joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69e6f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x100
push ebx
push esi
mov esi, 0x16
mov eax, 5
mov dword [esp + 0x78], esi
mov dword [esp + 0xa0], esi
mov esi, dword [esp + 0x10c]
push edi
mov dword [esp + 0x88], eax
mov dword [esp + 0xcc], eax
mov ebx, 3
mov edi, 7
mov edx, 1
mov ecx, 0x19
xor eax, eax
mov dword [esp + 0xc], 0x1a
test esi, esi
mov dword [esp + 0x10], 0x1f
mov dword [esp + 0x14], 0x11
mov dword [esp + 0x18], 0xa
mov dword [esp + 0x1c], 0x1e
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 0x1d
mov dword [esp + 0x30], 8
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x3c], 0x1c
mov dword [esp + 0x40], 0xb
mov dword [esp + 0x44], 0xd
mov dword [esp + 0x48], 4
mov dword [esp + 0x4c], 0x13
mov dword [esp + 0x50], 0x17
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xe
mov dword [esp + 0x60], 0x1b
mov dword [esp + 0x64], 6
mov dword [esp + 0x68], 0x12
mov dword [esp + 0x6c], 0x15
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], 9
mov dword [esp + 0x78], edi
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x8c], 0x12
mov dword [esp + 0x90], 0x1d
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], 0xf
mov dword [esp + 0xa0], 0x1f
mov dword [esp + 0xa8], 0x1b
mov dword [esp + 0xac], 9
mov dword [esp + 0xb0], 0x1a
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], 0xd
mov dword [esp + 0xbc], 0x13
mov dword [esp + 0xc0], 0xe
mov dword [esp + 0xc4], 0x14
mov dword [esp + 0xc8], 0xb
mov dword [esp + 0xd0], 2
mov dword [esp + 0xd4], 0x17
mov dword [esp + 0xd8], 0x10
mov dword [esp + 0xdc], 0xa
mov dword [esp + 0xe0], 0x18
mov dword [esp + 0xe4], 0x1c
mov dword [esp + 0xe8], 0x11
mov dword [esp + 0xec], 6
mov dword [esp + 0xf0], 0x1e
mov dword [esp + 0xf4], 0
mov dword [esp + 0xf8], 0x15
mov dword [esp + 0xfc], 0xc
mov dword [esp + 0x100], 8
mov dword [esp + 0x104], 4
mov dword [esp + 0x108], edx
jbe 0x69e991
mov bl, byte [esp + 0x114]
xor edi, edi
mov ecx, esi
mov edx, esi
and ecx, 0xfffffffe
sub edx, ecx
shr esi, 1
test edx, edx
je 0x69e98a
test bl, bl
je 0x69e97f
mov ecx, dword [esp + edi + 0xc]
jmp 0x69e986
mov ecx, dword [esp + edi + 0x8c]
shl edx, cl
add eax, edx
add edi, 4
test esi, esi
ja 0x69e966
pop edi
pop esi
pop ebx
add esp, 0x100
ret 8
Function at 0x69ea06
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x75ca7b
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1c]
lea eax, [esi + 0x20]
xor ebx, ebx
push eax
mov dword [esi], 0x76e4a8
mov dword [esi + 4], 0x76e46c
mov dword [esi + 8], 0x76e430
mov dword [esi + 0xc], 0x76e408
mov dword [esi + 0x10], 0x76e3ec
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], ebx
call dword [0x765360]
push 0xc
call fcn.00726f70
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x69ea69
mov dword [eax], 0x76e3d0
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
jmp 0x69ea6b
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0x30], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x6b7840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x75ec10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, ecx
mov cl, byte [eax]
push edi
mov byte [esi], cl
mov al, byte [edx]
xor ebx, ebx
push 0x34
mov dword [esp + 0x14], esi
mov byte [esi + 1], al
mov byte [esi + 8], bl
call fcn.00726f70
mov edi, eax
add esp, 4
lea ecx, [esp + 0x28]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x30], 1
call fcn.007376fa
mov eax, dword [0x9367a4]
mov dword [esp + 0x1c], ebx
cmp eax, ebx
jne 0x6b7897
mov dword [0x9367a4], edi
mov dword [edi], ebx
mov ecx, dword [0x9367a4]
xor ebp, ebp
mov dword [ecx + 8], ebx
mov ecx, dword [0x93c9c4]
inc ecx
mov dword [0x93c9c4], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00737796
cmp ebp, ebx
je 0x6b78c2
push ebp
call fcn.00726ea6
add esp, 4
mov edi, dword [0x9367a4]
push 0x34
call fcn.00726f70
mov dword [eax + 4], edi
mov dword [eax + 0x30], ebx
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [eax], eax
mov eax, dword [esi + 4]
add esp, 4
mov dword [eax + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword [esp + 0x14], 0xffffffff
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x6f5ab0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov edx, dword [esp + 0x1c]
push esi
push edi
mov edi, dword [ecx]
mov eax, dword [edx]
mov edx, dword [edx + 4]
mov dword [esp + 0x14], edi
mov edi, dword [ecx + 4]
mov dword [esp + 0x10], edi
mov edi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x1c], edi
xor esi, esi
mov dword [esp + 0x18], ecx
mov edi, 0x20
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov ecx, edx
sub esi, 0x61c88647
shr ecx, 5
add ecx, ebx
mov ebx, edx
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x1c]
xor ecx, ebx
lea ebx, [esi + edx]
xor ecx, ebx
mov ebx, dword [esp + 0x18]
add eax, ecx
mov ecx, eax
shr ecx, 5
add ecx, ebx
mov ebx, eax
shl ebx, 4
add ebx, ebp
xor ecx, ebx
lea ebx, [esi + eax]
xor ecx, ebx
add edx, ecx
dec edi
jne 0x6f5ae2
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov dword [ecx + 4], edx
pop ebx
add esp, 0x10
ret 4
Function at 0x6f5b40
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 0xc]
push ebp
push esi
xor ebp, ebp
push edi
mov edi, dword [esp + 0x10]
test eax, eax
jle 0x6f5c86
mov esi, dword [esp + 0x14]
mov cl, byte [esp + 0x18]
push ebx
mov eax, ebp
mov ebx, 3
cdq
idiv ebx
sub edx, 0
je 0x6f5c44
dec edx
je 0x6f5beb
dec edx
jne 0x6f5c76
mov al, byte [esi]
mov dl, cl
shr al, 6
and dl, 0x3f
or al, dl
cmp al, 0x1a
jae 0x6f5b8f
add al, 0x41
jmp 0x6f5ba8
cmp al, 0x34
jae 0x6f5b97
add al, 0x47
jmp 0x6f5ba8
cmp al, 0x3e
jae 0x6f5b9f
sub al, 4
jmp 0x6f5ba8
setne al
dec eax
and al, 0xfc
add eax, 0x2f
mov byte [edi], al
mov al, byte [esi]
inc edi
and al, 0x3f
inc esi
cmp al, 0x1a
jae 0x6f5bbe
add al, 0x41
mov byte [edi], al
inc edi
jmp 0x6f5c76
cmp al, 0x34
jae 0x6f5bcc
add al, 0x47
mov byte [edi], al
inc edi
jmp 0x6f5c76
cmp al, 0x3e
jae 0x6f5bda
sub al, 4
mov byte [edi], al
inc edi
jmp 0x6f5c76
setne al
dec eax
and al, 0xfc
add eax, 0x2f
mov byte [edi], al
inc edi
jmp 0x6f5c76
mov al, byte [esi]
and cl, 0x3f
shr al, 4
or al, cl
cmp al, 0x1a
jae 0x6f5c08
add al, 0x41
mov byte [edi], al
mov cl, byte [esi]
and cl, 0xf
inc edi
shl cl, 2
jmp 0x6f5c75
cmp al, 0x34
jae 0x6f5c1b
add al, 0x47
mov byte [edi], al
mov cl, byte [esi]
and cl, 0xf
inc edi
shl cl, 2
jmp 0x6f5c75
cmp al, 0x3e
jae 0x6f5c2e
sub al, 4
mov byte [edi], al
mov cl, byte [esi]
and cl, 0xf
inc edi
shl cl, 2
jmp 0x6f5c75
setne al
dec eax
and al, 0xfc
add eax, 0x2f
mov byte [edi], al
mov cl, byte [esi]
and cl, 0xf
inc edi
shl cl, 2
jmp 0x6f5c75
mov al, byte [esi]
shr al, 2
cmp al, 0x1a
jae 0x6f5c51
add al, 0x41
jmp 0x6f5c6a
cmp al, 0x34
jae 0x6f5c59
add al, 0x47
jmp 0x6f5c6a
cmp al, 0x3e
jae 0x6f5c61
sub al, 4
jmp 0x6f5c6a
setne al
dec eax
and al, 0xfc
add eax, 0x2f
mov byte [edi], al
mov cl, byte [esi]
and cl, 3
inc edi
shl cl, 4
inc esi
mov eax, dword [esp + 0x1c]
inc ebp
cmp ebp, eax
jl 0x6f5b5e
pop ebx
jmp 0x6f5c8a
mov cl, byte [esp + 0x18]
cdq
mov esi, 3
idiv esi
test edx, edx
je 0x6f5cd1
and cl, 0x3f
cmp cl, 0x1a
jae 0x6f5ca3
add cl, 0x41
jmp 0x6f5cc1
cmp cl, 0x34
jae 0x6f5cad
add cl, 0x47
jmp 0x6f5cc1
cmp cl, 0x3e
jae 0x6f5cb7
sub cl, 4
jmp 0x6f5cc1
setne cl
dec ecx
and ecx, 0xfffffffc
add ecx, 0x2f
mov byte [edi], cl
inc edi
cmp edx, 1
jne 0x6f5ccd
mov byte [edi], 0x3d
inc edi
mov byte [edi], 0x3d
inc edi
mov ecx, dword [esp + 0x10]
mov byte [edi], 0
mov eax, edi
pop edi
pop esi
sub eax, ecx
pop ebp
ret 0xc
Function at 0x6f76c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x763bb1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x234
mov ecx, dword [esp + 0x248]
push ebx
lea eax, [esp + 0x250]
push edi
push eax
lea edx, [esp + 0x40]
push ecx
push edx
call fcn.00727ad8
mov al, byte [esp + 0x17]
mov edi, 0x7ab3c8
mov byte [esp + 0x28], al
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x20], ebx
push ecx
push 0x7ab3c8
lea ecx, [esp + 0x24]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.004047b0
mov cl, byte [esp + 0xb]
mov dword [esp + 0x244], ebx
mov byte [esp + 0xc], cl
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x3c]
push ecx
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.004047b0
push ebx
push 1
lea eax, [esp + 0x24]
push ebx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
mov byte [esp + 0x25c], 1
call fcn.006f9ae0
add esp, 0x18
mov eax, dword [esp + 0x30]
mov byte [esp + 0x244], 1
cmp eax, ebx
je 0x6f77b6
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x6f77ad
cmp al, 0xff
je 0x6f77ad
dec al
mov byte [ecx], al
jmp 0x6f77b6
push ecx
call fcn.00726ea6
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
cmp eax, ebx
mov byte [esp + 0x244], bl
je 0x6f77ee
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x6f77e5
cmp al, 0xff
je 0x6f77e5
dec al
mov byte [ecx], al
jmp 0x6f77ee
push ecx
call fcn.00726ea6
add esp, 4
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp eax, ebx
mov dword [esp + 0x244], 0xffffffff
je 0x6f783f
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x6f7836
cmp al, 0xff
je 0x6f7836
dec al
pop edi
mov byte [ecx], al
pop ebx
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
add esp, 0x240
ret
push ecx
call fcn.00726ea6
add esp, 4
mov ecx, dword [esp + 0x23c]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x240
ret

Function at 0x700380
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
mov esi, dword [ecx]
mov edx, esi
dec esi
test edx, edx
je 0x7003ba
mov edx, dword [esp + 8]
xor ecx, ecx
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x7ab968]
xor ecx, eax
mov eax, ecx
mov ecx, esi
dec esi
test ecx, ecx
jne 0x700398
pop esi
ret
Function at 0x70274f
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x70277c
push esi
call fcn.0070a5f2
cmp byte [esi + 0x40], 0
pop ecx
je 0x702775
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x7027eb
mov eax, dword [esi + 0x18c]
cmp byte [eax + 0x10], 0
je 0x7027e0
mov eax, dword [esi + 8]
test eax, eax
je 0x70279d
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x18c]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x7027dc
cmp eax, 2
je 0x7027e0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x702792
cmp eax, 3
je 0x7027c1
cmp eax, 1
jne 0x702792
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x702792
mov edx, dword [esi + 0x118]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x702792
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x702809
cmp eax, 0xcc
je 0x702809
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.00702627
pop esi
ret
Function at 0x703666
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x7037bb
push ebx
mov ebx, 0xffc03fc0
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*4]
add edi, eax
cmp eax, edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x703796
mov esi, dword [eax + 4]
mov eax, dword [eax]
mov edx, dword [edi + 4]
mov edi, dword [edi]
mov ecx, eax
shr ecx, 2
and ecx, ebx
mov ebp, edi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, esi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, edx
shr ebp, 2
and ebp, ebx
lea ebx, [ecx + ebp - 0x7fff80]
mov ecx, eax
mov ebp, edi
and ecx, 0xff00ff
and ebp, 0xff00ff
add ecx, ebp
mov ebp, esi
and ebp, 0xff00ff
add ecx, ebp
mov ebp, edx
and ebp, 0xff00ff
shr eax, 2
lea ecx, [ecx + ebp + 0x20002]
shr ecx, 2
xor ebx, ecx
mov ecx, 0x3fc03fc0
and eax, ecx
shr edi, 2
and edi, ecx
add eax, edi
mov edi, dword [esp + 0x18]
shr esi, 2
and esi, ecx
add eax, esi
shr edx, 2
and edx, ecx
lea eax, [eax + edx + 0x800080]
and ebx, 0xff00ff
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 4
mov dword [eax], ebx
mov eax, dword [esp + 0x14]
add eax, 8
add edi, 8
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov ebx, 0xffc03fc0
jb 0x7036c9
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x7036a6
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x7038e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x703a27
push ebx
mov edx, 0xf81f
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x703a02
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x703949
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x703920
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x703b54
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x703c9a
push ebx
mov eax, 0x83e0
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x703c75
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x703bbd
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x703b94
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x703ca3
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x703ded
push ebx
mov edx, 0xf0f0
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x703dc8
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x703d0c
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x703ce3
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x703df6
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x703f2c
push ebx
mov edx, dword [edx + 0x1050]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x703f07
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0x1c
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 8]
mov ecx, eax
and ecx, 0xffff00e3
mov ebx, ebp
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00e3
shr edx, 2
lea ecx, [ecx + ebx + 0x42]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xe3
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0x1c
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x42]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x703e55
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x703e31
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x703fd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1048]
push edi
mov edi, dword [edx + 0x1054]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x704114
push ebx
push esi
mov esi, 0xff1c
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x7040ee
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xe3
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 0x42]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x208]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x208]
shr eax, 2
and edx, 0xffff00e3
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x704039
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1048]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1048]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x704010
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret