmp dword [esp + 0x2c], eax
jle 0x4cb6d0
mov byte [edx], 0
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x14
mov ebx, 0xffffffff
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
mov eax, 1
jmp 0x4cb6b6
mov dword [esp], 2
add edi, 2
xor esi, esi
mov byte [esp + 0xc], 0
jmp 0x4cb5d6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
mov eax, 0xebe720
jmp 0x4cb590
Function at 0x50b170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov edi, dword [ebx + 0x28]
push dword [edi + 0x84]
call fcn.00514620
add esp, 4
mov esi, eax
mov dword [esp + 4], edi
imul esi, dword [edi + 8]
push dword [ebx + 0x2c]
call fcn.00514680
add esp, 4
push dword [ebx + 0x30]
call fcn.00513d40
add esp, 4
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
test ebp, ebp
je 0x50b1db
mov dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x48]
cmp dword [esp + 8], 0
je 0x50b1e9
inc eax
mov dword [ebx + 0x48], eax
cmp eax, esi
jae 0x50b1f7
cmp dword [ebx + 0x5c], 0
je 0x50b2b7
mov esi, dword [ebx + 0x54]
test esi, esi
jne 0x50b20a
mov dword [ebx + 0x54], 0xc
mov esi, 0xc
mov edi, dword [esp]
push edi
push esi
push 0
push ebx
call fcn.005215a0
add esp, 0x10
push edi
push dword [ebx + 0x58]
push esi
push dword [ebx + 0x44]
call dword [ebx + 0x40]
add esp, 0x10
push dword [ebx + 0x2c]
call fcn.00514680
add esp, 4
push dword [ebx + 0x30]
call fcn.00513d40
add esp, 4
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
mov eax, dword [ebx + 0x28]
movzx ecx, word [ebx]
push ecx
push dword [eax + 0x90]
call fcn.00513970
add esp, 8
push dword [ebx + 0x34]
call fcn.00513d40
add esp, 4
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
push dword [ebx + 0x3c]
call fcn.00518150
add esp, 4
mov eax, dword [0xfef218]
push ebx
call dword [eax]
add esp, 4
push dword [esp + 4]
call fcn.0051db00
add esp, 4
mov eax, 0xc
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0050b2d0
Function at 0x522660
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
test edi, edi
je 0x5226f1
mov ecx, dword [esp + 0x10]
mov edx, edi
and edx, 3
cmp edi, 4
jae 0x522685
xor esi, esi
jmp 0x5226ca
and edi, 0xfffffffc
xor esi, esi
nop word [eax + eax]
movzx ebx, byte [ecx + esi]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 1]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 2]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 3]
xor ebx, eax
imul eax, ebx, 0x1000193
add esi, 4
cmp edi, esi
jne 0x522690
test edx, edx
je 0x5226f1
add ecx, esi
xor esi, esi
nop word cs:[eax + eax]
movzx edi, byte [ecx + esi]
xor edi, eax
imul eax, edi, 0x1000193
inc esi
cmp edx, esi
jne 0x5226e0
pop esi
pop edi
pop ebx
ret

Function at 0x522700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x52273d
mov ebx, dword [esp + 0x14]
xor ebp, ebp
nop word cs:[eax + eax]
movzx eax, byte [ebx + ebp]
push eax
call fcn.0051cd40
add esp, 4
movzx eax, al
xor eax, esi
imul esi, eax, 0x1000193
inc ebp
cmp edi, ebp
jne 0x522720
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5df810
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov esi, dword [edx]
mov ebp, dword [edx + 4]
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
movzx eax, byte [edx + 0x10]
shr al, 2
cmp ebp, ecx
sete dl
and dl, al
cmp dl, 1
jne 0x5df8a9
xor eax, eax
test ebp, ebp
jle 0x5df8df
xor edi, edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], ebp
nop word cs:[eax + eax]
mov ecx, dword [esi + edi*4]
mov ebp, dword [ebx + edi*4]
mov edx, ebp
xor edx, ecx
mov ebx, ecx
sub ebx, ebp
xor ebx, ebp
or ebx, edx
xor ebx, ecx
sar ebx, 0x1f
mov esi, ebx
not ebx
and ebx, eax
or ebx, esi
mov esi, dword [esp + 8]
mov eax, ebp
sub eax, ecx
xor eax, ecx
or eax, edx
xor eax, ebp
mov ebp, dword [esp]
sar eax, 0x1f
mov ecx, eax
not eax
and eax, ebx
mov ebx, dword [esp + 4]
and ecx, 1
or eax, ecx
inc edi
cmp ebp, edi
jne 0x5df860
jmp 0x5df8df
mov eax, ebp
sub eax, ecx
jne 0x5df8df
jmp 0x5df8cd
mov ecx, dword [esi + ebp*4 - 4]
mov edx, dword [ebx + ebp*4 - 4]
dec ebp
cmp ecx, edx
jne 0x5df8d5
test ebp, ebp
jg 0x5df8c0
xor eax, eax
jmp 0x5df8df
xor eax, eax
cmp edx, ecx
adc eax, 0xffffffff
or eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5dfcc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, eax
not ecx
dec eax
and eax, ecx
shr eax, 0x1f
dec eax
mov ecx, dword [edx + 4]
mov edi, dword [esi + 4]
xor edi, ecx
and edi, eax
xor ecx, edi
mov dword [edx + 4], ecx
xor dword [esi + 4], edi
mov ecx, dword [edx + 0xc]
mov edi, dword [esi + 0xc]
xor edi, ecx
and edi, eax
xor ecx, edi
mov dword [edx + 0xc], ecx
xor dword [esi + 0xc], edi
mov ecx, dword [esp + 0x24]
mov edi, dword [edx + 0x10]
mov ebx, dword [esi + 0x10]
xor ebx, edi
and ebx, eax
and ebx, 4
xor edi, ebx
mov dword [edx + 0x10], edi
xor dword [esi + 0x10], ebx
test ecx, ecx
jle 0x5dfdef
mov edx, dword [edx]
mov esi, dword [esi]
xor edi, edi
cmp ecx, 4
jb 0x5dfd93
lea ebx, [edx + ecx*4]
mov dword [esp], ebx
lea ebp, [esi + ecx*4]
cmp edx, ebp
setb bl
cmp esi, dword [esp]
setb bh
test bl, bh
jne 0x5dfd93
mov edi, ecx
and edi, 0x7ffffffc
movd xmm0, eax
pshufd xmm0, xmm0, 0
xor ebx, ebx
nop word [eax + eax]
movdqu xmm1, xmmword [edx + ebx*4]
movdqu xmm2, xmmword [esi + ebx*4]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm0
pxor xmm1, xmm3
movdqu xmmword [edx + ebx*4], xmm1
pxor xmm3, xmm2
movdqu xmmword [esi + ebx*4], xmm3
add ebx, 4
cmp edi, ebx
jne 0x5dfd60
cmp edi, ecx
je 0x5dfdef
mov ebx, edi
test cl, 1
je 0x5dfdb1
mov ebx, dword [edx + edi*4]
mov ebp, dword [esi + edi*4]
xor ebp, ebx
and ebp, eax
xor ebx, ebp
mov dword [edx + edi*4], ebx
xor dword [esi + edi*4], ebp
mov ebx, edi
or ebx, 1
lea ebp, [ecx - 1]
cmp edi, ebp
je 0x5dfdef
nop dword [eax + eax]
mov edi, dword [edx + ebx*4]
mov ebp, dword [esi + ebx*4]
xor ebp, edi
and ebp, eax
xor edi, ebp
mov dword [edx + ebx*4], edi
xor dword [esi + ebx*4], ebp
mov edi, dword [edx + ebx*4 + 4]
mov ebp, dword [esi + ebx*4 + 4]
xor ebp, edi
and ebp, eax
xor edi, ebp
mov dword [edx + ebx*4 + 4], edi
xor dword [esi + ebx*4 + 4], ebp
add ebx, 2
cmp ecx, ebx
jne 0x5dfdc0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x62b8f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x18]
xor eax, eax
test edx, edx
je 0x62b95d
movzx ecx, byte [edx]
test cl, cl
je 0x62b95d
inc edx
mov edi, 0x100
xor ebx, ebx
nop
mov dword [esp], edx
movsx eax, cl
mov ebp, edi
or ebp, eax
mov ecx, eax
shr ecx, 2
xor ecx, eax
and cl, 0xf
mov esi, ebx
mov al, 0x20
sub al, cl
shl esi, cl
mov ecx, eax
xor edx, edx
shrd ebx, edx, cl
mov edx, dword [esp]
xor ecx, ecx
add edi, 0x100
test al, 0x20
cmovne ebx, ecx
mov eax, ebx
or eax, esi
imul ebp, ebp
mov ebx, ebp
xor ebx, eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x62b910
mov eax, ebx
shr eax, 0x10
xor eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x62bfb0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x18]
xor eax, eax
test edx, edx
je 0x62c020
movzx ecx, byte [edx]
test cl, cl
je 0x62c020
inc edx
mov esi, 0x100
xor ebx, ebx
nop
mov dword [esp], edx
and cl, 0xdf
movsx eax, cl
mov ebp, esi
or ebp, eax
mov ecx, eax
shr ecx, 2
xor ecx, eax
and cl, 0xf
mov edi, ebx
mov al, 0x20
sub al, cl
shl edi, cl
mov ecx, eax
xor edx, edx
shrd ebx, edx, cl
mov edx, dword [esp]
xor ecx, ecx
test al, 0x20
cmovne ebx, ecx
mov eax, ebx
or eax, edi
imul ebp, ebp
mov ebx, ebp
xor ebx, eax
add esi, 0x100
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x62bfd0
mov eax, ebx
shr eax, 0x10
xor eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x63e0a0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor eax, eax
xor edx, edx
cmp ecx, 0
je 0x63e0cb
mov dl, byte [esi]
lea esi, [esi + 1]
xor dl, byte [edi]
lea edi, [edi + 1]
or al, dl
dec ecx
jne 0x63e0b7
neg eax
shr eax, 0x1f
pop edi
pop esi
ret
Function at 0x6444d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, edx
mov dword [esp + 0xc], ecx
mov esi, dword [ecx + 0x14]
cmp esi, edx
jae 0x64461b
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x18]
mov ebx, eax
sub ebx, edx
jb 0x644531
mov edi, eax
and ebx, 0xfffffffc
lea eax, [edx + ebx]
add eax, 4
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x18], eax
shl eax, 4
push 0x71
push 0xf236c0
push eax
mov ebx, ecx
push dword [ecx + 0x40]
call fcn.006310a0
add esp, 0x10
test eax, eax
je 0x64462d
mov dword [ebx + 0x40], eax
mov eax, edi
mov edx, esi
shl edx, 4
add edx, 0x1f
movdqa xmm0, xmmword [0xf236a0]
movdqa xmm1, xmmword [0xf236b0]
nop dword [eax]
mov ecx, dword [esp + 0xc]
mov edi, dword [ecx + 0x40]
mov bh, byte [edi + edx - 0x10]
mov bl, bh
movzx ecx, byte [edi + edx - 0x11]
shr bh, 7
mov ch, cl
add ch, cl
or ch, bh
mov byte [edi + edx - 1], ch
mov ch, byte [edi + edx - 0x12]
shr cl, 7
mov bh, ch
add bh, ch
or bh, cl
mov byte [edi + edx - 2], bh
mov cl, byte [edi + edx - 0x13]
shr ch, 7
add cl, cl
or cl, ch
add bl, bl
mov byte [edi + edx - 3], cl
movd xmm2, dword [edi + edx - 0x17]
movd xmm4, dword [edi + edx - 0x16]
psrlw xmm4, 7
pand xmm4, xmm0
movq xmm3, xmm2
paddb xmm2, xmm2
por xmm2, xmm4
movd dword [edi + edx - 7], xmm2
movq xmm2, qword [edi + edx - 0x1f]
movdqa xmmword [esp + 0x10], xmm2
mov bh, byte [esp + 0x10]
sar bh, 7
and bh, 0x87
xor bh, bl
movdqa xmm4, xmm2
pand xmm4, xmm1
por xmm4, xmm3
psllq xmm4, 0x38
movdqa xmm3, xmm2
psrlq xmm3, 8
por xmm3, xmm4
psrlw xmm3, 7
pand xmm3, xmm0
paddb xmm2, xmm2
por xmm2, xmm3
movq qword [edi + edx - 0xf], xmm2
mov byte [edi + edx], bh
inc esi
add edx, 0x10
cmp eax, esi
jne 0x644550
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x14], eax
shl eax, 4
mov ecx, dword [esp + 0xc]
add eax, dword [ecx + 0x40]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x644625
Function at 0x6726d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x6726fd
mov eax, dword [eax]
test eax, eax
je 0x6726fd
mov eax, dword [eax + 0x20]
test eax, eax
je 0x6726fd
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp eax
mov dword [esp + 0xf], 0x207265
mov dword [esp + 0xc], 0x65746e45
mov word [esp + 8], 0x20
mov dword [esp + 4], 0x726f6620
mov word [esp + 2], 0x3a
test ebp, ebp
je 0x6727b2
push ebp
call fcn.007ddf80
add esp, 4
mov esi, eax
test ebx, ebx
je 0x67274a
push ebx
call fcn.007ddf80
add esp, 4
add esi, eax
add esi, 0xb
jmp 0x67274d
add esi, 6
add esi, 2
push 0x166
push 0xf3d670
push esi
call fcn.00630f70
add esp, 0xc
test eax, eax
je 0x6727b2
mov edi, eax
lea eax, [esp + 0xc]
push esi
push eax
push edi
call fcn.00632e10
add esp, 0xc
push esi
push ebp
push edi
call fcn.00632e70
add esp, 0xc
test ebx, ebx
je 0x6727a1
lea eax, [esp + 4]
push esi
push eax
push edi
call fcn.00632e70
add esp, 0xc
push esi
push ebx
push edi
call fcn.00632e70
add esp, 0xc
lea eax, [esp + 2]
push esi
push eax
push edi
call fcn.00632e70
add esp, 0xc
jmp 0x6727b4
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6959f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
cmp ebx, 2
jb 0x695a68
mov dword [esp], ecx
mov eax, ebx
shr ebx, 1
lea esi, [edx + eax]
xor edi, edi
cmp ebx, 1
je 0x695a4b
and ebx, 0xfffffffe
mov eax, dword [esp + 0x18]
lea ebp, [eax - 1]
xor edi, edi
nop dword [eax + eax]
movzx eax, byte [edx + edi]
mov ah, byte [edx + ebp]
mov byte [edx + edi], ah
mov byte [edx + ebp], al
movzx eax, byte [edx + edi + 1]
mov ecx, edi
xor ecx, 0xfffffffe
mov ah, byte [esi + ecx]
mov byte [edx + edi + 1], ah
mov byte [esi + ecx], al
add edi, 2
add ebp, 0xfffffffe
cmp ebx, edi
jne 0x695a20
mov ebx, dword [esp + 0x18]
test bl, 2
mov ecx, dword [esp]
je 0x695a68
movzx eax, byte [edx + edi]
mov ebp, edi
not ebp
mov ah, byte [esi + ebp]
mov byte [edx + edi], ah
mov byte [esi + ebp], al
push ecx
push ebx
push edx
call fcn.005df080
add esp, 0xc
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6c2778
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x6c297e
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x820
mov dword [esp + 8], edx
mov edi, dword [ecx + 0x44]
mov eax, dword [ecx + 0x54]
mov ebx, eax
shl eax, 0xa
mov dword [esp + 0x14], eax
add eax, edi
add eax, 0xfffffc00
lea edx, [esp + 0x18]
push 0x400
push eax
push edx
mov esi, ecx
call fcn.007de188
add esp, 0xc
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x30]
mov dword [esp + 4], eax
cmp eax, 2
jb 0x6c28d7
mov edx, ebx
shl edx, 0xb
mov esi, dword [esp + 4]
imul esi, ebx
shl esi, 0xa
add esi, edi
lea eax, [esp + 0x18]
cmp eax, esi
lea esi, [edi + edx - 0x400]
setb cl
lea eax, [esp + 0x418]
cmp esi, eax
setb ch
and ch, cl
shr ebx, 0x15
and ebx, 1
or bl, ch
mov dword [esp + 0x10], ebx
lea ecx, [edi + edx]
add ecx, 0xfffffc30
add edx, edi
add edx, 0xfffffc08
mov edi, 1
jmp 0x6c2833
inc edi
mov eax, dword [esp + 0x14]
add ecx, eax
add edx, eax
cmp edi, dword [esp + 4]
je 0x6c28d7
cmp byte [esp + 0x10], 0
je 0x6c2870
xor esi, esi
nop dword [eax]
mov eax, dword [edx + esi*8 - 8]
mov ebx, dword [edx + esi*8 - 4]
xor dword [esp + esi*8 + 0x18], eax
xor dword [esp + esi*8 + 0x1c], ebx
mov eax, dword [edx + esi*8]
mov ebx, dword [edx + esi*8 + 4]
xor dword [esp + esi*8 + 0x24], ebx
xor dword [esp + esi*8 + 0x20], eax
add esi, 2
cmp esi, 0x80
jne 0x6c2840
jmp 0x6c2820
xor esi, esi
nop word cs:[eax + eax]
movups xmm0, xmmword [ecx + esi*8 - 0x30]
movups xmm1, xmmword [ecx + esi*8 - 0x20]
movups xmm2, xmmword [esp + esi*8 + 0x18]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + esi*8 + 0x28]
xorps xmm0, xmm1
movups xmmword [esp + esi*8 + 0x18], xmm2
movups xmmword [esp + esi*8 + 0x28], xmm0
movups xmm0, xmmword [ecx + esi*8 - 0x10]
movups xmm1, xmmword [ecx + esi*8]
movups xmm2, xmmword [esp + esi*8 + 0x38]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + esi*8 + 0x48]
xorps xmm0, xmm1
movups xmmword [esp + esi*8 + 0x38], xmm2
movups xmmword [esp + esi*8 + 0x48], xmm0
add esi, 8
cmp esi, 0x80
jne 0x6c2880
jmp 0x6c2820
xor eax, eax
nop dword [eax]
mov ecx, dword [esp + eax*8 + 0x18]
mov edx, dword [esp + eax*8 + 0x1c]
mov dword [esp + eax*8 + 0x420], edx
mov dword [esp + eax*8 + 0x41c], ecx
inc eax
cmp eax, 0x80
jne 0x6c28e0
mov edi, dword [esp + 0xc]
mov ecx, dword [edi + 0x5c]
lea esi, [esp + 0x41c]
mov edx, dword [esp + 8]
push 0x400
push esi
push dword [edi + 4]
call fcn.006c2980
add esp, 0xc
push 0x400
lea eax, [esp + 0x1c]
push eax
call fcn.0063e050
add esp, 8
push 0x400
push esi
call fcn.0063e050
add esp, 8
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x4c]
shl ecx, 0xa
cmp dword [edi + 0x40], 0
je 0x6c2963
push 0x310
push 0xf582f8
push ecx
push eax
call fcn.006324f0
jmp 0x6c2974
push 0x313
push 0xf582f8
push ecx
push eax
call fcn.00631350
add esp, 0x10
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret