joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7fa520
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
test byte [edx + 7], 0x40
je 0x7fa6e6
mov ebp, dword [esp + 0x14]
mov esi, ecx
test byte [ebp + 6], 8
jne 0x7fa546
mov eax, dword [esi]
cmp byte [eax + 0x20], 0
js 0x7fa6e6
mov edi, fcn.007b1580
xor eax, eax
movzx edx, byte [0xbb7c57]
imul edi, edi
and edi, 3
cmp edi, 3
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 2]
bt edx, eax
jb 0x7fa6d5
mov al, byte [0xbb7c57]
xor ecx, ecx
cmp edi, 3
mov ah, 1
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb7c57], ah
jne 0x7fa577
mov ecx, fcn.007b1580
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x7fa5e7
xor eax, eax
cmp ecx, 3
movzx edi, byte [0xbb7c57]
sete al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 2]
bt edi, eax
jae 0x7fa5c5
jmp 0x7fa6d5
xor eax, eax
cmp ecx, 3
movzx edx, byte [0xbb7c57]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 2]
bt edx, eax
jb 0x7fa6ac
mov ecx, fcn.007b1580
xor eax, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete al
mov ecx, eax
not ecx
and ecx, 0x505
lea ecx, [eax + ecx*2 - 0x4e80dd56]
mov eax, dword [0xbb7c40]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb7c40], eax
not eax
imul edx, eax
mov eax, dword [0xbb7c44]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb7c44], eax
or edi, edx
not eax
mov edx, dword [str._gX]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [str._gX], edx
or edi, eax
not edx
mov eax, dword [0xbb7c4c]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb7c4c], eax
or edi, edx
not eax
mov dl, 1
imul eax, edi
shl dl, cl
xor dword [0xbb7c50], eax
or byte [0xbb7c57], dl
mov eax, fcn.007b1580
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 3
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbb7c57], al
push dword [ebp + 0x20]
push 0xbb7c40
push esi
call fcn.0078de60
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7faa70
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ecx + 0x24], 0
jne 0x7facde
push ebp
push ebx
push edi
push esi
mov ebx, 0x8410d0
mov ebp, 0x8410d0
mov esi, ecx
movzx ecx, byte [0xbb7c93]
mov edi, dword [esp + 0x14]
or ebx, 2
xor ebp, 2
mov eax, ebx
add eax, ebp
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x7facca
mov al, byte [0xbb7c93]
mov ecx, ebx
mov ah, 1
add ecx, ebp
sete cl
not cl
and cl, 3
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb7c93], ah
jne 0x7faab7
mov ecx, 0x8410d0
mov ebx, 0x8410d0
or ecx, 2
xor ebx, 2
mov ebp, ecx
add ebp, ebx
sete ah
not ah
and ah, 3
xor ah, 7
movzx ebp, ah
movzx eax, al
bt eax, ebp
jae 0x7fab1f
mov eax, ecx
movzx ebp, byte [0xbb7c93]
add eax, ebx
sete al
not al
and al, 3
movzx eax, al
bt ebp, eax
jae 0x7fab00
jmp 0x7facca
add ecx, ebx
movzx ecx, byte [0xbb7c93]
sete al
not al
and al, 3
movzx eax, al
bt ecx, eax
jb 0x7faca3
mov eax, 0x8410d0
mov ebx, 0x8410d0
xor ecx, ecx
xor ebx, 2
or eax, 2
add eax, ebx
mov eax, dword [0xbb7c60]
sete cl
xor ecx, 0x7b31c663
add ecx, 0x1318
mov ebx, ecx
xor eax, ecx
shr ebx, 0x1f
mov dword [0xbb7c60], eax
not eax
or ebx, ecx
and cl, 7
imul ebx, eax
mov eax, dword [0xbb7c64]
lea ebp, [ebx + ebx]
xor eax, ebx
shr ebx, 0x1e
mov dword [0xbb7c64], eax
or ebp, ebx
not eax
mov ebx, dword [0xbb7c68]
imul eax, ebp
lea ebp, [eax*4]
xor ebx, eax
shr eax, 0x1d
mov dword [0xbb7c68], ebx
or ebp, eax
not ebx
mov eax, dword [0xbb7c6c]
imul ebx, ebp
lea ebp, [ebx*8]
xor eax, ebx
shr ebx, 0x1c
mov dword [0xbb7c6c], eax
or ebp, ebx
not eax
mov ebx, dword [0xbb7c70]
imul eax, ebp
mov ebp, eax
shl ebp, 4
xor ebx, eax
shr eax, 0x1b
mov dword [0xbb7c70], ebx
or eax, ebp
not ebx
imul ebx, eax
mov eax, dword [0xbb7c74]
mov ebp, ebx
shl ebp, 5
xor eax, ebx
shr ebx, 0x1a
mov dword [0xbb7c74], eax
or ebx, ebp
not eax
imul eax, ebx
mov ebx, dword [0xbb7c78]
mov ebp, eax
shl ebp, 6
xor ebx, eax
shr eax, 0x19
mov dword [0xbb7c78], ebx
or eax, ebp
not ebx
imul ebx, eax
mov eax, dword [0xbb7c7c]
mov ebp, ebx
shl ebp, 7
xor eax, ebx
shr ebx, 0x18
mov dword [0xbb7c7c], eax
or ebx, ebp
not eax
imul eax, ebx
mov ebx, dword [0xbb7c80]
mov ebp, eax
shl ebp, 8
xor ebx, eax
shr eax, 0x17
mov dword [0xbb7c80], ebx
or eax, ebp
not ebx
imul ebx, eax
mov eax, dword [0xbb7c84]
mov ebp, ebx
shl ebp, 9
xor eax, ebx
shr ebx, 0x16
mov dword [0xbb7c84], eax
or ebx, ebp
not eax
imul eax, ebx
mov ebx, dword [0xbb7c88]
mov ebp, eax
shl ebp, 0xa
xor ebx, eax
shr eax, 0x15
mov dword [0xbb7c88], ebx
or eax, ebp
not ebx
imul ebx, eax
mov ah, 1
xor dword [0xbb7c8c], ebx
shl ah, cl
or byte [0xbb7c93], ah
mov eax, 0x8410d0
mov ecx, 0x8410d0
xor ecx, 2
or eax, 2
add eax, ecx
mov al, 0xfe
sete cl
not cl
and cl, 3
xor cl, 7
rol al, cl
and byte [0xbb7c93], al
push edi
push edx
push 0xbb7c60
push esi
call fcn.0078de60
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7fc040
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x18]
mov ebp, ecx
mov ecx, edx
mov esi, edx
call fcn.007fb610
cmp eax, 1
jne 0x7fc068
mov ecx, ebp
mov edx, esi
push edi
call fcn.007fa200
add esp, 8
jmp 0x7fc0af
mov dword [edi], 0
cmp byte [esi], 0x88
je 0x7fc0b4
mov edx, dword [ebp + 0x2c]
mov ebx, eax
lea ecx, [edx + 1]
add edx, ebx
test ebx, ebx
mov dword [esp], ecx
mov dword [ebp + 0x2c], edx
jle 0x7fc0a9
xor edi, edi
mov ecx, dword [esi + 0x14]
mov eax, dword [esp]
lea edx, [edi + edi*4]
mov edx, dword [ecx + edx*4 + 4]
lea eax, [edi + eax]
mov ecx, ebp
push eax
call fcn.007fff40
add esp, 4
inc edi
cmp edi, ebx
jne 0x7fc089
mov eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, ebp
mov edx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.007face0
Function at 0x7fc7e0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0xbd33e0]
mov ebx, dword [esp + 0x1c]
mov edi, edx
mov esi, ecx
xor eax, esp
mov dword [esp + 4], eax
cmp dword [edx + 0xc], 0
jne 0x7fc847
mov ecx, esi
mov dword [esp], 0
call fcn.00563640
mov ecx, dword [edi + 4]
lea edx, [ebx + ebx*4]
movzx ebp, byte [eax + 0x4e]
movzx ebx, byte [ecx + edx*4 + 0xd]
mov edx, dword [ecx + edx*4 + 4]
mov ecx, eax
mov eax, esp
push eax
push ebx
mov ebx, dword [esp + 0x24]
push ebp
call fcn.007fc880
add esp, 0xc
mov edx, dword [esp]
test edx, edx
je 0x7fc847
mov ecx, esi
push 0xfffffffffffffff5
call fcn.007f7b70
add esp, 4
mov eax, dword [edi + 4]
lea ecx, [ebx + ebx*4]
cmp byte [eax + ecx*4 + 0xd], 0x45
jne 0x7fc867
mov ecx, esi
mov edx, 0x53
push dword [esp + 0x20]
call fcn.007f9600
add esp, 4
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00989fe9
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7fcec0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
cmp byte [edx], 0x88
je 0x7fcec8
xor eax, eax
ret
jmp fcn.007face0
Function at 0x7fe810
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
test byte [edx + 5], 8
mov esi, ecx
je 0x7fe834
mov eax, dword [edx + 0x14]
mov ecx, esi
mov eax, dword [eax + 0x1c]
mov edx, dword [eax]
push 1
call fcn.007faa70
add esp, 4
jmp 0x7fe9f8
mov edx, fcn.007bc560
mov edi, fcn.007bc560
xor eax, eax
movzx ebx, byte [0xbb7d37]
or edx, 2
xor edi, 2
mov ecx, edx
add ecx, edi
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt ebx, eax
jb 0x7fe9ea
mov al, byte [0xbb7d37]
mov ebx, edx
xor ecx, ecx
mov ah, 1
add ebx, edi
sete cl
mov ebx, ecx
not ebx
lea ecx, [ecx + ebx*2 + 4]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb7d37], ah
jne 0x7fe86f
mov ecx, fcn.007bc560
mov edx, fcn.007bc560
xor ebx, ebx
movzx eax, al
or ecx, 2
xor edx, 2
mov edi, ecx
add edi, edx
sete bl
mov edi, ebx
not ebx
lea ebx, [edi + ebx*2 + 4]
and bl, 7
xor bl, 7
movzx edi, bl
bt eax, edi
jae 0x7fe8ef
mov edi, ecx
xor eax, eax
add edi, edx
movzx edi, byte [0xbb7d37]
sete al
mov ebx, eax
not ebx
lea eax, [eax + ebx*2 + 4]
and al, 7
movzx eax, al
bt edi, eax
jae 0x7fe8c8
jmp 0x7fe9ea
xor eax, eax
add ecx, edx
movzx edx, byte [0xbb7d37]
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt edx, eax
jb 0x7fe9bb
mov ecx, fcn.007bc560
mov edx, fcn.007bc560
xor eax, eax
xor edx, 2
or ecx, 2
add ecx, edx
sete al
mov ecx, eax
not ecx
and ecx, 0x123
lea ecx, [eax + ecx*2 - 0x1415b134]
mov eax, dword [0xbb7d20]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb7d20], eax
not eax
imul edx, eax
mov eax, dword [0xbb7d24]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb7d24], eax
or edi, edx
not eax
mov edx, dword [0xbb7d28]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb7d28], edx
or edi, eax
not edx
mov eax, dword [0xbb7d2c]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb7d2c], eax
or edi, edx
not eax
mov dl, 1
imul eax, edi
shl dl, cl
xor dword [0xbb7d30], eax
or byte [0xbb7d37], dl
mov eax, fcn.007bc560
mov ecx, fcn.007bc560
xor edx, edx
xor ecx, 2
or eax, 2
add eax, ecx
sete dl
mov eax, edx
not eax
lea ecx, [edx + eax*2 + 4]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb7d37], al
push 0xbb7d20
push esi
call fcn.0078de60
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x7fea70
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov eax, dword [ecx + 0x74]
mov edi, 1
test eax, eax
cmove eax, ecx
mov ecx, edx
mov esi, dword [eax + 0x54]
shl edi, cl
bt esi, edx
jb 0x7fea95
or esi, edi
cmp edx, 1
mov dword [eax + 0x54], esi
je 0x7fea98
pop esi
pop edi
ret
mov ecx, eax
pop esi
pop edi
jmp fcn.007a1050
Function at 0x7feab0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x14]
mov edi, edx
mov esi, ecx
mov edx, 0x45
push ebp
push 0
call fcn.007d10d0
add esp, 8
mov ecx, esi
mov edx, 0x25
push edi
call fcn.007f9600
add esp, 4
mov ebx, eax
mov ecx, esi
mov edx, 0x59
push ebp
push 0
push edi
call fcn.007d10f0
add esp, 0xc
mov ecx, esi
mov edx, pe_nt_image_headers32
call fcn.0078e010
mov ecx, esi
mov edx, ebx
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.007f75c0
Function at 0x8002d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov ecx, dword [ecx]
xor eax, eax
cmp byte [ecx + 0xa5], 0
jne 0x8004fa
cmp byte [esi + 0xc8], 0
jne 0x8004fa
mov edi, dword [ecx + 0x150]
test edi, edi
je 0x8004fa
push dword [esi + 0xf0]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edx
push dword [ecx + 0x154]
call edi
add esp, 0x18
cmp eax, 1
jne 0x8004e4
mov eax, 0x79b370
mov edx, 3
movzx edi, byte [0xbb7e33]
sub edx, eax
xor eax, eax
mov ecx, edx
xor ecx, 0x79b370
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt edi, eax
jb 0x8004cd
mov al, byte [0xbb7e33]
mov edi, edx
xor ecx, ecx
mov ah, 1
xor edi, 0x79b370
sete cl
mov ebx, ecx
not ebx
lea ecx, [ecx + ebx*2 + 4]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb7e33], ah
jne 0x800363
mov edx, 0x79b370
mov ecx, 3
movzx eax, al
sub ecx, edx
xor edx, edx
mov edi, ecx
xor edi, 0x79b370
sete dl
mov ebx, edx
not ebx
lea edx, [edx + ebx*2 + 4]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x8003eb
mov edx, ecx
xor eax, eax
movzx edi, byte [0xbb7e33]
xor edx, 0x79b370
sete al
mov edx, eax
not edx
lea eax, [eax + edx*2 + 4]
and al, 7
movzx eax, al
bt edi, eax
jae 0x8003c0
jmp 0x8004cd
xor eax, eax
xor ecx, 0x79b370
movzx edx, byte [0xbb7e33]
sete al
mov ecx, eax
not ecx
lea eax, [eax + ecx*2 + 4]
and al, 7
movzx eax, al
bt edx, eax
jb 0x80049e
mov eax, 0x79b370
mov ecx, 3
sub ecx, eax
xor eax, eax
xor ecx, 0x79b370
sete al
mov ecx, eax
not ecx
and ecx, 0x833
lea ecx, [eax + ecx*2 + 0x6aabb1c4]
mov eax, dword [0xbb7e20]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb7e20], eax
not eax
imul edx, eax
mov eax, dword [0xbb7e24]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb7e24], eax
or edi, edx
not eax
mov edx, dword [0xbb7e28]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb7e28], edx
or edi, eax
not edx
mov al, 1
imul edx, edi
shl al, cl
xor dword [0xbb7e2c], edx
or byte [0xbb7e33], al
mov eax, 0x79b370
mov ecx, 3
sub ecx, eax
xor eax, eax
xor ecx, 0x79b370
sete al
mov ecx, eax
not ecx
lea ecx, [eax + ecx*2 + 4]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb7e33], al
push 0xbb7e20
push esi
call fcn.0078de60
add esp, 8
mov dword [esi + 0xc], 0x17
jmp 0x8004f5
mov ecx, eax
or ecx, 2
cmp ecx, 2
je 0x8004fa
mov ecx, esi
call fcn.00800500
mov eax, 1
pop esi
pop edi
pop ebx
ret
Function at 0x800500
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edx, fcn.007a8b70
mov esi, ecx
xor eax, eax
movzx edi, byte [0xbb7e5b]
and edx, 1
inc edx
mov ecx, edx
xor ecx, fcn.007a8b70
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edi, eax
jb 0x8006dd
mov al, byte [0xbb7e5b]
mov edi, edx
xor ecx, ecx
mov ah, 1
xor edi, fcn.007a8b70
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 6]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb7e5b], ah
jne 0x80053e
mov ecx, fcn.007a8b70
xor edx, edx
movzx eax, al
and ecx, 1
inc ecx
mov edi, ecx
xor edi, fcn.007a8b70
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 6]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x8005c6
mov edx, ecx
xor eax, eax
movzx edi, byte [0xbb7e5b]
xor edx, fcn.007a8b70
sete al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 6]
and al, 7
movzx eax, al
bt edi, eax
jae 0x80059a
jmp 0x8006dd
xor eax, eax
xor ecx, fcn.007a8b70
movzx edx, byte [0xbb7e5b]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edx, eax
jb 0x8006b1
mov ecx, fcn.007a8b70
xor eax, eax
and ecx, 1
inc ecx
xor ecx, fcn.007a8b70
sete al
mov ecx, eax
not ecx
and ecx, 0x401
lea ecx, [eax + ecx*2 - 0x6ae766a2]
mov eax, dword [0xbb7e40]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb7e40], eax
not eax
imul edx, eax
mov eax, dword [0xbb7e44]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb7e44], eax
or edi, edx
not eax
mov edx, dword [0xbb7e48]
imul eax, edi
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb7e48], edx
or edi, eax
not edx
mov eax, dword [0xbb7e4c]
imul edx, edi
lea edi, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb7e4c], eax
or edi, edx
not eax
mov edx, dword [0xbb7e50]
imul eax, edi
mov edi, eax
shl edi, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbb7e50], edx
or eax, edi
not edx
imul edx, eax
xor dword [0xbb7e54], edx
mov dl, 1
shl dl, cl
or byte [0xbb7e5b], dl
mov eax, fcn.007a8b70
xor ecx, ecx
and eax, 1
inc eax
xor eax, fcn.007a8b70
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 6]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb7e5b], al
push 0xbb7e40
push esi
call fcn.0078de60
add esp, 8
mov dword [esi + 0xc], 1
pop esi
pop edi
pop ebx
ret
Function at 0x800f70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edi, edx
mov eax, fcn.007953c0
mov edx, 3
mov esi, ecx
movzx ecx, byte [0xbb8083]
sub edx, eax
mov eax, edx
xor eax, fcn.007953c0
sete al
or al, 4
add al, 0x44
and al, 7
movzx eax, al
bt ecx, eax
jb 0x8010f4
mov al, byte [0xbb8083]
mov ecx, edx
mov ah, 1
xor ecx, fcn.007953c0
sete cl
or cl, 4
add cl, 0x44
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb8083], ah
jne 0x800fab
mov edx, fcn.007953c0
mov ecx, 3
movzx eax, al
sub ecx, edx
mov edx, ecx
xor edx, fcn.007953c0
sete dl
or dl, 4
add dl, 0x44
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x801024
mov eax, ecx
movzx edx, byte [0xbb8083]
xor eax, fcn.007953c0
sete al
or al, 4
add al, 0x44
and al, 7
movzx eax, al
bt edx, eax
jae 0x801000
jmp 0x8010f4
xor ecx, fcn.007953c0
movzx ecx, byte [0xbb8083]
sete al
or al, 4
add al, 0x44
and al, 7
movzx eax, al
bt ecx, eax
jb 0x8010c9
mov eax, fcn.007953c0
mov edx, 3
xor ecx, ecx
sub edx, eax
mov eax, dword [0xbb8070]
xor edx, fcn.007953c0
sete cl
or ecx, 0x591fed14
add ecx, 0x44
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb8070], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbb8074]
lea ebx, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb8074], eax
or ebx, edx
not eax
mov edx, dword [0xbb8078]
imul eax, ebx
lea ebx, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb8078], edx
or ebx, eax
not edx
mov al, 1
imul edx, ebx
shl al, cl
xor dword [0xbb807c], edx
or byte [0xbb8083], al
mov eax, fcn.007953c0
mov ecx, 3
sub ecx, eax
mov al, 0xfe
xor ecx, fcn.007953c0
sete cl
or cl, 4
add cl, 0x44
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb8083], al
mov ecx, esi
call fcn.007f7590
mov ebx, eax
mov ecx, esi
mov edx, edi
push 0xbb8070
push 1
push 1
call fcn.007f78a0
add esp, 0xc
mov ecx, ebx
mov edx, 0x61
push 5
push edi
push 1
push 0
call fcn.0078dfd0
add esp, 0x10
cmp dword [esi + 0x28], 0
jne 0x801135
mov dword [esi + 0x28], 1
pop esi
pop edi
pop ebx
ret
Function at 0x8019a0
Capabilities:
Terminate process

Disassembly:
push esi
mov eax, edx
mov esi, ecx
mov edx, 0x42
push eax
call fcn.007f9600
add esp, 4
mov eax, dword [esi + 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [esi + 0xc]
mov dword [eax + 0x1c], 0
pop esi
ret
Function at 0x804f80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
mov edi, dword [eax + 0x78]
xor eax, eax
cmp edi, edx
jge 0x8051e0
mov edx, fcn.007fbda0
mov esi, ecx
movzx ecx, byte [0xbb8e87]
imul edx, edx
and edx, 3
cmp edx, 2
sete al
or al, 6
movzx eax, al
bt ecx, eax
jb 0x8051cc
mov al, byte [0xbb8e87]
cmp edx, 2
mov ah, 1
sete cl
or cl, 6
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb8e87], ah
jne 0x804fbf
mov ecx, fcn.007fbda0
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete dl
or dl, 6
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x805019
cmp ecx, 2
movzx edx, byte [0xbb8e87]
sete al
or al, 6
movzx eax, al
bt edx, eax
jae 0x804ffd
jmp 0x8051cc
cmp ecx, 2
movzx edx, byte [0xbb8e87]
sete al
or al, 6
movzx eax, al
bt edx, eax
jb 0x8051ab
mov eax, fcn.007fbda0
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 2
mov eax, dword [0xbb8e50]
sete cl
or ecx, 0xf92a51ae
xor eax, ecx
and cl, 7
mov dword [0xbb8e50], eax
not eax
mov edx, dword [0xbb8e54]
imul eax, eax, 0xf92a51af
lea ebx, [eax + eax]
xor edx, eax
shr eax, 0x1e
mov dword [0xbb8e54], edx
or ebx, eax
not edx
mov eax, dword [0xbb8e58]
imul edx, ebx
lea ebx, [edx*4]
xor eax, edx
shr edx, 0x1d
mov dword [0xbb8e58], eax
or ebx, edx
not eax
mov edx, dword [0xbb8e5c]
imul eax, ebx
lea ebx, [eax*8]
xor edx, eax
shr eax, 0x1c
mov dword [0xbb8e5c], edx
or ebx, eax
not edx
mov eax, dword [0xbb8e60]
imul edx, ebx
mov ebx, edx
shl ebx, 4
xor eax, edx
shr edx, 0x1b
mov dword [0xbb8e60], eax
or edx, ebx
not eax
imul eax, edx
mov edx, dword [0xbb8e64]
mov ebx, eax
shl ebx, 5
xor edx, eax
shr eax, 0x1a
mov dword [0xbb8e64], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [0xbb8e68]
mov ebx, edx
shl ebx, 6
xor eax, edx
shr edx, 0x19
mov dword [0xbb8e68], eax
or edx, ebx
not eax
imul eax, edx
mov edx, dword [0xbb8e6c]
mov ebx, eax
shl ebx, 7
xor edx, eax
shr eax, 0x18
mov dword [0xbb8e6c], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [0xbb8e70]
mov ebx, edx
shl ebx, 8
xor eax, edx
shr edx, 0x17
mov dword [0xbb8e70], eax
or edx, ebx
not eax
imul eax, edx
mov edx, dword [0xbb8e74]
mov ebx, eax
shl ebx, 9
xor edx, eax
shr eax, 0x16
mov dword [0xbb8e74], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [0xbb8e78]
mov ebx, edx
shl ebx, 0xa
xor eax, edx
shr edx, 0x15
mov dword [0xbb8e78], eax
or edx, ebx
not eax
imul eax, edx
mov edx, dword [0xbb8e7c]
mov ebx, eax
shl ebx, 0xb
xor edx, eax
shr eax, 0x14
mov dword [0xbb8e7c], edx
or eax, ebx
not edx
imul edx, eax
xor dword [str.xj_a_], edx
mov dl, 1
shl dl, cl
or byte [0xbb8e87], dl
mov eax, fcn.007fbda0
imul eax, eax
and eax, 3
cmp eax, 2
mov al, 0xfe
sete cl
or cl, 6
xor cl, 7
rol al, cl
and byte [0xbb8e87], al
push edi
push 0xbb8e50
push esi
call fcn.0078de60
add esp, 0xc
mov eax, 1
pop esi
pop edi
pop ebx
ret
Function at 0x808090
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
mov ecx, dword [ecx]
cmp dword [ecx + 0x150], 0
je 0x808285
mov esi, edx
mov edx, dword [esp + 0x20]
call fcn.0078dee0
test eax, eax
mov dword [esp + 8], eax
js 0x808285
cmp byte [esi], 0x4d
je 0x8080f1
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
test ecx, ecx
jle 0x808285
mov edx, dword [esi + 0x1c]
xor ebp, ebp
lea ebx, [ebp + ebp*8]
cmp edx, dword [eax + ebx*8 + 0x34]
jne 0x8080e7
lea eax, [eax + ebx*8 + 0x18]
jmp 0x8080f4
inc ebp
cmp ebp, ecx
jl 0x8080d7
jmp 0x808285
lea eax, [edi + 0x78]
mov ebx, dword [eax]
test ebx, ebx
je 0x808285
movzx eax, word [esi + 0x20]
test ax, ax
jns 0x80811a
movzx eax, word [ebx + 0x28]
test ax, ax
jns 0x80811a
mov dword [esp + 4], 0xbb86a0
jmp 0x808128
mov ecx, dword [ebx + 4]
cwde
lea eax, [eax + eax*4]
mov eax, dword [ecx + eax*4]
mov dword [esp + 4], eax
mov ebp, fcn.00780ea0
xor eax, eax
movzx edx, byte [0xbb86ab]
imul ebp, ebp
and ebp, 3
cmp ebp, 3
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 2]
bt edx, eax
jb 0x808269
mov al, byte [0xbb86ab]
mov dword [esp], ebx
xor ecx, ecx
cmp ebp, 3
mov ah, 1
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 2]
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb86ab], ah
jne 0x80815c
mov ecx, fcn.00780ea0
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 2]
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x8081cf
mov ebx, dword [esp]
xor eax, eax
cmp ecx, 3
movzx ebp, byte [0xbb86ab]
sete al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 2]
bt ebp, eax
jae 0x8081ad
jmp 0x808269
xor eax, eax
cmp ecx, 3
movzx edx, byte [0xbb86ab]
mov ebx, dword [esp]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 2]
bt edx, eax
jb 0x808240
mov ecx, fcn.00780ea0
xor eax, eax
mov ebp, dword [0xbb86a0]
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete al
mov ecx, eax
not ecx
and ecx, 0x8cd
lea ecx, [eax + ecx*2 + 0x65277722]
mov edx, ecx
xor ebp, ecx
shr edx, 0x1f
mov dword [0xbb86a0], ebp
not ebp
or edx, ecx
and cl, 7
imul edx, ebp
xor dword [0xbb86a4], edx
mov dl, 1
shl dl, cl
or byte [0xbb86ab], dl
mov eax, fcn.00780ea0
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 3
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 2]
mov al, 0xfe
xor cl, 7
rol al, cl
and byte [0xbb86ab], al
mov edx, dword [ebx]
mov ecx, edi
push dword [esp + 8]
push dword [esp + 8]
call fcn.00808360
add esp, 8
cmp eax, 2
jne 0x808285
mov byte [esi], 0x77
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret